Table Of Contents
Release Notes for the Cisco ASA 5500 Series, Version 8.2(x)
Downloading Software from Cisco.com
Upgrading Between Major Releases
Upgrading the AIP SSC or SSM Software
Upgrading the Phone Proxy and MTA Instance
Activation Key Compatibility When Upgrading
Standard DRAM and Internal Flash Memory
DRAM, Flash Memory, and Failover
ASDM, SSM, SSC, and VPN Compatibility
Open Caveats in Software Version 8.2
Obtaining Documentation and Submitting a Service Request
Release Notes for the Cisco ASA 5500 Series, Version 8.2(x)
June 15, 2009
This document contains release information for Cisco ASA 5500 Version 8.2(1).
This document includes the following sections:
•
Open Caveats in Software Version 8.2
•
Important Notes
•
•
•
•
Workaround: Use the Cisco HTTP-POST plugin to provide single signon and correct Citrix portal behavior.
•
•
Limitations and Restrictions
•
•
•
•
Upgrading the Software
To upgrade to 8.2, see the "Managing Software and Configurations" chapter in Cisco ASA 5500 Series Configuration Guide using the CLI. Be sure to back up your configuration before upgrading.
Use the show version command to verify the software version of your adaptive security appliance. Alternatively, the software version appears on the ASDM home page.
This section includes the following topics:
•
•
•
•
•
Downloading Software from Cisco.com
If you have a Cisco.com login, you can obtain software from the following website:
http://www.cisco.com/pcgi-bin/tablebuild.pl/asa
Upgrading Between Major Releases
To ensure that your configuration updates correctly, you must upgrade to each major release in turn. Therefore, to upgrade from Version 7.0 to Version 8.2, first upgrade from 7.0 to 7.1, then from 7.1 to 7.2, and finally from Version 7.2 to Version 8.2 (8.1 was only available on the ASA 5580).
Upgrading the AIP SSC or SSM Software
When upgrading the AIP SSC or SSM, do not use the upgrade command within the IPS software; instead use the hw-module 1 recover configure command within the adaptive security appliance software.
Upgrading the Phone Proxy and MTA Instance
In Version 8.0(4), you configured a global media-termination address (MTA) on the adaptive security appliance. In Version 8.2, you can now configure MTAs for individual interfaces (with a minimum of two MTAs). As a result of this enhancement, the old CLI has been deprecated. You can continue to use the old configuration if desired. However, if you need to change the configuration at all, only the new configuration method is accepted; you cannot later restore the old configuration.
Note
To upgrade the Phone Proxy, perform the following steps:
Step 1
Step 2
hostname(config)# phone-proxy phone_proxy_nameWhere phone_proxy_name is the name of the existing Phone Proxy.
Step 3
hostname(config)# no media-termination address ip_addressStep 4
hostname(config)# media-termination instance_nameWhere instance_name is the name of the MTA that you created in Step 1.
Activation Key Compatibility When Upgrading
Your activation key remains compatible if you upgrade to Version 8.2 or later, and also if you later downgrade. After you upgrade, if you activate additional feature licenses that were introduced before 8.2, then the activation key continues to be compatible with earlier versions if you downgrade. However if you activate feature licenses that were introduced in 8.2 or later, then the activation key is not backwards compatible. If you have an incompatible license key, then see the following guidelines:
•
•
System Requirements
The sections that follow list the system requirements for operating an adaptive security appliance. This section includes the following topics:
•
Memory Requirements
The adaptive security appliance includes DRAM and an internal CompactFlash card. You can optionally use an external CompactFlash card as well. This section includes the following topics:
•
•
Standard DRAM and Internal Flash Memory
Table 1 lists the standard memory shipped with the adaptive security appliance.
Table 1 Standard Memory
5505
256
128
5510
2561
512
5520
512
512
5540
1024
512
5550
4096
512
5580
4096
1024
1 For the ASA 5510—Version 8.2 uses more base memory than previous releases. This might cause problems for some ASA 5510 users who are currently running low on free memory (as indicated in the show memory output). If your current show memory output displays less than 20% free, we recommend upgrading the memory on the ASA 5510 from 256 MB to 512 MB before proceeding with the release 8.2 upgrade.
Note
Note
Memory Upgrade Kits
The ASA 5510 DRAM upgrade kit is available from Cisco with the following part number:
•
256 MB and 512 MB CompactFlash upgrades are avilable from Cisco with the following part numbers:
•
•
Viewing Flash Memory
You can check the size of internal flash and the amount of free flash memory on the adaptive security appliance by doing the following:
•
•
For example:
hostname # dirDirectory of disk0:/43 -rwx 14358528 08:46:02 Feb 19 2007 cdisk.bin136 -rwx 12456368 10:25:08 Feb 20 2007 asdmfile58 -rwx 6342320 08:44:54 Feb 19 2007 asdm-600110.bin61 -rwx 416354 11:50:58 Feb 07 2007 sslclient-win-1.1.3.173.pkg62 -rwx 23689 08:48:04 Jan 30 2007 asa1_backup.cfg66 -rwx 425 11:45:52 Dec 05 2006 anyconnect70 -rwx 774 05:57:48 Nov 22 2006 cvcprofile.xml71 -rwx 338 15:48:40 Nov 29 2006 tmpAsdmCustomization43040652672 -rwx 32 09:35:40 Dec 08 2006 LOCAL-CA-SERVER.ser73 -rwx 2205678 07:19:22 Jan 05 2007 vpn-win32-Release-2.0.0156-k9.pkg74 -rwx 3380111 11:39:36 Feb 12 2007 securedesktop_asa_3_2_0_56.pkg62881792 bytes total (3854336 bytes free)hostname #
DRAM, Flash Memory, and Failover
In a failover configuration, the two units must have the same hardware configuration, must be the same model, must have the same number and types of interfaces, must have the same feature licenses, and must have the same amount of DRAM. You do not have to have the same amount of flash memory. For more information, see the failover chapters in Cisco ASA 5500 Series Configuration Guide using the CLI.
Note
ASDM, SSM, SSC, and VPN Compatibility
Table 2 lists information about ASDM, SSM, SSC, and VPN compatibility with the ASA 5500 series.
Table 2 ASDM, SSM, SSC, and VPN Compatibility
ASDM
ASA 5500 Version 8.2 requires ASDM Version 6.2 or later.
For information about ASDM requirements for other releases, see Cisco ASA 5500 Series and PIX 500 Series Security Appliance Hardware and Software Compatibility:
http://www.cisco.com/en/US/docs/security/asa/compatibility/asamatrx.html
VPN
For the latest OS and browser test results, see the Cisco ASA 5500 Series—Supported VPN Platforms, Version 8.2(1):
http://www.cisco.com/en/US/docs/security/asa/compatibility/vpn-platforms-82.html
SSM and SSC applications
For information about SSM and SSC application requirements, see Cisco ASA 5500 Series and PIX 500 Series Security Appliance Hardware and Software Compatibility:
http://www.cisco.com/en/US/docs/security/asa/compatibility/asamatrx.html
New Features
Note
Hi
Table 3 lists the new features for Version 8.2(1).
Table 3 New Features for ASA Version 8.2(1)
One Time Password Support for ASDM Authentication
ASDM now supports administrator authentication using one time passwords (OTPs) supported by RSA SecurID (SDI). This feature addresses security concerns about administrators authenticating with static passwords.
New session controls for ASDM users include the ability to limit the session time and the idle time. When the password used by the ASDM administrator times out, ASDM prompts the administrator to re-authenticate.
The following commands were introduced: http server idle-timeout and http server session-timeout. The http server idle-timeout default is 20 minutes, and can be increased up to a maximum of 1440 minutes.
In ASDM, see Configuration > Device Management > Management Access > ASDM/HTTPD/Telnet/SSH.
Customizing Secure Desktop
You can use ASDM to customize the Secure Desktop windows displayed to remote users, including the Secure Desktop background (the lock icon) and its text color, and the dialog banners for the Desktop, Cache Cleaner, Keystroke Logger, and Close Secure Desktop windows.
In ASDM, see Configuration > CSD Manager > Secure Desktop Manager.
Pre-fill Username from Certificate
The pre-fill username feature enables the use of a username extracted from a certificate for username/password authentication. With this feature enabled, the username is "pre-filled" on the login screen, with the user being prompted only for the password. To use this feature, you must configure both the pre-fill username and the username-from-certificate commands in tunnel-group configuration mode.
The double-authentication feature is compatible with the pre-fill username feature, as the pre-fill username feature can support extracting a primary username and a secondary username from the certificate to serve as the usernames for double authentication when two usernames are required. When configuring the pre-fill username feature for double authentication, the administrator uses the following new tunnel-group general-attributes configuration mode commands:
•
•
In ASDM, see In ASDM, see Configuration> Remote Access VPN > Network (Client) Access > AnyConnect or Clienltess SSL VPN Connection Profiles > Advanced. Settings are in Authentication, Secondary Authentication, and Authorization panels.
Double Authentication
The double authentication feature implements two-factor authentication for remote access to the network, in accordance with the Payment Card Industry Standards Council Data Security Standard. This feature requires that the user enter two separate sets of login credentials at the login page. For example, the primary authentication might be a one-time password, and the secondary authentication might be a domain (Active Directory) credential. If either authentication fails, the connection is denied.
Both the AnyConnect VPN client and Clientless SSL VPN support double authentication. The AnyConnect client supports double authentication on Windows computers (including supported Windows Mobile devices and Start Before Logon), Mac computers, and Linux computers. The IPsec VPN client, SVC client, cut-through-proxy authentication, hardware client authentication, and management authentication do not support double authentication.
Double authentication requires the following new tunnel-group general-attributes configuration mode commands:
•
•
•
•
•
Note
In ASDM, see Configuration > Remote Access VPN > Network (Client) Access or Clientless SSL VPN > AnyConnect Connection Profiles > Add/Edit > Advanced > Secondary Authentication.
AnyConnect Essentials
AnyConnect Essentials is a separately licensed SSL VPN client, entirely configured on the adaptive security appliance, that provides the full AnyConnect capability, with the following exceptions:
•
•
•
The AnyConnect Essentials client provides remote end users running Microsoft Windows Vista, Windows Mobile, Windows XP or Windows 2000, Linux, or Macintosh OS X, with the benefits of a Cisco SSL VPN client.
To configure AnyConnect Essentials, the administrator uses the following command:
anyconnect-essentials—Enables the AnyConnect Essentials feature. If this feature is disabled (using the no form of this command), the SSL Premium license is used. This feature is enabled by default.
Note
In ASDM, see Configuration > Remote Access VPN > Network (Client) Access > Advanced > AnyConnect Essentials License. The AnyConnect Essentials license must be installed for ASDM to show this pane.
Disabling Cisco Secure Desktop per Connection Profile
When enabled, Cisco Secure Desktop automatically runs on all computers that make SSL VPN connections to the adaptive security appliance. This new feature lets you exempt certain users from running Cisco Secure Desktop on a per connection profile basis. It prevents the detection of endpoint attributes for these sessions, so you might need to adjust the Dynamic Access Policy (DAP) configuration.
CLI: [no] without-csd command
Note
In ASDM, see Configuration > Remote Access VPN > Clientless SSL VPN Access > Connection Profiles > Add or Edit > Advanced, Clientless SSL VPN Configuration.
or
Configuration > Remote Access VPN > Network (Client) Access > AnyConnect Connection Profiles > Add or Edit > Advanced > SSL VPN.
Certificate Authentication Per Connection Profile
Previous versions supported certificate authentication for each adaptive security appliance interface, so users received certificate prompts even if they did not need a certificate. With this new feature, users receive a certificate prompt only if the connection profile configuration requires a certificate. This feature is automatic; the ssl certificate authentication command is no longer needed, but the adaptive security appliance retains it for backward compatibility.
In ASDM, see Configuration > Remote Access VPN > Network (Client) Access > AnyConnect Connection Profiles > Add/Edit > Basic.
or
Configuraiton > Remote Access VPN > Clientless SSL VPN > Connection Profiles > Add/Edit>Basic.
EKU Extensions for Certificate Mapping
This feature adds the ability to create certificate maps that look at the Extended Key Usage extension of a client certificate and use these values in determining what connection profile the client should use. If the client does not match that profile, it uses the default group. The outcome of the connection then depends on whether or not the certificate is valid and the authentication settings of the connection profile.
The following command was introduced: extended-key-usage.
In ASDM, use the IPSec Certificate to Connection Maps > Rules pane, or Certificate to SSL VPN Connections Profile Maps pane.
SSL VPN SharePoint Support for Win 2007 Server
Clientless SSL VPN sessions now support Microsoft Office SharePoint Server 2007.
Shared license for SSL VPN sessions
You can purchase a shared license with a large number of SSL VPN sessions and share the sessions as needed among a group of adaptive security appliances by configuring one of the adaptive security appliances as a shared license server, and the rest as clients. The following commands were introduced: license-server commands (various), show shared license.
Note
In ASDM, see Configuration > Device Management > Licensing > Shared SSL VPN Licenses. Also see, Monitoring > VPN > Clientless SSL VPN > Shared Licenses.
TCP state bypass
If you have asymmetric routing configured on upstream routers, and traffic alternates between two adaptive security appliances, then you can configure TCP state bypass for specific traffic. The following command was introduced: set connection advanced tcp-state-bypass.
In ASDM, see Configuration > Firewall > Service Policy Rules > Rule Actions > Connection Settings.
Per-Interface IP Addresses for the Media-Termination Instance Used by the Phone Proxy
In Version 8.0(4), you configured a global media-termination address (MTA) on the adaptive security appliance. In Version 8.2, you can now configure MTAs for individual interfaces (with a minimum of two MTAs). As a result of this enhancement, the old CLI has been deprecated. You can continue to use the old configuration if desired. However, if you need to change the configuration at all, only the new configuration method is accepted; you cannot later restore the old configuration.
In ASDM, see Configuration > Firewall > Advanced > Encrypted Traffic Inspection > Media Termination Address.
Displaying the CTL File for the Phone Proxy
The Cisco Phone Proxy feature includes the show ctl-file command, which shows the contents of the CTL file used by the phone proxy. Using the show ctl-file command is useful for debugging when configuring the phone proxy instance.
This command is not supported in ASDM.
Clearing Secure-phone Entries from the Phone Proxy Database
The Cisco Phone Proxy feature includes the clear phone-proxy secure-phones command, which clears the secure-phone entries in the phone proxy database. Because secure IP phones always request a CTL file upon bootup, the phone proxy creates a database that marks the IP phones as secure. The entries in the secure phone database are removed after a specified configured timeout (via the timeout secure-phones command). Alternatively, you can use the clear phone-proxy secure-phones command to clear the phone proxy database without waiting for the configured timeout.
This command is not supported in ASDM.
H.239 Message Support in H.323 Application Inspection
In this release, the adaptive security appliance supports the H.239 standard as part of H.323 application inspection. H.239 is a standard that provides the ability for H.300 series endpoints to open an additional video channel in a single call. In a call, an endpoint (such as a video phone), sends a channel for video and a channel for data presentation. The H.239 negotiation occurs on the H.245 channel. The adaptive security appliance opens a pinhole for the additional media channel. The endpoints use open logical channel message (OLC) to signal a new channel creation. The message extension is part of H.245 version 13. The decoding and encoding of the telepresentation session is enabled by default. H.239 encoding and decoding is preformed by ASN.1 coder.
In ASDM, see Configuration > Firewall > Service Policy Rules > Add Service Policy Rule Wizard > Rule Actions > Protocol Inspection > H.323 H.225. Click Configure and then choose the H.323 Inspect Map.
Processing H.323 Endpoints When the Endpoints Do Not Send OLCAck
H.323 application inspection has been enhanced to process common H.323 endpoints. The enhancement affects endpoints using the extendedVideoCapability OLC with the H.239 protocol identifier. Even when an H.323 endpoint does not send OLCAck after receiving an OLC message from a peer, the adaptive security appliance propagates OLC media proposal information into the media array and opens a pinhole for the media channel (extendedVideoCapability).
In ASDM, see Configuration > Firewall > Service Policy Rules > Add Service Policy Rule Wizard > Rule Actions > Protocol Inspection > H.323 H.225.
IPv6 in transparent firewall mode
Transparent firewall mode now participates in IPv6 routing. Prior to this release, the adaptive security appliance could not pass IPv6 traffic in transparent mode. You can now configure an IPv6 management address in transparent mode, create IPv6 access lists, and configure other IPv6 features; the adaptive security appliance recognizes and passes IPv6 packets.
All IPv6 functionality is supported unless specifically noted.
In ASDM, see Configuration > Device Management > Management Access > Management IP Address.
Botnet Traffic Filter
Malware is malicious software that is installed on an unknowing host. Malware that attempts network activity such as sending private data (passwords, credit card numbers, key strokes, or proprietary data) can be detected by the Botnet Traffic Filter when the malware starts a connection to a known bad IP address. The Botnet Traffic Filter checks incoming and outgoing connections against a dynamic database of known bad domain names and IP addresses, and then logs any suspicious activity. You can also supplement the dynamic database with a static database by entering IP addresses or domain names in a local "blacklist" or "whitelist."
Note
http://www.cisco.com/en/US/docs/security/asa/asa82/license/license82.htmlThe following commands were introduced: dynamic-filter commands (various), and the inspect dns dynamic-filter-snoop keyword.
In ASDM, see Configuration > Firewall > Botnet Traffic Filter.
AIP SSC card for the ASA 5505
The AIP SSC offers IPS for the ASA 5505 adaptive security appliance. Note that the AIP SSM does not support virtual sensors. The following commands were introduced: allow-ssc-mgmt, hw-module module ip, and hw-module module allow-ip.
In ASDM, see Configuration > Device Setup > SSC Setup and Configuration > IPS.
IPv6 support for IPS
You can now send IPv6 traffic to the AIP SSM or SSC when your traffic class uses the match any command, and the policy map specifies the ips command.
In ASDM, see Configuration > Firewall > Service Policy Rules.
SNMP version 3 and encryption
This release provides DES, 3DES, or AES encryption and support for SNMP Version 3, the most secure form of the supported security models. This version allows you to configure authentication characteristics by using the User-based Security Model (USM).
The following commands were introduced:
•
•
•
•
•
•
The following command was modified:
•
In ASDM, see Configuration > Device Management > Management Access > SNMP.
Multicast NAT
The adaptive security appliance now offers Multicast NAT support for group addresses.
Coredump functionality
A coredump is a snapshot of the running program when the program has terminated abnormally. Coredumps are used to diagnose or debug errors and save a crash for later or off-site analysis. Cisco TAC may request that users enable the coredump feature to troubleshoot application or system crashes on the adaptive security appliance.
To enable coredump, see the coredump enable command.
Open Caveats in Software Version 8.2
The caveats listed in Table 4 are open in software Version 8.2. If you are a registered Cisco.com user, view more information about each caveat using the Bug Toolkit at the following website:
http://www.cisco.com/support/bugtools
The caveats listed in Table 5 are recently-found caveats that were fixed in interim builds for previous versions; however, they are still open in Version 8.2 (they will be addressed in future releases).
End-User License Agreement
For information on the end-user license agreement, go to:
http://www.cisco.com/univercd/cc/td/doc/es_inpck/eu1jen__.pdf
Related Documentation
For additional information on the adaptive security appliance, see Navigating the Cisco ASA 5500 Series Documentation:
http://www.cisco.com/en/US/docs/security/asa/roadmap/asaroadmap.html
For additional information on IPS, see:
http://www.cisco.com/en/US/products/hw/vpndevc/ps4077/tsd_products_support_series_home.html
Obtaining Documentation and Submitting a Service Request
For information on obtaining documentation, submitting a service request, and gathering additional information, see the monthly What's New in Cisco Product Documentation, which also lists all new and revised Cisco technical documentation, at:
http://www.cisco.com/en/US/docs/general/whatsnew/whatsnew.html
Subscribe to the What's New in Cisco Product Documentation as a Really Simple Syndication (RSS) feed and set content to be delivered directly to your desktop using a reader application. The RSS feeds are a free service and Cisco currently supports RSS Version 2.0.
This document is to be used in conjunction with the documents listed in the "Related Documentation" section.
CCDE, CCENT, CCSI, Cisco Eos, Cisco HealthPresence, Cisco IronPort, the Cisco logo, Cisco Lumin, Cisco Nexus, Cisco Nurse Connect, Cisco Pulse, Cisco StackPower, Cisco StadiumVision, Cisco TelePresence, Cisco Unified Computing System, Cisco WebEx, DCE, Flip Channels, Flip for Good, Flip Mino, Flipshare (Design), Flip Ultra, Flip Video, Flip Video (Design), Instant Broadband, and Welcome to the Human Network are trademarks; Changing the Way We Work, Live, Play, and Learn, Cisco Capital, Cisco Capital (Design), Cisco:Financed (Stylized), Cisco Store, and Flip Gift Card are service marks; and Access Registrar, Aironet, AllTouch, AsyncOS, Bringing the Meeting To You, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, CCVP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Collaboration Without Limitation, Continuum, EtherFast, EtherSwitch, Event Center, Explorer, Fast Step, Follow Me Browsing, FormShare, GainMaker, GigaDrive, HomeLink, iLYNX, Internet Quotient, IOS, iPhone, iQuick Study, IronPort, the IronPort logo, Laser Link, LightStream, Linksys, MediaTone, MeetingPlace, MeetingPlace Chime Sound, MGX, Networkers, Networking Academy, Network Registrar, PCNow, PIX, PowerKEY, PowerPanels, PowerTV, PowerTV (Design), PowerVu, Prisma, ProConnect, ROSA, ScriptShare, SenderBase, SMARTnet, Spectrum Expert, StackWise, The Fastest Way to Increase Your Internet Quotient, TransPath, WebEx, and the WebEx logo are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.
All other trademarks mentioned in this document or website are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0908R)
Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.
©2009 Cisco Systems, Inc. All rights reserved.
Guest
