The Cisco Firepower security appliance is a next-generation platform for network and content security solutions. The Firepower security appliance is part of the Cisco Application Centric Infrastructure (ACI) Security Solution and provides an agile, open, secure platform that is built for scalability, consistent control, and simplified management.

The Firepower security appliance provides the following features:

• Modular chassis-based security system—Provides high performance, flexible input/output configurations, and scalability.

• Firepower Chassis Manager—Graphical user interface provides a streamlined, visual representation of the current chassis status and allows for simplified configuration of chassis features.

• FXOS CLI—Provides command-based interface for configuring features, monitoring chassis status, and accessing advanced troubleshooting features.

• FXOS REST API—Allows users to programmatically configure and manage their chassis.

New Features in FXOS 2.7.1.131

Fixes for various problems (see Resolved Bugs in FXOS 2.7.1.131).

New Features in FXOS 2.7.1.122

Fixes for various problems (see Resolved Bugs in FXOS 2.7.1.122).

New Features in FXOS 2.7.1.106

Fixes for various problems (see Resolved Bugs in FXOS 2.7.1.106).

New Features in FXOS 2.7.1.98

Fixes for various problems (see Resolved Bugs in FXOS 2.7.1.98).

New Features in FXOS 2.7.1.92

Cisco FXOS 2.7.1.92 introduces the following new features:

You can download software images for FXOS and supported applications from one of the following URLs:

• Firepower 9300 — https://software.cisco.com/download/type.html?mdfid=286287252

• Firepower 4100 — https://software.cisco.com/download/navigator.html?mdfid=286305164

For information about the applications that are supported on a specific version of FXOS, see the Cisco FXOS Compatibility guide at this URL:

https://www.cisco.com/c/en/us/td/docs/security/firepower/fxos/compatibility/fxos-compatibility.html

• To mitigate CSCvq34340, upgrading an FTD device to Version 6.5.0.2 turns off egress optimization processing regardless of whether the egress optimization feature is enabled or disabled. For more information, see Cisco Firepower Release Notes, Version 6.5.0.x.

• In FXOS 2.4(1) or later, if you are using an IPSec secure channel in FIPS mode, the IPSec peer entity must support RFC 7427.

• If you reinitialize a security module after upgrading to FXOS 2.6(1), you might receive an error message about disk partitions on that security module being incompatible if you later downgrade to an earlier FXOS release. To resolve this issue, you need to reinitialize the security module again after downgrading.

• When you configure Radware DefensePro (vDP) in a service chain on a currently running Firepower Threat Defense application on a Firepower 4110 or 4120 device, the installation fails with a fault alarm. As a workaround, stop the Firepower Threat Defense application instance before installing the Radware DefensePro application.

  Note	This issue and workaround apply to all supported releases of Radware DefensePro service chaining with Firepower Threat Defense on Firepower 4110 and 4120 devices.

• Firmware Upgrade—We recommend upgrading your Firepower 4100/9300 security appliance with the latest firmware. For information about how to install a firmware update and the fixes included in each update, see https://www.cisco.com/c/en/us/td/docs/security/firepower/fxos/firmware-upgrade/fxos-firmware-upgrade.html.

• When you upgrade a network or security module, certain faults are generated and then cleared automatically. These include a “hot swap not supported” fault or a “module removed when in online state” fault. If you have followed the appropriate procedures, as described in the Cisco Firepower 9300 Hardware Installation Guide or Cisco Firepower 4100 Series Hardware Installation Guide, the fault(s) are cleared automatically and no additional action is required.

FXOS 2.7(1) provides additional testing to verify the security module adapters on your security appliance. After installing FXOS 2.4.1.101 or later, you might receive a critical fault similar to the following indicating that you should update the firmware for your security module adapter:

Critical F1715 2017-05-11T11:43:33.121 339561 Adapter 1 on Security Module 1 requires a critical firmware upgrade. Please see Adapter Bootloader Upgrade instructions in the FXOS Release Notes posted with this release.

If you receive this, use the following procedure to update the boot image for your adapter. Note that this procedure may result in a traffic disruption, and thus should be performed during a maintenance window to avoid business impact.

1. Connect to the FXOS CLI on your Firepower security appliance. For instructions, see the “Accessing the FXOS CLI” topic in the Cisco Firepower 4100/9300 FXOS CLI Configuration Guide, 2.7(1) or Cisco Firepower 4100/9300 FXOS Firepower Chassis Manager Configuration Guide, 2.7(1).

2. Enter the adapter mode for the adapter whose boot image you are updating:

   fxos-chassis# scope adapter 1/security_module_number/adapter_number

3. Enter show image to view the available adapter images and to verify that fxos-m83-8p40-cruzboot.4.0.1.62.bin is available to be installed:

   fxos-chassis /chassis/server/adapter # show image
   Name Type Version
   
   --------------------------------------------- -------------------- -------
   
   fxos-m83-8p40-cruzboot.4.0.1.62.bin Adapter Boot 4.0(1.62)
   
   fxos-m83-8p40-vic.4.0.1.51.gbin Adapter 4.0(1.51)

4. Enter update boot-loader to update the adapter boot image to version 4.0.1.62:

   fxos-chassis /chassis/server/adapter # update boot-loader 4.0(1.62)
   Warning: Please DO NOT reboot blade or chassis during upgrade, otherwise, it may cause adapter to become UNUSABLE!
   After upgrade has completed, blade will be power cycled automatically
   fxos-chassis /chassis/server/adapter* # commit-buffer

5. Enter show boot-update status to monitor the update status:

   fxos-chassis /chassis/server/adapter # show boot-update status
   State: Updating
   fxos-chassis /chassis/server/adapter # show boot-update status
   State: Ready

6. Enter show version detail to verify that the update was successful:

   Note	Your show version detail output might differ from the following example. However, verify that Bootloader-Update-Status is “Ready” and that Bootloader-Vers is 4.0(1.62).

   fxos-chassis /chassis/server/adapter # show version detail
   Adapter 1:
   Running-Vers: 5.2(1.2)
   Package-Vers: 2.2(2.17)
   Update-Status: Ready
   Activate-Status: Ready
   Bootloader-Update-Status: Ready
   Startup-Vers: 5.2(1.2)
   Backup-Vers: 5.0(1.2)
   Bootloader-Vers: 4.0(1.62)

You can access the Firepower Chassis Manager using the following browsers:

• Mozilla Firefox—Version 42 and later

• Google Chrome—Version 47 and later

• Microsoft Internet Explorer—Version 11 and later

We tested FXOS 2.7(1) using Mozilla Firefox version 42, Google Chrome version 47, and Internet Explorer version 11. Other versions of these browsers are expected to work. However, if you experience any browser-related issues, we suggest you use one of the tested versions.

You can upgrade your Firepower 9300 or Firepower 4100 series security appliance to FXOS 2.7(1) if it is currently running any FXOS 2.0(1) or later build.

For upgrade instructions, see the Cisco Firepower 4100/9300 Upgrade Guide.

Installation Notes

• An upgrade of a single chassis to FXOS 2.7(1) can take up to 45-60 minutes. Note that your upgrade time may vary depending on the hardware, software, and complexity of your deployment. Plan your upgrade activity accordingly.

  Use scope system > show firmware monitor in the FXOS CLI to monitor your upgrade progress.

• If you are upgrading a Firepower 9300 or Firepower 4100 series security appliance that is running a standalone logical device or if you are upgrading a Firepower 9300 security appliance that is running an intra-chassis cluster, traffic does not traverse through the device while it is upgrading.

• If you are upgrading a Firepower 9300 or a Firepower 4100 series security appliance that is part of an inter-chassis cluster, traffic does not traverse through the device being upgraded while it is upgrading. However, the other devices in the cluster continue to pass traffic.

• Downgrade of FXOS images is not officially supported. The only Cisco-supported method of downgrading an image version of FXOS is to perform a complete re-image of the device.

The open and resolved bugs for this release are accessible through the Cisco Bug Search Tool. This web-based tool provides you with access to the Cisco bug tracking system, which maintains information about bugs and vulnerabilities in this product and other Cisco hardware and software products.

Note	You must have a Cisco.com account to log in and access the Cisco Bug Search Tool. If you do not have one, you can register for an account.

For more information about the Cisco Bug Search Tool, see the Bug Search Tool Help & FAQ.

For additional information on the Firepower 9300 or 4100 series security appliance and FXOS, see Navigating the Cisco FXOS Documentation.

Cisco provides online resources to download documentation, software, and tools, to query bugs, and to open service requests. Use these resources to install and configure Firepower software and to troubleshoot and resolve technical issues.

• Cisco Support & Download site: https://www.cisco.com/c/en/us/support/index.html

• Cisco Bug Search Tool: https://tools.cisco.com/bugsearch/

• Cisco Notification Service: https://www.cisco.com/cisco/support/notifications.html

Access to most tools on the Cisco Support & Download site requires a Cisco.com user ID and password.

If you cannot resolve an issue using the online resources listed above, contact Cisco TAC:

• Email Cisco TAC: tac@cisco.com

• Call Cisco TAC (North America): 1.408.526.7209 or 1.800.553.2447

• Call Cisco TAC (worldwide): Cisco Worldwide Support Contacts

• To receive timely, relevant information from Cisco, sign up at Cisco Profile Manager.

• To get the business impact you’re looking for with the technologies that matter, visit Cisco Services.

• To submit a service request, visit Cisco Support.

• To discover and browse secure, validated enterprise-class apps, products, solutions and services, visit Cisco Marketplace.

• To obtain general networking, training, and certification titles, visit Cisco Press.

• To find warranty information for a specific product or product family, access Cisco Warranty Finder.