below my step to deploy IPS in UNL :
- Download "IPSforty-two-forty.ova"
This link from daveguy: http://www.4shared.c...-two-forty.html
- Open "IPSforty-two-forty.ova" with VMplayer to extract into "IPSforty-two-forty-disk1.vmdk" and "IPSforty-two-forty-disk2.vmdk"
- Run Unetlab
- Run "WinSCP" to login to Unetlab (username=root, passw=root), its alot easier than command line on linux
download WinSCP : http://winscp.net/eng/download.php
- Via WinSCP, go to directory "/opt/unetlab/addons/qemu"
- Create new folder "cips-4240"
- Copy "IPSforty-two-forty-disk1.vmdk" and "IPSforty-two-forty-disk2.vmdk" from your computer into "/opt/unetlab/addons/qemu/cips-4240" on UnetLab
- Convert file vmdk into qcow2 format, you must login to Unetlab console
login as: root [email protected]'s password: Welcome to Ubuntu 14.04.2 LTS (GNU/Linux 3.13.0-52-generic x86_64) [email protected]:~# cd /opt/unetlab/addons/qemu/cips-4240/ [email protected]:/opt/unetlab/addons/qemu/cips-4240# qemu-img convert -f vmdk -O qcow2 IPSforty-two-forty-disk1.vmdk hda.qcow2 [email protected]:/opt/unetlab/addons/qemu/cips-4240# qemu-img convert -f vmdk -O qcow2 IPSforty-two-forty-disk2.vmdk hdb.qcow2
- Via WinSCP, delete 2 files vmdk
- fix permissions
[email protected]:/opt/unetlab/addons/qemu/cips-4240# /opt/unetlab/wrappers/unl_wrapper -a fixpermissions
- Now try to create new Lab, add new nodes, and taraa, you should see "image:cips-4240"
- Open the lab and run the node, then console the IPS
- Now lets fix the interfaces problems
- Log in to the IPS using account 'service' and password 'ciscoips123'
- Type: vi /usr/cids/idsRoot/etc/interface.conf (you need to know how to use the text editor 'vi')
- Scroll down until you see the section [models/IPS-4240/interfaces]
- Edit the "pci-path" section for each interface to match the QEMU PCI bus address of each NIC. QEMU E1000 bus addresses are usually:
- need to change the device ID as well for each one
Change every instance of:
- Save the file and reboot the IPS sensor.
- login using account "cisco" pass "cisco" or "ciscoips123"
thanx to daveguy, paulno1, Unholydarkness