Source fire Sourcefire 3D System - Page 200

Version 5.2 Sourcefire 3D System Installation Guide 200
Restoring a Sourcefire Appliance to Factory Defaults
Understanding the Restore Process
Chapter 7
3. Copy the image to an appropriate storage medium.
4. Connect to the appliance.
5. Reboot the appliance and invoke the restore utility.
6. Install the ISO image.
For your convenience, you can install system software and intrusion rule updates
as part of the restore process on most appliances.
The following table summarizes how to restore the different models of Sourcefire
appliances.
Note that you cannot restore an appliance using its web interface. To restore an
appliance, you must connect to it in one of the following ways:
Keyboard and Monitor/KVM
You can connect a USB keyboard and VGA monitor to any Sourcefire
appliance, which is useful for rack-mounted appliances connected to a KVM
(keyboard, video, and mouse) switch. If you have a KVM that is
remote-accessible, you can restore Series 3 appliances and the 3D9900
without having physical access.
Serial Connection/Laptop
You can use a serial cable to connect a computer to any Sourcefire appliance
except the 3D2100/2500/3500/4500 devices. To interact with the appliance,
use terminal emulation software such as HyperTerminal or XModem. The
settings for this software are 9600 baud, 8 data bits, no parity checking, 1
stop bit, and no flow control.
Supported Restore Methods by Appliance Model
MODELS RESTORE METHOD PHYSICAL ACCESS
R
EQUIRED?
UPDATE DURING
R
ESTORE?
DC1000
DC3000
Use a Sourcefire-provided CD-ROM
with the ISO image pre-loaded, or
create your own CD.
yes, to load the CD no
DC500
all Series 2 devices
(except 3D9900)
Boot from a Sourcefire-provided
external USB drive and use an
interactive menu to download and
install the ISO image on the
appliance.
yes, to insert the
USB drive
yes
3D9900
Series 3 appliances
Boot from the appliance’s internal
flash drive and use an interactive
menu to download and install the ISO
image on the appliance.
no; a remote KVM
switch (all) or LOM
(Series 3) allows you
to restore remotely
yes