Chapter 1. Introduction

This document describes the Version 6.2.0.x Firepower update.

Even if you have experience with previous Firepower updates, make sure you thoroughly read and understand this document.

Note

After you update to Version 6.2.0.3, you must apply Hotfix BH. If you do not apply Hotfix BH, you cannot edit or deploy access control rules.

Note

Devices running Version 6.2.0.1, Version 6.2.0.2, Version 6.2.0.3, Version 6.2.0.4, and Version 6.2.0.5 that are configured for Threat Grid integration may be unable to pull reports from Threat Grid or submit files manually for analysis, per CSCvj07038. See the Patch or Hotfix for New Dynamic Analysis CA Certificate for more information.

Chapter 2. Supported Platforms and Environments in Version 6.2.0.x

The following table lists the supported platforms for Version 6.2.0.x:

Supported Platforms and Environments

Supported Platform

Supported Environment

Firepower Management Centers: MC750, MC1000, MC1500, MC2000, MC2500, MC3500, MC4000, MC4500

—

64-bit Firepower Management Center Virtual

- VMware vSphere/VMware ESXi 5.5

- VMware vSphere/VMware ESXi 6.0

- Amazon Web Services (AWS) VPC/EC2

- Kernel-based virtual machine (KVM)

7000 and 8000 Series devices: 7010, 7020, 7030, 7050, 7110, 7115, 7120, 7125, 8120, 8130, 8140, 8250, 8260, 8270, 8290, 8350, 8360, 8370, 8390, AMP7150, AMP8050, AMP8150, AMP8350, AMP8360, AMP8370, AMP8390

—

NGIPSv (virtual managed devices)

- VMware vSphere/VMware ESXi 5.5

- VMware vSphere/VMware ESXi 6.0

Cisco ASA with FirePOWER Services: ASA 5506-X, ASA 5506H-X, ASA 5506W-X, ASA 5508-X, ASA 5512-X, ASA 5515-X, ASA 5516-X, ASA 5525-X, ASA 5545-X, ASA 5555-X, ASA 5585-X-SSP-10, ASA 5585-X-SSP-20, ASA 5585-X-SSP-40, ASA 5585-X-SSP-60

Note

You can also configure these devices as an ASA FirePOWER module managed by ASDM.

ASA OS, for ASA FirePOWER:

- 9.5(2), 9.5(3) except 5506 models

- 9.6(x)

- 9.7(x)

- 9.8(x)

Note

The ASA 5506-X does not support the ASA FirePOWER module when running ASA Version 9.5(x).

ASDM Version 7.7(1) and later.

Note

The ASA 5506-X, ASA 5508-X, and ASA 5516-X require ROMMON Version 1.1.8 or later.

Cisco ASA with Firepower Threat Defense: ASA 5506-X, ASA 5506H-X, ASA 5506W-X, ASA 5508-X, ASA 5512-X, ASA 5515-X, ASA 5516-X, ASA 5525-X, ASA 5545-X, ASA 5555-X

Note

You can also configure these devices as Firepower Threat Defense managed by Firepower Device Manager. For more information, see the System Management topic in the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager.

—

Firepower 9300 appliance with Firepower Threat Defense and the Firepower 4100 series with Firepower Threat Defense: Firepower 4110, Firepower 4120, Firepower 4140, Firepower 4150

FXOS Version 2.1(1) and later, or Version 2.2(1) and later.

Caution

Do not update to FXOS Version 2.3.1.56 if you are running an instance of Firepower Threat Defense that has been updated from Version 6.0.1.x of the Firepower System. Doing so may disable your Firepower Threat Defense application, which could interrupt traffic on your network. For more information, see CSCvh64138 in the Cisco Bug Search Tool.

Note

The Firepower 9300 appliance requires ROMMON Version 1.0.10 or later.

Firepower Threat Defense Virtual

- VMware vSphere/VMware ESXi 5.5

- VMware vSphere/VMware ESXi 6.0

- AWS VPC/EC2

- KVM

- Microsoft Azure Standard D3

- Microsoft Azure Standard D3_v2

Chapter 3. Management Capability in Version 6.2.0.x

- Management Capability: Firepower Management Center

- Local Management Capability: ASA FirePOWER Module, Firepower Device Manager, and 7000 and 8000 Series Devices

Management Capability: Firepower Management Center

You can use the Firepower Management Center web interface to configure and manage the Firepower Management Center and its managed devices. Alternatively, you can use the UI on specific device platforms to configure and manage those specific device platforms (see Local Management Capability: ASA FirePOWER Module, Firepower Device Manager, and 7000 and 8000 Series Devices).

If a managed device is running Version 6.2.0.x, you must use at least Version 6.2.0 of the Firepower Management Center to manage the device. If a Firepower Management Center is running Version 6.2.0.x, it can manage devices running the versions specified in the following table.

Device Version Requirements to be Managed by Firepower Management Center Running Version 6.2.0.x

Device

Minimum Required Version for Device

7000 and 8000 Series managed devices

Version 6.1.0

NGIPSv virtual managed devices

Version 6.1.0

ASA with FirePOWER Services on ASA 5512-X, ASA 5515-X, ASA 5525-X, ASA 5545-X, ASA 5555-X, ASA 5585-X-SSP-10, ASA 5585-X-SSP-20, ASA 5585-X-SSP-40, ASA 5585-X-SSP-60

Version 6.1.0

ASA with FirePOWER Services on ASA 5506-X, ASA 5506W-X, ASA 5506H-X, ASA 5508-X, ASA 5516-X

Version 6.1.0

Firepower Threat Defense on ASA 5506-X, ASA 5506W-X, ASA 5506H-X, ASA 5508-X, ASA 5512-X, ASA 5515-X, ASA 5516-X, ASA 5525-X, ASA 5545-X, ASA 5555-X

Version 6.1.0

Firepower Threat Defense on Firepower 9300 (with SM-24, SM-36, or SM-44 security modules)

Version 6.1.0

Firepower Threat Defense on Firepower 4110, Firepower 4120, Firepower 4140, Firepower 4150

Version 6.1.0

Firepower Threat Defense Virtual

On VMware: Version 6.1.0

On AWS: Version 6.1.0

On KVM: Version 6.1.0

On Azure: Version 6.2.0

Local Management Capability: ASA FirePOWER Module, Firepower Device Manager, and 7000 and 8000 Series Devices

On select device platforms tailored for smaller deployments, you can use a GUI to configure and manage the devices. These platforms include the ASA with FirePOWER Services module managed with ASDM or devices running FTD managed by Firepower Device Manager.

Also, you can use a web interface to perform limited configuration on 7000 and 8000 Series devices.

Alternatively, you can use the Firepower Management Center web interface to configure and manage these devices (see Management Capability: Firepower Management Center).

ASA FirePOWER Module Managed with ASDM

Supported Platforms: ASA 5506-X, ASA 5506H-X, ASA 5506W-X, ASA 5508-X, ASA 5516-X, ASA 5512-X, ASA 5515-X, ASA 5525-X, ASA 5545-X, ASA 5555-X, ASA 5585-X-SSP-10, ASA 5585-X-SSP-20, ASA 5585-X-SSP-40, ASA 5585-X-SSP-60

You can use ASDM to configure and manage an ASA FirePOWER module running Version 6.2.0.x.

See the Cisco ASA with FirePOWER Services Local Management Configuration Guide for more information.

Firepower Threat Defense Devices Managed by Firepower Device Manager

Supported Platforms: ASA 5506-X, ASA 5506H-X, ASA 5506W-X, ASA 5508-X, ASA 5512-X, ASA 5515-X, ASA 5516-X, ASA 5525-X, ASA 5545-X, ASA 5555-X

You can use the Firepower Device Manager to configure and manage a FTD device running Version 6.2.0.x.

See the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager for more information.

7000 and 8000 Series Devices

Supported Platforms: 7010, 7020, 7030, 7050, 7110, 7115, 7120, 7125, 8120, 8130, 8140, 8250, 8260, 8270, 8290, 8350, 8360, 8370, 8390, AMP7150, AMP8050, AMP8150, AMP8350, AMP8360, AMP8370, AMP8390

You can use the web interface for a 7000 or 8000 Series device running Version 6.2.0.x to manage limited configurations on that device. You must use the Firepower Management Center for some device configurations not accessible from the 7000 and 8000 Series web interface.

See the Firepower Management Center Configuration Guide for more information.

Chapter 4. Features and Functionality

Features and functionality introduced in previous versions may be superseded by new features and functionality in later versions.

- New Features and Functionality Added in Version 6.2.0.x

- New or Changed Functionality in Version 6.2.0.x

- Features and Functionality Introduced in Version 6.2.0

- Changed Functionality in Version 6.2.0

New Features and Functionality Added in Version 6.2.0.x

The following table lists the features introduced in Version 6.2.0.x:

New Features in Version 6.2.0.2

Feature

Description

Supported Platforms

Snort processes

Version 6.2.0.2 adds the configure snort preserve-connection {enable | disable} command to the Firepower Threat Defense CLI. This command determines whether to preserve existing connections on routed and transparent interfaces if the Snort process goes down. When disabled, all new or existing connections are dropped when Snort goes down. When enabled, connections that were already allowed remain established, but new connections cannot be established until Snort is again available.

Note that you cannot permanently disable this command on a Firepower Threat Defense device managed by Firepower Device Manager; existing connections may drop when the settings revert to default during the next configuration deployment.

Firepower Threat Defense

New or Changed Functionality in Version 6.2.0.x

The following features have new or changed functionality in Version 6.2.0.x:

- Version 6.2.0.5 increases the memory capacity for lower-end Firepower appliances and reduces the number of health alerts. (CSCvg34306)

- Version 6.2.0.5 improves blocking of BitTorrent downloads.

- In Version 6.2.0.3, if you modify the AMP for Endpoints connection to the Cisco cloud in the Firepower Management Center UI, the Firepower Management Center keeps the previous identifer when communicating with the AMP cloud and continues to receive retrospective alerts.

- In Version 6.2.0.1, due to memory limitations, some device models (7100 Family, ASA 5506-X, ASA 5506H-X, ASA 5506W-X, ASA 5508-X, ASA 5512-X, ASA 5515-X, ASA 5516-X, and ASA 5525-X) perform most URL filtering with a smaller, less granular, set of categories and reputations. To avoid storing the full category and reputation database on lower-memory devices, the system may perform cloud lookups to determine category and reputation for sites not in the local database. (CSCuz66673)

- Version 6.2.0.1 adds the All applications including unidentified applications option for Version 6.2.0 users. This option is added to Intelligent Application Bypass Settings in the access control policy advanced settings. When selected, if one of the IAB inspection performance thresholds is met, the system trusts any application that exceeds any flow bypass threshold regardless of the application type. For more information, see the Firepower Management Center Configuration Guide, Version 6.2.0 or the Cisco ASA with Firepower Services Local Management Configuration Guide, Version 6.2.0.

Features and Functionality Introduced in Version 6.2.0

This table includes the new and updated features and functionality included in Version 6.2.0.

Features in Version 6.2.0: Migration Enablers

New Feature

Description

Supported Platforms

Migration Tool

Migrating from Cisco ASA-to-Firepower Threat Defense can be a daunting task for customer is with multiple access control lists (ACLs), Network Address Translation policies, and related configuration objects. The migration tool is specifically designed to assist this migration process. The tool allows you to convert ASA configurations (ACL, NAT and related objects) to Firepower Threat Defense configurations, which you can then import into the Firepower Management Center. The migration tool supports the conversion of up to 600,000 total access rule elements per ASA configuration file.

- 64-bit Firepower Management Center Virtual (VMware and KVM)

REST API

Firepower Version 6.2.0 allows REST clients to create and configure interfaces for Firepower Threat Defense devices through the Firepower Management Center REST API. This feature enables the Firepower Management Center to interact with various Cisco products and services as well as those from third-party vendors. Implementation of these APIs is ideal in the following scenarios:

- Large enterprises that want to control policy changes in Firepower through other Cisco systems such as Application Centric Infrastructure (ACI) or through their own proprietary orchestration solutions

- Managed security service providers that want to adopt software-defined networking, application-centric infrastructure, and network function virtualization solutions

Note

SDN controllers do not have a way to automatically insert Firepower Threat Defense devices in the traffic path.

- Firepower Management Center

- 64-bit Firepower Management Center Virtual

Packet Tracer and Capture

The Packet Tracer and Capture offers the ability to show all the processing steps that a packet takes, the outcomes, and whether the traffic is blocked or allowed. This allows users to initiate and display output of tracing from the Firepower Management Center. The tracing information includes information from SNORT and preprocessors about verdicts and action taken while processing a packet.

- Firepower Threat Defense

Features for Version 6.2.0: Architecture

New Feature

Description

Supported Platforms

Integrated Routing and Bridging (IRB)

Customers often want to have multiple physical interfaces configured to be part of the same VLAN. The IRB feature meets this demand by allowing users to configure bridges in routed mode, and enables the devices to perform L2 switching between interfaces (including subinterfaces).

- Firepower Threat Defense on ASA 5506-X, ASA 5506W-X, ASA 5506H-X, ASA 5508-X ASA 5512-X, ASA 5515-X, ASA 5516-X, ASA 5525-X, ASA 5545-X, or ASA 5555-X

- Firepower Threat Defense on Firepower 4100 Series

- Firepower Threat Defense on Firepower 9300

Interchassis Clustering

Clustering lets you group multiple FXOS chassis Firepower Threat Defense devices together as a single logical device. A cluster provides all the convenience of a single device (management and integration into a network) while achieving the increased throughput and redundancy of multiple devices. Firepower Version 6.2.0 supports clustering across multiple chassis (interchassis clustering), allowing for higher scalability. You can use the Firepower Management Center to automatically discover all nodes of a cluster.

- Firepower Threat Defense on Firepower 4100 Series

- Firepower Threat Defense on Firepower 9300 Appliances

Policy Change Improvement

Deploying policy changes to a Firepower Threat Defense device can result in restarting the SNORT process and the related loss of some packets. As part of a continuing effort to address this issue, Firepower Version 6.2.0 allows you to configure actions separately for fault conditions, such as SNORT Busy/Overload or SNORT Down. This feature allows you to emphasize either continuity or security by checking a checkbox option in the Firepower Management Center.

Firepower Threat Defense (inline mode only)

Features for Version 6.2.0: Platform/Integration

New Feature

Description

Supported Platforms

Firepower Threat Defense on Microsoft Azure

In Firepower Version 6.2.0, Cisco Firepower Threat Defense Virtual is available in the Microsoft Azure Marketplace. This new platform enables you to secure workloads consistently across the data center and public cloud. Managed centrally by an on-premises Firepower Management Center, Firepower Threat Defense Virtual provides advanced threat protection in the Azure environment without forcing customers to return traffic to the data center.

- Firepower Threat Defense virtual

Firepower Threat Grid API Key Integration

This feature streamlines the process of associating a Threat Grid account with your Firepower Management Center.

- Firepower Management Center

- 64-bit Firepower Management Center Virtual

ISE and SGT tags without Identity

Before Firepower Version 6.2.0, you had to create a realm and identity policy to perform user control based on ISE Security Group Tag (SGT) data, even if you did not want to configure passive authentication using ISE. In Firepower Version 6.2.0, you no longer need to create a realm or identity policy to perform user control based on ISE Security Group Tag (SGT) data.

- Firepower Management Center

- Firepower Management Center Virtual

- 7000 and 8000 Series

- NGIPSv

- ASA with FirePOWER Services

- Firepower Threat Defense

- Firepower Threat Defense Virtual

TS Agent (VDI Identity Support)

To design policies that enforce rules based on the user’s identity, you must be able to identify the user correctly. This is a problem in a shared environment, where multiple users are using the same IP address, identifying which user certain traffic applies to becomes difficult.

Firepower now provides the ability to better identify individual users in shared environments, such as Citrix’s Virtual Desktop Infrastructure (VDI), to accurately enforce user-based policy rules on the firewall.

Rather than just associating a user with an IP address, Firepower now associates the user with both the IP address and a port range combination through the use of a new agent deployed on the Windows Terminal Server. The Cisco Terminal Services Agent (TS Agent) intercepts every log in to the terminal server and assigns a port range to every user that logs in. Using RESTful APIs it communicates this information (user, IP address and port range) to the Firepower Management Center, which in turn communicates it to the individual Firepower Threat Defense devices.

Now, when User 1 logs in, Firepower Threat Defense devices not only see the IP address, but also know the port range assigned to the user. Based on the IP address and the port range, Firepower Threat Defense devices properly map the traffic to User 1. When User 2 logs in, a new port range is assigned which enables the Firepower Threat Defense devices to map the appropriate traffic to that user while applying any specific policy rules to that user and their traffic.

- Firepower Management Center

- Firepower Management Center Virtual

Features for Version 6.2.0: Firepower Threat Defense and Threat

New Feature

Description

Supported Platforms

Site-to-Site VPN

The site-to-site VPN with public key infrastructure (PKI) support is an addition to the current capability of site-to-site VPN with preshared keys. The Firepower Device Manager (FDM) also allows you to configure site-to-site VPN with pre shared keys.

- Firepower Threat Defense managed by Firepower Management Center

- Firepower Threat Defense Virtual

PKI Support for Firepower Management Center

PKI is required to create certificate-based trusted identities for devices establishing site-to-site VPN tunnels. This feature allows you to associate PKI certificate data with devices on the Firepower Management Center.

- Firepower Threat Defense

- Firepower Threat Defense Virtual

User-based Indications of Compromise (IOCs)

This feature allows you to generate user-based IOCs from intrusion events or view the associations of users and IOCs. You can also enable and disable eventing of a given IOC per user (against false positives). With this feature, you can correlate IOCs and events to both hosts and users and give them more visibility and alerting options on a per-user basis.

- Firepower Management Center

- 64-bit Firepower Management Center Virtual

- 7000 and 8000 Series

- NGIPSv

- ASA with FirePOWER Services

- Firepower Threat Defense managed by Firepower Management Center

- Firepower Threat Defense Virtual

URL Lookups

This feature allows you to perform a bulk lookup of URLs (up to 250 URLs at a time) to obtain information such as reputation, category, and matching policy. You can also export the results as a file of comma-separated values.

The feature reduces the manual work necessary to determine if your organization is protected against a malicious URL or if you should add a custom rule for a specific IOC. You can use this feature to reduce the number of custom rules, which in turn reduces the chance of performance degradation due to extensive custom rule lists.

- Firepower Management Center Virtual

- 64-bit Firepower Management Center Virtual

FlexConfig

The FlexConfig feature allows you use the Firepower Management Center to deploy ASA CLI template-based functionality to Firepower Threat Defense devices. This feature allows you to enable some of the most valuable ASA functions that are not currently available on Firepower Threat Defense devices. This functionality is structured as templates and objects that work together in a policy. The default templates are officially supported by Cisco TAC.

The targeted features unlocked by FlexConfig potentially include:

- Non-Inspection Templates:

- Routing (EIGRP, PBR, and IS-IS)

- Netflow (NSEL) export

- MPF connection limits, timeouts (including DCD), and Normalizer settings

- Platform sysopt commands

- Proxy ARP Neighbor Discovery (sysopt noproxyarp interface)

- IPv6 Prefix Delegation

- IPV6

- WCCP

- VXLAN

- Application Layer Inspection Templates:

- ALGs default configuration

- GTPv1/v2 support

- Diameter inspection

- LISP inspection

- SCTP support and inspection

- SIP

- SS7 inspection

- Firepower Threat Defense

- Firepower Threat Defense Virtual

Changed Functionality in Version 6.2.0

Version 6.2.0

- Version 6.2.0 introduces new functionality related to latency-based performance settings in access control policies. In Version 6.2.0 and later, by default, new access control policies obtain latency-based performance settings from the latest intrusion rule update. You can choose to overwrite these settings with custom settings. For more information, see "Latency-Based Performance Setting Configuration” in the Firepower Management Center Configuration Guide.

When you update to Version 6.2.0, the system determines whether existing access control policies use default or custom latency-based performance settings and continues as appropriate under the following conditions:

- If existing policies use default settings, the system sets the Apply Settings From option to Installed Rule Update. When you deploy the access control policy, the system obtains the latency-based performance settings from the latest intrusion rule update and uses them in that policy.

- If existing policies do not use default settings, the system sets the Apply Settings From option to Custom and retains the preupgrade settings.

- Version 6.2.0 does not support international characters in URLS for URL objects or inline values in access control policy rules. (CSCux24338)

- Private keys are no longer mandatory when importing certificates. (CSCvb13045)

- Generated troubleshoot now includes captive portal information. (CSCvb26174)

- If you create an access control policy or NAT policy referencing an object or object group that contains an invalid character in the name, the system now generates an Unsupported object names are used in the policy for devices error message and does not save the policy. (CSCvb29308)

- The ASA-to-FTD migration process failed if the ASA configuration file included an access list entry (ACE) with an interface object configured as source network, destination network, or both. Now, the migration tool converts this ASA configuration to a disabled FTD rule. (CSCvb49745)

Chapter 5. Terminology and Documentation for Version 6.2.0.x

- Product Terminology and Branding in Version 6.2.0.x

- Documentation for Version 6.2.0.x

- Known Documentation Issues in Version 6.2.0.x

Product Terminology and Branding in Version 6.2.0.x

The terminology and branding used in Version 6.2.0.x may differ from the terminology used in previous releases as summarized in the following table. See the Firepower System Compatibiltiy Guide for more information about terminology and branding changes.

Product Terminology and Branding

Name

Description

Firepower System

Firepower

Refers to the product line.

Firepower Management Center

Management Center

Refers to Firepower management software running on physical or virtual Firepower platforms.

Cisco ASA with FirePOWER Services

ASA device running an ASA FirePOWER module

ASA FirePOWER module

Refers to Firepower software running on a Cisco Adaptive Security Appliance (ASA) operating system installed on an ASA platform.

ASA FirePOWER module managed with ASDM

Refers to ASA FirePOWER module local configuration interface accessible with ASDM.

Firepower Threat Defense

Refers to Firepower Threat Defense software running on a Firepower operating system installed on an ASA, Firepower 9300 appliance, Firepower 4100 series, or virtual platform.

Firepower Device Manager

Refers to Firepower Threat Defense local configuration interface accessible with specific Firepower Threat Defense platforms.

Documentation for Version 6.2.0.x

The following documents were updated for Version 6.2.0.x to reflect the addition of new features and functionality and to address reported documentation issues:

- Cisco Firepower Management Center Virtual for the AWS Cloud Quick Start Guide

For additional information about updating and configuring your system, see the documents in the Cisco Firepower System Documentation Roadmap.

For parallel ASA versions, see the ASA documentation roadmap and release notes (including known issues).

For the FXOS documentation roadmap and release notes (including known issues) for parallel FXOS versions, see the Cisco FXOS Documentation roadmap.

Known Documentation Issues in Version 6.2.0.x

- The Cisco ASA with FirePOWER Services Local Management Configuration Guide refers to creating new, custom access control and system policies. ASA with FirePOWER Services does not support multiple custom policies. Instead, edit and deploy the system-provided policies.

- The Firepower Management Center Configuration Guide does not state that if you deploy an access control rule, SSL rule, or identity rule with geolocation network conditions and the system detects an IP address that appears to be moving from country to country, the system incorrectly reports the continent rule as unknown country.

- The Cisco ASA with FirePOWER Services Local Management Configuration Guide states After you establish remote management and register the Cisco ASA with FirePOWER Services to a Firepower Management Center, you must manage the ASA FirePOWER module from the Firepower Management Center instead of ASDM. However the guide does not state that once remote management is established, you cannot access the ASA FirePOWER configuration with the ASDM manager.

Chapter 6. Product Compatibility in Version 6.2.0.x

- Integrated Product Compatibility

- Web Browser Compatibility in Version 6.2.0.6

- Web Browser Compatibility in Version 6.2.0.5

- Web Browser Compatibility in Version 6.2.0.4

- Web Browser Compatibility in Version 6.2.0.3

- Web Browser Compatibility in Version 6.2.0.2

- Web Browser Compatibility in Version 6.2.0.1

- Screen Resolution Compatibility

Integrated Product Compatibility

The required versions for the following integrated products vary by Firepower version:

- Cisco Identity Services Engine (ISE)

- Cisco AMP Threat Grid

- Cisco Firepower User Agent

For more information about the required versions, see the Firepower Compatibility Guide.

Web Browser Compatibility in Version 6.2.0.6

Firepower web UI for Version 6.2.0.6 has been tested on the browsers listed in the following table:

Caution

The Chrome browser does not cache static content, such as images, CSS, or Javascript, with the system-provided self-signed certificate. This may cause the system to redownload static content when you refresh. To avoid this, add the self-signed certificate used by the Firepower System to the trust store of the browser/OS or use another web browser.

Supported Web Browsers

Browser

Required Enabled Options and Settings

Google Chrome 67

JavaScript, cookies

Mozilla Firefox 60

JavaScript, cookies, TLS v1.2

Note

If you use a self-signed certificate on the Firepower Management Center and the Login screen takes a long time to load, enter about:support in a Firefox web browser search bar and click Refresh Firefox. Note that you may lose existing Firefox settings when you refresh Firefox. For more information, see https://support.mozilla.org/en-US/kb/refresh-firefox-reset-add-ons-and-settings.The Firepower Management Center uses a self-signed certificate by default; we recommend that you replace that certificate with a certificate signed by a trusted certificate authority. For more information on replacing server certificates, see the section on system configuration in the Firepower Management Center Configuration Guide for your version.

Microsoft Internet Explorer 10 and 11

JavaScript, cookies, TLS v1.1 or v1.2, 128-bit encryption, Active scripting security setting, Compatibility View, set Check for newer versions of stored pages to Automatically

Note

If you use the Microsoft Internet Explorer 11 browser, you must disable Include local directory path when uploading files to server in your Internet Explorer settings through Tools > Internet Options > Security > Custom level ....

Apple Safari 8 and 9

—

Microsoft Edge

—

Note

Many browsers use Transport Layer Security (TLS) v1.3 by default. If you have an active SSL policy and your browser uses TLSv1.3, websites that support TLSv1.3 fail to load. As a workaround, configure your managed device to remove extension 43 (TLS 1.3) from ClientHello negotiation. See this software advisory for more information.

Web Browser Compatibility in Version 6.2.0.5

Firepower web UI for Version 6.2.0.5 has been tested on the browsers listed in the following table:

Caution

The Chrome browser does not cache static content, such as images, CSS, or Javascript, with the system-provided self-signed certificate. This may cause the system to redownload static content when you refresh. To avoid this, add the self-signed certificate used by the Firepower System to the trust store of the browser/OS or use another web browser.

Supported Web Browsers

Browser

Required Enabled Options and Settings

Google Chrome 64

JavaScript, cookies

Mozilla Firefox 58

JavaScript, cookies, TLS v1.2

Note

If you use a self-signed certificate on the Firepower Management Center and the Login screen takes a long time to load, enter about:support in a Firefox web browser search bar and click Refresh Firefox. Note that you may lose existing Firefox settings when you refresh Firefox. For more information, see https://support.mozilla.org/en-US/kb/refresh-firefox-reset-add-ons-and-settings.The Firepower Management Center uses a self-signed certificate by default; we recommend that you replace that certificate with a certificate signed by a trusted certificate authority. For more information on replacing server certificates, see the section on system configuration in the Firepower Management Center Configuration Guide for your version.

Microsoft Internet Explorer 10 and 11

JavaScript, cookies, TLS v1.1 or v1.2, 128-bit encryption, Active scripting security setting, Compatibility View, set Check for newer versions of stored pages to Automatically

Note

If you use the Microsoft Internet Explorer 11 browser, you must disable Include local directory path when uploading files to server in your Internet Explorer settings through Tools > Internet Options > Security > Custom level ....

Apple Safari 8 and 9

—

Microsoft Edge

—

Note

Many browsers use Transport Layer Security (TLS) v1.3 by default. If you have an active SSL policy and your browser uses TLSv1.3, websites that support TLSv1.3 fail to load. As a workaround, configure your managed device to remove extension 43 (TLS 1.3) from ClientHello negotiation. See this software advisory for more information.

Web Browser Compatibility in Version 6.2.0.4

Firepower web UI for Version 6.2.0.4 has been tested on the browsers listed in the following table:

Caution

The Chrome browser does not cache static content, such as images, CSS, or Javascript, with the system-provided self-signed certificate. This may cause the system to redownload static content when you refresh. To avoid this, add the self-signed certificate used by the Firepower System to the trust store of the browser/OS or use another web browser.

Supported Web Browsers

Browser

Required Enabled Options and Settings

Google Chrome 63

JavaScript, cookies

Mozilla Firefox 57

JavaScript, cookies, TLS v1.2

Note

If you use a self-signed certificate on the Firepower Management Center and the Login screen takes a long time to load, enter about:support in a Firefox web browser search bar and click Refresh Firefox. Note that you may lose existing Firefox settings when you refresh Firefox. For more information, see https://support.mozilla.org/en-US/kb/refresh-firefox-reset-add-ons-and-settings.The Firepower Management Center uses a self-signed certificate by default; we recommend that you replace that certificate with a certificate signed by a trusted certificate authority. For more information on replacing server certificates, see the section on system configuration in the Firepower Management Center Configuration Guide for your version.

Caution

Firefox 56 incorrectly displays HTML instead of the Firepower Management Center UI . We strongly recommend using Firefox 57 or later, or Firefox 55 or earlier.

Microsoft Internet Explorer 10 and 11

JavaScript, cookies, TLS v1.1 or v1.2, 128-bit encryption, Active scripting security setting, Compatibility View, set Check for newer versions of stored pages to Automatically

Note

If you use the Microsoft Internet Explorer 11 browser, you must disable Include local directory path when uploading files to server in your Internet Explorer settings through Tools > Internet Options > Security > Custom level ....

Apple Safari

Not supported

Microsoft Edge

Not supported

Note

Many browsers use Transport Layer Security (TLS) v1.3 by default. If you have an active SSL policy and your browser uses TLSv1.3, websites that support TLSv1.3 fail to load. As a workaround, configure your managed device to remove extension 43 (TLS 1.3) from ClientHello negotiation. See this software advisory for more information.

Web Browser Compatibility in Version 6.2.0.3

Firepower web UI for Version 6.2.0.3 has been tested on the browsers listed in the following table:

Caution

The Chrome browser does not cache static content, such as images, CSS, or Javascript, with the system-provided self-signed certificate. This may cause the system to redownload static content when you refresh. To avoid this, add the self-signed certificate used by the Firepower System to the trust store of the browser/OS or use another web browser.

Supported Web Browsers

Browser

Required Enabled Options and Settings

Google Chrome 60

JavaScript, cookies

Mozilla Firefox 55

JavaScript, cookies, TLS v1.1 or v1.2

Note

If you use a self-signed certificate on the Firepower Management Center and the Login screen takes a long time to load, enter about:support in a Firefox web browser search bar and click Refresh Firefox. Note that you may lose existing Firefox settings when you refresh Firefox. For more information, see https://support.mozilla.org/en-US/kb/refresh-firefox-reset-add-ons-and-settings. The FMC uses a self-signed certificate by default; we recommend that you replace that certificate with a certificate signed by a trusted certificate authority. For more information on replacing server certificates, see the section on system configuration in the Firepower Management Center Configuration Guide for your version.

Caution

Firefox 56 incorrectly displays HTML instead of the FMC UI . We strongly recommend using Firefox 57 or later, or Firefox 55 or earlier.

Microsoft Internet Explorer 10 and 11

JavaScript, cookies, TLS v1.1 or v1.2, 128-bit encryption, Active scripting security setting, Compatibility View, set Check for newer versions of stored pages to Automatically

Note

If you use the Microsoft Internet Explorer 11 browser, you must disable Include local directory path when uploading files to server in your Internet Explorer settings through Tools > Internet Options > Security > Custom level ....

Apple Safari

Not supported.

Microsoft Edge

Not supported.

Note

Many browsers use Transport Layer Security (TLS) v1.3 by default. If you have an active SSL policy and your browser uses TLSv1.3, websites that support TLSv1.3 fail to load. As a workaround, configure your managed device to remove extension 43 (TLS 1.3) from ClientHello negotiation. See this software advisory for more information.

Web Browser Compatibility in Version 6.2.0.2

Firepower web UI for Version 6.2.0.2 has been tested on the browsers listed in the following table:

Caution

The Chrome browser does not cache static content, such as images, CSS, or Javascript, with the system-provided self-signed certificate. This may cause the system to redownload static content when you refresh. To avoid this, add the self-signed certificate used by the Firepower System to the trust store of the browser/OS or use another web browser.

Supported Web Browsers

Browser

Required Enabled Options and Settings

Google Chrome 57

JavaScript, cookies

Mozilla Firefox 53

JavaScript, cookies, TLS v1.1 or v1.2

Note

If you use a self-signed certificate on the Firepower Management Center and the Login screen takes a long time to load, enter about:support in a Firefox web browser search bar and click Refresh Firefox. Note that you may lose existing Firefox settings when you refresh Firefox. For more information, see https://support.mozilla.org/en-US/kb/refresh-firefox-reset-add-ons-and-settings. The FMC uses a self-signed certificate by default; we recommend that you replace that certificate with a certificate signed by a trusted certificate authority. For more information on replacing server certificates, see the section on system configuration in the Firepower Management Center Configuration Guide for your version.

Caution

Firefox 56 incorrectly displays HTML instead of the FMC UI . We strongly recommend using Firefox 57 or later, or Firefox 55 or earlier.

Microsoft Internet Explorer 10 and 11

JavaScript, cookies, TLS v1.1 or v1.2, 128-bit encryption, Active scripting security setting, Compatibility View, set Check for newer versions of stored pages to Automatically

Note

If you use the Microsoft Internet Explorer 11 browser, you must disable Include local directory path when uploading files to server in your Internet Explorer settings through Tools > Internet Options > Security > Custom level ....

Apple Safari

Not supported.

Microsoft Edge

Not supported.

Note

Many browsers use Transport Layer Security (TLS) v1.3 by default. If you have an active SSL policy and your browser uses TLSv1.3, websites that support TLSv1.3 fail to load. As a workaround, configure your managed device to remove extension 43 (TLS 1.3) from ClientHello negotiation. See this software advisory for more information.

Web Browser Compatibility in Version 6.2.0.1

Firepower web UI for Version 6.2.0.1 has been tested on the browsers listed in the following table:

Caution

The Chrome browser does not cache static content, such as images, CSS, or Javascript, with the system-provided self-signed certificate. This may cause the system to redownload static content when you refresh. To avoid this, add the self-signed certificate used by the Firepower System to the trust store of the browser/OS or use another web browser.

Supported Web Browsers

Browser

Required Enabled Options and Settings

Google Chrome 56

JavaScript, cookies

Mozilla Firefox 52

JavaScript, cookies, TLS v1.1 or v1.2

Note

If you use a self-signed certificate on the Firepower Management Center and the Login screen takes a long time to load, enter about:support in a Firefox web browser search bar and click Refresh Firefox. Note that you may lose existing Firefox settings when you refresh Firefox. For more information, see https://support.mozilla.org/en-US/kb/refresh-firefox-reset-add-ons-and-settings.The Firepower Management Center uses a self-signed certificate by default; we recommend that you replace that certificate with a certificate signed by a trusted certificate authority. For more information on replacing server certificates, see the section on system configuration in the Firepower Management Center Configuration Guide for your version.

Caution

Firefox 56 incorrectly displays HTML instead of the Firepower Management Center UI . We strongly recommend using Firefox 57 or later, or Firefox 55 or earlier.

Microsoft Internet Explorer 10 and 11

JavaScript, cookies, TLS v1.1 or v1.2, 128-bit encryption, Active scripting security setting, Compatibility View, set Check for newer versions of stored pages to Automatically

Note

If you use the Microsoft Internet Explorer 11 browser, you must disable Include local directory path when uploading files to server in your Internet Explorer settings through Tools > Internet Options > Security > Custom level ....

Apple Safari

Not supported

Microsoft Edge

Not supported

Note

Many browsers use Transport Layer Security (TLS) v1.3 by default. If you have an active SSL policy and your browser uses TLSv1.3, websites that support TLSv1.3 fail to load. As a workaround, configure your managed device to remove extension 43 (TLS 1.3) from ClientHello negotiation. See this software advisory for more information.

Screen Resolution Compatibility

When you access user interfaces to manage Firepower, we recommend using the screen resolutions in the table below. The user interfaces are compatible with lower resolutions, but a higher resolution optimizes the display.

Recommended Screen Resolutions by Web Interface

Web Interface

Recommended Screen Resolution

Firepower Management Centers

At least 1280 pixels wide

7000 and 8000 Series devices

ASDM (managing ASA FirePOWER)

1024 pixels wide by 768 pixels high

Firepower Device Manager (managing Firepower Threat Defense)

1024 pixels wide by 768 pixels high

Chapter 7. Update vs. Reimage vs. Deploy

In most cases, it is best to perform a traditional update from Version 6.2.0 to Version 6.2.0.x as described in Update Paths to Version 6.2.0.x.

However, the following cases require you to reimage and/or deploy your appliance:

- If you are moving from ASA with FirePOWER Services to Firepower Threat Defense, you must reimage your ASA device to deploy Firepower Threat Defense.

- If you are recreating a Firepower Threat Defense Virtual device in a different environment than before, you must redeploy your virtual platform to Firepower Threat Defense. For example, if you were using VMware before and now want to deploy in AWS, you must redeploy rather than update.

- If you are unable or disinclined to follow the required update path as described in Update Paths to Version 6.2.0.x, you must reimage and/or deploy your appliance.

In rare cases, you may need to reimage your device. You must reimage to Version 6.2.0 only; see Firepower Release Notes Version 6.2.0.

Chapter 8. Important Update Notes

Before you begin the update process to Version 6.2.0.x, you should familiarize yourself with the behavior of the system during the update process, as well as with any compatibility issues or required pre- or post update configuration changes.

Caution

Do not update to FXOS Version 2.3.1.56 if you are running an instance of Firepower Threat Defense that has been updated from Version 6.0.1.x of the Firepower System. Doing so may disable your Firepower Threat Defense application, which could interrupt traffic on your network. For more information, see CSCvh64138 in the Cisco Bug Search Tool.

Note

After you update to Version 6.2.0.3, you must apply Hotfix BH. If you do not apply Hotfix BH, you cannot edit or deploy access control rules.

Caution

Do not reboot or shut down your appliance during the update until you see the login prompt. The system may appear inactive during the prechecks; this is expected behavior and does not require you to reboot or shut down your appliance.

- Update Paths to Version 6.2.0.x

- Update Interface Options

- Update Sequence Guidelines

- Preupdate Readiness Checks

- Preupdate Configuration and Event Backups

- Traffic Flow and Inspection During the Update

- Patch or Hotfix for New Dynamic Analysis CA Certificate

- Version 6.2.0.6 Time and Disk Space

- Version 6.2.0.5 Time and Disk Space

- Version 6.2.0.4 Time and Disk Space

- Version 6.2.0.3 Time and Disk Space

- Version 6.2.0.2 Time and Disk Space

- Version 6.2.0.1 Time and Disk Space

- Post Update Tasks

Update Paths to Version 6.2.0.x

Firepower Management Center Update Paths

The following table describes update paths for Firepower Management Centers, including Firepower Management Center Virtual:

Firepower Management Center Platform

Update Path

MC750, MC1000, MC1500, MC2000, MC2500, MC3500, MC4000, MC4500

Firepower Management Center Virtual: VMware

Version 5.4.1.1+ > Version 6.0.0 PreInstallation Package > Version 6.0.0 > Version 6.0.1 Preinstall > Version 6.0.1 > Version 6.1.0 PreInstallation Package > Version 6.1.0 > Version 6.2.0

Firepower Management Center Virtual: AWS

Version 6.0.1 > Version 6.1.0 PreInstallation Package > Version 6.1.0 > Version 6.2.0

Firepower Management Center Virtual: KVM

Version 6.1.0 > Version 6.2.0

Firepower Threat Defense Update Paths—With Firepower Management Center

This table describes update paths for Firepower Threat Defense devices managed by a Firepower Management Center.

Firepower Threat Defense Platform

Update Path

ASA 5506-X, ASAS 5506H-X, ASA 5506W-X, ASA 5508-X, 16-X

ASA 5512-X, ASA 5515-X, ASA 5525-X, ASA 5545-X, ASA 5555-X

Firepower Threat Defense Virtual: VMware

Firepower Threat Defense Virtual: AWS

Firepower 4110, 4120, 4140

Firepower 9300 with SM-24, SM-36, or SM-44 modules

Version 6.0.1 > Version 6.1.0 PreInstallation Package > Version 6.1.0 > Version 6.2.0

Firepower Threat Defense Virtual: KVM

Firepower 4150

Version 6.1.0 > Version 6.2.0

Firepower Threat Defense Virtual: Azure

Version 6.2.0

Firepower Threat Defense Update Paths—With Firepower Device Manager

This table describes update paths for Firepower Threat Defense devices managed by Firepower Device Manager.

Firepower Threat Defense Platform

Update Path

ASA 5506-X, ASA 5506H-X, ASA 5506W-X, ASA 5508-X, ASA 5516-X

ASA 5512-X, ASA 5515-X, ASA 5525-X, ASA 5545-X, ASA 5555-X

Version 6.1.0 > Version 6.2.0

NGIPS Update Paths—With Firepower Management Center

This table describes update paths for NGIPS devices (including ASA FirePOWER modules) managed by a Firepower Management Center.

NGIPS Platform

Update Path

Firepower 7010, 7020, 7030, 7050, 7110, 7115, 7120, 7125

Firepower 8120, 8130, 8140, 8250, 8260, 8270, 8290, 8350, 8360, 8370, 8390

AMP7150, AMP8050, AMP8150, AMP8350, AMP8360, AMP8370, AMP8390

ASA FirePOWER: ASA 5512-X, ASA 5515-X, ASA 5525-X, ASA 5545-X, ASA 5555-X

ASA FirePOWER: ASA 5585-X-SSP-10, ASA 5585-X-SSP-20, ASA 5585-X-SSP-40, ASA 5585-X-SSP-60

NGIPSv: VMware

Version 5.4.0.2 > Version 6.0.0 PreInstallation Package > Version 6.0.0 > Version 6.0.1 Preinstall > Version 6.0.1 > Version 6.1.0 PreInstallation Package > Version 6.1.0 > Version 6.2.0

ASA FirePOWER: ASA 5506-X, ASA 5506H-X, ASA 5506W-X, ASA 5508-X, ASA 5516-X

Version 5.4.1.1 > Version 6.0.0 PreInstallation Package > Version 6.0.0 > Version 6.0.1 Preinstall > Version 6.0.1 > Version 6.1.0 Pre-nstallation Package > Version 6.1.0 > Version 6.2.0

NGIPS Update Paths—ASA FirePOWER with ASDM

This table describes update paths for ASA FirePOWER modules managed by ASDM.

ASA FirePOWER NGIPS Platform

Update Path

ASA 5506-X, ASA 5506H-X, ASA 5506W-X, ASA 5508-X, ASA 5516-X

Version 5.4.1.1 > Version 6.0.0 PreInstallation Package > Version 6.0.0 > Version 6.0.1 Preinstall > Version 6.0.1 > Version 6.1.0 PreInstallation Package > Version 6.1.0 > Version 6.2.0

ASA 5512-X, ASA 5515-X, ASA 5525-X, ASA 5545-X, ASA 5555-X

ASA 5585-X-SSP-10, ASA 5585-X-SSP-20, ASA 5585-X-SSP-40, ASA 5585-X-SSP-60

Version 6.0.0 > Version 6.0.1 Preinstall > Version 6.0.1 > Version 6.1.0 PreInstallation Package > Version 6.1.0 > Version 6.2.0

Update Interface Options

If you are locally managing the ASA FirePOWER module with ASDM, use the ASDM to perform the update. To configure the ASA FirePOWER module through ASDM, see the Cisco ASA with FirePOWER Services Local Management Configuration Guide.

If you are locally managing a Firepower Threat Defense device with the Firepower Device Manager, use the Firepower Device Manager to update your Firepower Threat Defense device. To configure the Firepower Device Manager, see the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager.

Otherwise, use the Firepower Management Center to update first the Firepower Management Center and then the devices it manages. To configure the Firepower Management Center or its managed devices, see the Firepower Management Center Configuration Guide.

For more information about management, see Management Capability in Version 6.2.0.x.

Update Sequence Guidelines

Update your Firepower Management Center to at least Version 6.2.0 before updating the devices it manages. Then, use the Firepower Management Center to redeploy policies to all managed devices before updating those devices to Version 6.2.0.x.

Note the following update sequence complications when you have high availability or device stacking configured:

- Update Sequence for Firepower Management Centers in High Availability

- Update Sequence for Firepower Threat Defense Devices in High Availability

- Update Sequence for Clustered FTD Devices

- Update Sequence for 7000 and 8000 Series Devices in High Availability

- Update Sequence for High Availability 7000 and 8000 Series Devices in Inline Deployment

- Update Sequence for Stacked 8000 Series Devices

Update Sequence for Firepower Management Centers in High Availability

This procedure explains how to upgrade the Firepower software on Firepower Management Centers in a high availability pair.

You upgrade peers one at a time. With synchronization paused, first upgrade the standby (or secondary), then the active (or primary). When the standby Firepower Management Center starts prechecks, its status switches from standby to active, so that both peers are active. This temporary state is called split-brain and is not supported except during upgrade. Do not make or deploy configuration changes while the pair is split-brain. Your changes will be lost after you upgrade the Firepower Management Centers and restart synchronization.

Procedure

Step 1

Pause the synchronization of the active Firepower Management Center of the high availability pair on the High Availability tab of the Integration page (System > Integration) as described in the Pausing Communication Between Paired Firepower Management Centers topic in the Firepower Management Center Configuration Guide, Version 6.2.0.

Step 2

Update the standby Firepower Management Center in the high availability pair.

After the update is completed, the Firepower Management Center switches from standby to active so both Firepower Management Centers in the high availability pair are active.

Step 3

Update the other Firepower Management Center within the pair.

The update is complete.

Step 4

Click Make-Me-Active on the High Availability tab of one of the Firepower Management Center web UIs.

The Firepower Management Center you do not make active automatically switches to standby mode. communication between the Firepower Management Center pairs automatically restarts.

Update Sequence for Firepower Threat Defense Devices in High Availability

Update the FXOS chassis of Firepower Threat Defense devices in a high availability pair to the most recent compatible FXOS version before installing the most recent Firepower version. For more information on FXOS versions, see the Firepower Compatibility Guide.

Caution

You must always update the FXOS version on the standby device of a Firepower Threat Defense high availability pair. Do not update the FXOS version of the active device.

Procedure

Step 1

Update the FXOS version on the standby Firepower Threat Defense device within the high availability pair.

Step 2

Switch the active peer so the standby Firepower Threat Defense device is now the active device.

Step 3

Update the FXOS version on the standby Firepower Threat Defense device within the high availability pair.

What to do next

Update the Firepower Threat Defense high availabiltiy pair to the most recent Firepower version.

When you install a Firepower update on Firepower Threat Defense devices in a high availability pair, the devices are updated one at a time. When the update starts, Firepower first applies it to the standby device, which goes into maintenance mode until any necessary processes restart and the device is processing traffic again. Once the standby Firepower Threat Defense update is complete, the active Firepower Threat Defense automatically fails over to standby mode and then is updated.

Update Sequence for Clustered FTD Devices

When you update clustered Firepower 9300 or Firepower 4100 series devices running Firepower Threat Defense, the system updates the security modules one at a time—first the secondary security modules, then the primary security module. Modules operate in maintenance mode while they are updated.

During the primary security module update, the system stops logging events. Event logging resumes after the full update is completed.

Caution

Upgrading an inter-chassis cluster to Version 6.2.0.1, Version 6.2.0.2, or Version 6.2.0.3 can cause a 2-3 second traffic interruption when each module is removed from the cluster.

Caution

Updating FXOS reboots the device, which can affect traffic in a clustered environment until at least one module comes online. In an intra-chassis cluster, traffic drops if the cluster does not use an optional hardware bypass (fail‑to‑wire) module or if bypass is disabled. Traffic passes without inspection if bypass is enabled. In an inter‑chassis cluster, traffic drops during the reboot if chassis reboots overlap before at least one module comes online; traffic is unaffected if there is no reboot overlap.

For more information, see the About Clustering on the Firepower 4100/9300 Chassis chapter of the Firepower Management Center Configuration Guide and the About Clustering on the Firepower 4100/9300 Chassis chapter of the Cisco FXOS Firepower Chassis Manager Configuration Guide.

Events for traffic processed during the logging downtime appear with out-of-sync timestamps after the update is complete. However, if the logging downtime was significant, the system may not log some of the oldest events because it may prune them before they can be logged.

Update Sequence for 7000 and 8000 Series Devices in High Availability

Note

You cannot locally update 7000 and 8000 Series devices in a high availability pair. You must update from the managing Firepower Management Center.

When you install an update on 7000 and 8000 Series devices in a high availability pair, the system updates the devices one at a time. When the update starts, the system first applies it to the standby device, which goes into maintenance mode until any necessary processes restart and the device is processing traffic again. The standby device then takes over the active role and the system updates the formerly active device, which follows the same process.

Update Sequence for High Availability 7000 and 8000 Series Devices in Inline Deployment

When you install an update on 7000 Series or 8000 Series devices in high availability configured for inline deployment, the system performs the update on the devices one at a time. The system first applies it to the primary device, which goes into maintenance mode until any necessary processes restart and the device is processing traffic again. While the primary device is updated in maintenance mode, the secondary device temporarily becomes primary and does not drop traffic. When the primary device update is complete, the primary device moves from maintenance mode to primary mode and the system updates the secondary device.

Update Sequence for Stacked 8000 Series Devices

When you install an update on 8000 Series stacked devices, Firepower updates the stacked devices simultaneously. Each device resumes normal operation when the update is complete. Note the following scenarios:

- If the active device completes the update before all of the standby devices, the stack operates in a limited, mixed-version state until all devices have completed the update.

- If the active device completes the update after all of the standby devices, the stack resumes normal operation when the update is complete on the active device.

Preupdate Readiness Checks

Caution

Do not reboot or shut down an appliance during the readiness check. If your appliance fails the readiness check, correct the issues and run the readiness check again. If the readiness check exposes issues that you cannot resolve, do not begin the upgrade. Instead, contact Cisco TAC.

- Checks Firepower software readiness only—The readiness check does not assess preparedness for intrusion rule, VDB, or GeoDB updates.

- Version 6.1+ required—The readiness check was introduced in Version 6.1. A readiness check on the upgrade to Version 6.1 may not return accurate results.

- Web interface vs shell—You can use the Firepower Management Center web interface to perform the readiness check on itself and its standalone managed devices only. For clustered devices, stacked devices, and devices in high availability pairs, run the readiness check from each device's shell.

- Time requirements—The time required to run the readiness check varies depending on your appliance model and database size. You may find it expedient to forgo readiness checks if your deployment is large (for example, if your Firepower Management Center manages more than 100 devices).

- Run a Readiness Check through the Shell

- Run a Readiness Check through the Firepower Management Center Web Interface

Run a Readiness Check through the Shell

For clustered devices, stacked devices, and devices in high availability pairs, you must use the shell.

Before you begin

- Download the upgrade package for the appliance whose readiness you want to check. Readiness checks are included in upgrade packages.

- Deploy configurations to managed devices whose configurations are out of date. Otherwise, the readiness check may fail.

Procedure

Step 1

Log into the shell as a user with administrator privileges.

Step 2

Make sure the upgrade package is on the appliance in the correct place:

- Firepower Threat Defense devices: /ngfw/var/sf/updates

- All other Firepower appliances: /var/sf/updates

On Firepower Management Centers, you can use the web interface to upload the upgrade package.

If you cannot or do not want to use the Firepower Management Center web interface, use SCP to copy the upgrade package to the appliance. Initiate from the Firepower side.

Step 3

Run this command as the root user:

sudo install_update.pl --detach --readiness-check full_path_to_update_package

Unless you are running the readiness check from the console, use the --detach option to ensure the check does not stop if your user session times out. Otherwise, the readiness check runs as a child process of the user shell. If your connection is terminated, the process is killed, the check is disrupted, and the appliance may be left in an unstable state.

Step 4

(Optional) Monitor the readiness check.

If you use the --detach option (or begin another shell session), you can use the tail or tailf command to display logs, for example:

- Firepower Threat Defense devices: tail /ngfw/var/log/sf/update_package_name/status.log

- All other Firepower appliances: tail /var/log/sf/update_package_name/status.log

If you use tailf to display log entries as they occur, you must cancel (Ctrl+C) to return to the command prompt.

Step 5

When the readiness check completes, access the full readiness check report.

- Firepower Threat Defense devices: /ngfw/var/log/sf/$rpm_name/upgrade_readiness

- All other Firepower appliances: /var/log/sf/$rpm_name/upgrade_readiness

Run a Readiness Check through the Firepower Management Center Web Interface

You can use the Firepower Management Center web interface to perform readiness checks on itself and its standalone managed devices.

Before you begin

- Readiness checks are included in upgrade packages. Note that upgrade packages from Version 6.2.1+ are signed, and terminate in .sh.REL.tar instead of just .sh. Do not untar signed upgrade packages before performing either a readiness check or the upgrade itself.

- Redeploy configuration changes to any managed devices. Otherwise, the readiness check may fail.

Procedure

Step 1

On the Firepower Management Center web interface, choose System > Updates.

Step 2

Click the Install icon next to the upgrade you want the readiness check to evaluate.

Step 3

Click Launch Readiness Check.

Step 4

Monitor the progress of the readiness check in the Message Center.

When the readiness check completes, the system reports success or failure on the Readiness Check Status page.

Step 5

Access the full readiness check report in /var/log/sf/$rpm_name/upgrade_readiness.

Preupdate Configuration and Event Backups

Before you begin the update, we strongly recommend that you back up current event and configuration data to an external location. If you back up to an external location, verify the external backup is successful before updating the system.

The Firepower Management Center purges locally stored backups from previous updates. To retain archived backups, store the backups externally. Use the Firepower Management Center to back up event and configuration data for itself and the devices it manages. For more information on the backup and restore feature, see the Firepower Management Center Configuration Guide.

Use the Firepower Device Manager to back up event and configuration data for the device it manages. For more information on the backup and restore feature, see the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager.

Traffic Flow and Inspection During the Update

When you update your sensing devices, traffic either drops throughout the update or traverses the network without inspection depending on how your devices are configured and deployed: routed or transparent, inline versus passive, bypass mode settings, and so on. We strongly recommend performing the update in a maintenance window or at a time when the interruption will have the least impact on your deployment.

Note

When you update devices in a high availability pair, the system performs the update one device at a time to avoid traffic interruption.

This section discusses traffic behavior during the followng update stages:

- The update itself, including related reboots

- FXOS updates on clustered Firepower Threat Defense devices

- Configuration deployments after the update

Traffic Behavior During the Update

The following table describes how updates, including related device reboots, affect traffic flow for different deployments. Note that switching, routing, NAT, and VPN are not performed during the update process, regardless of how you configure any inline sets.

Caution

Do not update to FXOS Version 2.3.1.56 if you are running an instance of Firepower Threat Defense that has been updated from Version 6.0.1.x of the Firepower System. Doing so may disable your Firepower Threat Defense application, which could interrupt traffic on your network. For more information, see CSCvh64138 in the Cisco Bug Search Tool.

Update Traffic Behavior

Device

Deployment

Traffic Behavior

Firepower Threat Defense

inline with optional hardware bypass module;

bypass enabled:

(Bypass: Standby or Bypass‑Force)

or, bypass disabled:

(Bypass: Disabled)

dropped

Firepower Threat Defense

Firepower Threat Defense Virtual

inline with no hardware bypass module;

routed, transparent (including EtherChannel, redundant, subinterface)

inline in tap mode

egress packet immediately, copy not inspected

passive

uninterrupted, not inspected

7000 and 8000 Series

inline with optional hardware bypass module, bypass enabled (Bypass Mode: Bypass)

passed without inspection

Note that traffic is interrupted briefly at two points:

- At the beginning of the update process as link goes down and up (flaps) and the network card switches into hardware bypass.

- After the update finishes as link flaps and the network card switches out of bypass. Inspection resumes after the endpoints reconnect and reestablish link with the device interfaces.

The hardware bypass option is not supported on nonbypass network modules on Firepower 8000 series devices, or SFP transceivers on Firepower 7000 series.

inline with optional hardware bypass module, bypass disabled (Bypass Mode: Non‑Bypass)

dropped

7000 and 8000 Series

NGIPSv

inline with no hardware bypass module

dropped

inline in tap mode

egress packet immediately, copy not inspected

passive

uninterrupted, not inspected

routed, switched

dropped

ASA FirePOWER

routed or transparent, fail-open (Permit Traffic)

passed without inspection

(requires the latest supported ASA OS version; otherwise, traffic dropped)

routed or transparent, fail-close (Close Traffic)

dropped

Caution

Upgrading an inter-chassis cluster to Version 6.2.0.1, Version 6.2.0.2, or Version 6.2.0.3 can cause a 2-3 second traffic interruption when each module is removed from the cluster.

Caution

Rebooting the ASA FirePOWER module on an ASA 5585-X, including a reboot that occurs during a module upgrade, causes traffic to drop for up to thirty seconds on the interfaces on the ASA FirePOWER hardware module while the module reboots.

Traffic Behavior When Updating FXOS on Clustered Firepower Threat Defense Devices

Updating FXOS reboots the chassis, which can affect traffic in a clustered environment until at least one module comes online. Whether and how traffic is affected depends on the cluster type:

- Intra-chassis cluster—Traffic drops if the cluster does not use an optional hardware bypass (fail‑to‑wire) module or if bypass is disabled. Traffic passes without inspection if bypass is enabled.

- Inter-chassis cluster—Traffic drops during the overlap if multiple chassis reboots overlap before at least one module comes online. Traffic is unaffected if there is no reboot overlap.

For example, there would be no reboot overlap, and no dropped traffic, if you complete the FXOS update first on one chassis and then on another. Depending on when each update is initiated, there could be reboot overlap (and dropped traffic) if you update multiple chassis simultaneously.

The following table summarizes this behavior.

Traffic Behavior During an FXOS Update of Clustered Firepower Threat Defense Devices

Device Model

Deployment

Traffic Behavior

Firepower 9300

Intra-chassis cluster without optional hardware bypass module

Dropped

Intra-chassis cluster with optional hardware bypass module, bypass disabled

Dropped

Intra-chassis cluster with optional hardware bypass module, bypass enabled

Passed without inspection

Firepower 9300

Firepower 4100 Series

Inter-chassis cluster with no reboot overlap

Unaffected

Inter-chassis cluster with reboot overlap before at least one module comes online

Dropped

Traffic Behavior During Configuration Deployment

During the upgrade process, you deploy configurations either twice (standalone devices) or three times (devices managed by the Firepower Management Center). When you deploy, resource demands may result in a small number of packets dropping without inspection. In most cases, the deployment immediately after the upgrade restarts the Snort process. During subsequent deployments, the Snort process restarts only if, before deploying, you modify specific policy or device configurations that always restart the process when deployed.

The following table describes how different devices handle traffic during Snort process restarts.

Restart Traffic Effects by Managed Device Model

Device Model

Interface Configuration

Restart Traffic Behavior

Firepower Threat Defense, Firepower Threat Defense Virtual

Inline, Snort Fail Open: Down: disabled

Dropped

Inline, Snort Fail Open: Down: enabled

Passed without inspection

Routed, transparent (including EtherChannel, redundant, subinterface)

CLI command: configure snort preserve-connection enable (default); this functionality requires Version 6.2.0.2 or a subsequent 6.2.0.x patch

Existing flows: passed without inspection

New flows: dropped

Routed, transparent (including EtherChannel, redundant, subinterface)

CLI command, Version 6.2.0.2 or a subsequent 6.2.0.x patch: configure snort preserve-connection disable

Dropped

Inline, tap mode

Egress packet immediately, copy bypasses Snort

Passive

Uninterrupted, not inspected

7000 and 8000 Series, NGIPSv

Inline, Failsafe enabled or disabled

Passed without inspection

A few packets might drop if Failsafe is disabled and Snort is busy but not down.

Inline, tap mode

Egress packet immediately, copy bypasses Snort

Passive

Uninterrupted, not inspected

7000 and 8000 Series

Routed, switched, transparent

Dropped

ASA FirePOWER

Routed or transparent with fail-open (Permit Traffic)

Passed without inspection

Routed or transparent with fail-close (Close Traffic)

Dropped

Patch or Hotfix for New Dynamic Analysis CA Certificate

Deployments: AMP for Networks (malware detection) deployments where you submit files for dynamic analysis

Upgrading from: A patched/hotfixed system with new CA certificates

Directly to: Version 6.2 through 6.2.3

On June 15, 2018, some Firepower deployments stopped being able to submit files for dynamic analysis. This occurred due to an expired CA certificate that was required for communications with the AMP Threat Grid cloud. In Version 6.1+ deployments, you can obtain a new certificate with a patch or hotfix. For earlier versions, you must upgrade to at least Version 6.1, then patch or hotfix.

If you already patched or hotfixed your deployment, upgrading to a later major version (Version 6.2 through 6.2.3) reverts to the old certificate and disables dynamic analysis. You must patch or hotfix again.

Note

If this is your first time installing the patch or hotfix, make sure your firewall allows outbound connections to fmc.api.threatgrid.com (replacing panacea.threatgrid.com) from both the FMC and its managed devices. Managed devices submit files to the cloud for dynamic analysis; the FMC queries for results.

The following table lists the patches and hotfixes that contain the new certificates, for each major version sequence and platform. Patches and hotfixes are available on the Cisco Support & Download site. For release notes, see Firepower Release Notes.

Patches and Hotfixes with New CA Certificates

Versions with Old Cert

First Patch with New Cert

Hotfix with New Cert

6.2.3 through 6.2.3.3

6.2.3.4

Hotfix G

FTD devices

Hotfix H

FMC, NGIPS devices

6.2.2 through 6.2.2.3

6.2.2.4

Hotfix BN

All platforms

6.2.1

None. You must upgrade.

None. You must upgrade.

6.2.0 through 6.2.0.5

6.2.0.6

Hotfix BX

FTD devices

Hotfix BW

FMC, NGIPS devices

6.1.0 through 6.1.0.6

6.1.0.7

Hotfix EM

All platforms

6.0.x

None. You must upgrade.

None. You must upgrade.

Version 6.2.0.6 Time and Disk Space

Platform

Space on /

Space on /Volume

Space on FMC

Time

FMC

104 MB

8547 MB

—

From 6.2.0: 97 min

From 6.2.0.5: 36 min

FMCv

30 MB

8543 MB

—

Hardware dependent

Firepower 9300 chassis

4085 MB

4085 MB

789 MB

From 6.2.0: 23 min

From 6.2.0.5: 13 min

FTDv

226 MB

4526 MB

918 MB

Hardware dependent

ASA 5500-X series with FTD

227 MB

4960 MB

918 MB

From 6.2.0: 56 min

From 6.2.0.5:27 min

Firepower 7000/8000 series

29 MB

7464 MB

944 MB

From 6.2.0: 60 min

From 6.2.0.5: 24 min

ASA FirePOWER

28 MB

7191 MB

878 MB

From 6.2.0: 75 min

From 6.2.0.5: 49 min

NGIPSv

29 MB

1658 MB

284 MB

Hardware dependent

Version 6.2.0.5 Time and Disk Space

The following table provides disk space and time guidelines for the update. Note that when you use the Firepower Management Center to update a managed device, the Firepower Management Center requires additional disk space on its /Volume partition.

Caution

Do not reboot or shut down your appliance during the update until you see the login prompt. The system may appear inactive during the prechecks; this is expected behavior and does not require you to reboot or shut down your appliance.

Note

The following guidelines do not include the time required to complete the readiness check. For more information about the readiness check, see Preupdate Readiness Checks.

If you encounter issues with the progress of your update, contact Cisco TAC.

Time and Disk Space Requirements

Appliance

Space on /

Space on /Volume

Space on /Volume on Manager

Time to Update From Version 6.2.0

Time to Update from Version 6.2.0.4

Firepower Management Center

179.908 MB

6008.8 MB

–

1 hour 12 minutes

34 minutes

Firepower Management Center Virtual

19.648 MB

6942.728 MB

–

hardware dependent

7000 and 8000 Series managed device

17.104 MB

5805.964 MB

693 MB

51 minutes

18 minutes

NGIPSv device

17.444 MB

1300.334 MB

211 MB

hardware dependent

ASA FirePOWER module

15.628 MB

5944.352 MB

703 MB

1 hour 6 minutes

27 minutes

Cisco ASA with Firepower Threat Defense

134.228 MB

4315.904MB

548 MB

46 minutes

22 minutes

Firepower 9300 appliance running Firepower Threat Defense

3008.86 MB

3008.86 MB

441 MB

28 minutes

16 minutes

Firepower 4100 series security appliance running Firepower Threat Defense

3008.86 MB

3008.86 MB

441 MB

28 minutes

16 minutes

Firepower Threat Defense Virtual device

134.436 MB

2804.828 MB

548 MB

hardware dependent

Version 6.2.0.4 Time and Disk Space

The following table provides disk space and time guidelines for the update. Note that when you use the Firepower Management Center to update a managed device, the Firepower Management Center requires additional disk space on its /Volume partition.

Caution

Do not reboot or shut down your appliance during the update until you see the login prompt. The system may appear inactive during the prechecks; this is expected behavior and does not require you to reboot or shut down your appliance.

Note

The following guidelines do not include the time required to complete the readiness check. For more information about the readiness check, see Preupdate Readiness Checks.

If you encounter issues with the progress of your update, contact Cisco TAC.

Time and Disk Space Requirements

Appliance

Space on /

Space on /Volume

Space on /Volume on Manager

Time to Update From Version 6.2.0

Time to Update from Version 6.2.0.3

Firepower Management Center

166.884 MB

5270.372 MB

–

1 hour 24 minutes

50 minutes

Firepower Management Center Virtual

19.516 MB

5345.924 MB

–

hardware dependent

7000 and 8000 Series managed device

17.104 MB

4613.548 MB

608 MB

45 minutes

17 minutes

NGIPSv device

17.516 MB

1066.92 MB

208 MB

hardware dependent

ASA FirePOWER module

15.636 MB

4584.264 MB

597 MB

3 hours 34 minutes

1 hour 23 minutes

Cisco ASA with Firepower Threat Defense

133.776 MB

3592.632 MB

448 MB

2 hours 28 minutes

1 hour 9 minutes

Firepower 9300 appliance running Firepower Threat Defense

1827.372 MB

1827.372 MB

325 MB

23 minutes

12 minutes

Firepower 4100 series security appliance running Firepower Threat Defense

1827.372 MB

1827.372 MB

325 MB

23 minutes

12 minutes

Firepower Threat Defense Virtual device

135.212 MB

274.3712 MB

448 MB

hardware dependent

Version 6.2.0.3 Time and Disk Space

The following table provides disk space and time guidelines for the update. Note that when you use the Firepower Management Center to update a managed device, the Firepower Management Center requires additional disk space on its /Volume partition.

Caution

Do not reboot or shut down your appliance during the update until you see the login prompt. The system may appear inactive during the prechecks; this is expected behavior and does not require you to reboot or shut down your appliance.

Note

The following guidelines do not include the time required to complete the readiness check. For more information about the readiness check, see Preupdate Readiness Checks.

If you encounter issues with the progress of your update, contact Cisco TAC.

Time and Disk Space Requirements

Appliance

Space on /

Space on /Volume

Space on /Volume on Manager

Time to Update From Version 6.2.0

Time to Update from Version 6.2.0.2

Firepower Management Center

18 MB

3352 MB

–

75 minutes

37 minutes

Firepower Management Center Virtual

19 MB

3342 MB

–

hardware dependent

7000 and 8000 Series managed device

17 MB

3526 MB

554 MB

38 minutes

19 minutes

NGIPSv device

17 MB

842 MB

202 MB

hardware dependent

ASA FirePOWER module

3361 MB

15 MB

521 MB

3 hours

97 minutes

Cisco ASA with Firepower Threat Defense

2302 MB

131 MB

384 MB

118 minutes

76 minutes

Firepower 9300 appliance running Firepower Threat Defense

1355 MB

—

319 MB

18 minutes

12 minutes

Firepower 4100 series security appliance running Firepower Threat Defense

1361

—

319 MB

20 minutes

12 minutes

Firepower Threat Defense Virtual device

17 MB

842 MB

384 MB

hardware dependent

Version 6.2.0.2 Time and Disk Space

The following table provides disk space and time guidelines for the update. Note that when you use the Firepower Management Center to update a managed device, the Firepower Management Center requires additional disk space on its /Volume partition.

Caution

Do not reboot or shut down your appliance during the update until you see the login prompt. The system may appear inactive during the prechecks; this is expected behavior and does not require you to reboot or shut down your appliance.

Note

The following guidelines do not include the time required to complete the readiness check. For more information about the readiness check, see Preupdate Readiness Checks.

If you encounter issues with the progress of your update, contact Cisco TAC.

Time and Disk Space Requirements

Appliance

Space on /

Space on /Volume

Space on /Volume on Manager

Time to Update From Version 6.2.0

Time to Update from Version 6.2.0.1

Firepower Management Center

35 MB

1665 MB

–

36 minutes

30 minutes

Firepower Management Center Virtual

21 MB

2834 MB

–

hardware dependent

7000 and 8000 Series managed device

17 MB

2110 MB

458 MB

54 minutes

35 minutes

NGIPSv device

19 MB

612 MB

195 MB

hardware dependent

ASA FirePOWER module

17 MB

2014 MB

383 MB

40 minutes

80 minutes

Cisco ASA with Firepower Threat Defense

144 MB

1808 MB

295 MB

95 minutes

59 minutes

Firepower 9300 appliance or Firepower 4100 series security appliance running Firepower Threat Defense

1060 MB

1060 MB

274 MB

12 minutes

9 minutes

Firepower Threat Defense Virtual device

143 MB

998 MB

295 MB

hardware dependent

Version 6.2.0.1 Time and Disk Space

The following table provides disk space and time guidelines for the update. Note that when you use the Firepower Management Center to update a managed device, the Firepower Management Center requires additional disk space on its /Volume partition.

Caution

Do not reboot or shut down your appliance during the update until you see the login prompt. The system may appear inactive during the prechecks; this is expected behavior and does not require you to reboot or shut down your appliance.

Note

The following guidelines do not include the time required to complete the readiness check. For more information about the readiness check, see Preupdate Readiness Checks.

If you encounter issues with the progress of your update, contact Cisco TAC.

Time and Disk Space Requirements

Appliance

Space on /

Space on /Volume

Space on /Volume on Manager

Time to Update From Version 6.2.0

Firepower Management Center

49.5 MB

1236.9 MB

–

28 minutes

Firepower Management Center Virtual

22.8 MB

1488 MB

–

hardware dependent

7000 and 8000 Series managed device

17.32 MB

1134 MB

184.4 MB

22 minutes

NGIPSv device

18.80 MB

720.8 MB

97.6 MB

hardware dependent

ASA FirePOWER module

16.78 MB

96.17 MB

205.8 MB

69 minutes

Cisco ASA with Firepower Threat Defense

143.33 MB

944.8 MB

158.2 MB

62 minutes

Firepower 9300 appliance or Firepower 4100 series security appliance running Firepower Threat Defense

524 MB

524 MB

136.8 MB

12 minutes

Firepower Threat Defense Virtual device

9.6 MB

143.6 MB

158.2 MB

hardware dependent

Post Update Tasks

After you perform the update on the Firepower Management Center or managed devices, you must deploy configuration changes to the devices.

Note

You must deploy configuration changes first after updating the Firepower Management Center and then again after updating its managed devices.

When you deploy configuration changes, resource demands may result in a small number of packets dropping without inspection. Additionally, deploying some configurations requires the Snort process to restart, which temporarily interrupting traffic inspection. Whether traffic drops during this interruption or passes without further inspection depends how the managed device handles traffic. For more information, see the Firepower Management Center Configuration Guide.

There are several additional post update steps you should take to ensure that your deployment is performing properly, which include the following include:

- Verify that the update succeeded.

- Make sure that all appliances in your deployment are communicating successfully.

- Update your intrusion rules and vulnerability database (VDB) and deploy configuration changes. (See the Firepower Management Center Configuration Guide for details.)

- Make configuration changes based on new features and functionality.

- Redeploy policies and configuration.

Chapter 9. Update to Version 6.2.0.x

Note

Updates can require large data transfers from the Firepower Management Center to managed devices. Before you begin, make sure your management network has sufficient bandwidth to successfully perform the transfer. See the Troubleshooting Tech Note at https://www.cisco.com/c/en/us/support/docs/security/firepower-management-center/212043-Guidelines-for-Downloading-Data-from-the.html.

Note

Devices running Version 6.2.0.1, Version 6.2.0.2, Version 6.2.0.3, Version 6.2.0.4, and Version 6.2.0.5 that are configured for Threat Grid integration may be unable to pull reports from Threat Grid or submit files manually for analysis, per CSCvj07038. See Patch or Hotfix for New Dynamic Analysis CA Certificate for more information.

Before you begin the update, you must thoroughly read and understand these release notes, especially Important Update Notes and Preupdate Readiness Checks.

- Update Procedures Listed by Platform

- Update Firepower Management Centers and Firepower Management Centers Virtual

- Update Firepower Threat Defense Devices Using the Firepower Management Center

- Update Firepower Threat Defense Devices with the Firepower Device Manager

- Update 7000 and 8000 Series Devices, NGIPSv, and ASA FirePOWER Modules Using the Firepower Management Center

- Update ASA FirePOWER Modules Managed with ASDM

Update Procedures Listed by Platform

If you want to update:

See:

Firepower Management Centers: MC750, MC1000, MC1500, MC2000, MC2500, MC3500, MC4000, MC4500

Update Firepower Management Centers and Firepower Management Centers Virtual

Firepower Management Center Virtual

7000 and 8000 Series devices: 7010, 7020, 7030, 7050, 7110, 7115, 7120, 7125, 8120, 8130, 8140, 8250, 8260, 8270, 8290, 8350, 8360, 8370, 8390, AMP7150, AMP8050, AMP8150, AMP8350, AMP8360, AMP8370, AMP8390

Update 7000 and 8000 Series Devices, NGIPSv, and ASA FirePOWER Modules Using the Firepower Management Center

NGIPSv (virtual managed devices)

Cisco ASA with FirePOWER Services: ASA 5506-X, ASA 5506H-X, ASA 5506W-X, ASA 5508-X, ASA 5512-X, ASA 5515-X, ASA 5516-X, ASA 5525-X, ASA 5545-X, ASA 5555-X, ASA 5585-X-SSP-10, ASA 5585-X-SSP-20, ASA 5585-X-SSP-40, ASA 5585-X-SSP-60

If managing with the Firepower Management Center:

Update 7000 and 8000 Series Devices, NGIPSv, and ASA FirePOWER Modules Using the Firepower Management Center

If managing with ASDM:

Update ASA FirePOWER Modules Managed with ASDM

Cisco ASA with Firepower Threat Defense: ASA 5506-X, ASA 5506H-X, ASA 5506W-X, ASA 5508-X, ASA 5512-X, ASA 5515-X, ASA 5516-X, ASA 5525-X, ASA 5545-X, ASA 5555-X

If managing with the Firepower Management Center:

Update Firepower Threat Defense Devices Using the Firepower Management Center

If managing with Firepower Device Manager:

Update Firepower Threat Defense Devices with the Firepower Device Manager

Firepower 9300 with Firepower Threat Defense (with SM-24, SM-36, or SM-44 security modules)

Update Firepower Threat Defense Devices Using the Firepower Management Center

Firepower 4100 series with Firepower Threat Defense: Firepower 4110, Firepower 4120, Firepower 4140, Firepower 4150

Firepower Threat Defense Virtual

Update Firepower Management Centers and Firepower Management Centers Virtual

Use the procedure in this section to update your Firepower Management Centers and Firepower Management Center Virtuals.

If your appliance is in a high availability configuration, see Update Sequence Guidelines.

Note

After you update to Version 6.2.0.3, you must apply Hotfix BH. If you do not apply Hotfix BH, you cannot edit or deploy access control rules.

Caution

Do not reboot or shut down your appliance during the update until you see the login prompt. The system may appear inactive during the prechecks; this is expected behavior and does not require you to reboot or shut down your appliance.

Procedure

Step 1

If you want to update Firepower Management Centers in a high availability pair, see Update Sequence for Firepower Management Centers in High Availability.

Step 2

Update to the minimum version as described in Update Paths to Version 6.2.0.x.

Step 3

Read these release notes and complete any preupdate tasks. For more information, see the following sections:

- Product Compatibility in Version 6.2.0.x

- Important Update Notes

Step 4

Download the update from the Support site:

- For Firepower Management Center (MC750, MC1000, MC1500, MC2000, MC 2500, MC3500, MC4000, MC4500) and Firepower Management Center Virtual:
Sourcefire_3D_Defense_Center_S3_Patch-6.2.0.x-xxx.sh

Note

Download the update package directly from the Support site. If you transfer an update file by email, it may become corrupted.

Step 5

Upload the update to the Firepower Management Center by choosing System > Updates, then clicking Upload Update on the Product Updates tab. Browse to the update and click Upload.

The update is uploaded to the Firepower Management Center. The web interface shows the type of update you uploaded, its version number, and the date and time it was generated.

Step 6

Redeploy configuration changes to any managed devices. Otherwise, the eventual update of the managed devices may fail.

When you deploy before updating the Firepower Management Center, resource demands may result in a small number of packets dropping without inspection. Additionally, deploying some configurations restarts the Snort process, which interrupts traffic inspection. Whether traffic drops during this interruption or passes without further inspection depends on how the device handles traffic. For more information, see Configurations that Restart the Snort Process When Deployed or Activated and Snort® Restart Traffic Behavior in the Firepower Management Center Configuration Guide, Version 6.2.0.

Step 7

(Optional) Run a readiness check on the Firepower Management Center as described in Run a Readiness Check through the Shell and Run a Readiness Check through the Firepower Management Center Web Interface.

Caution

If you encounter issues with the readiness check that you cannot resolve, do not begin the update. Instead, contact Cisco TAC.

Step 8

Make sure that the appliances in your deployment are successfully communicating and that there are no issues reported by the health monitor.

Step 9

Click the System Status icon and view the Tasks tab in the Message Center to make sure that there are no tasks in progress.

You must wait until any long-running tasks are complete before you begin the update. Tasks that are running when the update begins are stopped, become failed tasks, and cannot be resumed; you must manually delete them from the Tasks tab after the update finishes.

Step 10

On the System > Updates window, click the install icon next to the update you are installing.

Step 11

Choose the Firepower Management Center and click Install. Confirm that you want to install the update and reboot the Firepower Management Center.

The update process begins. You can begin monitoring the update’s progress in the Tasks tab of the Message Center. However, after the Firepower Management Center finishes its necessary pre-update checks, you are logged out. When you log back in, the Upgrade Status page appears. The Upgrade Status window displays a progress bar and provides details about the script currently running. Click show log for current script to see the update log.

If the update fails for any reason, the page displays an error message indicating the time and date of the failure, which script was running when the update failed, and instructions on how to contact Cisco TAC. Do not restart the update.

Caution

If you encounter any other issue with the update (for example, if a manual refresh of the Update Status page shows no progress for several minutes), do not restart the update. Instead, contact Cisco TAC.

When the update finishes, the Firepower Management Center displays a success message and reboots.

Step 12

After the update finishes, clear your browser cache and relaunch the browser. Otherwise, the user interface may exhibit unexpected behavior.

Step 13

Log into the Firepower Management Center.

Step 14

Choose Help > About and confirm that the software version is listed correctly: Version 6.2.0.x. Also note the versions of the intrusion rule update and VDB on the Firepower Management Center; you will need this information later.

Step 15

Verify that the appliances in your deployment are successfully communicating and that there are no issues reported by the health monitor.

Step 16

If the intrusion rule update available on the Support site is newer than the rule set on your Firepower Management Center, import the newer rule set. Do not autoapply the imported rules when working with Version 6.2.0.x.

For information on intrusion rule updates, see the Firepower Management Center Configuration Guide.

Step 17

If the VDB available on the Support site is newer than the VDB installed during the update, install the latest VDB. Do not autodeploy VDB updates when working with Version 6.2.0.x.

Installing a VDB update restarts the Snort process when you deploy configuration changes, temporarily interrupting traffic inspection. Whether traffic drops during this interruption or passes without further inspection depends how the managed device handles traffic. For more information, see the Firepower Management Center Configuration Guide.

Step 18

Redeploy policies to all managed devices.

Click Deploy and choose all available devices, then click Deploy.

Note

You must redeploy configuration changes before updating any managed devices or you may have to reimage your appliances.

In most cases, deploying for the first time after you update the Firepower Management Center restarts the Snort process, which interrupts traffic inspection. Whether traffic drops during this interruption or passes without further inspection depends on how the device handles traffic. For more information, see Snort® Restart Traffic Behavior in the Firepower Management Center Configuration Guide.

Step 19

If a later patch is available on the Support site, update to the latest patch as described in the Firepower Release Notes roadmap for that version. You must update to the latest patch to take advantage of product enhancements and security fixes.

Step 20

If you updated Firepower Management Centers in a high availability pair, see Update Sequence for Firepower Management Centers in High Availability

Update Firepower Threat Defense Devices Using the Firepower Management Center

Use this procedure to update Firepower Threat Defense devices running at least Version 6.2.0. A Firepower Management Center must be running at least Version 6.2.0 to update Firepower Threat Defense devices to Version 6.2.0.x.

You can autodownload files for Firepower Threat Defense devices managed by the Firepower Management Center. You can update multiple devices at once but only if they use the same update file.

If your appliance is in a high availability or clustered configuration, see the Update Sequence Guidelines.

Note

You cannot update an ASA with FirePOWER Services device directly to Firepower Threat Defense. For more information, see the Update vs. Reimage vs. Deploy section of the Firepower Release Notes Version 6.2.0.

For devices running or hosted on a non-Firepower appliance (for example, ASA OS or FXOS), resolving an issue may require that you update the operating system in addition to Firepower. We recommend you update to the latest supported version.

Note

Switching the management of a Firepower Threat Defense device resets device configuration to system default settings. If you need to switch the management of a Firepower Threat Defense device from the Firepower Management Center to a Firepower Device Manager, execute the configure manager local CLI command and register the Firepower Threat Defense device to a Firepower Management Center. Note that switching the management of a Firepower Threat Defense device resets device configuration to system default settings. For more information, see the Firepower Threat Defense Command Reference Guide.

Caution

Do not reboot or shut down your appliance during the update until you see the login prompt. The system may appear inactive during the prechecks; this is expected behavior and does not require you to reboot or shut down your appliance.

Procedure

Step 1

Update to the minimum version as described in Update Paths to Version 6.2.0.x.

Step 2

Read these release notes and complete any preupdate tasks. For more information, see the following sections:

- Product Compatibility in Version 6.2.0.x

- Important Update Notes

Step 3

Update the software on the device’s managing Firepower Management Center; see Update Firepower Management Centers and Firepower Management Centers Virtual.

Step 4

Use the managing Firepower Management Center to deploy configuration changes to the managed devices. Otherwise, the eventual update may fail.

In most cases, deploying for the first time after you update the Firepower Management Center restarts the Snort process, which interrupts traffic inspection. Whether traffic drops during this interruption or passes without further inspection depends on how the device handles traffic. For more information, see Snort® Restart Traffic Behavior in the Firepower Management Center Configuration Guide.

Step 5

If you are updating a Firepower 9300 appliance or Firepower 4100 series, update to the latest supported FXOS version as described in the Cisco FXOS release notes. See the FXOS release notes landing page, the FXOS Compatibility Guide, and the Firepower Compatibility Guide for more information. If a Firepower 9300 appliance or a Firepower 4100 series device is in a high availability pair, you must update the standby device’s FXOS chassis manager before updating the Firepower software. See Update Sequence for Firepower Management Centers in High Availability for more information.

Updating to FXOS Version 2.0.1 or later causes an expected disruption in traffic. Updating FXOS also reboots the chassis, which drops traffic or passes it uninspected in an intra-chassis cluster depending on whether the cluster uses an enabled hardware bypass module, and drops traffic in an inter-chassis cluster only if chassis reboots overlap before at least one module comes online.

Step 6

Download the update from the Support site:

- For Firepower Threat Defense running on the ASA 5506-X, ASA 5506H-X, ASA 5506W-X, ASA 5508-X, ASA 5512-X, ASA 5515-X, ASA 5516-X, ASA 5525-X, ASA 5545-X, ASA 5555-X, or any supported virtual platform (VMware, AWS, KVM, Microsoft Azure):

Cisco_FTD_Patch-6.2.0.x-xxx.sh

- For Firepower Threat Defense running on the Firepower 4110, Firepower 4120, Firepower 4140, Firepower 4150, Firepower 9300 appliance, and Firepower Threat Defense Virtual:

Cisco_FTD_SSP_Patch-6.2.0.x-xxx.sh

Note

Download the update package directly from the Support site. If you transfer an update file by email, it may become corrupted.

Step 7

Upload the update to the Firepower Management Center by choosing System > Updates, then clicking Upload Update on the Product Updates tab. Browse to the update and click Upload.

The update is uploaded to the Firepower Management Center. The web UI shows the type of update you uploaded, its version number, and the date and time it was generated. The page also indicates whether a reboot is required as part of the update.

Step 8

(Optionally) Run a readiness check on the Firepower Threat Defense device as described in Run a Readiness Check through the Shell and Run a Readiness Check through the Firepower Management Center Web Interface.

Caution

If you encounter issues with the readiness check that you cannot resolve, do not begin the update. Instead, contact Cisco TAC.

Step 9

Make sure that the appliances in your deployment are successfully communicating and that there are no issues reported by the health monitor.

Step 10

On the System > Updates window, click the install icon next to the update you are installing.

Step 11

Choose the devices on which you want to install the update.

Step 12

Click Install. Confirm that you want to install the update and reboot the devices.

The update process begins. You can monitor the update's progress on the Tasks tab of the Message Center.
Note that managed devices may reboot twice during the update; this is expected behavior.

Caution

If you encounter issues with the update (for example, if messages in the Tasks tab of the Message Center show no progress for several minutes or indicate that the update has failed), do not restart the update. Instead, contact Cisco TAC.

Step 13

After the update process finishes, choose Devices > Device Management and confirm that the devices you updated have the correct software version.

Step 14

Verify that the appliances in your deployment are successfully communicating and that there are no issues reported by the health monitor.

Step 15

Redeploy policies to all managed devices.

Click Deploy and choose all available devices, then click Deploy.

When you deploy for the first time after updating a device, resource demands may result in a small number of packets dropping without inspection. The deploy does not otherwise interrupt traffic inspection unless, since the previous deploy, you have modified specific policy or device configurations that always restart the Snort process when you deploy them. If you have modified any of these configurations, traffic drops or passes without further inspection during the restart depending on how the device handles traffic.

For more information, see Configurations that Restart the Snort Process When Deployed or Activated and Snort® Restart Traffic Behavior in the Firepower Management Center Configuration Guide, Version 6.2.0.

Step 16

If a later patch is available on the Support site, update to the latest patch as described in the Firepower Release Notes for that version. You must update to the latest patch to take advantage of product enhancements and security fixes.

Update Firepower Threat Defense Devices with the Firepower Device Manager

Procedure

Step 1

Download the update from the Support site:

- For Firepower Threat Defense running on the ASA 5506-X, ASA 5506H-X, ASA 5506W-X, ASA 5508-X, ASA 5512-X, ASA 5515-X, ASA 5516-X, ASA 5525-X, ASA 5545-X, ASA 5555-X:

Cisco_FTD_Patch-6.2.0.x-xxx.sh

Step 2

Follow instructions for updating as described in the System Management topic in the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager.

Update 7000 and 8000 Series Devices, NGIPSv, and ASA FirePOWER Modules Using the Firepower Management Center

Use this procedure to update 7000 and 8000 Series devices, NGIPSv virtual managed devices, and ASA FirePOWER modules running at least Version 6.2.0. A Firepower Management Center must be running at least Version 6.2.0 to update these devices to Version 6.2.0.x.

You can update multiple devices at once but only if they use the same update file.

If your appliance is in a high availability or stacked configuration, see Update Sequence Guidelines.

Note

If you are locally managing the ASA FirePOWER module through ASDM, do not update the ASA FirePOWER module using the Firepower Management Center. For more information, see Update ASA FirePOWER Modules Managed with ASDM.

Caution

Do not reboot or shut down your appliance during the update until you see the login prompt. The system may appear inactive during the prechecks; this is expected behavior and does not require you to reboot or shut down your appliance.

For devices running or hosted on a non-Firepower appliance (for example, ASA OS or FXOS), resolving an issue may require that you update the operating system in addition to Firepower. We recommend you update to the latest supported version.

Procedure

Step 1

Update to the minimum version as described in Update Paths to Version 6.2.0.x.

Step 2

Read these release notes and complete any preupdate tasks. For more information, see the following sections:

- Product Compatibility in Version 6.2.0.x

- Important Update Notes

Step 3

Update the software on the device’s managing Firepower Management Center; see Update Firepower Management Centers and Firepower Management Centers Virtual.

Step 4

Use the managing Firepower Management Center to deploy configuration changes to the managed devices. Otherwise, the eventual update may fail.

In most cases, deploying for the first time after you update the Firepower Management Center restarts the Snort process, which interrupts traffic inspection. Whether traffic drops during this interruption or passes without further inspection depends on how the device handles traffic. For more information, see Snort® Restart Traffic Behavior in the Firepower Management Center Configuration Guide, Version 6.2.0..

Step 5

If you are updating an ASA device, update to the latest supported ASA version as described in the notes for that ASA release. For more information see the ASA/ASDM Release Notes landing page, Cisco ASA Compatibility matrix, and the Firepower Compatibility Guide.

Step 6

Download the update from the Support site:

- For 7000 and 8000 Series:

Sourcefire_3D_Device_S3_Patch-6.2.0.x-xxx.sh

- For NGIPSv:

Sourcefire_3D_Device_Virtual64_VMware_Patch-6.2.0.x-xxx.sh

- For ASA with FirePOWER Services running on the ASA 5506-X, ASA 5506H-X, ASA 5506W-X, ASA 5508-X, ASA 5512-X, ASA 5515-X, ASA 5516-X, ASA 5525-X, ASA 5545-X, ASA 5555-X, ASA 5585-X-SSP-10, ASA 5585-X-SSP-20, ASA 5585-X-SSP-40, and ASA 5585-X-SSP-60:

Cisco_Network_Sensor_Patch-6.2.0.x-xxx.sh

Note

Download the update package directly from the Support site. If you transfer an update file by email, it may become corrupted.

Step 7

(Optionally) Run a readiness check on the device as described in Run a Readiness Check through the Shell and Run a Readiness Check through the Firepower Management Center Web Interface.

Caution

If you encounter issues with the readiness check that you cannot resolve, do not begin the update. Instead, contact Cisco TAC.

Step 8

Make sure that the appliances in your deployment are successfully communicating and that there are no issues reported by the health monitor.

Step 9

On the System > Updates window, click the install icon next to the update you are installing.

Step 10

Choose the devices where you want to install the update.

If you are updating stacked 7000 and 8000 Series devices, choosing one member of the stack automatically chooses the other devices in the stack. You must update members of a stack together.

Step 11

Click Install. Confirm that you want to install the update and reboot the devices.

The update process begins. You can monitor the update's progress on the Tasks tab of the Message Center.
Note that managed devices may reboot twice during the update; this is expected behavior.

Caution

If you encounter issues with the update (for example, if messages in the Tasks tab of the Message Center show no progress for several minutes or indicate that the update has failed), do not restart the update. Instead, contact Cisco TAC.

Step 12

After the update process finishes, choose Devices > Device Management and confirm that the devices you updated have the correct software version.

Step 13

Verify that the appliances in your deployment are successfully communicating and that there are no issues reported by the health monitor.

Step 14

Redeploy policies to all managed devices.

Click Deploy and choose all available devices, then click Deploy.

When you deploy for the first time after updating a device, resource demands may result in a small number of packets dropping without inspection. The deploy does not otherwise interrupt traffic inspection unless, since the previous deploy, you have modified specific policy or device configurations that always restart the Snort process when you deploy them. If you have modified any of these configurations, traffic drops or passes without further inspection during the restart depending on how the device handles traffic. For more information, see Configurations that Restart the Snort Process When Deployed or Activated and Snort® Restart Traffic Behavior in the Firepower Management Center Configuration Guide, Version 6.2.0.

Update ASA FirePOWER Modules Managed with ASDM

Use this procedure to update ASA FirePOWER modules using ASDM running at least Version 6.2.0. Locally managed ASA FirePOWER modules managed with ASDM do not require Firepower Management Centers to update.

For devices running or hosted on a non Firepower appliance (for example, ASA OS or FXOS), resolving an issue may require that you update the operating system in addition to Firepower. We recommend you update to the latest supported version.

Procedure

Step 1

Update to the minimum version as described in Update Paths to Version 6.2.0.x.

Step 2

Read these release notes and complete any preupdate tasks. For more information, see the following sections:

- Product Compatibility in Version 6.2.0.x

- Important Update Notes

Step 3

If you are updating an ASA device, update to the latest supported ASA version as described in the notes for that ASA release. For more information see the ASA/ASDM Release Notes landing page, Cisco ASA Compatibility matrix, and the Firepower Compatibility Guide.

Step 4

Download the update from the Support site:

Cisco_Network_Sensor_Patch-6.2.0.x-xxx.sh

Note

Download the update package directly from the Support site. If you transfer an update file by email, it may become corrupted.

Step 5

Deploy configuration changes. Otherwise, the eventual update may fail.

Step 6

Choose Configuration > ASA FirePOWER Configuration > Updates.

Step 7

Click Upload Update.

Step 8

Click Choose File to navigate to and choose the update.

Step 9

Click Upload.

Step 10

Choose Monitoring > ASA FirePOWER Monitoring > Task Status to view the task queue and make sure that there are no jobs in process.

Tasks that are running when the update begins are stopped and cannot be resumed; you must manually delete them from the task queue after the update finishes. The task queue automatically refreshes every 10 seconds. You must wait until any long-running tasks are complete before you begin the update.

Step 11

Choose Configuration > ASA FirePOWER Configuration > Updates.

Step 12

Click the install icon next to the update you uploaded.

The update process begins. You can begin monitoring the update’s progress in the task queue.

Step 13

After the update finishes, reconnect ASDM to the ASA device as described in the ASA Firepower Module Quick Start Guide.

Step 14

Access the ASA FirePOWER module interface and refresh the window. Otherwise, the interface may exhibit unexpected behavior.

Step 15

If the intrusion rule update available on the Support site is newer than the rule set on your ASA FirePOWER module, import the newer rule set. Do not autoapply the imported rules when working with Version 6.2.0.x.

Step 16

If the VDB available on the Support site is newer than the VDB installed during the update, install the latest VDB. Do not autodeploy VDB updates when working with Version 6.2.0.x.

Installing a VDB update causes a short pause in traffic flow and processing, and may also cause a few packets to pass uninspected. For more information, see the Cisco ASA with FirePOWER Services Local Management Configuration Guide.

Step 17

Deploy configuration changes.

Deploying may cause a short pause in traffic flow and processing, and may also cause a few packets to pass uninspected. For more information, see the Cisco ASA with FirePOWER Services Local Management Configuration Guide.

Chapter 10. Uninstall Version 6.2.0.x

You must uninstall updates locally. You cannot use a Firepower Management Center to uninstall the update from a managed device.

To monitor the uninstallation process, access the device through the shell and navigate to the /var/log/sf/<uninstaller file name folder> directory, then execute the tail –f main_upgrade_script.log shell command. Once the uninstallation process is complete, the system generates a upgrade completed message in the file main_upgrade_script.log.

Order of Uninstallation

Uninstall the update in the reverse order that you installed it. That is, first uninstall the update from managed devices, then from Firepower Management Centers.

Uninstall the Update from Firepower Threat Defense Devices in High Availability

Firepower Threat Defense devices in high availability pairs must run the same Firepower version.

You cannot uninstall Firepower Threat Defense devices in high availability. Before you uninstall, you must break the high availability. Uninstall each device independently, then reform the high availability pair.

Uninstall the Update from Clustered Firepower Threat Defense Devices

Verify the Firepower Threat Defense devices within the cluster are healthy and operating normally. Determine which member nof the cluster is the master and which member is the slave. Uninstall the update from each slave unit one at a time and then uninstall the master unit to avoid dropping traffic. While the slave unit uninstalls, the other slave units and the master unit continue to process traffic. While the master unit uninstalls, one of the slave units becomes the master and continues to process traffic. Once the uninstall completes on the master unit, the termporary master unit returns to the slave state and reforms the cluster.

Uninstall the Update from Clustered 7000 and 8000 Series Devices

Clustered devices must run the same Firepower version. Although the uninstallation process triggers an automatic failover, appliances in mismatched pairs or clusters do not share configuration information, nor do they install or uninstall updates as part of their synchronization. If you need to uninstall an update from redundant appliances, plan to perform the uninstallations in immediate succession.

To ensure continuity of operations, uninstall the update from clustered devices one at a time. First, uninstall the update from the secondary appliance. While the secondary appliance uninstalls, the active appliance continues to forward traffic to the Firepower Management Center. Wait until the uninstallation process is complete, then immediately uninstall the update from the active appliance. While the active appliance uninstalls, the secondary appliance temporarily becomes active and continues to forward traffic to the Firepower Management Center. Once the uninstall completes, the secondary appliances returns and the appliances reform the cluster.

Uninstall the Update from Stacked Devices

All devices in a stack must run the same Firepower version. Uninstalling the update from any of the stacked devices causes the devices in that stack to enter a limited, mixed-version state.

To minimize impact on your deployment, we recommend you uninstall an update from stacked devices simultaneously. The stack resumes normal operation when the uninstallation completes on all devices in the stack.

Uninstall the Update from Devices Deployed Inline

Managed devices do not perform traffic inspection, switching, routing, or related functions while the update is being uninstalled. Depending on how your devices are configured and deployed, the uninstallation process may also affect traffic flow and link state. See Preupdate Configuration and Event Backups for more information.

Uninstall the Update from Firepower Management Centers in High Availability

Firepower Management Centers in high availability pairs must run the same Firepower version. Although the uninstallation process triggers an automatic failover, appliances in mismatched pairs or clusters do not share configuration information, nor do they install or uninstall updates as part of their synchronization. If you need to uninstall an update from redundant appliances, plan to perform the uninstallations in immediate succession.

To ensure continuity of operations, uninstall the update from paired Firepower Management Centers one at a time. First, pause high availability synchronization and uninstall the update from the secondary Firepower Management Center. Wait until the uninstallation process is complete, then immediately uninstall the update from the primary Firepower Management Center. Once the primary Firepower Management Center uninstallation completes, resume high availability synchronization. At this point, both Firepower Management Centers exist in split brain. Click Make Me Active for the Firepower Management Center you want to act as the primary. The Firepower Management Center you do not make active automatically switches to standby mode. Communication between the Firepower Management Center pairs automatically restarts.

Note

If the uninstallation process on Firepower Management Centers in a high availability pair fails, do not restart the uninstall or change configurations on its peer. Instead, contact Cisco TAC.

After the Uninstall

After you uninstall the update, there are several steps you should take to ensure that your deployment is performing properly. These include verifying that the uninstall succeeded and that all appliances in your deployment are communicating successfully.

Confirm that uninstalling devices with Firepower software and ASA Firepower or FXOS versions, such as devices running Firepower Threat Defense or ASA Firepower Services, uninstalls both the Firepower and the ASA or FXOS version.

Clustered, stacked, or paired devices reform after the uninstall. Verify the cluster, stack, or paired devices experience healthy activity and communication before deploying any new policies.

The next sections include detailed instructions not only on performing the uninstallation, but also on completing any post-update steps. Make sure you complete all of the listed tasks.

- Uninstall 7000 and 8000 Series Managed Devices

- Uninstall Firepower NGIPSv Devices

- Uninstall ASA FirePOWER Modules Managed By Firepower Management Center

- Uninstall Firepower Threat Defense Devices and Firepower Threat Defense Virtual Managed By Firepower Management Center

- Uninstall Firepower Management Centers

- Uninstall ASA FirePOWER Modules Managed By ASDM

- Uninstall from Firepower Threat Defense Devices Managed by Firepower Device Manager

Uninstall 7000 and 8000 Series Managed Devices

Uninstalling the update results in a device running the previous version. For information on uninstalling a previous version, see to the Firepower System Release Notes for that version.

Uninstalling the update reboots the device. Appliances do not perform traffic inspection, switching, routing, or related functions during the update. Depending on how your devices are configured and deployed, the update process may also affect traffic flow and link state. For more information, see Preupdate Configuration and Event Backups.

Procedure

Step 1

Read and understand "Order of Installation" at the beginning of this chapter.

Step 2

Log into the device as admin, through SSH or the virtual console.

Step 3

At the CLI prompt, enter expert to access the bash shell.

Step 4

At the bash shell prompt, type sudo su -.

Step 5

Type the admin password to continue the process with root privileges.

Step 6

At the prompt, enter the following on a single line: install_update.pl --detach/var/sf/updates/filename_Patch_Uninstaller-[version]-[build].sh

The uninstallation process begins.

Note

If you encounter issues with the uninstallation, do not restart the uninstallation. Instead, contact Cisco TAC.

Step 7

After the uninstallation finishes, the device reboots.

Step 8

Log into the managing Firepower Management Center and choose Devices > Device Management. Confirm that the device where you uninstalled the update reflects the software version previous to the one you just uninstalled..

Step 9

Verify that the appliances in your deployment are successfully communicating with the Firepower Management Center and that there are no issues reported by the health monitor.

Uninstall Firepower NGIPSv Devices

Uninstalling the update results in a device running the previous version. For information on uninstalling a previous version, see to the Firepower System Release Notes for that version.

Uninstalling the update reboots the device. Appliances do not perform traffic inspection, switching, routing, or related functions during the update. Depending on how your devices are configured and deployed, the update process may also affect traffic flow and link state. For more information, see Preupdate Configuration and Event Backups.

Procedure

Step 1

Read and understand "Order of Installation" at the beginning of this chapter.

Step 2

Log into the device as admin, through SSH or the virtual console.

Step 3

At the CLI prompt, enter expert to access the bash shell.

Step 4

At the bash shell prompt, type sudo su -.

Step 5

Type the admin password to continue the process with root privileges.

Step 6

At the prompt, enter the following on a single line: install_update.pl --detach/var/sf/updates/filename_Patch_Uninstaller-[version]-[build].sh

The uninstallation process begins.

Note

If you encounter issues with the uninstallation, do not restart the uninstallation. Instead, contact Cisco TAC.

Step 7

After the uninstallation finishes, the device reboots.

Step 8

Log into the managing Firepower Management Center and choose Devices > Device Management. Confirm that the device where you uninstalled the update reflects the software version previous to the one you just uninstalled..

Step 9

Verify that the appliances in your deployment are successfully communicating with the Firepower Management Center and that there are no issues reported by the health monitor.

Uninstall ASA FirePOWER Modules Managed By Firepower Management Center

Uninstalling the update results in a device running the previous version. For information on uninstalling a previous version, see to the Firepower System Release Notes for that version.

Uninstalling the update reboots the device. Appliances do not perform traffic inspection, switching, routing, or related functions during the update. Depending on how your devices are configured and deployed, the update process may also affect traffic flow and link state. For more information, see Preupdate Configuration and Event Backups.

Procedure

Step 1

Read and understand "Order of Installation" at the beginning of this chapter.

Step 2

Log into the device as admin, through SSH or the virtual console.

Step 3

At the CLI prompt, type session sfr console.

Step 4

At the CLI prompt, enter expert to access the bash shell.

Step 5

At the bash shell prompt, type sudo su -.

Step 6

Type the admin password to continue the process with root privileges.

Step 7

At the prompt, enter the following on a single line: install_update.pl /var/sf/updates/filename_Patch_Uninstaller-[version]-[build].sh

The uninstallation process begins.

Note

If you encounter issues with the uninstallation, do not restart the uninstallation. Instead, contact Cisco TAC.

Step 8

After the uninstallation finishes, the device reboots.

Step 9

Log into the managing Firepower Management Center and choose Devices > Device Management. Confirm that the device where you uninstalled the update reflects the software version previous to the one you just uninstalled..

Step 10

Verify that the appliances in your deployment are successfully communicating with the Firepower Management Center and that there are no issues reported by the health monitor.

What to do next

Uninstall Firepower Threat Defense Devices and Firepower Threat Defense Virtual Managed By Firepower Management Center

Uninstalling the update results in a device running the previous version. For information on uninstalling a previous version, see to the Firepower System Release Notes for that version.

Uninstalling the update reboots the device. Appliances do not perform traffic inspection, switching, routing, or related functions during the update. Depending on how your devices are configured and deployed, the update process may also affect traffic flow and link state. For more information, see Preupdate Configuration and Event Backups.

Procedure

Step 1

Read and understand "Order of Installation" at the beginning of this chapter.

Step 2

Log into the device as admin, through SSH or the virtual console.

Step 3

For Firepower 4100 Series devices and Firepower 9300 Security Appliances, type connect module <slot number> console and then connect ftd .

Step 4

At the CLI prompt, enter expert to access the bash shell.

Step 5

At the bash shell prompt, type sudo su -.

Step 6

Type the admin password to continue the process with root privileges.

Step 7

At the prompt, enter the following on a single line: install_update.pl /var/sf/updates/filename_Patch_Uninstaller-[version]-[build].sh

The uninstallation process begins.

Note

If you encounter issues with the uninstallation, do not restart the uninstallation. Instead, contact Cisco TAC.

Step 8

After the uninstallation finishes, the device reboots.

Step 9

Log into the managing Firepower Management Center and choose Devices > Device Management. Confirm that the device where you uninstalled the update reflects the software version previous to the one you just uninstalled..

Step 10

Verify that the appliances in your deployment are successfully communicating with the Firepower Management Center and that there are no issues reported by the health monitor.

Uninstall Firepower Management Centers

Uninstalling the update results in a device running the previous version. For information on uninstalling a previous version, see to the Firepower System Release Notes for that version.

Procedure

Step 1

Read and understand "Order of Installation" at the beginning of this chapter.

Step 2

On the managing Firepower Management Center, make sure that the appliances in your deployment are successfully communicating with the Firepower Management Center and that there are no issues reported by the health monitor.

Step 3

On the managed device, click the system status icon and view the Tasks tab in the Message Center to make sure there are no tasks in progress.

Tasks that are running when the uninstallation begins are stopped, become failed tasks, and cannot be resumed; you must manually delete them from the Tasks tab after the uninstallation completes.

Step 4

Choose System > Updates.

Step 5

Click the install icon next to the uninstaller that matches the update you want to remove, then confirm that you want to uninstall the update.

You can monitor the uninstallation progress in the Tasks tab of the Message Center.

Note

Do not use the UI to perform any other tasks until the uninstallation is complete and the device reboots. Before the uninstallation completes, the web interface may become unavailable and the device may log you out. This is expected behavior; log in again to view the Tasks tab. If the uninstallation is still running, do not use the web interface until the uninstallation is complete. If you encounter issues with the uninstallation (for example, if the Tasks tab indicates that the update has failed or if the Tasks tab shows no progress for several minutes), do not restart the uninstallation. Instead, contact Cisco TAC.

Step 6

After the uninstallation is complete, the appliance reboots.

Step 7

Clear your browser cache and force a reload of the browser. Otherwise, the user interface may exhibit unexpected behavior.

Step 8

Log in to the device.

Step 9

Choose Help > About and confirm that the version number reflects the software version previous to the one you just uninstalled.

Step 10

On the managing Firepower Management Center, verify that the appliances in your deployment successfully communicate with the Firepower Management Center and that there are no issues reported by the health monitor.

Uninstall ASA FirePOWER Modules Managed By ASDM

Uninstalling the update results in a device running the previous version. For information on uninstalling a previous version, see to the Firepower System Release Notes for that version.

Uninstalling the update reboots the device. Depending on how your devices are configured and deployed, the update process may also affect traffic flow. For more information, see Preupdate Configuration and Event Backups.

Procedure

Step 1

Read and understand "Order of Installation" at the beginning of this chapter.

Step 2

Log into the device as admin, through SSH or the virtual console.

Step 3

At the CLI prompt, type expert to access the bash shell.

Step 4

At the bash shell prompt, type sudo su -.

Step 5

Type the admin password to continue the process with root privileges.

Step 6

At the prompt, enter the following on a single line: install_update.pl /var/sf/updates/filename_Patch_Uninstaller-6.1.0.X-57xxx.sh

The uninstallation process begins.

Note

If you encounter issues with the uninstallation, do not restart the uninstallation. Instead, contact Cisco TAC.

Step 7

After the uninstallation finishes, the device reboots.

Step 8

Verify that the appliances in your deployment are successfully communicating with the Firepower Management Center and that there are no issues reported by the health monitor.

Uninstall from Firepower Threat Defense Devices Managed by Firepower Device Manager

You cannot uninstall Firepower Threat Defense devices managed by Firepower Device Manager. You must reimage the appliance. See the Firepower Threat Defense Command Reference Guide for more information.

Chapter 11. Resolved Issues

For devices running or hosted on a non-Firepower appliance (for example, ASA OS or FXOS), resolving an issue may require that you update the operating system in addition to Firepower. We recommend you update to the latest supported version.

The following defects are resolved in Version 6.2.0.x:

- Issues Resolved in Version 6.2.0.6

- Issues Resolved in Version 6.2.0.5

- Issues Resolved in Version 6.2.0.4

- Issues Resolved in Version 6.2.0.3

- Issues Resolved in Version 6.2.0.2

- Issues Resolved in Version 6.2.0.1

- Issues Resolved in Version 6.2.0

Issues Resolved in Version 6.2.0.6

The following table addresses resolved caveats at the time of publication of these release notes. If you have a Cisco support contract, use the following dynamic queries for an updated list of resolved caveats, run the provided query in the Bug Search Tool:

- Resolved Firepower Management Center caveats in Version 6.2.0.6

- Resolved Firepower Management Center Virtual caveats in Version 6.2.0.6

- Resolved ASAFirePOWER caveats in Version 9.7.x

Caveat ID Number

Description

CSCuy57310

Cisco Adaptive Security Appliance Traffic Flow Confidentiality Denial of Service Vulnerability

CSCvc91092

Cisco FireSIGHT System Software Arbitrary Code Execution Vulnerability

CSCvd02391

Enabling URL filtering license for Firepower Threat Defense breaks the smart license.

CSCvd76821

tcp-options md5 allow is pushed to slave units as tcp-options md5 clear

CSCvd96108

Traceback in thread name DATAPATH due to lan to lan VPN

CSCve31387

No CPU alert on 8000 Series, when snort is overwhelmed.

CSCve87945

Cannot install new https certificate

CSCve97046

threat_name table prune cannot keep up with insertion

CSCvf53734

access control rules and Categories duplication on Firepower Management Center UI

CSCvf56533

Cannot re-register Firepower 9300 cluster to a different Firepower Management Center

CSCvf64831

Firepower Management Center reports incorrect IPv6 addresses and ports

CSCvg00565

ASA crashes in glib/g_slice when do debug menu self testing

CSCvg05368

Upon joining cluster slave unit generates ASA-3-202010: NAT/PAT pool exhausted for all PAT'd conns

CSCvg09316

Cisco Firepower Threat Defense Software Policy Bypass Vulnerability

CSCvg20782

Identified Vulnerabilities associated with the CVEs from Oracle MySQL Patch Updates

CSCvg25287

Add mysql-server.err file to logrotate.d in Firepower Threat Defense

CSCvg37391

Migrated access control policy deploy fails since it has FQDN objects

CSCvg42033

prune to cleanup unused data in eoattributes table at vms.db to reduce backup file size

CSCvg43389

ASA traceback due to 1550 block exhaustion.

CSCvg65072

Cisco ASA sw, FTD sw, and AnyConnect Secure Mobility Client SAML Auth Session Fixation Vulnerability

CSCvg73042

SSL Cache missing session info leading to ERR_SSL_PROTOCOL_ERROR in the browser for SSL websites

CSCvg84474

Space in port range for an access control policy rule causes error that prevents rule editing

CSCvg85765

ASA5506 traceback on policy deploy

CSCvg97808

Cisco Firepower System Software Transport Level Security Extensions Denial of Service Vulnerability

CSCvg99327

Cisco Firepower System Software Transport Level Security Denial of Service Vulnerability

CSCvh07446

On 7000/8000 devices, many IPs in a single access control rule will match rule incorrectly

CSCvh20742

Cisco Adaptive Security Appliance Clientless SSL VPN Cross-Site Scripting Vulnerability

CSCvh22181

Failures loading websites, such as mail sites, using TLS 1.3 with SSL inspection enabled

CSCvh46202

Slow 2048 byte block leak due to fragmented traffic over VPN

CSCvh48668

Device overrides not correctly applied to access control policy.

CSCvh53901

SFDataCorrelator cores when reading invalid fingerprint type from database

CSCvh68521

On 8000 series stack, with Maint on sec fail setting enabled, stack health is in compromised state

CSCvh77721

Standby SFDataCorrelator fails to connect to Sybase after Management Center pair establish/resume

CSCvh83145

ASA interface IP and subnet mask changes to 0.0.0.0 0.0.0.0 causing outage of services on interface

CSCvh84511

Cisco FireSIGHT System URL-based Access Control Policy Bypass Vulnerability

CSCvh85246

ssl inspection can be limited by a Do-Not-Decrypt rule specifying one or more common names

CSCvh85580

ids_event_alerter core when processing connection events

CSCvh89095

Firepower Management Center allows deleting Interface Object being used in SLA monitor object

CSCvh90092

AQ task selection ignores few groups when large no of groups present causing 8 hr delays in deploy

CSCvh95600

Need consistent identifier for lines of ssl debug log output

CSCvh95807

SSL FLow Errors reported when accessing ECDSA signed websites

CSCvh97594

ssl inspection cache can become unbalanced, leading to premature removal of recently used items

CSCvi09305

Some SSL connections slow or fail under a Do-Not-Decrypt SSL policy action

CSCvi12354

Threat Defense member in intra-cluster environment is not able to be re-added in Management Center

CSCvi16029

Cisco Adaptive Security Appliance WebVPN Denial of Service Vulnerability

CSCvi29845

Cisco Firepower detection engine memory leak vulnerability

CSCvi58865

SSL policy with URL category rules specifying decryption can cause browser errors

CSCvi63888

SSL errors might occur when resumed sessions are not decrypted

CSCvi66905

PIM Auto-RP packets are dropped after cluster master switchover

CSCvi97721

The memcap for Security Intelligence URL feeds needs to be increased for devices 4GB total memory

CSCvj07038

Firepower devices need to trust Threat Grid certificate

CSCvj45594

SFDataCorrelator core when timing-out old host info on a slow Firepower Management Center

CSCvj48931

Firepower recommendation updates task never runs

CSCvj63196

Workaround for Sybase issue: After snort engine update, policy deployment fail abruptly

Issues Resolved in Version 6.2.0.5

The following table addresses resolved caveats at the time of publication of these release notes. If you have a Cisco support contract, use the following dynamic queries for an updated list of resolved caveats, run the provided query in the Bug Search Tool:

- Resolved Firepower Management Center caveats in Version 6.2.0.5

- Resolved Firepower Management Center Virtual caveats in Version 6.2.0.5

- Resolved ASAFirePOWER caveats in Version 9.7.x

Security Issues in Version 6.2.0.5

Caveat ID Number

Description

CSCto19832

OpenLDAP needs to be upgraded or patched in ASA running Firepower Threat Defense process

CSCve26946

Cisco Firepower System Software Bit Torrent File Policy Bypass Vulnerability

CSCve91584

Cisco Firepower Management Console Security Intelligence Objects Denial of Service Vulnerability

CSCvg35384

snort crash "deleteSessionByKey" found when access control policy edited and malware traffic is sent

CSCvg35618

Cisco Adaptive Security Appliance Remote Code Execution and Denial of Service Vulnerability

CSCvh79732

Cisco Adaptive Security Appliance Denial of Service Vulnerability

CSCvh81737

Cisco Adaptive Security Appliance Denial of Service Vulnerability

CSCvh81870

Cisco Adaptive Security Appliance Denial of Service Vulnerability

Caveat ID Number

Description

CSCto19051

Resolve any vulnerabilities in ASA/Firepower Threat Defense Heimdal code

CSCuy91788

ASAv: Free memory is reported as negative in an OOM condition

CSCuy96471

Firepower Threat Defense device runs out of memory when nearing 35 million open connections.

CSCuz68504

Dynamic Analysis Summary not showing full report

CSCva02655

ASA sends invalid interface id to SFR module for clientless VPN traffic

CSCva17189

References to "Adaptive Security Appliance" when booting Firepower Threat Defense

CSCva42408

Event Analysis UI: Domain column disappears after switching to secondary Firepower Management Center

CSCva97863

971 EST - Console hang on show capture

CSCva98532

Firepower Threat Defense inline is not blocking MPLS-switched TCP session it should block

CSCvb39082

Smart License: Cluster role change triggers authorization renewal.

CSCvb40875

Default inspection statements missing on ASA 5500-x and 2100 device running FirepowerThreat Defense

CSCvb50750

Cisco ASA failure during failover with SIP traffic.

CSCvb57936

Unable to save AD join credentials from Edit Realm page

CSCvb58087

Redundant service group objects are incorrectly removed from object-group searches.

CSCvb81438

TCP connections might fail through a Threat Defense cluster with inline mode interfaces

CSCvc21275

Internal error on editing the NAT policy after import

CSCvc24310

Correlation events showing up with random Security Intelligence Category.

CSCvc36805

Firepower Threat Defense IKEv2 NAT-T gets disabled after reboot

CSCvc38425

ASA with FirePOWER module generates traceback and reloads or causes process not running

CSCvc46502

Firepower Threat Defense Cluster 9K block depletion with fragmented traffic

CSCvc71764

Blade got stuck in slave bulk sync after changing the CCL

CSCvc82146

ASA traceback in threadname Datapath

CSCvc91839

Unable to deploy policy on Firepower Threat Defense devices due to wrong XML parsing

CSCvc92982

Unable to delete configured Auto NAT from Firepower Management Center

CSCvc94586

CTS traffic not propagating Firepower Threat Defense inline mode

CSCvc97734

Deployment fails when management-only enabled on port-channel interface

CSCvd03421

Number of interfaces on active and standby are not consistent.

CSCvd08709

Asymetric path ICMP traffic fails through distributed clustering

CSCvd10251

Insufficient TCP options validation at 2nd normalizer in tcp_norm_parse_ts

CSCvd20408

Threat Defense: Interface capture on lina CLI causes all traffic to be dropped on data-plane

CSCvd23471

ASA may traceback while loading a large context config during bootup

CSCvd26939

SNMP lists same Hostname for all Firepower Threat Defense managed devices

CSCvd33044

Firepower Threat Defense traceback while deploying access control policy

CSCvd34694

Enabling SSL Decryption blocks legitimate traffic

CSCvd41052

Scheduler Queue Corruption leads to connectivity failures or failover problems after 9.6(2)

CSCvd56292

Default "global_policy" service-policy removed after reboot

CSCvd75631

Firepower Threat Defense DHCP Client tries to request a DHCP address instead of declining

CSCvd78303

ARP functions fail after 213 days of uptime, drop with error 'punt-rate-limit-exceeded'

CSCvd79863

Firepower Threat Defense OSPF with ECMP, packets sent to peer in down state for existing connections

CSCvd93621

Unable to edit performance settings in advanced section of access control policy

CSCvd97568

Firepower Threat Defense traceback observed during failover synchronization.

CSCve03387

Proxy ARP information for SSH NLP NAT not updating on Firepower Threat Defense Device upon failover

CSCve04326

Slave should have use CCL to forward traffic instead of blackholing when egress interface is down

CSCve13410

Upgrading the ASA results in no valid adjacency due to track configure on the route

CSCve23091

Auto-RP packet is dropped due to no-route - No route to host

CSCve25577

Interfaces on slaves in shutdown if Firepower Management Center deployment results in failure

CSCve34640

SSL policy causing inspection engine (Snort) processes stop unexpectedly

CSCve46883

Firepower Threat Defense Diagnostic Interface does Proxy ARP for br1 management subnet

CSCve63762

ASA-SM: Interface VLANs going to admin down after reload.

CSCve70416

SSL policy with decrypt-resign action does not decrypt traffic with ECDSA certificates

CSCve71661

Firepower Threat Defense - Multicast and BPDU traffic dropped due to dst-l2_lookup-fail

CSCve74524

User Agent does not properly report group names with special characters in the name

CSCve84791

Capturing asp-drop causes unexpected ASA failure

CSCve96463

False positives for TCP Session Hijacking in routed deployments

CSCve97395

Syslog and SNMP do not work for Prefilter Policy on Firepower Threat Defense

CSCve97874

ASA: Low free DMA Memory on Versions 9.6 and later (Applies to ASA 5515 ONLY)

CSCvf10088

Migration fails when access-list contains VXLAN port

CSCvf11695

Duplicate host entries in flow-export action cause traceback after policy deployment

CSCvf13106

EIGRP system defined template for every time deployment is not working

CSCvf22930

Firepower 9300 running ASA 9.7.1.10 Firepower Threat Defense high availability traceback in Datapath

CSCvf25415

Spaces in IP range in access control policy can cause deploy to fail

CSCvf26676

With SSL inspection, Snort can terminate unexpectedly in SideChannel

CSCvf34791

Install 6.2.2-1290 on an ASA with Firepower Services-- ASA fails unexpectedly.

CSCvf44801

Intrusion rule with multiple negations can be trigger false positives

CSCvf58260

Categories missing from Security Intelligence events

CSCvf64643

ERROR on Firepower Threat Defense device: Captive-portal port not available. Try again

CSCvf72930

Firepower Threat Defense may traceback in Thread Name appAgent_monitor_nd_thread during registration

CSCvf81222

Memory leak in 112 byte bin when packet hits PBR and connection is built

CSCvf90278

ASA/Firepower Threat Defense traceback when enabling or clearing the packet capture buffer

CSCvf96656

After creating an access control rule with app filters via REST API, cannot access policy from UI

CSCvg00356

BitTorrent traffic not detected when traffic path includes a proxy

CSCvg07052

RealID+TempID in Sybase makes SFDataCorrelator incorrectly assign TempID to new logins

CSCvg17478

Traceback with Show OSPF Database Commands

CSCvg22873

Threat Defense Virtual: Azure, waagent.log file grows without bounds and needs to rotate

CSCvg23945

ASA panic/crash spin_lock_fair_mode_enqueue: Lock (mps_shash_bucket_t) is held for a long time

CSCvg25358

Set oom-killer priorities

CSCvg25694

Crash on Standby Firepower 4140 module after Policy deployment.

CSCvg28189

Snort memory leak causing complete traffic outage and goes into D state

CSCvg34306

ENH - The memcap for Security Intelligence URL feeds needs to be increased.

CSCvg52995

Unable to save configuration in system context after enabling password encryption in ASA

CSCvg53208

Application protocol field missing in connection events

CSCvg54460

ASA FirePOWER module managed by ASDM, ADI.conf removed on policy deployment

CSCvg58941

Elevated CPU Using Flow-Offload & High Rate of Flow Table Collisions

CSCvg60217

AppId is sharing incorrect high availability pair information for unmonitored networks

CSCvg60323

D/R HTTPS connections fail in browsers that enforce OCSP must staple

CSCvg65044

When network packets are transmitted out-of-order, some SSL sessions may not be established

CSCvg66697

segfault in ssl_handshake::sig_hash

CSCvg66706

SFDataCorrelator deadlock core due to slow User Identity event processing

CSCvg66844

Excessive log messages "found no record for Realm" and excessive database queries

CSCvg71421

Archive Cache Pruning May Not Work

CSCvg76652

Default DLY value of port-channel sub interface mismatch

CSCvg90403

Blocks of size 80 leak observed when IRB is used in conjunction with multicast traffic

CSCvg96525

SFDataCorrelator deadlock during whitelist host evaluation

CSCvg97541

Firepower Threat Defense prefilter policy only fast-paths single direction of bidirectional flow

CSCvg97874

FireAMP Cloud events are not available for eStreamer clients

CSCvh12075

Firepower Threat Defense devices in high availability might go into reboot loop one after the other

CSCvh18106

Firepower Management Center- Flexconfig-Removal of EIGRP Authentication every time during deployment

CSCvh21873

SFDataCorrelator on Firepower Management Center repeatedly crashes for corrupt user login event

CSCvh81331

Add support for i) wild card port numbers in host cache ii) overwriting port service AppId

CSCvh91577

IDSEventAlerter:config [ERROR] Unrecognized keyword: "ssl_policy_UUID"

Issues Resolved in Version 6.2.0.4

The following table addresses resolved caveats at the time of publication of these release notes. If you have a Cisco support contract, use the following dynamic queries for an updated list of resolved caveats, run the provided query in the Bug Search Tool:

- Resolved Firepower Management Center caveats in Version 6.2.0.4

- Resolved Firepower Management Center Virtual caveats in Version 6.2.0.4

- Resolved ASA FirePOWER caveats in Version 9.7.x

Security Issues in Version 6.2.0.4

Caveat ID Number

Description

CSCvc72421

Security Review for OpenSSH: CVE-2016-10009 , CVE-2016-10010 , CVE-2016-10011 , CVE-2016-10012

CSCvd97249

Cisco Firepower Detection Engine SSL Decryption Memory Consumption Denial of Service Vulnerability

Caveat ID Number

Description

CSCto19051

Resolve any vulnerabilities in ASA/Firepower Threat Defense Heimdal code

CSCuu97541

Turn off older SSL/TLS versions and ciphers

CSCuy36266

Autonegotiation automatically enabled after 5.4.x patch is applied

CSCuy91788

ASAv: Free memory is reported as negative in an OOM condition

CSCuy96471

Firepower Threat Defense: When nearing 35 million open connections, box runs out of memory

CSCuz44985

Erroneous syslog messages cause excessive upgrade times/failures

CSCva02655

ASA sends invalid interface id to SFR for clientless VPN traffic

CSCva17189

References to "Adaptive Security Appliance" when booting Firepower Threat Defense

CSCva97863

971 EST - Console hang on show capture

CSCva98532

Firepower Threat Defense inline is not blocking MPLS-switched TCP session it should block

CSCvb39082

SmartLic: Trigger auth renewal from the app for cluster role change

CSCvb40875

Default inspect statements are missing on ASA 5500-x and 2100 device running Threat Defense

CSCvb50750

Cisco ASA core during failover with sip traffic

CSCvb58087

Object-group-search redundant service group objects are incorrectly removed

CSCvb81438

TCP connections might fail through a Threat Defense cluster with inline mode interfaces

CSCvb81481

No Input/Output packet for Port-channel in Firepower Threat Defense 4100

CSCvc36805

Firepower Threat Defense IKEv2 NAT-T gets disabled after reboot

CSCvc37849

Cannot edit intrusion policy after upgrade to 6.1 due to undefined rule state

CSCvc38425

ASA with FirePOWER module generates traceback and reloads or causes process not running

CSCvc46502

Firepower Threat Defense Cluster 9K block depletion with fragmented Traffic

CSCvc82146

ASA traceback in threadname Datapath

CSCvc84721

Health monitor error: "The cloud databases for these appliances are not synced"

CSCvc91839

Unable to deploy policy on Firepower Threat Defense devices due to wrong XML parsing

CSCvc92397

Webpages loads very slowly when URL retry is enabled

CSCvc92982

Unable to delete Configured Auto NAT from FMC

CSCvc94586

CTS traffic not propagating Firepower Threat Defense Inline mode

CSCvc97734

Deployment fails when management-only enabled on port-channel interface

CSCvd03421

Number of interfaces on Active and Standby are not consistent.

CSCvd10251

Insufficient TCP options validation at 2nd normalizer in tcp_norm_parse_ts

CSCvd23471

ASA may traceback while loading a large context config during bootup

CSCvd26939

SNMP lists same Hostname for all Firepower Threat Defense managed devices

CSCvd33044

Firepower Threat Defense traceback at "cli_xmlserver_thread" while deploying access-control policy

CSCvd41052

Scheduler Queue Corruption leads to connectivity failures or failover problems after 9.6(2)

CSCvd51463

Custom detection/Clean list is incorrect with multiple file polices in use

CSCvd56292

Default "global_policy" service-policy removed after reboot

CSCvd75631

Firepower Threat Defense DHCP Client tries to request a DHCP address instead of declining

CSCvd78303

ARP functions fail after 213 days of uptime, drop with error 'punt-rate-limit-exceeded'

CSCvd79863

Firepower Threat Defense OSPF with ECMP, packets sent to peer in down state for existing connections

CSCvd82225

Queries against temp merge tables may fail

CSCvd97568

Firepower Threat Defense traceback observed during failover synchronization.

CSCve03387

Proxy ARP information for SSH NLP NAT not updating on Firepower Threat Defense Device upon failover

CSCve04326

Slave should have use CCL to forward traffic instead of blackholing when egress interface is down

CSCve08525

URL DB Download Fail with error -8

CSCve10708

Upgrade file-transfer from Firepower Management Center to Firepower device times out after one hour

CSCve13410

Upgrading the ASA results in No Valid adjacency due to track configure on the route

CSCve23091

Auto-RP packet is dropped due to no-route - No route to host

CSCve25577

Interfaces on SLAVES in shutdown if Firepower Management Center deployment results in failure

CSCve28417

[NSS] Snort 6 Core - AAB - in SnortPcre of file detection_options.c

CSCve34640

SSL policy causing inspection engine (snort) processes stop unexpectedly

CSCve46883

Firepower Threat Defense Diagnostic Interface does Proxy ARP for br1 management subnet

CSCve55696

UIMP continues to attempt import for deleted users

CSCve58157

Host Input Daemon exits when interface is IPv6 (no IPv4)

CSCve58826

Issues with multiple pending UserEnforcementSnapshot tasks

CSCve63762

ASASM: Interface vlans going to admin down after reload.

CSCve64913

Database Limits are not correct for Firepower Management Centers (2500, 4500)

CSCve71661

Firepower Threat Defense - Multicast and BPDU traffic dropped due to dst-l2_lookup-fail

CSCve82410

Port Scan doesn't block scans

CSCve85240

Access control policy uneditable if copying large Policy, insert/move 50+ rules into category

CSCve85996

Deployment timeouts after 30 minutes due to expand of ACE during deployment

CSCve86182

Reserved Characters in AC/ Prefilter policy rule names may fail Firepower Threat Defense Deployments

CSCve88096

File Events may incorrectly show "Device Not Activated" for capacity handled files

CSCve94530

SFDataCorrelator signal-6 core on Firepower Management Center after reconfigure

CSCve97874

ASA: Low free DMA Memory on versions 9.6 and later

CSCve97997

Multiple CLAM update tasks created in the AQ ,during device registration.

CSCvf02972

Inspection engine (snort) can stop unexpectedly during an SSL rule update

CSCvf11695

Duplicate host entries in flow-export action cause traceback after policy deployment

CSCvf12124

Third Party Vulnerability Maps won't save

CSCvf14953

Health Alert for CPU usage on cores dedicated to Radware DefensePro service

CSCvf22930

FP9300 9.7.1.10 Threat Defense high availability traceback in Datapath

CSCvf23425

SSL handshake error and timeout occurs when HTTPS traffic is passed through GRE tunnel

CSCvf29140

Avoid deleting latest version for bcdb_rep*.bin file

CSCvf34791

Install 6.2.2-1290 on an ASA with Firepower Services- ASA fails unexpectedly

CSCvf41773

Threshold configuration files have old unneeded policies

CSCvf50819

AS Path prepend command truncated while deployed

CSCvf52889

Delay of end of connection events for SSL traffic

CSCvf54853

Large database size for devices upgraded from 6.1.0.x to 6.2.0.x

CSCvf54986

Policy import from SFO or deleting realms fails with unreachable directory servers

CSCvf55219

Heap out of bounds read in DecodeCiscoMeta()

CSCvf55850

access-list rules missing after policy deployment on Firepower Threat Defense

CSCvf56267

Duplicate email addresses causes Firepower Management Center processes to fail

CSCvf59214

User sessions without email might cause database issues

CSCvf59399

Memory growth in SFDataCorrelator due to User Identity

CSCvf62276

Missing IP address in AMP cloud malware events

CSCvf63022

Application isn't being identified for RTP stream

CSCvf63871

Inspection engine CPU usage high if SSL policy or captive portal are enabled

CSCvf64643

ERROR on Firepower Threat Defense device: Captive-portal port not available. Try again

CSCvf67573

Errors during interface creation/deletion and config save

CSCvf69012

Unassigning Flexconfig object that has MPF config removes service-policy and pmap but not class-map

CSCvf70092

Resource Leak in SFTop10Cacher leads to deadlock

CSCvf72930

Firepower Threat Defense may traceback in Thread Name appAgent_monitor_nd_thread during registration

CSCvf74790

OGS and TCM commands are negated by Firepower Management Center during policy deployment

CSCvf76566

S4000-K9 // Cannot add object to the network group (FMC 682412623)

CSCvf77469

Packet loss during Server Hello when SSL policy verdict is Do Not Decrypt causes failures

CSCvf77493

Management interfaces are missing on Firepower Management Center 4500, 2500, or 1000

CSCvf78924

Maximum Transmission Unit (MTU) setting ignored on managed devices, leading to dropped packets

CSCvf80717

TCP SACK in conjunction with SSL decryption can cause connections to stuck

CSCvf81222

Memory leak in 112 byte bin when packet hits PBR and connection is built

CSCvf86080

SFDataCorrelator needs to log incorrect timestamp on bucketized partitioned tables

CSCvf86435

If Drop threshold is configured in Intelligent Application Bypass, all traffic will be trusted

CSCvf86487

Intelligent Application Bypass drop percentage does not work as expected

CSCvf87538

Syslog ID is reset to '111111' when editing syslog settings

CSCvf89183

Large Deploy Bundles and slow links causes deploy to fail

CSCvf90278

ASA/Firepower Threat Defense crashes when clearing the packet capture buffer

CSCvf92782

PAT pool fails to be enabled on Japanese GUI

CSCvf95108

Action_queue tables not pruning successful/failure tasks

CSCvf95494

Routes are not applied on a 7000/8000 series devices in Cluster

CSCvf97107

Retransmit delay when first packet lost with decrypt - resign or do not decrypt SSL policy action

CSCvg08745

Snort segfaults and coring while processing FTP traffic.

CSCvg08988

Access Control Rule is not created in snort if source zone and destination zone are the same

CSCvg17478

Traceback with Show OSPF Database Commands

CSCvg23945

ASA panic/crash spin_lock_fair_mode_enqueue: Lock (mps_shash_bucket_t) is held for a long time

CSCvg25694

Assert Traceback, thread name : cli_xml_server

CSCvg32885

Unable to edit or Deployment missing some of the access control rules after upgraded to 6.2.0.3

CSCvg36672

Need a way to prioritize user driven deployment tasks in Action Queue

CSCvg42347

6.2.0.3 upgrade failed on standby 4140 at script 800_post/755_reapply_sensor_policy.pl

CSCvg52995

Unable to save configuration in system context after enabling password encryption in ASA

CSCvg56681

Upgrade framework scripts incorrectly delete rc symlinks

CSCvg58941

Elevated CPU Using Flow-Offload & High Rate of Flow Table Collisions

CSCvg72583

Archive Cache Loading Could be in Deadlock

CSCvh12075

Firepower Threat Defense devices in high availability might go into reboot loop one after the other

Issues Resolved in Version 6.2.0.3

The following table addresses resolved caveats at the time of publication of these release notes. If you have a Cisco support contract, use the following dynamic queries for an updated list of resolved caveats, run the provided query in the Bug Search Tool:

- Resolved Firepower Management Center caveats in Version 6.2.0.3

- Resolved Firepower Management Center caveats in Version 6.2.0.3

- Resolved ASA FirePOWER Module caveats in ASA Version 9.7.x

Security Issues in Version 6.2.0.3

Security Issue

CSCve02069

2048 byte block depletion with continuous SSL traffic and decrypt resign enabled on Threat Defense

Security Issue

CSCvd07072

Cisco Firepower SSL Logging Denial of Service Vulnerability

Security Issue

CSCve12652

Cisco Firepower System Software Secure Sockets Layer Policy Bypass Vulnerability

Caveat ID Number

Description

CSCuy65203

Inline result showing would have dropped

CSCva30652

spurious high unmanaged disk usage on /dev/shm alerts

CSCvb22670

SFDCNotificationd dumps core if stopped after SFDataCorrelator

CSCvb34534

access control policy search highlight incorrectly highlights

CSCvb44254

ASA 5506-X Firepower Threat Defense Reset Button

CSCvb72561

Mperf causing high CPU and stays constantly high .

CSCvb87476

Proxy configuration can't be saved from UI, under some circumstances

CSCvc06133

Firepower Management Center freezes when attempt is made to sort the App Detectors

CSCvc06397

Upgrade ASA on Firepower Threat Defense managed by Management Center breaks Malware cloud lookup

CSCvc09017

Show Nat flows on Firepower 7000/8000 series devices displays incorrect data

CSCvc39550

Unable to expand or scroll if more than 11 DHCP relay agents configured in Management Center

CSCvc46599

Error message Unable to translate SSL cipher suite 65535 needs cleaning up

CSCvc46914

Rule copy and paste reset to top instead of the rule being edited

CSCvc49556

Diskmanager not managing /var/cisco/umpd properly

CSCvc51553

Unclear to user that DB check is running after ungraceful shutdown

CSCvc54659

Sub-interface entries not getting removed from bridge group interface after net-mode change

CSCvc57886

Search in access control policy returning incorrect results.

CSCvc59913

Mismatched VLAN tagged traffic has inconsistent access control rule matches.

CSCvc66770

Mishandled rule index numbers on multipage access control policies with collapsed rule categories

CSCvc68564

logrotate fails if permission on .conf file is incorrect - perm should be checked

CSCvc91394

Making minor changes to included/excluded users in a realm may cause unexpected behavior

CSCvc94207

Use of manage_procs.pl can result in a stack coming out of maintenance mode

CSCvc94589

Evaluation of sfims for OpenSSL Jan 2017

CSCvc96254

Route cannot be added under Management Interface

CSCvc96927

Management Interfaces Proxy settings disabled after 6.1.0 Management Center upgrade

CSCvc99959

Possible error in PDF/SWF decompression

CSCvd01405

Health monitoring for 8000 series firmware needs to try again for comms failure

CSCvd15607

DHCP server : Not able to configure DHCP server on BVI member (Redundant) - Transparent mode.

CSCvd16631

Excessive logging from sip preprocessor function SipSessionSnortCallback

CSCvd22778

Firepower Threat Defense high availability creation failed due to DB lock issue

CSCvd27999

PerlMessageHand_11 core on Firepower Management Center Virtual while system is shutting down

CSCvd28945

modbus false postive on MODBUS_BAD_LENGTH

CSCvd35905

upgraded 6.x Management Center incorrectly deploys obsoleted detectors to 6.x devices

CSCvd37120

Snort is unable to map the filename if there are unsupported characters.

CSCvd39490

ADI discards all but one IP address from a session notification

CSCvd51190

Snort reloads cause memory leaks and CPU increase

CSCvd51302

When import HTTPS Server Certificate fails, UI is blank without error

CSCvd56035

Custom NAP rule with inline normalization enabled does not enable normalization

CSCvd59199

Mismatch between internal database entries prevents correct session propagation

CSCvd62879

Repeated same DiskMgr logs flooding messages log - causing small log retention period

CSCvd70549

Query Cisco CSI for Unknown URLs option is not properly synchronized in Management Center pairs

CSCvd73687

Access Control Policy page conflict detection can show conflicts when there are none.

CSCvd78338

Correlation Events and Syslog Events show incorrect local rule SID

CSCvd86594

Need ability to enable PPTP inspection

CSCvd89890

Policy deploy hangs at 40% with the object names end with [ _ ]

CSCvd91019

Unable to delete third party vulnerabilities when the host count associated with them is > 100

CSCvd94044

7000 and 8000 Series Device with Passive Interface does not Failover when Active device powers off

CSCvd95667

Data channel traffic on windows FTP server aren't matching the pin hole session as expected

CSCvd96322

CSM backup failed on Secondary Firepower Management Center

CSCvd99119

Unable to import if Access Control rules has Realm as matching condition

CSCvd99574

Snort process at 100% and takes excessive amount of time to parse IPS rules.

CSCve02220

eStreamer certificate generates errors with a McAfee ESM generationQualifier verification failed

CSCve08217

Maximum File Events limit reduces to smaller number after upgrade to 6.1.0

CSCve08961

Stack entering bypass due to disk space health alert

CSCve10406

SFDataCorrelator will not stop on Threat Defense device due to database connection corruption

CSCve10708

Upgrade file-transfer from Firepower Management Center to Firepower device times out after one hour

CSCve11915

POP3 payload inspection not proper on snort with the file detection policy

CSCve15155

Host input operations can overwhelm high availability transactions

CSCve17116

Access control rule is not matched correctly if src zone and dst zone have different types

CSCve18975

Nothing is shown when clicked on Policy Assignements

CSCve34181

Static URL/DNS lists are not included in backup

CSCve34924

When expanding individual categories in Access Control Policy rule ID changes

CSCve35722

Running Patch Uninstaller causes cc-integrity.sh to fail; no UI.

CSCve35816

SFDataCorrelator segfault due to null pointer dereference in handle_host_address_changes()

CSCve39775

Multiple login messages different username and same realm/IP/timestamp scrambles SFDaco

CSCve41306

Firepower Management Center Interface Type Mismatch with Syslog Server Ip Type error

CSCve44987

eStreamer service sends corrupt messages and spams log files with Not connected

CSCve46036

SFDataCorrelator segfault due to null field in internally generated logoff event

CSCve46186

Snort memcals for startup memory incorrect on Firepower Threat Defense

CSCve47333

Management Center not deactivating smart licenses for Firepower Threat Defense devices

CSCve47800

Port Scan: IP Protocol scanning not getting detected.

CSCve47868

Snort not triggering Event 123:7 FRAG3_ANOMALY_BADSIZE_LG

CSCve47923

eStreamer log spam Unable to open directory

CSCve51315

record_count for interface stats from the sensor are being set to 0, coring SFDatacorrelator.

CSCve53544

Firepower Management Center high availability sync fails if file name contains 2 dots [ .. ]

CSCve61591

BitTorrent traffic not blocked consistently on resumed sessions.

CSCve63017

Migration lock not removed even if migration fails

CSCve64643

REST API internal error when removing AP rule from API that moved via GUI

CSCve72760

Missing column netmap_num from the join on event_extra_data table.

CSCve73229

Platform settings applied to more than 1 Threat Defense device do not vary

CSCve73601

Threat Defense: Blocking Facebook post/chat/comments/likes application not working for Firefox

CSCve74585

SFDataCorrelator crash or exit when event table contains large highest index

CSCve74902

REST identity application and ADI leak File Descriptors

CSCve79949

Poor performance of packet logs UI due to query not using index

CSCve82386

Configuring an IP pool for a diagnostic port channel interface on an Threat Defense cluster fails

CSCve85240

Access control policy uneditable if copying large Policy, insert/move 50+ rules into category

CSCve90940

DNS Security Intelligence feeds are not automatically push to sensors

CSCve94250

SFDataCorrelator coring due to ids_event_msg_map message being null

CSCve94848

MC2000 and MC4000 can rarely hang during boot

CSCve95026

ids_event_alerter causes high CPU on Threat Defense device when UUID is missing from EOAttributes

CSCve95168

Unicode file support over SMB on Firepwer Threat Defense

CSCve97997

Multiple CLAM update tasks created in the AQ ,during device registration.

CSCve99153

Access control policy/Pre-filter rules are negated and readded on usage of icmp objects

CSCve99203

256 low block count leads to traffic failures due to alloc to inspect snort

CSCve99622

Intrusion event of old session is missing after update and config deploy

CSCvf02208

Management Center: Deleting 1 category in nested access control policy deletes all categories

CSCvf05977

Firepower Threat Defense management interface link flaps when IPv6 gateway is configured

CSCvf09887

Performance graphs are inconsistent when processed_total_packets is 0

CSCvf09949

Incorrect access control rule is matched in Threat Defense device when it is setup in passive mode

CSCvf10781

SFDataCorrelator segfaults repeatedly when processing SSL certificate details

CSCvf15216

When SSL rules are enabled and sensor is over subscribed, rules are not correctly enforced.

CSCvf15265

SFDataCorrelator takes a long time to start due to large firewall_rule_cache table

CSCvf16288

after captive portal authentication, packet is incorrectly associated with realm ID 0

CSCvf16799

DH Ephemeral Keys with Known Key SSL Policy and session reuse causes client to close session.

CSCvf18368

Long traffic connections matching Do Not Decrypt SSL rules may be blocked

CSCvf22098

Management interface bootstrap fails with IPv6 only configuratiom and no available DHCPv4 servers

CSCvf36025

SFDataCorrelator segfaults during loading of compliance rules

CSCvf38056

SSL flows failing due to Flow tables and Flow ID's overflowing

CSCvf38081

SSL policy Category lookup fails for URLs that aren't in local database

CSCvf39476

Rules getting pushed after the Default Block All Rule on Firepower Threat Defense device

CSCvf43107

Estreamer Cores - SSLCert length handling

CSCvf54853

Large database size for devices upgraded from 6.1.0.x to 6.2.0.x

CSCvf55850

access-list rules missing after policy deployment on Firepower Threat Defense

CSCvf71086

Port-channel cannot be configured as a passive interface

CSCvf75781

Firepower Threat Defense device may leave cluster due to disk space alert

Issues Resolved in Version 6.2.0.2

The following table addresses resolved caveats at the time of publication of these release notes. If you have a Cisco support contract, use the following dynamic queries for an updated list of resolved caveats, run the provided query in the Bug Search Tool:

- Resolved Firepower Management Center Virtual caveats in Version 6.2.0.2

- Resolved Firepower Management Center Virtual caveats in Version 6.2.0.2

- Resolved ASA FirePOWER Module caveats in ASA Version 9.7.x

Caveat ID Number

Description

CSCvc57886

'Search' in access control policy returning incorrect results.

CSCva78299

access control Policy Report Differs from access control Policy Web Interface

CSCvc24013

Firepower Management Center not providing options to restrict ICMP types for certain codes

CSCvd69506

Network range with a space after the dash removes current and subsequent ACP rules

CSCvc10913

SFDataCorrelator polling for status of file analysis can fail in certain circumstances

CSCvd05788

Communication channel is blocked if recurring backup fails due to disk space on remote server

CSCvc09017

Show Nat flows on series 3 displays incorrect data

CSCvd14261

Fail to create Threat Defense high availability due to previous failed attempt

CSCve17179

Firepower Management Center high availability Sync can delete csm config files

CSCvd38500

Performance issue with Device listing page

CSCvd75631

Threat Defense DHCP Client tries to request a DHCP address instead of declining

CSCve47923

eStreamer log spam "Unable to open directory"

CSCve44987

eStreamer service sends corrupt messages and spams log files with "Not connected"

CSCuy50039

In Task Status page the task is stucked/spinning

CSCvd23471

ASA may traceback while loading a large context config during bootup

CSCvd04066

PBR config is blocked in FlexConfig

CSCvc53358

Interfaces not interpreted in hardware when contexts have 'lag' in their name

CSCvd37902

nse interface intialization has not occurred, but still receiving packets

CSCvc37876

Policy deploy fails due to inconsistency in HA Primary Threat Defense device in the backend

CSCvc56921

Altering logging settings like disabling syslog causes IPS and File policies to become disabled

CSCvc50598

Comparison reports for intrusion policy between 2 revisions is not working correctly

CSCvc04546

Discard does not rollback the updated Firepower Recommendation.

CSCvd60359

During backup intrusion policy error message on save should be intuitive.

CSCuy93365

Flowbit auto-resolution not working properly

CSCvd72697

Intrusion policy commit is slow because prepare statement is called multiple times

CSCva90055

change impact_flag on IPS/snort rule to red/orange/yellow/blue/gray

CSCvb28212

False warnings in DB Integrity Check for rule_comments/rule_comment_map

CSCvd32767

Unable to use objects inside IPS rules

CSCvc16184

Cannot re-arrange order of Network Analysis Rules

CSCvd62553

Policy deploy with NAP fails when adaptive profiles or auto detect setting is disabled in NAP

CSCvc48768

Search Option does not work for network objects under NAP editor

CSCur46880

Encapsulated traffic not matching hardware rules

CSCvd12448

Message "CSR access problem for ME 25" flooding dmesg

CSCvb40875

Default inspect statements are missing on ASA 5500-x and 2100 device running Threat Defense

CSCvd34691

Firepower: With SafeSearch on, users can't access multiple websites.

CSCvd55859

Snort segfault while processing malware cache.

CSCvd01332

With Safesearch configured but disabled, can lead to cores

CSCvd80218

Able to create Bridge group interface from global domain but device is in leaf domain

CSCvd90766

Deployment failed and internal error occurred when deleting Port channel inline set and deploy

CSCvd38316

Deployment is getting failed in high availability pair due to cluster inline-set interface.

CSCve01438

IP Address/Mask validation for Stanby Address missing during high availability formation

CSCvd83682

PPPoE User Name field should allow more characters

CSCve41306

Firepower Management Center 'Interface Type Mismatch with Syslog Server Ip Type' error

CSCvc10668

Unable to edit network objects when they are shared between devices

CSCvd65669

Standard ACL elements deployed in wrong order

CSCvb63720

Pseudo rule IDs are not unique when multiple DNS policies are deployed simultaneously

CSCvd09003

Checking for conflicts in variable sets doesn't work on network groups

CSCva92910

Too many addresses in HOME_NET results in failed deployment

CSCvd35243

C-groups modification during policy apply causes AAB to trigger.

CSCvb13791

Not able to login to Firepower 4100 using 'connect ftd' CLI

CSCvc94908

Qos Rule and interface widget doesn't display stats for QoS rules

CSCvd56292

Default "global_policy" service-policy removed after reboot

CSCvd18507

SFDataCorrelator segfault due to multi-threaded curl on HTTPS

CSCvb24824

Suspected latency during shared memory lookup (with URL Retry enabled)

CSCvc17167

URL Filtering stopped working due to major version change in the BC database

CSCvc92397

Webpages loads very slowly when URL retry is enabled

CSCvd90101

Report generation fails if the remote storage device is unmounted by another action

CSCvb16465

Security Intelligence category goes missing from Security Intelligence events after time

CSCve35816

SFDataCorrelator segfault due to null pointer dereference in handle_host_address_changes()

CSCvd76935

Unchecked host count growth after SFDataCorrelator reconfigure

CSCvd41052

Scheduler Queue Corruption leads to connectivity failures or failover problems after 9.6(2)

CSCvd74162

snort core in alert action.

CSCvd66343

Unable to block bittorent traffic when download is resumed after moving to a new network

CSCvc84361

Cisco Firepower Threat Defense and Cisco ASA with FirePOWER Module Denial of Service Vulnerability

CSCvc51173

Enabling SSL Policy may result in detection engine exits

CSCve02069

2048 byte block depletion with continuous SSL traffic and decrypt resign enabled on Threat Defense.

CSCvd93722

SSL Block action when Extended Master Secret is used with SSL Policy Known Key Decrypt

CSCvd41054

SSL Trusted CAs not deployed to sensor in some cases

CSCvc07857

Unable to disable Proxy Auth on Management Center by un-checking the proxy auth box

CSCvd11997

Database settings for a fresh deployment were not saved

CSCvd92322

ICMP Any in dst/src ports are saved incorrectly, which can result in broken pre-filter policy

CSCuy17170

After upgrading to 6.0, you cannot remove tasks from the taskbar

CSCvd04922

captive portal ntlm needs to handle token received in POST in addition to GET.

CSCvc93679

Firepower doesn't support userPrincipalName attribute for login with ISE / Active authentication

CSCvd94183

Intermittent failure in User Group lookup.

CSCvd77847

Management Center deployment fails due to error after creating a domain with devices

CSCva06227

Only 1500 Group Members are downloaded per group for an AD Realm

CSCvd45766

PxGrid sent MAB and internal ISE DB info to /var/log/messages cause outage on Management Center

CSCvd73834

Show user information in connection events for flows hitting early deny

CSCvd27278

UIMP fails importing all users if any user in the import list has been deleted

CSCvd71808

Users are removed from groups after scheduled user/group download

CSCva98254

Trying to delete an identity realm that is in use breaks the identity realm

CSCvc91320

"Failed to set user name for lights-out management" error when trying to change admin pw on FMC1500

Issues Resolved in Version 6.2.0.1

The following table addresses resolved caveats at the time of publication of these release notes. If you have a Cisco support contract, use the following dynamic queries for an updated list of resolved caveats, run the provided query in the Bug Search Tool:

- Resolved Firepower Management Center caveats in Version 6.2.0.1

- Resolved Firepower Management Center Virtual caveats in Version 6.2.0.1

- Resolved ASA FirePOWER Module caveats in ASA Version 9.7.x

Caveat ID Number

Description

CSCvb39435

Import of Access control Policy fails after upgrade to 6.1

CSCuz46366

Files not Sandboxed even when they are under file limit.

CSCvb69285

Policy Export fails partially in Firepower ASDM 6.1

CSCvb63352

SafeSearch breaks for retransmitted packets

CSCvb19716

FR Scale: Large File Copy (>4GB) Fails In SFTunnel

CSCvb82371

AC policy:Deployment failure is happening due to rule update issue

CSCvb08840

Policy cant be applied when SRU and automated deploys run in parallel

CSCvb63664

Passive Authentication with User Agent is not working for some users

CSCvb85231

Intrusion Email Alert is not working

CSCvb67792

Intrusion Emails no longer send after upgrading to 6.1

CSCvb24807

After 6.1 upgrade, stale entries in fireamp_cloud table cause UI problem

CSCvc51117

ASA to FTD migration may fail when invalid characters are used in an access-list name

CSCvb66611

ASA to FTD migration script creates nested port group objects, which causes deployment to fail

CSCvc09761

Cannot delete multiple rules at a time from ASA migrated Prefilter Policies

CSCvc52158

FQDN objects getting imported in FMC from migration tool generated .sfo

CSCvc36047

Having "0" at the object service PING service icmp echo 0 causes migration to fail

CSCvc46502

FTD Cluster 9K block depletion with fragmented Traffic

CSCvc48702

Migration fails when SLA monitor configuration is present

CSCvb20859

Migration report succeed but sfo creation & cleanup fails intermittently

CSCvc18928

Unable to import ASA config file in migration tool i.e 6.1.0-330

CSCva59135

When a migration activity in progress new migration need to be blocked

CSCuz90632

Backup done remotely can't be restored locally

CSCvb24755

Cardmanager on ASA5585-SSP-40 SFR exits due to a SIGPIPE signal

CSCuz40408

system support capture traffic parser rejects slash used in net filter

CSCvc54134

Device goes into reboot loop one after another until failover cable is removed

CSCvd20947

Unable to deploy AC policy to an FTD HA pair due to an object description with the '&' character

CSCvc33995

Context Explorer performance issues due to query incorrectly joining two event tables

CSCvb24378

Add ability to enable or disable default inspect configuration

CSCvb51382

FTD:Not able to login to converged cli using SSH

CSCvb52751

DB error after trying to add and survey network in whitelist profile

CSCvb27494

Cisco Firepower Malware Detection Bypass Vulnerability

CSCvc12727

snort core file when processing bltd packets

CSCvb67848

SSL widgets lack data labels in 6.1

CSCvb52344

some perl processes leak semaphores

CSCvc76394

Time-ordered EQE queries against partitioned event tables are not optimized

CSCvc05376

FMC Database issues causing Missing Passive User Sessions via User Agent failure

CSCvc49789

OptimizeTables.pl always fails on 6.1.0

CSCvb35499

Upgrade 6.0.1.2 to 6.1.0-330 fails at 560_install_version_masked_apps.pl

CSCvb01821

Policy deployment failing on FMC for VMWare

CSCvb96776

Frangelico: FMC HA: HA establishment fails due to large database files copy

CSCuz95008

eStreamer 5.4 clients are unable to process userID info on 6.0 Firepower Management Center metadata

CSCvc53293

Estreamer cores found in DC-HA setup

CSCvc30591

estreamer should use correct datastore for user identity mapping.

CSCvb88976

High unmanaged disk usage due to large flow_chunk table

CSCvc05323

snort is restarting and filling the disk with logs.

CSCvb79079

Adding syslog to Access Control Rule may result in loss of Real Time Eventing

CSCvb70786

ids_event_alert coring on 6.1.0

CSCvc44292

ids_event_alerter can crash or infinite-loop

CSCva23034

Latency in FMC HA synchronization

CSCvc10655

access control Policy Deployment failed after patch installation(6.1.0.330 to 6.1.0.1.30)

CSCvb91730

Attempting to change copper SFP interfeace type (inline/switched/routed) results in error

CSCva12703

SCALE: Health alarms are not displayed in UMS

CSCvc37927

Import fails with duplicate object name when the object names differs by case only

CSCvc52214

Import with config involving inline values fails

CSCvb02417

adaptive profiling performance scales badly in some cases

CSCvb42559

Firepower Management Center Smart Licensing bypasses Proxy Configuration when in eval mode

CSCvc06397

Upgrade on Off-box ASA-FTD breaks Malware cloud lookup.

CSCvc48851

Network Object not listed under the custom rule editor in NAP

CSCvc01694

Enable flow control on stacking interfaces

CSCvb78786

Network Discovery fails to parse zones in ND rules under certain conditions

CSCvb36847

Event QoS in legacy mode does not have an entry for interface stats

CSCva07265

Incorrect rule being logged for application rules that go pending.

CSCvb65052

Network based AC rules don't always match if preceded by a rule with application/url

CSCvb52057

SafeSearch dropping legitimate traffic since paf not marking packet flags

CSCvb46555

Segmentation fault at HttpPacketModification, httpModProcess

CSCvc49641

Snort process segfaults processing traffic in firewall (ngfw).

CSCvb77099

Traffic misses matching AC rule

CSCvc44398

URL not extracted from reassembled requests

CSCvb24768

Security Zone is "Unknown" after upgrade to 6.1

CSCvb55593

DHCP Relay configuration does not display in UI after 6.1 upgrade

CSCvb53091

platform settings page fails to load when applied to multiple stacks

CSCvb75591

Security Intelligence DNS Feed based logs not sent to external Syslog

CSCvb68226

Constant failovers on ASA high availability pair due to SSP module failure

CSCvb85507

Evaluation of sfims for CVE-2016-5195 (DIRTY CoW)

CSCvb97742

FP or AMP 7000/8000 series sensor kernel deadlock on 6.1

CSCvc26880

oom condition leads to repeated RCU stall warnings

CSCvc50232

SFR upgrade to 6.1.0 causes erroneous HA failovers and/or traffic loss under load on 5585-40,60

CSCvb96160

CWE-200 - M4-FMC - TLS/SSL Birthday attacks on 64-bit block ciphers

CSCvc23451

Evaluation of sfims for NTP November 2016

CSCva90011

FR - CVE-2011-3389 -TLS/SSL is enabling BEAST attack

CSCvc64050

ASAConfig uses wrong interface IDs after module unit rejoins multi context ASA cluster

CSCvb81176

Bird fix for segfault needs to be ported to EC and FR

CSCva89342

Interfaces get deleted on SFR during Multi-context HA configuration sync

CSCvb66334

OOM keeps running, series3 units keep crashing, requiring reboot

CSCvb40343

PM generated commands can break dhcrelay if using more than 22 lifs

CSCvc73128

Reservation of core 0 for system processes in arc.conf is ignored by ARC.pm

CSCvb57747

Deploy during intrusion rule update install may cause all subsequent policy applies to fail

CSCvb68292

Httpmod preprocessor does not get disabled when safesearch rules are disabled

CSCvc57533

Policy Deployment may fail due to delta splitting logic fail

CSCvc11916

Removing special characters from UI in AC rule does not remove characters from lina config

CSCvb92968

Two PM instances running simultaneously

CSCva30652

spurious high unmanaged disk usage on /dev/shm alerts

CSCvc32479

Cannot load proxy information for dynamical analysis (sandbox)

CSCvb16413

URL Filtering option on GUI being unset/disabled intermittenly

CSCvb65642

Firepower FMC Risk Reporting has spelling mistakes!

CSCvb94393

SFDataCorrelator malware lookups take too long - UI shows timeout action

CSCuy91156

Cisco Firepower System Software FTP Malware Vulnerability

CSCvb40344

File policy oversubscription when many hosts process file.

CSCva89328

FTD gets into a bad state in which it has severe performance degradation

CSCuy65203

Inline result showing "would have dropped"

CSCvc08844

Retry packets never time out and keep being sent to Snort

CSCvc08057

Snort core is seen on FTD during rate limiting test

CSCvb74873

Snort crash during SMB inspection in file_capture_stop

CSCvb61018

some application and file policy combinations can cause snort to core

CSCvb52625

unexpected ACK packet for MDI malware file traffic connection

CSCvb62292

Cisco Firepower Detection Engine SSL Denial of Service Vulnerability

CSCvb92740

HTTPS pages take 30+ sec to load with SSL decryption and URL category rules enabled together

CSCvb38524

IPS and File detection is not working if Applications are FTP, FTP Data

CSCvc03589

Seg fault on SSL after policy apply

CSCvc11251

segfault in ns_net_mbrwq_release while processing SSL flow.

CSCvc55369

Snort segfault in process_ssl

CSCvc30521

SSL Handshake not completing for "Do Not Decrypt" action with large server certificate

CSCvb94411

SSL policy rules may match undecryptable actions too early in certain configurations

CSCvc09753

SSL rules with URL categories defined are not processed correctly

CSCvc10937

Platform settings policy so not appear to work for Firepower stacks

CSCvc43324

Changing admin user password may fail for systems not using LOM.

CSCux46182

"Failed to run troubleshoot script / failed (256)" on secondary DC.

CSCvc53628

'Available Ports' tab hangs when editing prefilter rule ports

CSCvb63264

Default Prefilter Policies are not imported properly on FMC2000

CSCvb03905

PrefilterPolicy DefaultAction Issue with 6.1.x FMC upgraded from 6.0.x managing 6.0.x FTD Device

CSCvc12080

Rules from prefilter policy do not retain order when saving policy

CSCvb46146

Don't allow different upgrade to start when upgrade is in failed state

CSCvc12702

bltd segfault processing checksum (computeChecksum).

CSCvb36748

captive portal support for ips on a stick

CSCuy05562

Deleting users from analysis->users doesn't remove sessions from sensor

CSCvc24316

Firepower Management Center does not handle Postured user session updates from ISE servers

CSCvb69906

Users are removed from groups after scheduled user/group download (database problem)

CSCvb92474

user_ip_map files being skipped while pushed from FMC to Sensor due to DaCo crash

Issues Resolved in Version 6.2.0

Caveat ID Number

Description

CSCuw70987, CSCux50957, CSCux86317

Resolved multiple vulnerabilities within the third party Open SSH, as described in CVE-2015-5600, CVE-2015-6565, CVE-2016-0777, and CVE-2016-0778.

CSCuw88390, CSCuw88396, CSCuw89094

Addressed a cross-site scripting (XSS) vulnerability, as described in CVE-2015-6363 and CVE-2016-1294.

CSCux41304, CSCuz52366, CSCvb24543, CSCvb48536

Addressed multiple vulnerabilities that generated denial of service in OpenSSL, as described in CVE-2015-3194, CVE-2015-3195, CVE-2015-3196, CVE-2016-2105, CVE-2016-2106 CVE-2016-2107, CVE-2016-2108, CVE-2016-2109, CVE-2016-2176, CVE-2016-2177, CVE-2016-2178, CVE-2016-2179, CVE-2016-2180, CVE-2016-2181, CVE-2016-2182, CVE-2016-2183, CVE-2016-6302, CVE-2016-6303, CVE-2016-6304, CVE-2016-6305, CVE-2016-6306 CVE-2016-6307 CVE-2016-6308 CVE-2016-6309 CVE-2016-7052 CVE-2015-3194, CVE-2015-3195 and CVE-2015-3196.

CSCux42288

Addressed a vulnerability issue in the third party Java, as described in CVE-2015-6420.

CSCux90163

Resolved a vulnerability where a user without Admin without privileges could delete other users' scheduled tasks.

CSCuy32284

Addressed a vulnerability in the third party GNU C Library, as described in CVE-2015-7547.

CSCuz52939, CSCvb24561, CSCvb24562

Addressed multiple vulnerabilities in the third party product Libxml2, as described in CVE-2016-2073, CVE-2016-444, and CVE-2016-4448.

CSCuz92632

Addressed multiple vulnerabilities in the third party product NTP, as described in CVE-2016-4953, CVE-2016-4954, CVE-2016-4955, CVE-2016-4956, and CVE-2016-4957.

CSCvb24566, CSCvb24564 CSCuz52935

Address multiple vulnerabilities in the Libarchive, as described in CVE-2016-1541, CVE-2016-5844, and CVE-2016-6250.

CSCuu96447

In some cases, if you deleted the permanent license from the Licenses page System > Licenses, the Device Management page Devices > Device Management did not display Unlicensed for devices the permanent license was deleted from when it should have, and policy deploy would fail.

CSCux64898

In some cases, if you deployed an access control policy with the default action set to Block and executed the configure network management-interface disable-event-channel CLI command, Firepower continued to generate intrusion and connection events when it should not have.

CSCux78211

Resolved an issue where, if an ASA FirePOWER module in high availability experienced a partial failure, the device did not failover when it should have.

CSCux91934

Resolved an issue where, if you deployed an SSL policy configured with a rule associated with an expired SSL certificate, Firepower used an incorrect SSL rule.

CSCuy28088

Cannot apply FP8130-CTRL-LIC to AMP8050.

CSCuy49371

If you clicked Create Email Alert on the Alerts page Policies > Actions > Alerts and enabled Retrospective Events configuration on the Advanced Malware Protection Alerts tab, then saved and applied, the email alerts generated by Firepower when the alert was triggered were truncated. Emails should not have been truncated.

CSCuy51566

If you updated a Firepower Management Center from Version 5.4.x to Version 6.0.0 or later and created a new sub domain and deployed a network discovery policy, you could not delete any objects or object groups referenced by the network discovery policy in the global domain.

CSCuy57756

In some cases, if you broke a Firepower Threat Defense high availability pair, one of the devices in the pair stayed in standalone mode and Firepower could not recreate the high availability pair.

CSCuy67210

Not able to disable notifications on the Firesight manager Web interface.

CSCuy68648

Resolved an issue where, if you added a security zone on a Firepower Management Center running Version 5.4.0 or later and updated Firepower to Version 6.0.0 or later and deleted the security zone, Firepower generated an Object deletion restricted. Remove object from the following: Access control policies error even if the security zone was not referenced within a rule.

CSCuy83201

Fatal errors on applying policy from 6.0.0.1 with different vulnerability database.

CSCuz17315

Resolved an issue where Firepower generated erroneous Error found during SSL flow after server certificate messages for evicted SSL flows.

CSCuz17723

Firepower 9300 devices' high availability status is displayed incorrectly/inconsistent in the Firepower Management Center.

CSCuz24872

Original Client IP does not populate for dropped events when inline normalization enabled.

CSCuz46366

Firepower incorrectly allowed you configure sandbox file sizes from 0 MB to 100 MB on the Files and Malware Settings section on the Advanced tab of the access control editor. Firepower only supports capturing files as large as 10 MB. If you configured the sandbox environment to a file size larger than 10 MB, Firepower did not capture the file.

CSCuz49023

Resolved an issue where despite configuration of impact flag alerting for an eStreamer client, Firepower did not stream impact flag data.

CSCuz54417

If you deployed an SSL policy containing application rule conditions for SMTPS, POP3S, and IMAPS traffic, Firepower might have incorrectly displayed Unknown as the application protocol in the Connection Events page Analysis > Connections > Events.

CSCuz78239

DLL-Load vulnerability in Snort on Windows platforms.

CSCuz92255

Resolved an issue where, if you tested the default storage type on the Remote Stage Device section of the Configuration page System > Configuration, Firepower incorrectly generated a Please enter valid host. Please enter a valid Directory path. error message.

CSCuz92983

Policy deployment fails with mode 10 Gbit Full-Duplex for lag interface.

CSCuz94444

Resolved an issue where the associated client incorrectly rejected resigned certificates for Apple related products and you could not log into iTunes.

CSCuz95008

Resolved an issue where, if you requested pre 6.0.0 metadata from a Firepower Management Center with eStreamer running Version 6.0.0. or later, Firepower incorrectly sent the userID field to the eStreamer client instead of the configured LDAP username.

CSCuz99677

Resolved an issue where, if you created a new user with an administrator role and deployed configuration, Firepower incorrectly displayed the default admin user as the user deploying the configuration instead of the newly created user.

CSCva00234

Resolved an issue where policy comparison did not include the high availability health modules when it should have.

CSCva01674

sfestreamer crashes when we have 4 management interfaces on Firepower Management Center.

CSCva12481

Disk manager marks conn-unified as deleted.

CSCva28854

Under rare conditions, when 7000 and 8000 Series devices where firstboot policy apply failed, file handles are depleted on the device which caused health/hardware alarms and a variety of malfunctions.

CSCva29636

Resolved an issue where, if you configure network management for a Firepower Threat Defense virtual device, the console incorrectly provided an HTTPS address to complete the installation when it should not have.

CSCva37443

If your ASA configuration file contained an invalid ICMP service object, the ASA-to-Firepower Threat Defense migration tool failed, but did not log adequate information to troubleshooting logs. Migration no longer fails under this condition. Instead, the tool excludes the invalid ICMP objects from the conversion, converts the related ASA access rules to disabled Firepower Threat Defense rules, and adds a comment to the rules describing the unsupported case.

CSCva38608

Resolved an issue where SHA1 signed certificate with a modern browser and Firepower generated untrusted certificate errors for modern browser.

CSCva41164

Version 6.2.0 does not support access control policy names including the $ character.

CSCva47456

Resolved an issue where, if Firepower requested a URL lookup and the cloud did not immediately return a URL category, the cached request incorrectly remained marked as Pending instead of updating the URL type to Uncategorzied.

CSCva49869

Report generation did not give a failed message, continues in queue for week.

CSCva51022

If you deployed a pair of network object groups to a Firepower Threat Defense high availability pair and the network object group IP addresses on either the active and standby device overlapped with the IP addresses on the other device within the pair, deployment failed and Firepower generated a Deployment failed due to configuration error message in the Message Center.

CSCva51662

Resolved an issue where, if you clicked Launch Readiness Check while another readiness check is in the queue and closed the dialog window, Firepower incorrectly started a new readiness check task .

CSCva57174

On a Firepower Threat Defense Virtual with RIP and redistribution configured, even if you disabled RIP and redeployed, the device continued to use RIP.

CSCva58269

Resolved an issue where, if you created alerts associated with a domain and then deleted the domain, Firepower did not remove the alerts from the database when it should have.

CSCva58393

User is able to apply smart licenses on AWS HB device.

CSCva58411

Resolved an issue where, if you added smart licenses to a Firepower Threat Defense high availability pair, the smart licensing widget on the dashboard page did not load.

CSCva59135

The ASA-to-Firepower Threat Defense migration tool can convert only one ASA configuration file at a time. If you started a conversion while a conversion task was in progress, Firepower displayed an Error 500 Internal server error message. Firepower now displays a warning message that a migration is already in progress.

CSCva63604

Resolved an issue where, if a security module on a Firepower Threat Defense cluster with an access control policy containing more than 10,000 rules reloaded, the security module failed to re-join the cluster and generated a All data interfaces have been shutdown due to clustering being disabled. To recover either enable clustering or remove cluster group configuration warning.

CSCva67943

Resolved an issue where, if you enabled common criteria (CC) mode on an appliance for security certifications compliance and the syslog server certificate did not contain serverAuth, Firepower incorrectly passed connections to the syslog server when they should have failed.

CSCva72899

Access control policy report fails if category has span across 50 rules.

CSCva81548

Improved configuration deployment performance.

CSCva82945

The Interfaces tab of the device management page for a Firepower Threat Defense device now displays the current status for interfaces on the device.

CSCva89328

Resolved an issue where, if you deployed an intrusion rule containing an AppID web application condition and a managed device experienced a high volume of traffic containing an excessive amount of similar connection types that did not apply to the AppID application, the application detection process took more time than it normally should and caused latency for other traffic matches.

CSCva89342

If you created an ASA Firepower module high available pair configured for multi-context mode and deployed one or more security zone from the managing Firepower Management Center, then the standby ASA Firepower module within the pair restarted, the standby ASA Firepower module incorrectly removed all security zones and interfaces.

CSCva93408, CSCva93158

Improved the RPC decoder.

CSCva99998

Resolved an issue where Firepower did not restrict read-only users from editing the blacklist page when it should have.

CSCvb02417

Adaptive profiling performance scales badly in some cases.

CSCvb02846

Resolved a rare issue where, if you switched Firepower Management Center high availability peers twice and viewed the Smart Licenses page System > Licenses > Licenses > Smart Licenses, the table of devices and any edit windows failed to load.

CSCvb05694

Resolved an issue where, if you deployed an SSL policy and traffic with an HTTP tunnel matched the SSL policy, Firepower dropped some traffic and experienced high CPU use and overall latency.

CSCvb08840

Resolved an issue where, if you enabled automated intrusion rule updates for an ASA Firepower module managed by ASDM, and the device simultaneously deployed automated deployments, the device experienced issues.

CSCvb11574

Resolved an issue where, if you deployed an access control policy containing a custom application detector and deleted the application detector, Firepower did not generate a warning that the application detector must be removed from the access control policy prior to deletion.

CSCvb11642

Resolved an issue where, if you created a network discovery policy configured to detect hosts and a correlation policy containing a rule set to trigger if discovery event occurs and the OS information for a host has changed, then added a condition for if OS name is unknown and added a remediation Nmap scan, discovery events matching the rules did not generated corresponding Nmap scans.

CSCvb11931

Resolved an issue where, if Firepower experienced an issue processing the first session of SMTP traffic between a client and an SMTP server, Firepower did not correctly identify the subsequent SMTP sessions as SMTP for the client-server pair and displayed Unknown in the Application Protocol column of the Connection Events page Analysis > Connections > Events.

CSCvb12453

Resolved an issue where, if you enabled common criteria (CC) mode on an appliance for security certifications compliance and the syslog server certificate did not contain host name matching the name of the server, connections to the syslog server incorrectly passed when they should have failed.

CSCvb12791

Resolved an issue where, if you enabled Common Criteria (CC) mode on an appliance for security certifications compliance and the syslog server certificate and/or intermediate certificate(s) have been revoked, Firepower incorrectly established a TLS connection with the syslog server without checking the revocation status.

CSCvb14402

Traffic by Initiator Report for User Renders No Output.

CSCvb19366

Cisco Firepower Management Center Information Disclosure Vulnerability.

CSCvb19716

Resolved an issue where Firepower Management Center high availability synchronization failed if the total size of the database files and logs totaled more than 4GB.

CSCvb20859

Intermittently, if the ASA-to-Firepower Threat Defense migration tool could not migrate an ASA configuration because the access control list was not applied via a valid access-group command, Firepower did not complete internal operations related to that migration, and you could not start another migration.

CSCvb24378

You can now enable or disable default inspection with the command line interface on a Firepower Threat Defense device using configure inspection <inspection_name> enable|disable.

CSCvb24768

Resolved an issue where, in some cases, if you updated a system containing at least one security zone to Version 6.1 or later, the Interfaces page Devices > Interfaces might incorrectly displayed the security zone state as Unknown .

CSCvb24807

In rare cases, after you updated the Firepower Management Center to Version 6.10, the dynamic analysis page AMP > AMP Management would not load.

CSCvb25963

Resolved an issue where, if you formed a Firepower 4100 series series or Firepower 9300 high availability pair with devices containing named interfaces and assigned a portchannel from the FXOS chassis manager, then edited the Interfaces tab of the high availability pair listed on the Device Management page Devices > Device Management and saved, Firepower did not include the interfaces created for the high availability pair when it should and, in some cases, deployment failed.

CSCvb26266

Resolved an issue where, if you enabled captive portal on a system and updated to Version 6.1.0, captive portal did not work.

CSCvb28158

Workflow set with User Preferences not honored by Search Constraints.

CSCvb28202

False warnings in database Integrity Check for PlatformSettings object.

CSCvb32484

Upgrade to 6.1 fails at 600_schema/000_install_csm.sh.

CSCvb32873

Cannot create new Application Filter Objects 6.1 on ASA managed by ASDM.

CSCvb35499

Resolved an issue where, in some cases, if you updated a system from Version 6.1.0 to Version 6.1.0.x, the update failed.

CSCvb35861

Resolved an issue where, if you created a high availability pair and synchronization requests overload the Tasks tab in the Message Center, Firepower experienced disk space issues and intermittent login issues.

CSCvb36645

Resolved an issue where, if incoming HTTP, TCP, or SSH traffic did not contain an SGT value in the header, traffic matched against the default access control policy instead of any other configured policy.

CSCvb36847

Event QoS in legacy mode does not have an entry for interface stats.

CSCvb39325

Resolved an issue where incoming HTTP and HTTPS traffic containing XFF fields caused system issues.

CSCvb39435

If you updated Firepower from a version earlier than Version 6.1.0 to Version 6.1.0 and immediately exported the access control policy, then imported the policy, importing the access control policy failed.

CSCvb40344

If you deployed a file policy to a device with an excessive amount of endpoints configured, Firepower experienced high CPU and memory use. As a workaround, you could redeploy configuration.

CSCvb41047

Resolved an issue where Firepower generated an incorrect Health monitoring running behind schedule health warning if the Firepower Management Center did not receive any health events from registered devices.

CSCvb42559

Firepower Management Center Smart Licensing bypasses Proxy Configuration when in evaluation mode.

CSCvb43868

Upgrade failing for v6.0.1 at 600_schema/000_install_csm.sh.

CSCvb44812

Resolved an issue where Firepower 4100 series series devices generated excessive logging and experienced storage space issues.

CSCvb44268

Resolved an issue where the Appliance Status widget did not load if you had 400 or more devices attached to a Firepower Management Center.

CSCvb46146

If updating Firepower failed and you attempted to update to a different version from the one that failed without resolving the original failure, the new install also failed and could cause Firepower to become unrecoverable.

CSCvb46555

Resolved an issue where, if you enabled Safe Search in an access control policy and deployed, Firepower incorrectly generated Primary Detection Engine Exiting health alerts.

CSCvb47847

Resolved an issue where, if you updated a system from Version 6.0.1.1 or later to Version 6.1.0, Firepower experienced a variety of issues such as update failure or Firepower Management Center login failure.

CSCvb51077

Resolved an issue where, if you added a remediation as a response to a rule in a correlation policy on a Firepower Management Center and created a high availability pair, then switch high availability peers, the new active Firepower Management Center did not correctly synchronize the correlation policy and the remediation experienced issues.

CSCvb52057

Resolved an issue where, if you deployed an access control policy containing rules with Safe Search enabled, some websites experienced latency when loading.

CSCvb57521

Firepower Management Center/FTD - Multiple default routes with same metric or gateway exists.

CSCvb57747

Deploy during intrusion rule update install may cause all subsequent policy applies to fail.

CSCvb60088

FTD policy deployment fails with Syslog Event class All.

CSCvb61055

Security Intelligence synchronization failure results in disk becoming full.

CSCvb61156

Resolved an issue where, if a Firepower Management Center running Version 6.1.0 managed a device running a version earlier than Version 6.1.0, Firepower did not generate any new discovery events and removed the network map several days after the Firepower Management Center updated to Version 6.1.0.

CSCvb61480

In some cases, if Firepower processed SIP packets, traffic containing voice or video content might have appeared distorted or experienced latency.

CSCvb61836

Resolved an issue where Firepower logged extraneous policy information during deployment and, in some cases, deploying large policies failed.

CSCvb65648

Resolved an issue where, if you deployed an access control policy containing an identity policy that referenced a realm or access control rules containing groups or users from the realm and you deleted the realm, Firepower incorrectly generated a System defined Objects cannot be Altered. Please use a different Object error and you could not edit the access control policy.

CSCvb66591

If you configured a realm for an Active Directory (AD) server to download users and groups, then created a Firepower Management Center high availability pair and the downloads contained large amounts of users and groups, Firepower Management Center high availability registration failed.

CSCvb67568

Resolved a rare issue where, if you created a realm and deployed an access control policy containing rules, then clicked Download users and groups and configured a User Agent connection, the user to group mapping became incorrect and access control rules using groups did not match when it should.

CSCvb68226

SFR upgrade to 6.1 causes constant failover between ASA FirePOWER module high availability pair.

CSCvb69742

6.0.0 pre install 5.4.0.999 nfp kernel modules fail to unload followed by outage.

CSCvb69906

Intermittently, if you created a realm and deployed an access control policy containing rules, then downloaded users and groups (including scheduled downloads), the user-to-group mapping could become incorrect, and access control rules using groups might not have matched when they should have.

CSCvb70125

Resolved an issue where policy deploy failed if you configured captive portal on a Firepower Management Center then updated the Firepower Management Center and its managed devices, then tried to redeploy.

CSCvb74873

If you enabled SMB File Inspection in a file policy and deployed to a device managed by theFirepower Management Center, Firepower generated Primary detection engine exited unexpectedly warning messages, and Firepower could experience issues.

CSCvb75591

If you deployed a DNS rule with a blacklist action containing a Security Intelligence DNS feed, Firepower did not send the Security Intelligence events to the external syslog if one was configured.

CSCvb78786

Firepower ignored security zone constraints on network discovery rules if the network discovery policy contained rules constrained by zones that included interfaces from multiple devices. This condition was present if the rules used single zones with interfaces from multiple devices (for example, Zone 1 included interfaces from Device 1 and Device 2) or multiple rules used different zones (for example if Rule 1 used Zone 1, which included interfaces from Device 1, and Rule 2 used Zone 2, which included interfaces from Device 2).

CSCvb79079

Resolved an issue where, if you added a syslog alert to an access control rule and deployed on an ASA FirePOWER module managed by ASDM, the device incorrectly generated excessive logging from prefilter policies.

CSCvb80872

Resolved an issue where, in some cases, updating a system to Version 6.1.0 and deploying to a registered device generated a Deployment failed in policy and object collection. If problem persists after retrying, contact TAC error message.

CSCvb88561

Resolved an issue where, if Firepower processed HTTP traffic containing XFF headers, Firepower experienced issues and generated erroneous detection engine health warnings.

CSCvb91730

Attempting to change copper SFP interface type (inline/switched/routed) results in error.

CSCvb91613

Snort cores after reload when processing XFF addresses.

CSCvb94411

In some cases, if you deployed an SSL policy containing an SSL rule with the action set to Do Not Decrypt placed above an SSL rule with the action set to Decrypt - Resign, Firepower incorrectly identified the sessions as undecryptable and matched against the wrong rule with an undecryptable action instead of the correct rule.

CSCvb97742

7000 and 8000 Series devices with low memory could experience a traffic outage and not recover.

CSCvc05323

Resolved an issue where snort restarts caused Firepower to generate extraneous NGFW Rule Engine Failed to write connection event log messages.

CSCvc08057

Resolved an issue where FTD devices experienced Snort cores while performing QoS rate limiting on destination interface objects.

CSCvc08912

No input validation on FTD Platform Setting syslog Logging Filter.

CSCvc09761

Cannot delete multiple rules at a time from ASA migrated Prefilter Policies.

CSCvc10655

Resolved an issue where deploying policies to a FTD device failed after updating to a new Firepower version.

CSCvc14561

Resolved an issue where the Firepower Management Center web interface was not available after enabling compliance mode.

CSCvc26880

Resolved an issue where, if a Firepower 8350 device or AMP8350 device produced an unusually large stream of messages on the serial port console or, if you enabled it, the Lights-out Management (LOM) console, the device became unresponsive.

CSCvc30591

eStreamer should use correct datastore for user identity mapping.

CSCvc31852

Resolved an issue where the Firepower Management Center Tasks tab displayed an incorrect amount of time taken for policy deployment.

CSCvc36047

Having 0 at the object service PING service icmp echo 0 causes migration to fail.

CSCvc37923

Resolved an issue where Firepower did not recover from a disk write error caused by disk full even after the disk full issue was resolved, causing excessive logging.

CSCvc37927

Import fails with duplicate object name when the object names differs by case only.

CSCvc44398

URL not extracted from reassembled requests.

CSCvc49641

Snort process segfaults processing traffic in firewall.

CSCvc49789

OptimizeTables.pl always fails on 6.1.0.

CSCvc53628

Available Ports tab hangs when editing prefilter rule ports.

CSCvc54134

Resolved an issue where, when a FTD high availability pair simultaneously rebooted, the pair continuously rebooted until the failover cable was removed.

CSCvc55170

Firepower Management Center login stops working if resume sync is selected after upgrade.

CSCvc58398

Firepower Management Center warnings needed during high availability configuration that configuration on the standby Firepower Management Center will be wiped.

CSCvd78303

Resolved an issue where the FTD device running Version 6.1.0.1 or Version 6.1.0.2 stopped passing traffic after 213 days of uptime and experienced a range of issues from limited connectivity to a traffic outage.

Chapter 12. Known Issues

The following tables address known issues open at the time of publication of these release notes. For an updated list of known issues, run the provided query in the Bug Search Tool.

- Known Issues

Known Issues

If you have a Cisco support contract, use the following dynamic queries for an updated list of open caveats in all available versions, run the provided query in the Bug Search Tool:

Version 6.2.0.1

- Firepower Management Center

- Firepower Management Center Virtual

- NGIPSv

- ASA FirePOWER

Version 6.2.0.2

- Firepower Management Center

- Firepower Management Center Virtual

- NGIPSv

- ASA FirePOWER

Version 6.2.0.3

- Firepower Management Center

- Firepower Management Center Virtual

- NGIPSv

- ASA FirePOWER

Version 6.2.0.4

- Firepower Management Center

- Firepower Management Center Virtual

- NGIPSv

- ASA FirePOWER

Version 6.2.0.5

- Firepower Management Center

- Firepower Management Center Virtual

- NGIPSv

- ASA FirePOWER

Version 6.2.0.6

- Firepower Management Center

- Firepower Management Center Virtual

- NGIPSv

- ASA FirePOWER

Chapter 13. For Assistance

Thank you for choosing Firepower.

For information on obtaining documentation, using the Cisco Bug Search Tool (BST), submitting a service request, and gathering additional information about Cisco NGFW and NGIPS devices, see What’s New in Cisco Product Documentation at: https://www.cisco.com/c/en/us/td/docs/general/whatsnew/whatsnew.html.

Subscribe to What’s New in Cisco Product Documentation, which lists all new and revised Cisco technical documentation, as an RSS feed and deliver content directly to your desktop using a reader application. The RSS feeds are a free service.

If you have any questions about installing or running Firepower, contact TAC Support:

- Visit the Cisco Support site at https://www.cisco.com/c/en/us/support/index.html.

- Email Cisco Support at mailto:tac@cisco.com.

- Call Cisco Support at 1.408.526.7209 or 1.800.553.2447.

Full Cisco Trademarks with Software License

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.

THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.

The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB's public domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.

NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS" WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.

IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.

All printed copies and duplicate soft copies of this document are considered uncontrolled. See the current online version for the latest version.

Cisco has more than 200 offices worldwide. Addresses and phone numbers are listed on the Cisco website at www.cisco.com/go/offices.

Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: http://www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1721R)