Table of Contents

fxos113_rn

Cisco FXOS Release Notes, 1.1(3)

June 23, 2016

This document contains release information for Cisco Firepower eXtensible Operating System 1.1(3).

Use this release note as a supplement with the other documents listed in the documentation roadmap:

The online versions of the user documentation are occasionally updated after the initial release. As a result, the information contained in the documentation on Cisco.com supersedes any information contained in the context-sensitive help included with the product.

This document contains the following sections:

■Introduction

■What’s New

–New Features in FXOS 1.1.3.97

–New Features in FXOS 1.1.3.86

–New Features in FXOS 1.1.3.84

■Image Details

■Important Notes

■System Requirements

■Installation Notes

■Open and Resolved Bugs

–Open Bugs

–Resolved Bugs in FXOS 1.1.3.97

–Resolved Bugs in FXOS 1.1.3.86

–Resolved Bugs in FXOS 1.1.3.84

■Related Documentation

■Obtaining Documentation and Submitting a Service Request

Introduction

The Cisco Firepower 9300 security appliance is a next-generation platform for network and content security solutions. The Firepower 9300 is part of the Cisco Application Centric Infrastructure (ACI) Security Solution and provides an agile, open, secure platform that is built for scalability, consistent control, and simplified management.

The Firepower 9300 provides the following features:

■Modular chassis-based security system—provides high performance, flexible input/output configurations, and scalability.

■Firepower Chassis Manager—graphical user interface provides a streamlined, visual representation of the current chassis status and allows for simplified configuration of chassis features.

■FXOS CLI—provides command-based interface for configuring features, monitoring chassis status, and accessing advanced troubleshooting features.

■FXOS REST API—allows users to programmatically configure and manage their chassis.

What’s New

New Features in FXOS 1.1.3.97

Cisco Firepower eXtensible Operating System 1.1.3.97 introduces the following new features:

■Support for ASA 9.5.2.11.

■Fixes for various problems (see Resolved Bugs in FXOS 1.1.3.97).

New Features in FXOS 1.1.3.86

Cisco Firepower eXtensible Operating System 1.1.3.86 introduces the following new features:

■Support for ASA 9.5.2.2.

■Fixes for various problems (see Resolved Bugs in FXOS 1.1.3.86).

New Features in FXOS 1.1.3.84

Cisco Firepower eXtensible Operating System 1.1.3.84 introduces the following new features:

■Support for ASA 9.5.2.1.

■Inter-chassis clustering—FXOS 1.1.3 introduces support for clustering security modules together across multiple Firepower 9300 security appliances (also known as inter-chassis clustering). Inter-chassis clustering has been tested using up to six security modules.

■Flow offload—On security modules running ASA 9.5(2), you can identify select traffic to be off-loaded to a super fast path, where the flows are switched in the NIC itself. Off-loading can help you improve performance for data-intensive applications such as large file transfers.

■Packet Capture—allows you collect packets being sent to and from the customer-facing ports and backplane ports on a Firepower 9300.

■Support of the Smart License Manager satellite for the Firepower 9300. Customers who cannot, or do not, want to manage their Cisco products using the Cisco Smart Software Manager residing at software.cisco.com can choose to install the Cisco Smart Manager satellite on-premises. When the satellite application is enabled, you can activate, register, view, and transfer your company's licenses without sending data to Cisco Smart Software Manager using the Internet.

■Configuration Import/Export—allows you to import and export logical device and platform configuration settings as an XML file. You can also configure a recurring export task or configure a notification to remind you to perform an export.

■QoS—FXOS 1.1(3) adds support for prioritizing traffic based on QoS settings. QoS configurations specific to the Firepower 9300 are not user configurable. Most of the configurations are applied automatically during initialization, and some are applied during logical-device configuration.

■SGT Load Balancing—FXOS 1.1(3) adds support for load balancing of traffic with Secure Group Tags. There is no specific configuration or CLI available for this feature. It is statically enabled and cannot be disabled. SGT Load Balancing is supported for IPv4 traffic only.

■Fixes for various problems (see Resolved Bugs in FXOS 1.1.3.84).

Image Details

FXOS 1.1.3.97 includes the following components:

Component

Build Number

Image Location

FXOS 1.1.3.97 Platform Bundle

fxos-k9.1.1.3.97.SPA

ASA 9.5(2.11)

cisco-asa.9.5.2.11.SPA.csp

FXOS 1.1.3.86 includes the following components:

Component

Build Number

Image Location

FXOS 1.1.3.86 Platform Bundle

fxos-k9.1.1.3.86.SPA

ASA 9.5(2.2)

cisco-asa.9.5.2.2.SPA.csp

FXOS 1.1.3.84 includes the following components:

Component

Build Number

Image Location

FXOS 1.1.3.84 Platform Bundle

fxos-k9.1.1.3.84.SPA

ASA 9.5(2.1)

cisco-asa.9.5.2.1.SPA.csp

Important Notes

■Beginning with FXOS 1.1(3), the behavior for port-channels has changed. Now, when a port-channel is created, it will be configured as lacp cluster-detach by default and its status will show as down even if the physical link is up. The port-channel will be brought out of cluster-detach mode in the following situations:

–The port-channel's port-type is set to either cluster or mgmt

–The port-channel is added as a data port for a logical device that is part of a cluster and at least one security module has joined the cluster

If the port-channel is removed from the logical device or the logical device is deleted, the port-channel will revert to cluster-detach mode.

command was used after migrating to 1.1(3). All subsequent passwords created or changed while running 1.1(3) will be entered into and maintained in the password history mechanism.

■To use ASDM and other strong encryption features such as VPN, after you deploy a cluster you must enable the Strong Encryption (3DES) license on the master unit using the ASA CLI.

■If you encounter any issues with accessing the ASA console, we recommend that you switch to a different SSH client or upgrade to a newer version.

System Requirements

.

Supported Browsers

You can access the Firepower Chassis Manager using the following browsers:

■Mozilla Firefox – Version 42 and later

■Google Chrome – Version 47 and later

Testing on FXOS 1.1(3) was performed using Mozilla Firefox version 42 and Google Chrome version 47. We anticipate that future versions of these browsers will also work. However, if you experience any browser-related issues, we suggest you revert to one of the tested versions.

Installation Notes

After upgrading to FXOS 1.1(3), you must perform the following procedure.

Delete Default Trustpoint

The default trustpoint is generated by the SSL library. FXOS 1.1(3) has been upgraded to use Cisco SSL. Before your unit can connect to the Smart Licensing servers and download entitlements, you must first delete the default trustpoint so that the trustpoint can be regenerated using the new SSL library.

1. Connect to the FXOS CLI.

2. Enter the following commands to delete the default trustpoint:

3. Enter the following commands to reboot the system:

Open and Resolved Bugs

The open and resolved bugs for this release are accessible through the Cisco Bug Search Tool. This web-based tool provides you with access to the Cisco bug tracking system, which maintains information about bugs and vulnerabilities in this product and other Cisco hardware and software products.

.

.

Open Bugs

All open bugs severity 3 and higher for Firepower eXtensible Operating System 1.1(3) can be accessed using the following search and are also listed in the table below:

Table 1 Open Bugs Affecting FXOS 1.1(3)

Identifier

Description

CSCus73654

ASA do not mark management-only for the mgmt interface assign by LD

CSCut76730

Flow Offload : On new csp install ,offload engine not enabled

CSCuu17780

CLI allows to configure trap as "priv" even when user is set to "sha"

CSCuu18497

NTP radio button not selected even if configured

CSCuv18505

UI issues with creating port-channel (breakout port members) using CM

CSCuv76823

1G Copper and Fiber blink on EPM. Should stay Solid Green

CSCuv97491

Message enic_get_flowtable_ctrl(): error enic_get_ft_ctrl failed!!

CSCuv99740

Error message is not shown when the session memory usage is full

CSCuw03704

FXOS SW displays incorrect Supervisor VID

CSCuw31077

Filter applied to a interface should be validated

CSCuw37616

Deleting&adding interface in append mode has the deleted interface file

CSCuw43815

Currently running firmware bundle package deletion not allowed.

CSCuw61160

Warning message shown 3 times after edit cluster

CSCuw68106

after importing all configuration old user password might not work

CSCuw82080

ChassisManager: Must display port-channel operationalState

CSCuw86671

Smart License information should be included in export/import

CSCuw89854

Error message when creating session above or around 5GB

CSCuw95062

Bad error messages when downgrading ASA from chassis manager

CSCux04158

ASA app-instance failed with error"SMA_no_ssp_os_response_in_config_XML"

CSCux05403

9.5.2/main: VPN-Loadbalancing with SSP shows devices as SpykerD

CSCux05661

Chassis Manager: Acknowledge Security Module refers to "blade server"

CSCux15238

Supervisor switch dropping IPv6 Multicast packets

CSCux17304

blade is "not responding" but seems to be up

CSCux18974

SNMP value has truncated and copyright need to update

CSCux19618

SSP: "show mem" causes tcp drop under high loaded CPU

CSCux21401

Disabling cluster member can cause add-on license without standard lic

CSCux26822

If slave with entitlement becomes master, other slaves not synced

CSCux36990

Chassis Manager shows network module as "Empty" intermittently

CSCux37611

After fail tftp export, the export configuration remained enable state

CSCux37677

asa console slow response

CSCux37994

VLAN info not displayed in "show interface" output on SSP

CSCux44527

User should not be allowed to cancel in-progress import configuration

CSCux45823

PID value is showing empty in output for show fan-module detail

CSCux46537

Import-config failed at stage 4 importWaitForSwitch

Resolved Bugs in FXOS 1.1.3.97

The following table lists the defects that were resolved in Firepower eXtensible Operating System 1.1.3.97:

Table 2 Resolved Bugs in FXOS 1.1.3.97

Identifier

Description

CSCuy66912

Ping does not pass to outside network.FXOS-1.1(4.85) + ASA-9.6.0.124

CSCuy70690

Add app_id support for feature/snm

CSCuy79839

Handle MTS_OPC_SNM_NOTIF_MSG message in portAG

Resolved Bugs in FXOS 1.1.3.86

The following table lists the defects that were resolved in Firepower eXtensible Operating System 1.1.3.86:

Table 3 Resolved Bugs in FXOS 1.1.3.86

Identifier

Description

CSCux03547

SNMP mib object output changed.

CSCuy36940

FXOS l2-config mismatch from ASA MAC Addresses

Resolved Bugs in FXOS 1.1.3.84

The following table lists the previously release-noted and customer-found defects that were resolved in Firepower eXtensible Operating System 1.1.3.84:

Table 4 Resolved Bugs in FXOS 1.1.3.84

Identifier

Description

CSCuu22893

Dates not displayed on Updates screen

CSCuv59357

SSP3RU: Cluster: Unable to add 3 logical device in cluster

CSCuv65571

PSU PID and product name doesn't show after inserting new PSU

CSCuv78619

Delete App object fails even if no slot has that application installed.

CSCuv86427

Blade Health-LED showing green in fprm even though it's amber

CSCuw18186

REST local Cookies - not working osx Yosemite release and chrome 45.0

CSCuw30963

FP9300: Unable to 'fsck flash' for CSP

Related Documentation

.

Obtaining Documentation and Submitting a Service Request

.

. The RSS feeds are a free service.

. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)

© 2015-2016 Cisco Systems, Inc. All rights reserved.