Platform Enhancements

Dedicated AMP Appliances

Version 5.4 introduces a new Series 3 FirePOWER managed devices designed with additional processing power to maximize the performance of the FireSIGHT System’s AMP features. The AMP8050 is a 81xx Family device with support for Netmods and includes the additional storage necessary to function as a dedicated AMP appliance. The AMP8350 is an 83xx Family device also with support for Netmods and the additional storage required for AMP functionality. The AMP8350 model can be used as a stacked unit as the AMP8360, AMP8370, and AMP8390, for 2, 3, and 4 stacks, respectively.

FirePOWER Services Management Capabilities

Centralized Management of Cisco ASA with FirePOWER Services

The Defense Center is now able to manage FirePOWER Services (ASA FirePOWER devices) implementations running on ASA5506H-X, ASA5506W-X, ASA5508-X, and ASA5516-X devices in the same way it does on all of the other ASA5500-X devices. This enables the management of multiple ASA devices running ASA FirePOWER devices from a single Defense Center, as long as the ASA platform is running Version 9.3.1 or later and the ASA FirePOWER device is running Version 5.4.1 or later. Administrators will be able to configure intrusion detection and prevention policies, advanced malware protection, application control, user and group control, file control, and URL filtering and then apply those configurations to multiple ASA devices all at once. In addition, Defense Centers provide critical dashboards, event views, alerting capabilities, and reporting from all of your ASA FirePOWER devices in a single view.

Direct Management of Cisco ASA with FirePOWER Services

Cisco’s Adaptive Security Device Manager (ASDM) can be used to perform the same ASA FirePOWER management functions listed above, but only on one ASA device at a time (the ASA5506H-X, ASA5506W-X, ASA5508-X, and ASA5516-X devices). In addition, you can manage system policies, licensing, and back up and restore directly.

Management Limitations of Cisco ASA with FirePOWER Services

At the current time, the Cisco ASA FirePOWER product consists of two different products tightly integrated with each other: the ASA Firewall and the FirePOWER Next-Generation Intrusion Prevention System (NGIPS). Whereas critical data sharing between the two has been accomplished, a unified management platform is still in development.

For this reason, the Cisco ASA functionality is currently managed through the Cisco Security Manager (CSM) or the Adaptive Security Device Manager (ASDM), and the FirePOWER Services functionality is managed through the Cisco Defense Center. As a result, the Defense Center does not support any of the following capabilities:

■Cisco ASA hardware-based features, including clustering, stacking, switching, routing, virtual private networks (VPN), and network address translation (NAT).

■Configuring ASA interfaces. In addition, when FirePOWER Services are deployed in SPAN port mode, any ASA interfaces that have been configured will not be displayed.

■Shutting down, restarting or otherwise managing ASA processes.

■Creating or restoring backups from ASA devices.

■Writing access control rules to match traffic using VLAN tag conditions.

Note: The ASA platform provides these features, configured using the ASA command line interface (CLI) and ASDM. For more information, see the ASA FirePOWER module documentation.

Terminology

If you reference documentation for Version 5.3.1.x or Version 5.3.0.x, you may notice the terminology differs from the documentation for Version 5.4.0.2 and Version 5.4.1.1.

 

Tip: Cisco documentation may refer to the Defense Center as the FireSIGHT Management Center. The Defense Center and the FireSIGHT Management Center are the same appliance.

Features and Functionality Introduced in Previous Versions

The following features and functionality were updated in Version 5.4.1:

■The system now clears all intrusion policy locks when you upload intrusion rules or install intrusion rule updates.

FirePOWER Services Management Capabilities

Centralized Management of Cisco ASA5506-X with FirePOWER Services

The Defense Center is now able to manage FirePOWER Services (ASA FirePOWER devices) implementations running on ASA5506-X devices in the same way it does on all of the other ASA5500-X devices. This enables the management of multiple ASA5506-X devices running ASA FirePOWER devices from a single Defense Center, as long as the ASA platform is running Version 9.3.1 or later and the ASA FirePOWER device is running Version 5.4.1 or later. Administrators will be able to configure intrusion detection and prevention policies, advanced malware protection, application control, user and group control, file control, and URL filtering and then apply those configurations to multiple ASA5506-X devices all at once. In addition, Defense Centers provide critical dashboards, event views, alerting capabilities, and reporting from all of your ASA FirePOWER devices in a single view.

Direct Management of Cisco ASA5506-X with FirePOWER Services

Cisco’s Adaptive Security Device Manager (ASDM) can be used to perform the same ASA FirePOWER management functions listed above, but only on one ASA5506-X device at a time. In addition, you can manage system policies, licensing, and back up and restore directly.

Management Limitations of Cisco ASA with FirePOWER Services

At the current time, the Cisco ASA FirePOWER product consists of two different products tightly integrated with each other: the ASA Firewall and the FirePOWER Next-Generation Intrusion Prevention System (NGIPS). Whereas critical data sharing between the two has been accomplished, a unified management platform is still in development.

For this reason, the Cisco ASA functionality is currently managed through the Cisco Security Manager (CSM) or the Adaptive Security Device Manager (ASDM), and the FirePOWER Services functionality is managed through the Cisco Defense Center. As a result, the Defense Center does not support any of the following capabilities:

■Cisco ASA hardware-based features, including clustering, stacking, switching, routing, virtual private networks (VPN), and network address translation (NAT).

■Configuring ASA interfaces. In addition, when FirePOWER Services are deployed in SPAN port mode, any ASA interfaces that have been configured will not be displayed.

■Shutting down, restarting or otherwise managing ASA processes.

■Creating or restoring backups from ASA devices.

■Writing access control rules to match traffic using VLAN tag conditions.

Note: The ASA platform provides these features, configured using the ASA command line interface (CLI) and ASDM. For more information, see the ASA FirePOWER module documentation.

Platform Enhancements

VMware Tool Support

You can now use VMware Tools with FireSIGHT System virtual appliances. This enhances compatibility with the VMware environment and improves management of virtual devices by enabling soft power down, migration, and other virtual specific capabilities. VMware tools are supported on:

■64-bit Virtual Defense Center

■64-bit Virtual managed device

Note: As of Version 5.4 of the FireSIGHT System, the system supports ESXi version 5.0, 5.1, and 5.5.

Support for VMXNET3 Interfaces in VMware Virtual Appliances

VMXNET3 interface types are now supported on virtual devices. This allows you to use high-speed network interfaces, up to 10Gbits/s.

Multiple Management Interfaces

You can now use multiple management interface ports on Series 3 Defense Centers, FirePOWER (Series 3) managed devices, and virtual Defense Centers. You can set one interface for management traffic and another interface for event traffic. This improves deployment options in some environments.

Series 3 Support

Version 5.4 introduces the 3D7050 as a 70xx Family device with a dual core quad thread processor, 8GB of RAM, and a 80GB hard drive.

LACP Support

FirePOWER (Series 3) devices are now able to take part in Link Aggregation Control Protocol (LACP) (IEEE 802.3ad) negotiation to aggregate multiple links together into one. This allows both link redundancy and bandwidth sharing.

Defense Center 2000 (DC2000)

The DC2000 is a new Defense Center appliance platform that offers double the performance and capacity of the DC1500.

Defense Center 4000 (DC4000)

The DC4000 is a new Defense Center appliance platform that offers double the performance and capacity of the DC3500.

International Compatibility Enhancements

Unicode Support

The system now displays the names of files detected through file detection, malware detection, and FireAMP file events. This allows the display of non-Western characters, including those that are double-byte encoded.

Geolocation and Security Intelligence Data in Correlation Rules

The correlation rules engine has been updated to make connection, geolocation, and Security Intelligence data available. This allows you to generate correlated events or take correlated actions based on these two new constraints. For example, if an Impact 1 intrusion event is detected from a specific country, you can set up an alert to log that information to an external syslog server.

Support for Private FireAMP Cloud

With Version 5.4, you can use a private FireAMP cloud rather than the Cisco public cloud. This requires installation of a private cloud virtual appliance. The private cloud mediates interactions with the public cloud so you can gather collected threat information from the public cloud without exposing information from your network.

The following features and functionality were updated in Version 5.4:

Detection and Security Enhancements

Integrated SSL Decryption

FirePOWER (Series 3) devices can now identify SSL communications and decrypt the traffic before applying attack, application, and malware detection. You can use SSL decryption in any of the supported Series 3 device deployment modes, including inline and passive. SSL policies control characteristics of SSL in use within the enterprise, with SSL rules to exert granular control over encrypted traffic logging and handling.

Simplified Normalization and Preprocessor Configuration

You now configure traffic normalization and preprocessing in the access control policy, rather than the intrusion policy. This simplifies configuration, especially for new users. The sensitive data preprocessor, rule states, alerting, and event thresholds can still be configured at an individual intrusion policy level.

New file_type Keyword in the Snort Rule Language

A new file_type keyword is available in the Snort rules language that enables the specification of a file type for detection. This is a streamlined alternative to the existing flowbits -driven method.

Expanded IoC support from FireAMP Connectors

The list of Indicators of Compromise (IoC) provided by FireAMP is now dynamic and data-driven. As new IoCs become available, they are automatically supported by the Defense Center. This enhances the IoC correlation capability in any deployment where FireAMP is used.

Protected Rule Content

A new capability of the Snort rule language is available for use in high-security environments. You can now create a Snort content match using hashed data. This allows the rule writer to specify what content to search for, but never exposes the content in plain text.

Previously Changed Functionality

The following features and functionality were introduced in Version 5.41:

■Registered ASA devices now have configurable advanced options on the Advanced tab of the Device Management page (Devices > Device Management).

■The show users CLI command is now supported on ASA devices.

■You can configure alerts only for retrospective events or network-based malware events from the Advanced Malware Protections Alerts tab on the Alerts page.

The following features and functionality were updated in Version 5.4:

■You can now view VLAN tags for connection events in the event viewer (Analysis > Connections > Events).

■The system now identifies login attempts over the FTP, HTTP, and MDNS protocols.

■You can now select archived connection events separately from discovery events for transmission to the eStreamer client.

■The Discovery Event Health Monitor is no longer available in health policies.

■Expand Packet View, previously available in Version 4.10.x, is now a configurable option in Version 5.4 via the Event View Settings tab (Admin > User Preferences > Event View Settings).

■Importing a custom intrusion rule as an .rtf file now generates an Invalid Rules File 'rtf_rule.rtf': Must be a plain text file that is ASCII or UTF-8 encoded warning.

■You can now generate the following intrusion event performance graphs via the Intrusion Event Graphs page (Overview > Summary > Intrusion Event Graphs):

–ECN Flags Normalized in TCP Traffic/Packet

–ECN Flags Normalized in TCP Traffic/Session

–ICMPv4 Echo Normalizations

–ICMPv6 Echo Normalizations

–IPv4 DF Flag Normalizations

–IPv4 Options Normalizations

–IPv4 Reserved Flag Normalizations

–IPv4 Resize Normalizations

–IPv4 TOS Normalizations

–IPv4 TTL Normalizations

–IPv6 TTL Normalizations

–IPv6 Options Normalizations

–TCP Header Padding Normalizations

–TCP No Option Normalizations

–TCP NS Flag Normalizations

–TCP Options Normalizations

–TCP Packets Blocked by Normalization

–TCP Reserved Flags Normalizations

–TCP Segment Reassembly Normalizations

–TCP SYN Option Normalizations

–Total TCP Filtered Packets

–TCP Timestamp ECR Normalizations

–Total UDP Filtered Packets

–TCP Urgent Flag Normalizations

■You can now configure the HTTP Referrer and User Agent fields in the Connection Events table view and the Security Intelligence Events table view when configuring the displayed columns.

■You can now view warnings associated with the individual rules of your access control policy via the Access Control Policy page (Policies > Access Control). In the access control policy editor, view a warning by hovering your pointer over the alert icon next to the rule name and reading the warning in the tooltip text, or by selecting the Show Warnings button at the top of the page to view the warnings associated with all the rules referenced in your access control policy.

■In Version 5.4, inline normalization is automatically enabled when you create a network analysis policy with Inline Mode enabled. In previous versions, you had to manually enable inline normalization in your inline intrusion policies. Note that the update from Version 5.3.x to Version 5.4 does not change your inline normalization settings.

■You can now add access control rule port conditions that specify unassigned protocol numbers not included in the Protocol drop-down list.

■You no longer need a secondary rule to control FTP Data Channel in your access control policy.

■The new Decompress SWF File (LZMA), Decompress SWF File (Deflate), and Decompress PDF File (Default) HTTP Inspect preprocessor options offer enhanced decompression support for PDF and SWF file content.

■The TCP stream preprocessor now has enhanced protocol-awareness for SMTP, POP3, and IMAP.

■The system now provides enhanced detection of information in application traffic, including detection of application data in DNS traffic and detection of users in additional protocols.

■You can now configure LDAP authentication to use Common Access Cards (CACs) to associate the card with a user name so a user can log directly into the system using the card.

■The system now offers enhanced GPRS Tunneling Protocol (GTP) support.

Configuration and Event Backup Guidelines

Before you begin the update, Cisco strongly recommends that you delete or move any backup files that reside on your appliance, then back up current event and configuration data to an external location.

Use the Defense Center to back up event and configuration data for itself and the devices it manages. For more information on the backup and restore feature, see the FireSIGHT System User Guide.

Note: The Defense Center purges locally stored backups from previous updates. To retain archived backups, store the backups externally.

Caution: You must update your DC2000 and DC4000 BIOs to Version 2.0.1b in order to update your appliances to Version 5.4.1.1. Download the BIOs update via the Cisco Support site.

Traffic Flow and Inspection During the Update

The update process reboots managed devices. Depending on how your devices are configured and deployed, the following capabilities are affected:

■traffic inspection, including application awareness and control, URL filtering, Security Intelligence, intrusion detection and prevention, and connection logging

■traffic flow, including switching, routing, NAT, VPN, and related functionality

■link state

Note that when you update clustered devices, the system performs the update one device at a time to avoid traffic interruption.

Traffic Inspection and Link State

In an inline deployment, your managed devices (depending on model) can affect traffic flow via application control, user control, URL filtering, Security Intelligence, and intrusion prevention, as well as switching, routing, NAT, and VPN. For more information on appliance capabilities, see the FireSIGHT System Installation Guide.

The following table provides details on how traffic flow, inspection, and link state are affected during the update, depending on your deployment. Note that regardless of how you configured any inline sets, switching, routing, NAT, and VPN are not performed during the update process.

 

Switching and Routing

Series 3 devices do not perform switching, routing, NAT, VPN, or related functions during the update. If you configured your devices to perform only switching and routing, network traffic is blocked throughout the update.

Audit Logging During the Update

When updating appliances that have a web interface, after the system completes its pre-update tasks and the streamlined update interface page appears, login attempts to the appliance are not reflected in the audit log until the update process is complete and the appliance reboots.

Version Requirements for Updating to Version 5.4.0.2 and Version 5.4.1.1

To update to Version 5.4.1.1, a Defense Center must be running at least Version 5.4. If you are running an earlier version, you can obtain updates from the Support site.

A Defense Center must be running at least Version 5.4 to update its managed devices to Version 5.4.1.1.

The closer your device’s or ASA module’s current version to the release version (Version 5.4.0.2), the less time the update takes.

Caution: You must update your DC2000 and DC4000 BIOs to Version 2.0.1b in order to update your appliances to Version 5.4.1.1. Download the BIOs update via the Cisco Support site.

Note: If you plan on updating the system to Version 6.0, you must install the FireSIGHT System Version 6.0 Pre-Installation package prior to updating the Version 6.0. For more information, see the FireSIGHT System Release Notes Version 6.0 Pre-Installation Package.

Time and Disk Space Requirements for Updating to Version 5.4.0.2 and Version 5.4.1.1

The table below provides disk space and time guidelines for the Version 5.4.0.2 and Version 5.4.1.1 update. Note that when you use the Defense Center to update a managed device, the Defense Center requires additional disk space on its /Volume partition.

Caution: Do not restart the update or reboot your appliance at any time during the update process. Cisco provides time estimates as a guide, but actual update times vary depending on the appliance model, deployment, and configuration. Note that the system may appear inactive during the pre-checks portion of the update and after rebooting; this is expected behavior.

The reboot portion of the update includes a database check. If errors are found during the database check, the update requires additional time to complete. System daemons that interact with the database do not run during the database check and repair.

If you encounter issues with the progress of your update, contact Support.

 

Product Compatibility After Updating to Version 5.4.0.2 and Version 5.4.1.1

You must use at least Version 5.4.1 of the Defense Center to manage devices running Version 5.4.1.1. To manage the ASA FirePOWER modules ASA5506-X,ASA5506W-X, ASA5506H-X, ASA5508-X, or ASA5516-X device, you must use at least Version 5.4.1 of the Defense Center. Devices must be running the versions identified in the following table to be managed by a Defense Center running Version 5.4.1.1.

 

Note: You cannot update Cisco NGIPS for Blue Coat X-Series running Version 5.3.0.x of the FireSIGHT System directly to Version 5.4. Instead, you must uninstall the previous version and install Version 5.4. Note that this results in the loss of all configuration and event data on the X-Series installation. For more information, see the Cisco NGIPS for Blue Coat X-Series Installation and Configuration Guide.

Operating System Compatibility

You can host 64-bit virtual appliances running Version 5.4.1.1 on the following hosting environments:

■VMware vSphere Hypervisor/VMware ESXi 5.0

■VMware vSphere Hypervisor/VMware ESXi 5.1

■VMware vSphere Hypervisor/VMware ESXi 5.5

■VMware vCloud Director 5.1

You can install ASA FirePOWER modules running Version 5.4.0.2 on the following ASA platforms running ASA Version 9.3(2), ASA Version 9.3(3), ASA Version 9.4(x) and later, ASA Version 9.5(1.5), ASA Version 9.5(2), ASA Version 9.5(3), ASA Version 9.6(x) and later, ASA Version 9.7(x), ASA Version 9.8(x), and ASA Version 9.9(x):

■ASA5512-X

■ASA5515-X

■ASA5525-X

■ASA5545-X

■ASA5555-X

■ASA5585-X-SSP-10, ASA5585-X-SSP-20, ASA5585-X-SSP-40, and ASA5585-X-SSP-60

You can install ASA FirePOWER modules running Version 5.4.1.1 on the following AA platforms running ASA Version 9.4(x), ASA 9.5(1.5), ASA Version 9.5(2), ASA Version 9.5(3), ASA Version 9.6(x), ASA Version 9.7(x), ASA Version 9.8(x), and ASA Version 9.9(x):

■ASA5506-X

■ASA5506W-X

■ASA5506H-X

■ASA5508-X

■ASA5516-X

Note that you can install Version 5.4.1.1 on ASA5506-X platforms running ASA Version 9.3(2), ASA Version 9.3(3) as well.

Note that ASA5506-X devices managed by ASDM must be running ASDM Version 7.3(3) and later and 7.4(1) and later. For more information, see the FireSIGHT System Installation Guide or the FireSIGHT System Virtual Installation Guide.

You can run Version 5.4.0.2 of the Cisco NGIPS for Blue Coat X-Series on the X-Series platform running XOS Version 9.7.2 and later and Version 10.0 and later. For more information, see the Cisco NGIPS for Blue Coat X-Series Installation and Configuration Guide.

Web Browser Compatibility

Version 5.4.0.2 and Version 5.4.1.1 of the web interface for the FireSIGHT System has been tested on the browsers listed in the following table.

Note: The Chrome browser does not cache static content, such as images, CSS, or Javascript, with the FireSIGHT System-provided self-signed certificate. This may cause FireSIGHT System to redownload static content when you refresh. To avoid this, add a self-signed certificate to the trust store of the browser/OS or use another web browser.

Note: If you use the Microsoft Internet Explorer 11 browser, you must disable the Include local directory path when uploading files to server option in your Internet Explorer settings via Tools > Internet Options > Security > Custom level.

 

Many browsers use Transport Layer Security (TLS) v1.3 by default. If you have an active SSL policy and your browser uses TLSv1.3, websites that support TLSv1.3 fail to load As a workaround, configure your managed device to remove extension 43 (TLS 1.3) from ClientHello negotiation. See this software advisory for more information.

Screen Resolution Compatibility

Cisco recommends selecting a screen resolution that is at least 1280 pixels wide. The user interface is compatible with lower resolutions, but a higher resolution optimizes the display.

Returning to a Previous Version

If you need to return your appliance to a previous release of the FireSIGHT System for any reason, contact Support for more information.

Reimage Appliances

If you need to reimage your appliances to the current release of the FireSIGHT System for any reason, refer to the Installing Cisco NGIPS for Blue Coat X-Series section of the Cisco NGIPS for Blue Coat X-Series Installation and Configuration Guide for Cisco NGIPS for Blue Coat X-Series devices, the FireSIGHT System Virtual Installation Guide for virtual appliances, and the Restoring a FireSIGHT System Appliance to Factory Defaults section of the FireSIGHT System Installation Guide for all other appliances.

Note that if you uninstall a version of Cisco NGIPS for Blue Coat X-Series, you must restart the VAP before a new installation. This process can take several minutes.

To update to Version 5.4.0.2 or Version 5.4.1.1 from a Version 5.4.1 image, see Before You Begin: Important Update and Compatibility Notes and Installing the Update.

Download the following files from the Support site:

Note: Download the image directly from the Support site. If you transfer an image file by email, it may become corrupted.

■for Series 3 Defense Center

■virtual Defense Centers:

■for Series 2 managed devices:

■ for Series 3 managed devices:

■for 3D9900 managed devices:

■for virtual managed devices:

■for Cisco NGIPS for Blue Coat X-Series devices:

■for ASA FirePOWER modules:

■for Cisco ASA with FirePOWER Services (ASA5506-X, ASA5506H-X, ASA5506W-X, ASA5508-X, and ASA5516-X):

Note: To install the ASA FirePOWER module Version 5.4.1.1 image on Cisco ASA with FirePOWER Services, see the Cisco ASA FirePOWER Module Quick Start Guide for more information on deploying and installing the module.

Updating Defense Centers

Use the procedure in this section to update your Defense Centers, including virtual Defense Centers. For the Version 5.4.1.1 update, Defense Centers reboot.

Caution: You must update your DC2000 and DC4000 BIOs to Version 2.0.1b in order to update your appliances to Version 5.4.1.1. Download the BIOs update via the Cisco Support site.

Caution: Before you update the Defense Center, reapply access control policies to any managed devices. Otherwise, the eventual update of the managed device may fail.

Caution: Do not reboot or shut down your appliances during the update until after you see the login prompt. The system may appear inactive during the pre-checks portion of the update; this is expected behavior and does not require you to reboot or shut down your appliances.

Note: If you have inline normalization enabled and you update a Defense Center currently running Version 5.3.x to Version 5.4, the update process does not change the behavior of your policies. The system now adds user layers as necessary to preserve the settings that carried over.

Note: If you plan on updating the system to Version 6.0, you must install the FireSIGHT System Version 6.0 Pre-Installation package prior to updating the Version 6.0. For more information, see the FireSIGHT System Release Notes Version 6.0 Pre-Installation Package.

To update a Defense Center:

1. Read these release notes and complete any required pre-update tasks.

For more information, see Before You Begin: Important Update and Compatibility Notes.

2. Download the update from the Support site:

–for Series 3 and virtual Defense Centers:

Note: Download the update directly from the Support site. If you transfer an update file by email, it may become corrupted.

3. Upload the update to the Defense Center by selecting System > Updates, then clicking Upload Update on the Product Updates tab. Browse to the update and click Upload.

The update is uploaded to the Defense Center. The web interface shows the type of update you uploaded, its version number, and the date and time it was generated.

4. Make sure that the appliances in your deployment are successfully communicating and that there are no issues reported by the health monitor.

5. View the task queue (System > Monitoring > Task Status) to make sure that there are no tasks in progress.

You must wait until any long-running tasks are complete before you begin the update. Tasks that are running when the update begins are stopped, become failed tasks, and cannot be resumed; you must manually delete them from the task queue after the update completes. The task queue automatically refreshes every 10 seconds.

6. Select System > Updates.

7. Click the install icon next to the update you uploaded.

8. Select the Defense Center and click Install. Confirm that you want to install the update and reboot the Defense Center.

The update process begins. You can begin monitoring the update’s progress in the task queue (System > Monitoring > Task Status). However, after the Defense Center completes its necessary pre-update checks, you are logged out. When you log back in, the Upgrade Status page appears. The Upgrade Status page displays a progress bar and provides details about the script currently running.

If the update fails for any reason, the page displays an error message indicating the time and date of the failure, which script was running when the update failed, and instructions on how to contact Support. Do not restart the update.

Caution: If you encounter any other issue with the update (for example, if a manual refresh of the Update Status page shows no progress for several minutes), do not restart the update. Instead, contact Support.

When the update completes, the Defense Center displays a success message and reboots.

9. After the update finishes, clear your browser cache and force a reload of the browser. Otherwise, the user interface may exhibit unexpected behavior.

10. Log into the Defense Center.

11. Review and accept the End User License Agreement (EULA). Note that you are logged out of the appliance if you do not accept the EULA.

12. Select Help > About and confirm that the software version is listed correctly: Version 5.4.1.1. Also note the versions of the rule update and VDB on the Defense Center; you will need this information later.

13. Verify that the appliances in your deployment are successfully communicating and that there are no issues reported by the health monitor.

14. If the rule update available on the Support site is newer than the rules on your Defense Center, import the newer rules. Do not auto-apply the imported rules at this time.

For information on rule updates, see the FireSIGHT System User Guide.

15. If the VDB available on the Support site is newer than the VDB on your Defense Center, install the latest VDB.

Installing a VDB update causes a short pause in traffic flow and processing, and may also cause a few packets to pass uninspected. For more information, see the FireSIGHT System User Guide.

16. Reapply device configurations to all managed devices.

To reactivate a grayed-out Apply button, edit any interface in the device configuration, then click Save without making changes.

17. Reapply access control policies to all managed devices.

Caution: Do not reapply your intrusion policies individually; you must reapply all access control policies completely.

Applying an access control policy may cause a short pause in traffic flow and processing, and may also cause a few packets to pass uninspected. For more information, see the FireSIGHT System User Guide.

18. If a patch for Version 5.4.1.1 is available on the Support site, apply the latest patch as described in the FireSIGHT System Release Notes for that version. You must update to the latest patch to take advantage of the latest enhancements and security fixes.

Updating Managed Devices, ASA FirePOWER Modules, and Cisco NGIPS for Blue Coat X-Series

After you update your Defense Centers to Version 5.4.1.1, use them to update the devices they manage.

A Defense Center must be running at least Version 5.4 to update its managed devices to Version 5.4.1.1. Because they do not have a web interface, you must use the Defense Center to update your virtual managed devices, Cisco NGIPS for Blue Coat X-Series, and ASA FirePOWER modules.

Updating managed devices is a two-step process. First, download the update from the Support site and upload it to the managing Defense Center. Next, install the software. You can update multiple devices at once, but only if they use the same update file.

For the Version 5.4.0.2 update, all devices reboot; Cisco NGIPS for Blue Coat X-Series VAP groups reload. Series 3 devices do not perform traffic inspection, switching, routing, NAT, VPN, or related functions during the update. Depending on how your devices are configured and deployed, the update process may also affect traffic flow and link state. For more information, see Traffic Flow and Inspection During the Update.

Caution: Before you update a managed device, use its managing Defense Center to reapply the appropriate access control policy to the managed device. Otherwise, the managed device update may fail.

Caution: Do not reboot or shut down your appliances during the update until after you see the login prompt. The system may appear inactive during the pre-checks portion of the update; this is expected behavior and does not require you to reboot or shut down your appliances.

Tip: If your FireSIGHT Software for X-Series is deployed inline and you are using multi-member VAP groups, Cisco recommends that you update the VAPs one at a time. This allows the other VAPs in the group to inspect network traffic while the VAP that is being updated reloads. If you are using single-VAP VAP groups in an inline deployment, reloading the VAP causes an interruption in network traffic. Make sure you plan the update for a maintenance window or other time when it will have the least impact on your deployment.

Note: If you plan on updating the system to Version 6.0, you must install the FireSIGHT System Version 6.0 Pre-Installation package prior to updating the Version 6.0. For more information, see the FireSIGHT System Release Notes Version 6.0 Pre-Installation Package.

To update managed devices and ASA FirePOWER modules, and Cisco NGIPS for Blue Coat X-Series:

1. Read these release notes and complete any required pre-update tasks.

Note: Download the update directly from the Support site. If you transfer an update file by email, it may become corrupted.

For more information, see Before You Begin: Important Update and Compatibility Notes.

2. Update the software on the devices’ managing Defense Center; see Updating Defense Centers.

3. Download the update from the Support site:

–for Series 2 managed devices:

–for Series 3 managed devices:

–for 3D9900 managed devices:

–for virtual managed devices:

–for Cisco NGIPS for Blue Coat X-Series devices:

–for ASA FirePOWER modules (555X-X-SSP-X and 558X-X-SSP-X):

–for ASA FirePOWER modules (ASA5506-X, ASA5506W-X, ASA5506H-X, 5508-X, and ASA5516-X):

4. Upload the update to the Defense Center by selecting System > Updates, then clicking Upload Update on the Product Updates tab. Browse to the update and click Upload.

The update is uploaded to the Defense Center. The web interface shows the type of update you uploaded, its version number, and the date and time it was generated. The page also indicates whether a reboot is required as part of the update.

5. Make sure that the appliances in your deployment are successfully communicating and that there are no issues reported by the health monitor.

6. Click the install icon next to the update you are installing.

7. Select the devices where you want to install the update.

If you are updating a stacked pair, selecting one member of the pair automatically selects the other. You must update members of a stacked pair together.

8. Click Install. Confirm that you want to install the update and reboot the devices.

9. The update process begins. You can monitor the update's progress in the Defense Center’s task queue (System > Monitoring > Task Status).

Note that managed devices may reboot twice during the update; this is expected behavior. Traffic is interrupted while VAPs reload on Cisco NGIPS for Blue Coat X-Series devices deployed inline.

Note: When updating your X-Series device, you must wait for the device to reboot and completely reload the VAP before continuing.

Caution: If you encounter issues with the update (for example, if the task queue indicates that the update has failed or if a manual refresh of the task queue shows no progress for several minutes), do not restart the update. Instead, contact Support.

10. Select Devices > Device Management and confirm that the devices you updated have the correct software version: Version 5.4.0.2.

11. Verify that the appliances in your deployment are successfully communicating and that there are no issues reported by the health monitor.

12. Reapply device configurations to all managed devices.

Tip: To reactivate a grayed-out Apply button, edit any interface in the device configuration, then click Save without making changes.

13. Reapply access control policies to all managed devices.

Applying an access control policy may cause a short pause in traffic flow and processing, and may also cause a few packets to pass uninspected. For more information, see the FireSIGHT System User Guide.

14. If a patch for Version 5.4.0.2 is available on the Support site, apply the latest patch as described in the FireSIGHT System Release Notes for that version.

You must update to the latest patch to take advantage of the latest enhancements and security fixes.

Issues Resolved in Previous Versions

Previously resolved issues are listed by version.

Issues resolved in Version 5.4.1:

■ Security Issue Addressed multiple vulnerabilities in SSLv3 that allowed external attacks on client connections. The fix addresses CVE-2014-3566.

■ Security Issue Addressed an arbitrary script injection vulnerability allowing unauthenticated, remote attackers to execute commands via Bash. The fix addresses CVE-2014-6271 and CVE-2014-7169.

■ Security Issue Resolved an unauthorized vulnerability in Universal Unique Identifier (UUID) manipulation.

■ Security Issue Resolved cross-site scripting (XSS) vulnerabilities in the host attribute.

■ Security Issue Resolved an HTML injection vulnerability.

■Improved the speed of reloading Snort configurations during access control policy apply. (112070/CSCze87966, CSCur19687)

■Resolved an issue where, if you created an SSL policy with the Session Not Cached option set to Do Not Decrypt or Block and SSL session reuse enabled, the system displayed uncached session errors in the SSL Status column of the Connection Events table view when the session refreshed. (143335/CSCze93608).

■Resolved an issue where the system did not display data for the Network Analysis Policy column of the Intrusion Events table view and the Connection Events table view if you registered a device running Version 5.3.X to a Defense Center running Version 5.4. (143349/CSCze94484)

■Resolved an issue where the system failed to recover if you attempted to reboot your clustered Series 3 devices after the devices went to maintenance mode and experienced a power failure. (143504/CSCze94928)

■Updated the FireSIGHT System User Guide to reflect that applying an access control policy may cause a short pause in traffic flow and processing. (143514/CSCze94971)

■Access control policies now have logging capabilities for Log at Beginning and End of Connection, Log at End of Connection, and No Logging at Connection. (143507/CSCze94975)

■Resolved an issue where, if the system generated file events, the system incorrectly truncated file event filenames containing colons on several pages of the web interface. (143666/CSCze94954)

■Resolved an issue where, if you disabled an access control rule containing either an intrusion policy or a variable set that was different from any enabled access control rules, policy apply failed and the system experienced issues. (143871/CSCze94114, 144635/CSCze95200)

■Improved diskmanager cleanup during report generation. (143933/CSCze94240, 143934/CSCze94286)

■Resolved an issue where multiple IP addresses were incorrectly displayed for a single host profile. (144259/CSCze94623)

■Resolved an issue where decrypted SSL sessions displayed URLs in connection logs as http:// instead of https://. (144485/CSCze95739)

■Resolved an issue where, if you created a custom network variable named identically to a default variable but with different capitalization, the system incorrectly assumed the custom variable and the default variable were the same and prevented you from deleting the custom variable. (144488/CSCze95591, 144544/CSCze95599)

■Resolved an issue where, if you enabled your Defense Center or managed device’s eth1 for DHCP, the system incorrectly saved the configuration with DHCP enabled for both eth0 and eth1. (144525/CSCze95666)

■Resolved an issue where, if you applied an access control policy with archive file types enabled on a device running a vulnerability database (VDB) older than Version 211, policy apply failed. (144533/CSCze95570)

■Resolved an issue where the system treated DNS traffic as OpenVPN, QQ, and Viber traffic. (144548/CSCze95536)

■Resolved an issue where rule or packet latency thresholding timers could not be disabled. (144555/CSCze95704)

■Resolved an issue where, if you created a link aggregation group (LAG) interface on a NetMod connected to an 8000 Series managed device and then powered down the device, removing the NetMod after powering down caused errors. (144576/CSCze95166)

■Resolved an issue where removing the URL Filtering license from your system caused a disruption in cloud connectivity. (144578/CSCze95183)

■Resolved an issue where, if you used the SFR system restart CLI command on the ASA5506-X device while logged in via the ASA session command, the device stopped processes and did not restart them. (144609/CSCze94873)

■Resolved an issue where, if you created an HTML report, the web browser incorrectly displayed the report as binary data. (144667/CSCze95195)

■Resolved an issue where importing and exporting Defense Center policies failed. (144806/CSCze95396, 144905/CSCze96093)

■Resolved an issue where defining a large range of ports for source ports or destination ports caused policy apply to fail. (144933/CSCze95305)

■Resolved an issue where the system experienced a FSIC failure during update. (144964/CSCze95780)

■Resolved an issue where, if you attempted to establish a private cloud connection without utilizing the proxy option, the system attempted to connect to the private cloud via proxy even if you unchecked the use proxy option. (144968/CSCze95801)

■Resolved an issue where automatic update failed if you attempted to download updates while managing an X-Series device. (145060/CSCze95372)

■Resolved an issue where the user interface provided the incorrect patch release when you attempted to update your system with the Download Updates button. (145174/CSCze95284)

■Resolved an issue where, at altitudes of 2000 feet or higher, the AMP8150 emitted excessive noise due to inlet fans running at 20,000 RPM or faster, despite reported fan speeds as low as 0 RPM. Updating the BMC firmware or applying this update resolves the issue in the firmware, but to resolve temporarily until you can update, use the ipmi mc reset cold CLI command to reset the AMP8150 Baseboard Management Controller (BMC). Note that you must reestablish your Serial Over Lan (SOL) session after reset. (CSCus59936)

■Resolved an issue where the Inline Normalization preprocessor incorrectly resized packets when the Trim Data to Window option was enabled. (CSCur80901)

Issues resolved in Version 5.4:

■ Security Issue Addressed multiple vulnerability issues in Linux and other third parties as described in CVE-2013-0343, CVE-2013-2164, CVE-2013-2206, CVE-2013-2232, CVE-2013-2234, CVE-2013-2888, CVE-2013-3552, CVE-2013-4387, CVE-2013-4470, CVE-2013-4786, CVE-2007-6750, CVE-2013-7263, CVE-2013-7265

■ Security Issue Addressed multiple injection vulnerabilities, including HTML and command line injections.

■ Security Issue Addressed multiple cross-site scripting (XSS) vulnerabilities.

■ Security Issue Addressed multiple cross-site request forgery (CSRF) vulnerabilities.

■ Security Issue Addressed multiple parameter manipulation and misconfiguration vulnerabilities.

■If you configure an access control rule to Block, Block with reset, Interactive block, Interface Block with reset, or Monitor, selecting a reputation level also selects all reputations more severe than the selected level. If you configure an access control rule to Allow or Trust, selecting a reputation level also selects all reputations less severe than the selected level. (111747/CSCze87908)

■The system now prevents you from using IPv6 addresses to configure connections to the User Agent. (124377/CSCze88700)

■Resolved an issue where, in some cases, the system included extraneous data in intrusion event performance graphs. (124934/CSCze87728)

■Improved the functionality of eStreamer performance metrics. (129840/CSCze89231)

■Resolved an issue where large system backups failed if disk space usage exceeded the disk space threshold before pruning. (132501/CSCze88368)

■Resolved an issue where using the RunQuery tool to execute a SHOW TABLES command caused the query to fail. (132685/CSCze89153)

■Resolved an issue where, in some cases, performing remote backups of managed devices generated large backup files on your Defense Center. (133040/CSCze89204)

■You can now edit the maximum transmission unit (MTU) of a managed device via the Interface tab of the Management Interfaces page ( System > Local > Configuration > Management Interfaces) on the managed device’s web interface. You can no longer edit the MTU of management interfaces of managed devices from the Defense Center. (133802/CSCze89748)

■Resolved an issue where the syslog alert message for events generated by intrusion rules with preprocessor options enabled caused a Snort Alert message instead of a customized message. (134270/CSCze88831)

■Resolved an issue where remediation failed if you configured an Nmap scan remediation with the Fast Port Scan and the Use Port from Event options enabled. (134499/CSCze88810)

■Resolved an issue where, if you enabled end-of-connection logging on a system in high availability, the system did not report sessions or reported an incorrect time stamp if the session was terminated prematurely. (134806/CSCze89822)

■Resolved an issue where communication issues between the Defense Center and cloud did not generate a health alert. (134888/CSCze90122)

■Resolved an issue where the system did not resolve host names associated with IPv6 addresses as expected in the dashboard or event views if you enabled Resolve IP Addresses from the Event View Settings page. (135182/CSCze90155)

■Custom HTTP response pages now support up to 50,000 plaintext characters. (136295/CSCze90383)

■Resolved an issue where the system displayed an incorrect number of submitted IP addresses in the tooltips on the Security Intelligence tab if you specified a Feed URL previously created on a computer running a Windows operating system. (136557/CSCze89888)

■Resolved an issue where, if you disabled a physical interface on a managed device, the status of the logical interfaces associated with the physical interface remained green on the Interfaces tab of the editor even though they were disabled. (136560/CSCze89894)

■Resolved an issue where the Defense Center displayed different task statuses on the Task Status page, the Access Control Policy page, and the Device Management page of the web interface if you applied an access control policy to multiple devices. (136614/CSCze89936)

■Resolved an issue where a custom intrusion rule with a TCP protocol condition generated events based on UDP traffic instead of TCP traffic. (136843/CSCze89941)

■Resolved an issue where the captured files table was erroneously listed as an option for a custom table base. (136844/CSCze89977)

■Resolved an issue where the system generated false positives for the 145:1, 145:2, 145:3, 145:4, 145:5, and 145:6 DNP3 preprocessor rules. (137145/CSCze90786)

■Resolved an issue where, if you registered a managed device with a hostname containing more than 40 characters, device registration failed. (137235/CSCze90144)

■Resolved an issue where the system did not correctly filter objects in the Object Manager if you included any of the following special characters in the filter criteria: dollar sign ($), caret (^), asterisk (*), brackets ([ ]), vertical bar (|), forward slash (\), period (.), and question mark (?). (137493/CSCze90413)

■Resolved an issue where, if you enabled Simple Network Management Protocol (SNMP) polling in your system policy and modified the interface configuration on one of your clustered managed devices, the system generated inaccurate SNMP polling requests. (137546/CSCze90000)

■Resolved an issue where enabling syslog or Simple Network Management Protocol (SNMP) connection logging in an access control rule caused system issues. (137952/CSCze90538)

■Resolved an issue where the table view of file events appeared to support viewing the file trajectory by file name even without a calculated SHA256 value. (138155/CSCze90676)

■Resolved an issue where the system did not display UTF-8 characters in the x-axis filenames if you generated a report in HTML or PDF format that included a chart with File Name as the x-axis. (138297/CSCze90799)

■Resolved an issue where, in rare cases, revising and reapplying an intrusion policy hundreds of times caused intrusion rule updates and system updates to require over 24 hours to complete. (138333/CSCze90747)

■Resolved an issue where the system generated an error message if you attempted to update the geolocation database (GeoDB) to the version already installed on your Defense Center. (138348/CSCze90813)

■Resolved an issue where connection events logged to an external syslog or Simple Network Management Protocol (SNMP) trap server had incorrect URL Reputation values. (138504/CSCze91066)

■Resolved an issue where applying more than one access control policy across your deployment and searching for intrusion or connection events matching a specific access control rule retrieved events generated by unrelated rules in other policies. (138542/CSCze91690)

■Resolved an issue where cutting and pasting access control rules appeared to be supported. (138713/CSCze91012)

■Resolved an issue where, if your Defense Center was running Version 5.3 with eStreamer running Version 5.3, the security intelligence events on your Defense Center incorrectly reversed the values of the destination IP and the source IP. (138740/CSCze91402)

■Resolved an issue where the system did not generate a warning about ignored inline normalization settings if you applied an intrusion policy set to drop when inline to a device with passive interfaces. (139177/CSCze91163)

■Resolved an issue where, in rare cases, the Task Status page incorrectly reported a failed system policy apply was successful. (139428/CSCze92142)

■Resolved an issue where the system did not enforce the maximum transmission unit (MTU) setting on Series 2 or virtual devices. (139620/CSCze91705)

■Resolved an issue where, if you configured and saved three or more intrusion policies that referenced each other through their base policies, the system did not update the Last Modified dates for the policies on the Intrusion Policy page. (139647/CSCze91353)

■Resolved an issue where, if you configured and saved a report with a time window that included the transition day from observing Daylight Saving Time (DST) to not observing DST, the system adjusted the time window to begin an hour earlier than specified. (139713/CSCze91697)

■Resolved an issue where, if you switched interfaces between the virtual routers on your managed devices, the system did not activate the dormant static route for the switched interfaces. (139929/CSCze91619)

■Resolved an issue where, if you did not register a device to your Defense Center and your Defense Center had no data, viewing the Intrusion Events Graph page ( Overview > Summary > Intrusion Event Graphs) caused a WARNING: normalizations disabled because not inline error. (140117/CSCze92324)

■Resolved an issue where the system did not prevent an externally authenticated user from modifying their password using the FireSIGHT System web interface. (140143/CSCze91938)

■Resolved an issue where custom HTTPS certificates could be imported only once. (140283/CSCze92162)

■Resolved an issue where creating a new task on the Scheduling page ( System > Tools > Scheduling) caused the system to display an authorization error message. (140575/CSCze92225)

■Resolved an issue where bypass mode appeared as an option for clustered devices even though the option could not be enabled. (140604/CSCze92047)

■Resolved an issue where reports created in bar graph form displayed a maximum of 10 days. (140833/CSCze92405)

■Resolved an issue where the Password Lifetime column on the User Management page displayed a negative value if a user’s password expired. (140839/CSCze92338)

■Resolved an issue where, if you disabled an access control rule referencing an intrusion policy and then reapplied your access control policy, the system incorrectly indicated the appliance’s intrusion policy was out of date. (141044/CSCze92012)

■Resolved an issue where you could not delete third-party vulnerabilities. (141103/CSCze92621)

■Resolved an issue where files intentionally not stored by the system incorrectly appeared with a Failed File Storage value in the event viewer and dashboard. (141196/CSCze92629)

■Resolved an issue where the system-provided saved search Public Addresses Only included the private 172.16.0.0/12 IP address range. (141285/CSCze92654)

■Resolved an issue where, if you updated your Defense Center to Version 5.4, the update wrote over any changes made to the Connection Summary dashboard ( Overview > Dashboards > Connection Summary). (141363/CSCze92812)

■Resolved an issue where reports did not resolve host names for IP addresses. (141393/CSCze92797)

■Resolved an issue where, if you enabled HTTP Block Response in an access control policy and the web server’s operating host reached its open connection limit, HTTP Block Response caused sessions to remain open and the web server to time out. (141440/CSCze92753)

■Resolved an issue where excessive saved revisions to the intrusion policy caused system performance issues. (141501/CSCze92792)

■Resolved an issue where the passive interfaces not in security zones on 3D9900 devices did not generate intrusion or connection events. (141663/CSCze93022)

■You can now enable rules from the packet view of a generated event when you select the Set this rule to generate events in all locally created policies option from the actions menu. (142058/CSCze93416)

■Resolved an issue where, in rare cases, Series 3 devices experienced delays during device shutdown. (142110/CSCze93561)

■Resolved an issue where, if the Defense Center sent a file to the cloud to perform a dynamic analysis in a sandbox environment and the cloud was not available within 50 minutes, the file’s status remained Sent for Analysis instead of a timed out status. (142309/CSCze93757)

■Resolved an issue where, if the Defense Center incorrectly assigned an invalid serial header, the Defense Center failed to send events to the eStreamer client. (143201/CSCze93686)

■Resolved an issue where, if you clicked on an application in the Denied Connections by Application dashboard widget, the system did not properly constrain the resulting event view to blocked connections. (143376/CSCze93645)

■Resolved an issue where, if you generated a report in CSV format only, report section queries would ignore the option to inherit the time window. (143403/CSCze94376)

■Resolved an issue where the Modbus preprocessor failed to generate events after the system missed or dropped a packet. (142450/CSCze95921)

■Resolved an issue where, if you created an access control policy that referenced an SSL policy set to decrypt traffic, policy apply failed. (144518/CSCze94864)

■Resolved an issue where, if you created an intrusion policy or network analysis policy and added a shared layer to it, then exported and imported the new policy the system generated a Back-end failed for import error and did not import the policy. (144905/CSCze96093)