Temporarily disable the IPS driver on RHEL 7 in case of a kernel panic.

Products

• Data Center Security Server Advanced

Issue/Introduction

You have run into difficulties with a DCS Agent on a RHEL 7 system resulting in a kernel panic and need to disable the IPS driver as an isolation step.

Cause

If the system is unstable, using the sisipsconfig may not be possible at all and the IPS driver needs to be disabled from loading into kernel during system boot

Another possible case you may need to disable the IPS driver form the system boot menu is when the IPS policy is blocking access to the server, and there is no agent to manager connection making it impossible to change security groups and change the IPS policy to a prevention disabled or null policy.  

Resolution

To temporarily disable the IPS driver:

During the boot cycle, add the string SISIPSNULL to the boot options.

The agent and kernel mode driver will not load, and the policy won't be enforced:

Steps: 
1. Boot the RHEL 7 agent and in the boot menu when the kernel list is displayed, press 'e' to enter a kernel argument.
2. Find the line starting with "linux16 /vmlinux-....." set you cursor to the beginning of this line and press Ctrl-e to go to the end of 
the line. Then type space bar and SISIPSNULL. press Ctrl-X to restart without sisips driver.