Table Of Contents
Release Notes for Cisco Router and Security Device Manager Version 2.2
April 5, 2006
These release notes support Cisco Router and Security Device Manager version 2.2. They should be used with the documents listed in the "Related Documentation" section. These release notes are updated as needed.
This document contains the following sections:
Cisco Router and Security Device Manager (SDM) is a web-based configuration tool that allows you to configure LAN and WAN interfaces, routing, Network Admission Control (NAC), Network Address Translation (NAT), firewalls, Intrusion Prevention System (IPS), Virtual Private Networks (VPNs), and other features on the router. SDM version 2.1 and later can be installed on a PC, or in router flash, disk, or slot memory. Earlier versions of SDM cannot be installed on PCs, but can be installed in router flash, disk, or slot memory. If you have a router listed in the "Hardware Supported" section, SDM may be preinstalled in router memory, or may be shipped on a CD with the router.
This section contains SDM system requirements.
A minimum of 5.2 MB of free router memory is required to support Cisco SDM files. 2 MB of router memory is required to support Cisco SDM Express files. The Wireless Management application requires an additional 2 MB.
Cisco SDM installed on a PC requires 5.2 MB of memory.
Table 2 lists the files that are included with Cisco SDM, Cisco SDM Express, and the Wireless Management application.
This section lists the hardware that SDM supports.
Note SDM does not support Telco/CO router models.
SDM is supported on the following Cisco SB100 series routers.
SDM is supported on the following Cisco 800 series routers:
SDM is supported on the following Cisco 1700 series routers:
SDM is supported on the following Cisco 1800 series routers:
SDM is supported on the following Cisco 2600 series routers:
SDM is supported on the following 2800 series routers:
SDM is supported on the following Cisco 3600 series routers:
SDM is supported on the following Cisco 3700 series routers:
SDM is supported on the following Cisco 3800 series routers:
SDM is supported on the following Cisco 7000 series routers:
Supported Network Modules, WICs, Port Adapters, and Service Adapters
SDM supports configuration on the following network modules:
•NM-4A/S (synchronous only)
•NM-8A/S (synchronous only)
SDM supports only Ethernet configuration on the following network modules:
SDM supports the following EtherSwitch Service Modules:
SDM supports the following WAN interface cards:
•WIC-2A/S (Frame Relay, PPP, HDLC, no asynchronous)
SDM supports the following high-speed wan interface cards (HWICs):
SDM supports the following advanced integration modules (AIMs):
SDM supports the following port adapters on Cisco 7000 routers:
SDM supports the following service adapters on Cisco 7000 routers:
SDM also supports the MOD-1700VPN.
PC System Requirements
SDM is designed to run on a personal computer that has a Pentium III or faster processor.
This section describes SDM software requirements.
Cisco IOS Images
SDM is compatible with the Cisco IOS images listed in Table 1.
Note SDM supports the IOS Intrusion Prevention System (IPS). In order to be able to use SDM to configure IOS-IPS, the router must run an IOS image of Release 12.3(8)T4 or later.
Determining the Cisco IOS Software Version
To determine the Release of Cisco IOS software currently running on your Cisco router, log in to the router and enter the show version EXEC command. The following sample output from the show version command indicates the version number on the second output line:router> show versionCisco Internetwork Operating System SoftwareIOS (tm) C1700 Software (c1700-k8sv3y7-mz) Version 12.2(13)ZH
Web Browser Versions and Java Runtime Environment Versions
SDM can be used with the following browsers:
•Firefox version 1.0.6
•Internet Explorer version 5.5 and later
•Netscape version 7.1 and version 7.2
SDM requires Sun Java Runtime Environment (JRE). The following versions are supported:
Although the SDM application requires JRE to run, the Cisco SDM Express application included with SDM can run under the native Java Virtual Machine in the supported browsers, as well as with JRE.
PC Operating System Versions
SDM can be run on a PC running any of the following operating systems:
•Microsoft Windows XP Professional
•Microsoft Windows 2003 Server (Standard Edition)
•Microsoft Windows 2000 Professional with Service Pack 4
•Microsoft Windows ME
•Microsoft Windows NT 4.0 Workstation with Service Pack 4
Note Windows 2000 Advanced Server is not supported.
SDM version 2.2 is available only in English. SDM version 2.1.2 is available in six additional languages: Japanese, Simplified Chinese, French, German, Spanish and Italian. SDM version 2.1.2 supports full SDM functionality released prior to SDM 2.2. New functionality introduced in SDM 2.2 is currently under development for these languages and will be available shortly. If you want to use SDM version 2.1.2 in one of these languages, your PC must run one of the following operating systems:
•Microsoft Windows XP Professional with Service Pack 2 or later
•Microsoft Windows 2000 Professional with Service Pack 4 or later
Refer to the Release Notes for Cisco Router and Security Device Manager Version 2.1.2 for more information. See Related Documentation to learn how to obtain these release notes.
New and Changed Information
This section contains information that is new or that has changed since the previous release.
New Features Supported in SDM Version 2.2
This release of SDM supports the following new features:
•Application Security—SDM allows you to inspect traffic by application, as well as by network protocol. You can specify what the router is to do when it encounters traffic from the applications that you identify. SDM also offers low, medium and high application security policies that you can apply to router interfaces when completing the basic and the advanced firewall wizards.The Application Security feature also offers Granular Protocol Inspection, also described in this list.
•Network Admission Control (NAC)—NAC enables the router to control the use of the local network by local hosts, based on their virus protection status. When given a NAC configuration, the router can use NAC policy servers to determine host status, and user-defined policies to determine what action to take, including directing hosts to virus remediation sites . You can configure exception lists to specify the hosts that are to be exempted from the NAC validation process, and you can list the hosts that do not have posture agent software installed.
•Granular Protocol Inspection (GPI)—GPI allows you to have the router inspect Cisco IOS-recognized TCP and UDP protocols. GPI works with Port-to-Application Mapping, also described in this feature list.
•Dynamic DNS—SDM supports client-mode DDNS, enabling the router to update a DNS server when a router interface IP address is changed.
•NAT wizards—You can configure NAT translation rules using the basic or the advanced NAT wizard. After you configure the rule with the wizard, you can use the Edit screens to make additional changes to the rule.
•Port-to-Application Mapping (PAM)—Network applications typically accept traffic on registered, well-known port numbers, and the router uses those port numbers by default. For example, FTP typically uses port 21. When applications are configured to use nonstandard ports, the router must be given the mapping between the application and the port number that it uses. PAM enables you to create these mappings for the router. You can create mappings on a host or network basis, and if the application is configured to use a range of port numbers, you can create a mapping between the application and that port number range.
•Search function—You can now search for SDM features by entering the feature name on the toolbar and clicking Search.
•Switch Module support—SDM allows you to configure switchport VLANs and VLAN subinterfaces, and you can launch the eXpresso switch module management application from the SDM toolbar.
•Support for new High-speed WAN Interface Cards (HWICS)—The HWIC-ADSL-B/ST, HWIC-ADSLI-B/ST, HWIC-1ADSL, and HWIC-1ADSLI network modules are supported.
•USB Flash and Token support—SDM can detect the presence of USB flash and USB token devices on the router, and can use configuration files and digital certificates stored on those types of devices.
•DHCP Enhancements—SDM allows you to bind a particular IP address from a DHCP pool to a host MAC address that you specify.
•Easy VPN Remote enhancements—SDM now supports web intercept, RSA signatures, dial backup, VLAN subinterfaces, multiple routed subnets, traffic-triggered tunnel activation, and mode-configured addresses for device access.
•Easy VPN Server enhancements—SDM now allows you to do the following: create a banner to display to Easy VPN Remote clients when they log on to the server; provide for automatic updates by specifying an IOS image location and revision level; ensure consistency in client configuration via a configuration push feature; provide browser proxy server information to clients. In this release, SDM also supports split DNS, which allows remote clients to use an internal DNS server to resolve hosts with specific domain names, Perfect Forwarding Secrecy (PFS) push to remote clients, netmask support, the restriction of Easy VPN connections to specific interfaces, the setting of an IPSecurity (IPSec) idle timer, and group policies using a single AAA server.
•Easy VPN Troubleshooting enhancements—This feature has been enhanced to support new Easy VPN Remote and Easy VPN Server enhancements.
•Intrusion Prevention System (IPS) enhancements—IPS is integrated into the main SDM application, and includes an IPS rule wizard, and a signature import wizard. Also, IPS now supports TrendMicro signature engines.
This section describes the files used in SDM version 2.2.
Table 2 describes the files that SDM and SDM applications use.
This section contains important information regarding installation and upgrades to SDM.
Cisco 1700 Routers Running ITS/CCME and Cisco IOS Release 12.2(13)T
If you are installing SDM on a router that already has the Internet Telephony Service (ITS) or Cisco Call Manager Express (CCME) application installed in flash memory, you may exceed the number of files allowed in flash memory by installing SDM. Cisco 1700 routers using a Cisco IOS Release 12.2(13)T image cannot have more than 32 files in flash memory.
Before installing SDM, you must delete any unneeded files from flash memory. If no files can be deleted, do not install SDM on the router.
Downloading SDM from Cisco.com and Installing It on the Router
If SDM is not currently installed on the router, the document Downloading and Installing Cisco Router and Security Device Manager (SDM) explains how to download SDM from Cisco.com and install it on the router. To obtain this document, go to the following URL:
Upgrading to a New SDM Release
If a version of SDM later than version 1.0 is already installed on the router, you should use the SDM automatic update feature to install the latest files on the router. SDM automatically checks Cisco.com for more recent versions of SDM, downloads them to your PC, removes the old SDM files from memory, runs the squeeze flash: command if necessary, and copies the latest files to the router. The update feature is available from the Tools menu. Choose Tools > Update SDM > Update from CCO.
If you are currently using SDM version 1.0, you must download the file SDM-Vnn.zip at the following URL:
The document Downloading and Installing Cisco Router and Security Device Manager (SDM) explains how to install SDM and all related files on the router. This document is available at the following URL:
Click Install and Upgrade in the Technical Documentation and Tools box, and then click Install and Upgrade Guides.
Uninstalling SDM Files
If you want to remove SDM from flash memory or from a router disk file system, you can do so by logging onto the router and completing the following steps in EXEC mode:
Step 1 Change to the directory in which the SDM files are located.
If the router has a flash file system, use the following command:router# cd flash:
If the router has a disk file system, use the following command:router# cd diskN
Replace N with the actual number of the disk. Use the slot keyword instead of the disk keyword if necessary.
Step 2 Use the delete command to remove the SDM files. The example below deletes the file sdm.tar:router# delete sdm.tarDelete filename [sdm.tar]?Delete flash:sdm.tar? [confirm]
Press Return to confirm the deletion.
Step 3 Use the delete command to remove the remaining SDM files. The "SDM Files" section lists the files used by SDM.
Step 4 Reclaim memory space by using the squeeze flash: command:router# squeeze flash:
It is not necessary to use the squeeze flash: command on DOS-based file systems.
SDM version 2.1 or later can be installed on your PC. To remove SDM from your PC, complete the following steps:
Step 1 Click Start > Program> Cisco Systems > Cisco SDM > Uninstall to launch the Uninstall program.
Step 2 When the message "Do you want to remove the selected applications and all of its features?" appears, click Yes.
Step 3 When the Uninstallation Complete screen is displayed, click Finish.
Restrictions and Limitations
This section describes restrictions and limitations that may apply to SDM.
SDM Minimum Screen Resolution
SDM requires a screen resolution of at least 1024 x 768.
Restrictions for Cisco 7204VXR, 7206VXR, and 7301 Routers
The following restrictions apply to SDM running on Cisco 7204VXR, 7206VXR, and 7301 Routers:
•The SDM Express application is not supported.
•WAN configuration is not supported. SDM supports configuration of Ethernet and Fast Ethernet interfaces.
•The SDM Reset feature is not available.
•No SDM-default configuration file is supplied.
This section contains important information for SDM.
SDM IPS User Guide Discontinued for SDM 2.2
The SDM IPS application has been merged with SDM version 2.2. Instructions for using IPS are included in the Cisco Router and Security Device Manager Version 2.2 User's Guide. No SDM IPS User's Guide has been published for this release.
SDM May Lose Connection to Network Access Device
This note concerns the NAC feature.
If the PC used to invoke SDM returns a posture state (Healthy, Infected, Checkup, Quarantine, or Unknown) and if the group policy on the ACS server attached to the posture token assigned to the PC has a redirect URL configured, the connection between SDM and the router acting as the Network Access Device (NAD) may be lost. The same problem can occur if an exception list entry attached to a policy with a redirect URL is configured with the IP address or MAC address of the PC.
If you try to reinvoke SDM from this PC, you will not be able to do so because the browser will be redirected to the location specified in the redirect URL.
There are two workarounds for this problem:
•Ensure that the PC that you use to invoke SDM attains a posture token which has an associated group policy on the ACS server that is not configured with a redirect URL.
•Alternatively, use SDM to create a NAC exception list entry with the IP address or MAC address of the PC you use to invoke SDM. Note that the exception list entry created for the PC should be associated to an exception policy which does not have a redirect URL configured in it.
For more information, refer to the links in the SDM NAC online help pages.
SDM on PC May Not Launch under Windows XP with Service Pack 2
When SDM is installed on a PC running Windows XP with Service Pack 2, Internet Explorer may display HTML source code when you attempt to launch SDM. To fix this problem, go to Tools > Internet Options > Advanced. Then scroll to the Security section, check Allow active content to run in files on my computer, and click Apply. Then relaunch SDM.
Popup Blockers Disable SDM Online Help
If you have enabled popup blockers in the browser you use to run SDM, SDM online help will not appear when you click the help button. To prevent this from happening, you must disable the popup blocker when you run SDM. Popup blockers may be enabled in search engine toolbars, or may be standalone applications integrated with the web browser.
Microsoft Windows XP with Service Pack 2 blocks popups by default. In order to turn off popup blocking in Internet Explorer, go to Tools > Pop-up Blocker > Turn Off Pop-up Blocker.
If you have not installed and enabled pop up blockers, go to Tools >Internet Options > Privacy, and uncheck the Block popups checkbox.
Disable Proxy Settings
SDM will not start when run under Internet Explorer with proxy settings enabled. To correct this problem, choose Internet Options from the Tools menu, click the Connections tab, and then click the LAN settings button. In the LAN Settings window, disable the proxy settings.
Routers Shipped with SDM Do Not Execute the Standard Cisco IOS Startup Sequence
Because a default configuration file is provided on a router shipped with SDM, the router will not execute the standard Cisco IOS startup sequence. If you are expecting to use the Cisco IOS setup utility, a TFTP/BOOTP configuration download, or other features available through the standard Cisco IOS startup, you will need to erase the configuration file.
To erase the existing configuration and take advantage of the Cisco IOS startup sequence, perform the following steps. This will leave SDM on the router if you later decide you want to use it, but you will need to configure the router manually before you can begin using SDM. Please refer to the router quick start guide and to the SDM FAQ (available at http://www.cisco.com/go/sdm) for information about the minimum configuration required for using SDM.
Step 1 Connect the light blue console cable, included with the router, from the blue console port on the router to a serial port on your PC. See the router hardware installation guide for instructions.
Step 2 Connect the power supply to the router, plug the power supply into a power outlet, and turn on the router. See the router quick start guide for instructions.
Step 3 Use a terminal emulation program on your PC, with the terminal emulation settings 9600 baud, 8 data bits, no parity, 1 stop bit, and no flow control, to connect to the router.
Step 4 At the prompt, enter the enable command, and enter the password cisco.yourname> enablePassword: ciscoyourname#
Step 5 Enter the erase startup-config command.yourname# erase startup-config
Step 6 Confirm the command by pressing Enter.
Step 7 Enter the reload command.yourname# reload
Step 8 Confirm the command by pressing Enter.
After the router completes the reload operation, it enters into the standard Cisco IOS startup sequence. You can use the startup sequence to give the router a configuration manually, or to copy a configuration file from the network. If you later decide you want to use SDM to change an existing configuration, refer to the instructions on starting SDM included in the quick start guide for the router.
Unable to Perform "squeeze flash:" Operation
If the router is using a Cisco IOS image earlier than release 12.3T, or release 12.2(13)ZH, it may be necessary to use the squeeze flash: command to reclaim flash memory after repeated use of SDM. If this becomes necessary, SDM will inform you that the squeeze flash: command must be used, and will execute the command upon your confirmation.
However, the squeeze flash: command will not work if an erase flash: command has never been executed on the router. If this is the case you will receive an "Unable to perform `squeeze flash'" warning message, and you will need to run the erase flash: command to enable the use of the squeeze flash: command.
Executing the erase flash: command removes SDM and the Cisco IOS image from the router flash memory, and you will lose your connection to the router. Complete the following steps to save files in flash memory, execute erase flash:, and copy the files back so you can reconnect to SDM.
Step 1 Ensure that the router will not lose power. If the router loses power after an erase flash: operation, there will be no Cisco IOS image in memory.
Step 2 Prepare a TFTP server to which you can save files and copy them over to the router. You must have write access to the TFTP server. Your PC can be used for this purpose if it has a TFTP server program.
Step 3 Open up a Telnet session on the router so that you can use the CLI.
Step 4 Save the router's running configuration to the startup configuration by entering the command copy running-config startup-config.
Step 5 Use the copy tftp command to copy the Cisco IOS image, and the SDM files from flash memory to a TFTP server:
copy flash: filename tftp://tftp-server-address/filename
For example:Router# copy flash: sdm.tar tftp://10.10.10.3/sdm.tar
Table 2 lists the files SDM uses.
Tip If you prefer to download a Cisco IOS image, and the SDM-Vnn.zip file, follow these instructions to use an Internet connection to download an SDM-supported Cisco IOS image, and the SDM-Vnn.zip file.
a. Click the following link to obtain a Cisco IOS image from the Cisco Software Center:
b. Obtain an image that supports the features you want on the Cisco 12.2(11)T release or later. Save the file to the TFTP server that is accessible from the router.
c. Use the following link to obtain the latest SDM-Vnn.zip file.
d. Extract the SDM files from SDM-Vnn.zip.
e. Click the setup.exe file to start the SDM installation wizard.
Step 6 From the PC, log in to the router using Telnet, and enter Enable mode.Router> enablePassword:Router#
Step 7 Enter the command erase flash:, and confirm. The router's IOS image, configuration file, and the SDM files are removed from flash memory.
Step 8 Use the copy tftp command to copy the IOS image and the SDM files from the TFTP server to the router:
copy tftp://tftp-server-address/filename flash:
Example:Router# copy tftp://10.10.10.3/SDM.tar flash:
Note Copy the Cisco IOS image first, followed by the SDM files.
Step 9 Start your web browser, and reconnect to SDM, using the same IP address you used when you started the SDM session.
Now that an erase flash: operation has been performed on the router, you will be able to execute the squeeze flash: command when necessary.
Security Alert Dialog May Remain After SDM Launches
When SDM is launched using HTTPS, a security alert dialog box that informs you of possible security problems and asks you if you want to proceed with program launch may appear. This can happen if the router does not have the following global configuration command in the running configuration:ip http timeout-policy idle 600 life 86400 requests 10000
Caveats describe unexpected behavior in SDM. Severity 1 caveats are the most serious caveats, severity 2 caveats are less serious, and severity 3 caveats are the least serious of these three severity levels.
Open Caveats—Release 2.2
This section lists caveats that are open in release 2.2.
When you upgrade from SDM version 2.2.a to 2.2.1, SDM displays a warning popup that indicates that you are attempting to downgrade SDM to an earlier version. This message is seen when upgrading from SDM 2.2a to any language edition of SDM 2.2.1.
Workaround: Click Yes in the warning popup window to indicate that you want to proceed with the update.
When SDM is run on the PC, the Load File from PC function available from the File Management window may not work properly.
Workaround: With a TFTP server application on the PC, copy files to the router using the copy tftp flash command.
The SDM_HIGH security policy may not block Instant Messaging (IM) applications. The application security feature blocks IM applications using the server deny name command. New servers may become available, and if they do, IM applications may connect to them.
Workaround: Complete the following steps:
a. Turn on firewall logging for IM applications. The names of the servers that the IM applications connect to will be revealed in the log.
b. Use the CLI to block the new servers. The following example uses the server newserver.yahoo.com:router# config trouter(config)# appfw policy-name SDM_HIGHrouter(cfg-appfw-policy)# application im yahoorouter(cfg-appfw-policy-ymsgr)# server deny name newserver.yahoo.comrouter(cfg-appfw-policy-ymsgr)# exitrouter(cfg-appfw-policy)# exit
Due to IOS caveat CSCei75121, extra spaces introduced into the running configuration output may prevent SDM from accurately reading the running configuration. This occurs when RSA key pairs are manually entered.
Workaround: Go to View > Running Config to display the running configuration.
When the applications security policy blocks some Point-to-Point (P2P) applications, but permits others, blocked applications may be able to download files.
Workaround: Instead of permitting some P2P applications and blocking others, exclude the applications that you want to permit from the application security policy by unchecking the box next to the application name.
Because of a problem with the Cisco IOS NBAR feature, some Point-to-Point applications are able to download files even when application security is configured to block them. When the Cisco IOS NBAR feature is used to block Point-to-Point applications, only those applications and protocols supported by the NBAR feature will be successfully blocked.
Because of a problem with Cisco IOS (CSCin92327), a connection between an Easy VPN Remote client and an Easy VPN Server may timeout before the user has time to enter the credentials.
Due to a JVM bug (http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=4110094) SDM IPS may crash when large Signature Definition Files (SDF) are imported. When SDM is used to import large SDFs such as virtualsensor.xml or IOS-S178.zip, SDM crashes when dismissing the Import Signature dialog. This problem does not always occur.
Workaround: Set the java heap size to -Xmx256m and try to import the file again. If you need to use SDM to perform a critical operation, complete that operation before reattempting to import the file.
The SDM IPS import dialog may not appear when you attempt to import a large SDF, such as virtualsensor.xml more than 5 times. A java out-of-memory error occurs and the Import Signature dialog does not appear.
Workaround: Set the java heap size to -Xmx256m , restart SDM, and try to import the file again.
When using SDM IPS, if you go to IPS Global Settings > Edit and change the size of the SDEE event store, and then refresh or reinvoke SDM IPS, SDM shows the default size of the SDEE event store (200) instead of the value that you configured.
VPN status in the Monitor windows do not show IPSec security association (SA) parameters for DMVPN when CLI status commands report that the crypto tunnels are up and traffic is passing through. The DMVPN tunnel is shown as established in the IKE SA tab.
Workaround: Use the CLI to view DMVPN status.
This problem is encountered on routers running Cisco IOS image c3825-advsecurityk9-mz.123-10.2. If an ATM interface is configured on routers running this image, WAN troubleshooting may display inconsistent results. PVC connections may be shown as UP when they are DOWN.
When both SDM and IPS are open, an open dialog box requiring an OK or Cancel in one application will prevent the user from working in the other application.
Workaround: Complete the work in the dialog box and click OK, or click Cancel to close the dialog box before switching to the other application.
If multiple instances of SDM are run under Netscape version 7.1 using the Java Virtual Machine (JVM) or the Java plug-in, and the user shuts down one instance of SDM, then all other open instances of SDM on that PC are shut down.
This problem occurs because Netscape version 7.1 uses only one instance of the JVM or the Java plug-in, even when multiple instances of Netscape are launched. As a result, when one instance of SDM is shut down, Netscape shuts down the JVM or the Java plug-in, and all other instances of SDM are also shut down.
Workaround: If SDM is run under Netscape version 7.1, open only one instance of SDM . Using Internet Explorer is advised when multiple instances of SDM must be opened, such as when the user must configure multiple routers at the same time.
When the crypto identity ca command is used, the Loopback0 interface is shown as having no configured IP address in the Edit Interfaces and Connections window when an IP address has been configured.
Workaround: Disregard the IP address information in the Interfaces and Connections window. If you need to view the IP address, choose the interface and click the Edit button.
This problem is caused by the Cisco IOS caveat CSCef46305. After an Easy VPN Remote connection has been brought up after a successful user authentication (Xauth), the remote peer may not be listed in the Easy VPN Remote Edit screen if SDM is refreshed or reinvoked. If this problem occurs, Easy VPN Remote troubleshooting might not behave as expected for this connection.
This problem will occur only when the Easy VPN server sends Xauth challenges to the Easy VPN remote at the same time that the Easy VPN remote is trying to establish a tunnel with the VPN server.
When an Easy VPN Server is configured using Digital Certificates for authentication, and an Easy VPN Remote connection is configured on another router, the client statistics for the Easy VPN server are all shown as 0 in the VPN Status window.
Workaround: To view client statistics, choose Tools > Telnet. Log in to the router, and issue the show crypto session command.
When adding a new signature to the ATOMIC.ICMP engine, you may see the error message "[Enum(xxx)-StorageKey-ATOMIC.ICMP] the value AaBb is not a valid value."
Workaround: In the Add Signature window, go to the parameter StorageKey, and click the green square to enable editing for this parameter. the green square icon will change to a red diamond icon. Choosing any value from the drop down box will fix this problem.
This problem is caused by the Cisco IOS caveat CSCef64124. When the user unchecks the Save Xauth username and password on the router check box in the Edit Easy VPN Remote dialog box and clicks OK, the command is delivered to the router, but SDM shows the check box as checked, and the corresponding command is still shown in the running configuration if SDM is refreshed.
This occurs when the user wants to remove the saved Xauth username and password in Easy VPN Remote.
If an Easy VPN Remote configuration has connections to more than one Easy VPN server configured, VPN troubleshooting deactivating may report troubleshooting results for only one VPN server or give incorrect recommendations. This issue is seen only in some Cisco IOS images.
Invoking SDM with a user associated with SDM_Monitor view adds a PKI trust point and an Easy VPN profile. This behavior does not affect the running configuration.
Workaround: Invoke SDM with a user associated with a different CLI view, or with a user of privilege level 15.
SDM filenames are case sensitive. If the SDM files are copied from the PC hard disk to a flash card, File Explorer changes the names to uppercase. When this happens, SDM cannot be invoked from this flash card.
Workaround: Before removing the flash card from the PC, restore the filenames to lowercase.
When the router is running a Cisco IOS image that does not support the show pppoe session command, WAN troubleshooting may not report any reasons for failure or recommended actions for PPPoE connections that are found to be down.
If a firewall is configured for an interface which already has a Management Access policy associated with it, choosing Replace in the Merge/Replace dialog box might prevent access to certain networks.
This occurs because choosing Replace causes the policy access control entries (ACEs) to be disassociated from the interface but not from the vty or HTTP line.
Workaround: When running Firewall wizard on an interface configured with Management Access policy, choose Merge option instead of Replace and proceed.
VPN troubleshooting may report a possible Maximum Transmission Unit (MTU) problem in the passthrough network when the tunnel is up. If the VPN interface is a dialer interface configured on an asynchronous interface, this problem may not always exist, and the displayed recommended action will have no effect.
Workaround: Ignore this message and the corresponding recommendation.
Due to a problem with Cisco IOS, if a custom protocol is mapped to a port and the same custom protocol is specified for matching under a classmap, and then the mapping of the custom protocol is deleted from the configuration , Cisco IOS does not give any warning message that the user should first delete the match protocol custom-01 commands that make use of the custom protocol mapping.
Workaround: Do the following:
–Configure the custom protocol again.
–Remove all the match protocol statements that reference the custom protocol that you configured.
–Remove the custom protocol from the configuration.
This problem is caused by Cisco IOS caveat CSCef52919. A user with privilege level 1 who is associated with a view may be able to log in to SDM with a privilege level of 15. This occurs when authentication authorization and accounting (AAA) is enabled, and a vty line is configured with privilege level 2 through 15.
Workaround: Do not configure privilege 1-level users. The problem does not occur when users of higher privilege levels are configured.
When you update SDM, if any of the uploaded SDM files shows a size of zero bytes when show flash is invoked, no operations such as copy or delete can be performed on flash memory. This problem rarely occurs.
Workaround: Restart the router to be able to perform operations on flash memory. If files of zero bytes are shown in a show flash display, restart the router before starting SDM.
Router does not reload with default configuration when a' user executes a Reset To Factory Defaults operation in SDM.
If the router is running Cisco IOS Release 12.2(11)T6, and the last 4 bits of the config-register value are set to 0, for example 0x2100 or 0x1100, the router does not reload when the user performs a Reset To Factory Defaults. SDM indicates that it has sent a reload command to the router and shuts down, and the default configuration is copied to the startup-config, but the reload command has not executed, and the router is still using the running configuration that was present before the Reset To Factory Defaults operation.
Workaround: Use the CLI config-register command to ensure that the last 4 bits of the config register are not set to 0 (zero).
If you delete a WAN connection that you created, an ip nat inside command may still remain in a LAN interface configuration.
Workaround: To delete the ip nat inside command from the LAN interface configuration, go t o Edit Interfaces and Connections, choose the LAN interface, click Edit, and delete the association in the Association tab.
Enabling AES encryption or IP compression in the Add/Edit IKE Policy or Add/Edit Transform Set windows might not work even though the Cisco IOS image running on the router supports AES encryption or IP Compression. This may happen in the following circumstances:
–Hardware encryption is enabled.
–The router has a VPN module that does not support AES encryption or IP compression.
Workaround: Do one of the following:
–Disable hardware encryption by adding the no crypto engine accelerator command to the configuration file using the CLI interface. This command tells the router to use Cisco IOS software for encryption instead of using the encryption provided by the VPN module.
–Upgrade your hardware VPN module to one that supports AES or IP compression.
For more info on VPN Modules, refer to the document at the following URL:
When configuring static routing, if a virtual-template interface is configured as the next hop interface in a static route, SDM generates corresponding CLI commands. Delivering such commands to the router may fail on some platforms.
Workaround: Do not configure a virtual-template interface as a next hop interface if it is not supported on the router.
When SDM runs with a Cisco IOS image of a release earlier than 12.3T, or earlier than Release 12.2(13)ZH, the HTTP server appends unnecessary characters to names of files it displays. As a result, when SDM is started, the web browser displays the warning "Content does not match the signature."
Workaround: Disregard the warning and click Yes to continue.
When an Easy VPN tunnel is active, using SDM to apply a NAT configuration to the Easy VPN inside and outside interfaces will deliver ip nat inside and ip nat outside commands to the router, but the running configuration will not be changed. SDM displays no error message when this is attempted.
Workaround: To apply a NAT configuration to interfaces that have been designated as Easy VPN inside or outside interfaces, complete the following steps in SDM:
–Choose the Easy VPN tunnel in the VPN Connections window and click Disconnect. If the Connect/Disconnect button is disabled, choose the interface in the Interfaces and Connections window, open the Association tab for that connection and change the Easy VPN association to None.
–Open the NAT window, click Designate NAT Interfaces, and designate NAT inside and NAT outside interfaces.
–Select the Easy VPN tunnel, and click Connect. If you had to disassociate the Easy VPN tunnel from the connection, return to the Association tab, and choose the Easy VPN connection name again.
SDM will not start on a Cisco 831 router with 32 MB of memory if run from Netscape. An exception will be displayed in the Java console window, and in the router console window indicating a memory allocation failure.
Workaround: Run SDM using Internet Explorer version 5.5 or later. Or, if you want to continue to use Netscape, log in to the router CLI and enter the following memory-size command in global configuration mode:Router# memory-size iomem 10
XAuth authentication intermittently fails, and Easy VPN tunnels cannot be established using SDM on routers running Cisco IOS Release 12.3(4)T. When the user attempts to do an Xauth authentication in SDM, the following error message is displayed:Unable to establish a session with the router to process XAUTH request from the Easy VPN server. Easy VPN tunnel cannot be successfully brought up.
This message is followed by another indicating that the connect command was delivered to the router, but that the tunnel was not established.
Workaround: In the VPN Connections window, choose the Easy VPN tunnel configuration and click the Reset Tunnel button to clear the tunnel and reconnect it. If this does not bring up the tunnel, use the Login button, more than once if necessary, to bring up the tunnel.
When SDM Express runs with Cisco IOS image of Release 12.2(15)T, it fails to download the configuration file from the CNS server through the SDM Express wizard. See CSCin65539 for more details. This issue occurs only with Cisco IOS Release 12.2(15)T.
Workaround: Upgrade to Cisco IOS Release 12.3(4)T or later.
On Cisco 7x00 routers, the SDM Update feature is supported if the current SDM files were loaded onto the router flash disk or Compact Flash disk. However, the SDM Updates feature fails to upload new SDM files to the router if the current SDM files were installed in flash memory. The SDM Updates feature uses RCP protocol to upload the new SDM files to the router, but the RCP Server misinterprets the "flag" sent by the RCP Client for the above mentioned file systems.
Workaround: If the current SDM files were loaded into flash memory, update to the new SDM version by manually copying the new SDM files to the file system of the router using a TFTP server. To make use of the automatic SDM Update feature, always install SDM files on the flash disk or Compact Flash disks (disk0, disk1, disk2).
SDM should not get invoked from boot images such as kboot images on 72xx routers. Such boot images are a subset of the Cisco IOS software and do not support all router functions.
Workaround: Boot the router with an SDM-supported Cisco IOS image, and then invoke SDM. See Table 1 for the Cisco IOS releases that SDM supports.
On 72xx platforms, encryption is not supported on PA-4T port adapters. Because the CLI does not support crypto maps for these types of interfaces, SDM will fail to assign crypto maps to these interfaces. The PA-4T port adapter will not support future compression and encryption features.
Workaround: Upgrade your 72xx router hardware to the 4t+ PA port adapter.
Whenever any unconfigured interface contains the description $FW_INSIDE$, on a router configured with a firewall, adding a new NTP server will not modify the firewall ACLs to allow NTP passthrough traffic. Instead, when the user edits the firewall's outside interface in the Interfaces and Connections window, SDM prompts the user to add the NTP passthrough traffic.
Workaround: Use the CLI to manually remove the description $FW_INSIDE$ from the unconfigured interface.
If the interface used for the primary backup connection is configured for PPPoE encapsulation, the backup connection will not function properly if the next hop address is specified during configuration. A Cisco IOS caveat (CSCin64336) has been filed for this problem. If the interface used for the primary backup connection is an Ethernet interface configured without encapsulation, the backup connection will not function properly if the next hop address is not specified during configuration.
Workaround: Do one of the following:
–For PPPoE connections: Do not provide the next hop IP address when you configure the primary backup connection.
–For Ethernet connections without encapsulation: Do provide the next hop IP address when you configure the primary backup connection.
If the WAN wizard is used to configure an analog modem connection as a primary backup connection, and the analog modem connection is deleted, SDM may report that the interface contains unsupported configuration parameters.
Workaround: Click Refresh on the SDM toolbar, and delete the connection.
The Interfaces and Connections window may display the Backup option in disabled state for asynchronous interfaces on Cisco 831 and Cisco 837 routers. This will occur when the following operations have been performed:
–The interface used for the primary backup connection is configured with an SDM-supported IP address type.
–The asynchronous interface is configured as the backup for a primary interface.
–The IP address of the primary interface is changed.
When the IP address of the primary interface is changed, SDM displays a Yes or No warning popup asking if you want to remove the backup configuration. If you choose Yes, SDM removes the backup configuration, but the Interfaces and Connections window still shows the backup option as disabled, preventing you from choosing the asynchronous interface as a backup interface.
Workaround: Delete the asynchronous interface configuration using the Interfaces and Connections window.
When the router is configured to use PPPoE, users may not be able to download a file using FTP or display web pages from Internet hosts that they are able to ping or access using telnet. This can happen if SDM is being used on a router with interfaces that SDM does not support, such as Token Ring or VLAN interfaces. SDM does not deliver the command ip tcp adjust-mss 1452 to unsupported interfaces.
Workaround: Use the CLI to add the ip tcp adjust-mss 1452 command to the VLAN or Token Ring interface configuration. Use Telnet to access the router and enter the following command in VLAN or Token Ring interface configuration mode:Router# ip tcp adjust-mss 1452
The SDM Express wizard may not deliver the configuration to a Cisco 2691 router running Cisco IOS images of Release 12.2(15)T or 12.2(15)ZJ when SSH is used to communicate between SDM Express and the router. When SDM Express is invoked using the string https://router-IP-address, it uses SSH.
Workaround: When launching SDM Express, click Cancel in the SSH credentials window. SDM Express will use the Telnet protocol to communicate with the router. Enter the login ID and password in the Telnet credentials window.
When launching the Dynamic Multipoint Virtual Private Network (DMVPN) Hub and Spoke wizard, SDM may take up to 12 seconds to display the first wizard window. This latency may occur if a JRE plug-in of any version is running in the browser, or if SDM is using the SSH or Telnet communications module.
SDM may take several seconds to display screens in the DMVPN wizard. This latency may occur if a Java plug-in is running in the browser.
Using an IP unnumbered interface as a DMVPN tunnel source may cause Cisco IOS to crash. An interface configured as IP unnumbered uses the IP address of another interface on the router. This Cisco IOS problem does not always occur.
Workaround: Instead of using an IP unnumbered interface as the DMVPN tunnel source, use the interface that is referenced in the ip unnumbered command. If you are configuring a hub, the interface must have a static IP address.
The router reloads when an NHRP tunnel interface is removed. This is a Cisco IOS caveat which you may encounter when deleting a DMVPN tunnel. This caveat duplicates CSCed41641.
Workaround: There is no workaround for this problem.
If an Analog Modem or ISDN connection is deleted using SDM, the dialer interface may not be deleted from the configuration and the router may reload. This is due to a Cisco IOS caveat, CSCin69090. This occurs on routers using Cisco IOS images of Release 12.3(4)XG or later, or Cisco IOS Release 12.3(7)T.
Workaround: There is no workaround for this problem.
On routers running Cisco IOS Release 12.3(6), Cisco IOS may reload if SDM is started using HTTPS.
Workaround: Start SDM by entering http://ip-address. Do not use https://ip-address.
The SDM Express wizard may fail if the router is running Cisco IOS Release 12.3(9) and there is not sufficient space in NVRAM to save the startup configuration. This problem should not occur with new routers.
Workaround: If this problem occurs, use the CLI to remove unneeded files from NVRAM.
SDM does not issue the ntp update-calendar Cisco IOS command on Cisco 7200 routers if there are no new settings to enter and if the Network Time Protocol (NTP) server was configured using the CLI, only one NTP server IP address was provided and no ntp update-calendar Cisco IOS command was present in the running configuration.
Workaround: Use SDM to delete the NTP server configuration entry, click Refresh, and then re-create the entry, or make changes to the existing NTP server entry.
Because of a Cisco IOS issue (CSCee63313), if SDM is used to enable IPS on an interface, and then used to disable IPS on that interface, the router crashes.
Due to a Cisco IOS issue (refer to CSCee58000), SDM is unable to configure a virtual auxiliary port on Cisco 831, 836, or 837 routers running Cisco IOS Release 12.3(7)XR1.
Workaround: Load the rebuilt Cisco Release 12.3(7)XR2 image on the router when it becomes available and then use SDM to configure a virtual auxiliary port.
When SDM is installed on a PC, it cannot be launched if run from Netscape 7.1 or 7.2 and popup blockers have been enabled.
Workaround: In Netscape, go to Edit > Preferences > Privacy and Security > Popup Windows. In the Popup Windows section, uncheck Block unrequested popup windows, and then click Apply. Relaunch SDM.
A download exception message may appear in the Java console when SDM is launched on a PC running Japanese Windows 2000, or Japanese Windows XP. This problem does not prevent SDM from starting or from being used.
The SDM installation program does not use HTTPS to back up files from the router.
Workaround: No workaround exists.
When SDM is invoked from SDM Express, and SDM Express has been started under a nondefault browser, you must reenter router username and password before SDM will start.
Workaround: Use the default browser when launching SDM Express.
When SDM is installed on a PC running Windows XP with Service Pack 2, Internet Explorer will display a message bar at the top of the browser window stating: "To help protect your security, Internet Explorer has restricted this file from showing active content that access your computer. Click here for options..." Clicking Allow blocked content does not enable SDM to launch.
Workaround: In Internet Explorer, go to Tools > Internet Options > Advanced. Then scroll to the Security section, check Allow active content to run in files on my computer, and click Apply. Then relaunch SDM.
When SDM is run with certain Cisco IOS images, the number of Open Shortest Path First (OSPF) processes created can be greater than the number of interfaces in the administratively UP state. However, the running configuration does not display the value of the area configured for these additional networks. Thus, SDM is unable to display the networks for these additional OSPF processes. This problem has been reported with the following Cisco IOS images:
Workaround: No workaround exists.
If signatures are imported using SDM IPS on a router running Cisco IOS Release 12.3(11)T3, system variables parameters are ignored by Cisco IOS.
Workaround: Upgrade to a Cisco IOS image that supports SystemVariables.
The SDM Update from PC feature will not operate when the SDM-Vnn.zip file is placed in a shared folder with read-only access.
Workaround: Do not place the SDM-Vnn.zip file in a folder with read-only access.
Because of a problem with Cisco IOS (CSCeg63077), VPN troubleshooting will not detect the IKE mismatch in site-to-site VPN configuration. Instead it will give a generic recommendation to apply the mirror configuration generated by SDM which would solve this problem.
Workaround: Follow the recommendation displayed in the VPN troubleshooting window to apply mirror configuration on both the devices.
This section lists other documents with information on SDM.
Refer to the quick start guide for the router, available on www.cisco.com, to learn how to set up the router hardware connections.
These documents are available on www.cisco.com/go/sdm.
•Cisco Router and Security Device Manager Q&A. Click Product Literature, and then click Q&A.
•Downloading and Installing Cisco Router and Security Device Manager (SDM). Click Install and Upgrade in the Technical Documentation and Tools box, and then click Install and Upgrade Guides.
•Switching from Cisco Router Web Setup Tool (CRWS) to Cisco SDM on Cisco 83X Series Routers. Click Install and Upgrade in the Technical Documentation and Tools box, and then click Install and Upgrade Guides.
•Running Non English Editions of SDM on English-Language Operating Systems. Click Maintain and Operate in the Technical Documentation and Tools box, and then click End User Guides.
•A number of application notes are available by clicking Reference Guides in the Technical Documentation and Tools box, and then clicking Technical References
Cisco documentation and additional literature are available on Cisco.com. Cisco also provides several ways to obtain technical assistance and other technical resources. These sections explain how to obtain technical information from Cisco Systems.
You can access the most current Cisco documentation at this URL:
You can access the Cisco website at this URL:
You can access international Cisco websites at this URL:
Cisco documentation and additional literature are available in a Documentation DVD package, which may have shipped with your product. The Documentation DVD is updated regularly and may be more current than printed documentation. The Documentation DVD package is available as a single unit.
Registered Cisco.com users (Cisco direct customers) can order a Cisco Documentation DVD (product number DOC-DOCDVD=) from the Ordering tool or Cisco Marketplace.
Cisco Ordering tool:
You can find instructions for ordering documentation at this URL:
You can order Cisco documentation in these ways:
•Registered Cisco.com users (Cisco direct customers) can order Cisco product documentation from the Ordering tool:
•Nonregistered Cisco.com users can order documentation through a local account representative by calling Cisco Systems Corporate Headquarters (California, USA) at 408 526-7208 or, elsewhere in North America, by calling 1 800 553-NETS (6387).
You can send comments about technical documentation to email@example.com.
You can submit comments by using the response card (if present) behind the front cover of your document or by writing to the following address:
Attn: Customer Document Ordering
170 West Tasman Drive
San Jose, CA 95134-9883
We appreciate your comments.
Cisco Product Security Overview
Cisco provides a free online Security Vulnerability Policy portal at this URL:
From this site, you can perform these tasks:
•Report security vulnerabilities in Cisco products.
•Obtain assistance with security incidents that involve Cisco products.
•Register to receive security information from Cisco.
A current list of security advisories and notices for Cisco products is available at this URL:
If you prefer to see advisories and notices as they are updated in real time, you can access a Product Security Incident Response Team Really Simple Syndication (PSIRT RSS) feed from this URL:
Reporting Security Problems in Cisco Products
Cisco is committed to delivering secure products. We test our products internally before we release them, and we strive to correct all vulnerabilities quickly. If you think that you might have identified a vulnerability in a Cisco product, contact PSIRT:
•Emergencies — firstname.lastname@example.org
•Nonemergencies — email@example.com
Tip We encourage you to use Pretty Good Privacy (PGP) or a compatible product to encrypt any sensitive information that you send to Cisco. PSIRT can work from encrypted information that is compatible with PGP versions 2.x through 8.x.
Never use a revoked or an expired encryption key. The correct public key to use in your correspondence with PSIRT is the one that has the most recent creation date in this public key server list:
In an emergency, you can also reach PSIRT by telephone:
•1 877 228-7302
•1 408 525-6532
Obtaining Technical Assistance
For all customers, partners, resellers, and distributors who hold valid Cisco service contracts, Cisco Technical Support provides 24-hour-a-day, award-winning technical assistance. The Cisco Technical Support Website on Cisco.com features extensive online support resources. In addition, Cisco Technical Assistance Center (TAC) engineers provide telephone support. If you do not hold a valid Cisco service contract, contact your reseller.
Cisco Technical Support Website
The Cisco Technical Support Website provides online documents and tools for troubleshooting and resolving technical issues with Cisco products and technologies. The website is available 24 hours a day, 365 days a year, at this URL:
Access to all tools on the Cisco Technical Support Website requires a Cisco.com user ID and password. If you have a valid service contract but do not have a user ID or password, you can register at this URL:
Note Use the Cisco Product Identification (CPI) tool to locate your product serial number before submitting a web or phone request for service. You can access the CPI tool from the Cisco Technical Support Website by clicking the Tools & Resources link under Documentation & Tools. Choose Cisco Product Identification Tool from the Alphabetical Index drop-down list, or click the Cisco Product Identification Tool link under Alerts & RMAs. The CPI tool offers three search options: by product ID or model name; by tree view; or for certain products, by copying and pasting show command output. Search results show an illustration of your product with the serial number label location highlighted. Locate the serial number label on your product and record the information before placing a service call.
Submitting a Service Request
Using the online TAC Service Request Tool is the fastest way to open S3 and S4 service requests. (S3 and S4 service requests are those in which your network is minimally impaired or for which you require product information.) After you describe your situation, the TAC Service Request Tool provides recommended solutions. If your issue is not resolved using the recommended resources, your service request is assigned to a Cisco TAC engineer. The TAC Service Request Tool is located at this URL:
For S1 or S2 service requests or if you do not have Internet access, contact the Cisco TAC by telephone. (S1 or S2 service requests are those in which your production network is down or severely degraded.) Cisco TAC engineers are assigned immediately to S1 and S2 service requests to help keep your business operations running smoothly.
To open a service request by telephone, use one of the following numbers:
Asia-Pacific: +61 2 8446 7411 (Australia: 1 800 805 227)
EMEA: +32 2 704 55 55
USA: 1 800 553-2447
For a complete list of Cisco TAC contacts, go to this URL:
Definitions of Service Request Severity
To ensure that all service requests are reported in a standard format, Cisco has established severity definitions.
Severity 1 (S1)—Your network is "down," or there is a critical impact to your business operations. You and Cisco will commit all necessary resources around the clock to resolve the situation.
Severity 2 (S2)—Operation of an existing network is severely degraded, or significant aspects of your business operation are negatively affected by inadequate performance of Cisco products. You and Cisco will commit full-time resources during normal business hours to resolve the situation.
Severity 3 (S3)—Operational performance of your network is impaired, but most business operations remain functional. You and Cisco will commit resources during normal business hours to restore service to satisfactory levels.
Severity 4 (S4)—You require information or assistance with Cisco product capabilities, installation, or configuration. There is little or no effect on your business operations.
Obtaining Additional Publications and Information
Information about Cisco products, technologies, and network solutions is available from various online and printed sources.
•Cisco Marketplace provides a variety of Cisco books, reference guides, and logo merchandise. Visit Cisco Marketplace, the company store, at this URL:
•Cisco Press publishes a wide range of general networking, training and certification titles. Both new and experienced users will benefit from these publications. For current Cisco Press titles and other information, go to Cisco Press at this URL:
•Packet magazine is the Cisco Systems technical user magazine for maximizing Internet and networking investments. Each quarter, Packet delivers coverage of the latest industry trends, technology breakthroughs, and Cisco products and solutions, as well as network deployment and troubleshooting tips, configuration examples, customer case studies, certification and training information, and links to scores of in-depth online resources. You can access Packet magazine at this URL:
•iQ Magazine is the quarterly publication from Cisco Systems designed to help growing companies learn how they can use technology to increase revenue, streamline their business, and expand services. The publication identifies the challenges facing these companies and the technologies to help solve them, using real-world case studies and business strategies to help readers make sound technology investment decisions. You can access iQ Magazine at this URL:
•Internet Protocol Journal is a quarterly journal published by Cisco Systems for engineering professionals involved in designing, developing, and operating public and private internets and intranets. You can access the Internet Protocol Journal at this URL:
•World-class networking training is available from Cisco. You can view current offerings at this URL:
This document is to be used in conjunction with the documents listed in the "Related Documentation" section.
Copyright © 2003-2005 Cisco Systems, Inc. All rights reserved.