Cisco ASA 5500 Series Next Generation Firewalls

Table Of Contents

Release Notes for the Cisco ASA Series, Version 9.0(x)

Important Notes

Limitations and Restrictions

System Requirements

New Features

New Features in Version 9.0(2)

New Features in Version 9.0(1)

ACL Migration in Version 9.0

IPv6 ACLs

Any Keyword

Upgrading the Software

Viewing Your Current Version

Downloading the Software from Cisco.com

Upgrading a Standalone Unit

Upgrading a Failover Pair or ASA Cluster

Software Version Requirements for Zero Downtime Upgrading

Upgrading an Active/Standby Failover Pair

Upgrading an Active/Active Failover Pair

Upgrading an ASA Cluster

Open Caveats

Resolved Caveats

End-User License Agreement

Related Documentation

Obtaining Software, Documentation, and Submitting a Service Request

Release Notes for the Cisco ASA Series, Version 9.0(x)

---

Released: October 29, 2012

Updated: February 25, 2012

This document contains release information for Cisco ASA software Version 9.0(1) and 9.0(2). This document includes the following sections:

•Important Notes

•Limitations and Restrictions

•System Requirements

•New Features

•ACL Migration in Version 9.0

•Upgrading the Software

•Open Caveats

•Resolved Caveats

•End-User License Agreement

•Related Documentation

•Obtaining Software, Documentation, and Submitting a Service Request

Important Notes

•ASA Clustering—Due to many caveat fixes, we recommend the 9.0(2) release for ASA clustering. If you are running 9.0(1) or 9.1(1), you should upgrade to 9.0(2). Note that due to CSCue72961, hitless upgrading is not supported.

•Downgrading issues—Upgrading to Version 9.0 includes ACL migration (see the "ACL Migration in Version 9.0" section). Therefore, you cannot downgrade from 9.0 with a migrated configuration. Be sure to make a backup copy of your configuration before you upgrade so you can downgrade using the old configuration if required.

•Per-session PAT disabled when upgrading— Starting in Version 9.0, by default, all TCP PAT traffic and all UDP DNS traffic use per-session PAT (see the xlate per-session command in the command reference). If you upgrade to Version 9.0 from an earlier release, to maintain the existing functionality of multi-session PAT, the per-session PAT feature is disabled during configuration migration. The ASA adds the following deny rules:

xlate per-session deny tcp any4 any4

xlate per-session deny tcp any4 any6 

xlate per-session deny tcp any6 any4 

xlate per-session deny tcp any6 any6 

xlate per-session deny udp any4 any4 eq domain

xlate per-session deny udp any4 any6 eq domain

xlate per-session deny udp any6 any4 eq domain

xlate per-session deny udp any6 any6 eq domain

To enable per-session PAT after you upgrade, enter:

clear configure xlate

The above deny rules are cleared so that only the default permit rules are still in place, thus enabling per-session PAT.

•No Payload Encryption for export—You can purchase some models with No Payload Encryption. For export to some countries, payload encryption cannot be enabled on the Cisco ASA 5500 series. The ASA software senses a No Payload Encryption model, and disables the following features:

–Unified Communications

–VPN

You can still install the Strong Encryption (3DES/AES) license for use with management connections and encrypted route messages for OSPFv3. For example, you can use ASDM HTTPS/SSL, SSHv2, Telnet and SNMPv3. You can also download the dynamic database for the Botnet Traffic Filer (which uses SSL) and redirect traffic to Cloud Web Security.

•Two ASA caches are used for processing server certificate verification information. The global cache is 30 seconds while the session cache is 30 minutes, although the cache timeout values are not configurable.

Limitations and Restrictions

•Clientless SSL VPN with a self-signed certificate on the ASA—When the ASA uses a self-signed certificate or an untrusted certificate, Firefox 4 and later and Safari are unable to add security exceptions when browsing using an IPv6 address HTTPS URL (FQDN URL is OK): the "Confirm Security Exception" button is disabled. See: https://bugzilla.mozilla.org/show_bug.cgi?id=633001. This caveat affects all SSL connections originating from Firefox or Safari to the ASA (including clientless SSL VPN connections, and ASDM connections). To avoid this caveat, configure a proper certificate for the ASA that is issued by a trusted certificate authority. For Internet Explorer 9 and later, use compatibility mode.

•Citrix Mobile Receiver and accessing Virtual Desktop Infrastructure (VDI):

–CSD is not supported.

–HTTP redirect is not supported.

–Using Citrix Receiver mobile clients to access web interface of Citrix servers is not supported.

–Certificate or smart card authentication is not supported as a means of auto sign-on.

–You must install XML service and configure on XenApp and XenDesktop servers.

–Make sure the ports 443, 1494, 2598, and 80 are open on any intermediate firewalls between the ASA and the XenApp/XenDesktop server.

–The password-expire-in-days notification on tunnel group that is used by VDI is not supported.

•When configuring for IKEv2, for security reasons you should use groups 21, 20, 19, 24, 14, and 5. We do not recommend Diffie Hellman Group1 or Group2. For example, use

crypto ikev2 policy 10 
group 21 20 19 24 14 5

•With a heavy load of users (around 150 or more) using a WebVPN plugin, you may experience large delays because of the processing overload. Using Citrix web interface reduces the ASA rewrite overhead. To track the progress of the enhancement request to allow WebVPN plug files to be cached on the ASA, refer to CSCud11756.

•Inter-context OSPF adjacency is not supported. To work around this, use the point-to-point non-broadcast options under the interface configuration and the neighbor command under the router ospf section. See the following example for reference:

interface Redundant1.189

 description to core

 nameif core

 security-level 0

 ip address 172.18.0.2 255.255.255.0

 ospf network point-to-point non-broadcast

 router ospf 1

 router-id 172.18.0.2

 network 172.18.0.0 255.255.255.0 area 0

 log-adj-changes

 neighbor 172.18.0.7 interface core

•(ASA 5510, ASA 5520, ASA 5540, and ASA 5550 only) We strongly recommend that you enable hardware processing using the crypto engine large-mod-accel command instead of software for large modulus operations such as 2048-bit certificates and DH5 keys. If you continue to use software processing for large keys, you could experience significant performance degradation due to slow session establishment for IPsec and SSL VPN connections. We recommend that you initially enable hardware processing during a low-use or maintenance period to minimize a temporary packet loss that can occur during the transition of processing from software to hardware.

---

Note For the ASA 5540 and ASA 5550 using SSL VPN, in specific load conditions, you may want to continue to use software processing for large keys. If VPN sessions are added very slowly and the ASA runs at capacity, then the negative impact to data throughput is larger than the positive impact for session establishment.

The ASA 5580/5585-X platforms already integrate this capability; therefore, crypto engine commands are not applicable on these platforms.

---

System Requirements

For information about ASA/ASDM requirements and compatibility, see Cisco ASA Compatibility:

http://www.cisco.com/en/US/docs/security/asa/compatibility/asamatrx.html

For VPN compatibility, see the Supported VPN Platforms, Cisco ASA 5500 Series:

http://www.cisco.com/en/US/docs/security/asa/compatibility/asa-vpn-compatibility.html

New Features

•New Features in Version 9.0(2)

•New Features in Version 9.0(1)

New Features in Version 9.0(2)

Released: February 25, 2013

Table 1 lists the new features for ASA Version 9.0(2)/ASDM Version 7.1(2).

---

Note Features added in 8.4(4.x), 8.4(5), and 8.4(6) are not included in 9.0(2) unless they were listed in the 9.0(1) feature table.

---

Table 1 New Features for ASA Version 9.0(2)/ASDM Version 7.1(2) 

Feature	Description
Remote Access Features
Clientless SSL VPN: Windows 8 Support	This release adds support for Windows 8 x86 (32-bit) and Windows 8 x64 (64-bit) operating systems. We support the following browsers on Windows 8: •Internet Explorer 10 (desktop only) •Firefox (all supported Windows 8 versions) •Chrome (all supported Windows 8 versions) See the following limitations: •Internet Explorer 10: –The Modern (AKA Metro) browser is not supported. –If you enable Enhanced Protected Mode, we recommend that you add the ASA to the trusted zone. –If you enable Enhanced Protected Mode, Smart Tunnel and Port Forwarder are not supported. •A Java Remote Desktop Protocol (RDP) plugin connection to a Windows 8 PC is not supported.
Cisco Secure Desktop: Windows 8 Support	CSD 3.6.6215 was updated to enable selection of Windows 8 in the Prelogin Policy operating system check. See the following limitations: •Secure Desktop (Vault) is not supported with Windows 8.
Management Features
The default Telnet password was removed	To improve security for management access to the ASA, the default login password for Telnet was removed; you must manually set the password before you can log in using Telnet. Note: The login password is only used for Telnet if you do not configure Telnet user authentication (the aaa authentication telnet console command). Formerly, when you cleared the password, the ASA restored the default of "cisco." Now when you clear the password, the password is removed. The login password is also used for Telnet sessions from the switch to the ASASM (see the session command). For initial ASASM access, you must use the service-module session command, until you set a login password. We modified the following command: passwd.

New Features in Version 9.0(1)

---

Note New, changed, and deprecated syslog messages are listed in the syslog message guide.

---

Released: October 29, 2012

Table 2 lists the new features for ASA Version 9.0(1).

---

Note Features added in 8.4(4.x), 8.4(5), and 8.4(6) are not included in 9.0(1) unless they are explicitly listed in this table.

---

Table 2 New Features for ASA Version 9.0(1) 

Feature	Description
Firewall Features
Cisco TrustSec integration	Cisco TrustSec provides an access-control solution that builds upon an existing identity-aware infrastructure to ensure data confidentiality between network devices and integrate security access services on one platform. In the Cisco TrustSec solution, enforcement devices utilize a combination of user attributes and end-point attributes to make role-based and identity-based access control decisions. In this release, the ASA integrates with Cisco TrustSec to provide security group based policy enforcement. Access policies within the Cisco TrustSec domain are topology-independent, based on the roles of source and destination devices rather than on network IP addresses. The ASA can utilize the Cisco TrustSec solution for other types of security group based policies, such as application inspection; for example, you can configure a class map containing an access policy based on a security group. We introduced or modified the following commands: access-list extended, cts sxp enable, cts server-group, cts sxp default, cts sxp retry period, cts sxp reconcile period, cts sxp connection peer, cts import-pac, cts refresh environment-data, object-group security, security-group, show running-config cts, show running-config object-group, clear configure cts, clear configure object-group, show cts, show object-group, show conn security-group, clear cts, debug cts. We introduced the following MIB: CISCO-TRUSTSEC-SXP-MIB.
Cisco Cloud Web Security (ScanSafe)	Cisco Cloud Web Security provides content scanning and other malware protection service for web traffic. It can also redirect and report about web traffic based on user identity. Note Clientless SSL VPN is not supported with Cloud Web Security; be sure to exempt any clientless SSL VPN traffic from the ASA service policy for Cloud Web Security. We introduced or modified the following commands: class-map type inspect scansafe, default user group, http[s] (parameters), inspect scansafe, license, match user group, policy-map type inspect scansafe, retry-count, scansafe, scansafe general-options, server {primary | backup}, show conn scansafe, show scansafe server, show scansafe statistics, user-identity monitor, whitelist.
Extended ACL and object enhancement to filter ICMP traffic by ICMP code	ICMP traffic can now be permitted/denied based on ICMP code. We introduced or modified the following commands: access-list extended, service-object, service.
Unified communications support on the ASASM	The ASASM now supports all Unified Communications features.
NAT support for reverse DNS lookups	NAT now supports translation of the DNS PTR record for reverse DNS lookups when using IPv4 NAT, IPv6 NAT, and NAT64 with DNS inspection enabled for the NAT rule.
Per-session PAT	The per-session PAT feature improves the scalability of PAT and, for ASA clustering, allows each member unit to own PAT connections; multi-session PAT connections have to be forwarded to and owned by the master unit. At the end of a per-session PAT session, the ASA sends a reset and immediately removes the xlate. This reset causes the end node to immediately release the connection, avoiding the TIME_WAIT state. Multi-session PAT, on the other hand, uses the PAT timeout, by default 30 seconds. For "hit-and-run" traffic, such as HTTP or HTTPS, the per-session feature can dramatically increase the connection rate supported by one address. Without the per-session feature, the maximum connection rate for one address for an IP protocol is approximately 2000 per second. With the per-session feature, the connection rate for one address for an IP protocol is 65535/average-lifetime. By default, all TCP traffic and UDP DNS traffic use a per-session PAT xlate. For traffic that can benefit from multi-session PAT, such as H.323, SIP, or Skinny, you can disable per-session PAT by creating a per-session deny rule. We introduced the following commands: xlate per-session, clear configure xlate, show running-config xlate.
ARP cache additions for non-connected subnets	The ASA ARP cache only contains entries from directly-connected subnets by default. You can now enable the ARP cache to also include non-directly-connected subnets. We do not recommend enabling this feature unless you know the security risks. This feature could facilitate denial of service (DoS) attack against the ASA; a user on any interface could send out many ARP replies and overload the ASA ARP table with false entries. You may want to use this feature if you use: •Secondary subnets. •Proxy ARP on adjacent routes for traffic forwarding. We introduced the following command: arp permit-nonconnected. Also available in 8.4(5).
SunRPC change from dynamic ACL to pin-hole mechanism	Previously, Sun RPC inspection does not support outbound access lists because the inspection engine uses dynamic access lists instead of secondary connections. In this release, when you configure dynamic access lists on the ASA, they are supported on the ingress direction only and the ASA drops egress traffic destined to dynamic ports. Therefore, Sun RPC inspection implements a pinhole mechanism to support egress traffic. Sun RPC inspection uses this pinhole mechanism to support outbound dynamic access lists. Also available in 8.4(4.1).
Inspection reset action change	Previously, when the ASA dropped a packet due to an inspection engine rule, the ASA sent only one RST to the source device of the dropped packet. This behavior could cause resource issues. In this release, when you configure an inspection engine to use a reset action and a packet triggers a reset, the ASA sends a TCP reset under the following conditions: •The ASA sends a TCP reset to the inside host when the service resetoutbound command is enabled. (The service resetoutbound command is disabled by default.) •The ASA sends a TCP reset to the outside host when the service resetinbound command is enabled. (The service resetinbound command is disabled by default.) For more information, see the service command in the ASA command reference. This behavior ensures that a reset action will reset the connections on the ASA and on inside servers; therefore countering denial of service attacks. For outside hosts, the ASA does not send a reset by default and information is not revealed through a TCP reset. Also available in 8.4(4.1).
Increased maximum connection limits for service policy rules	The maximum number of connections for service policy rules was increased from 65535 to 2000000. We modified the following commands: set connection conn-max, set connection embryonic-conn-max, set connection per-client-embryonic-max, set connection per-client-max. Also available in 8.4(5)
High Availability and Scalability Features
ASA Clustering for the ASA 5580 and 5585-X	ASA Clustering lets you group multiple ASAs together as a single logical device. A cluster provides all the convenience of a single device (management, integration into a network) while achieving the increased throughput and redundancy of multiple devices. ASA clustering is supported for the ASA 5580 and the ASA 5585-X; all units in a cluster must be the same model with the same hardware specifications. See the configuration guide for a list of unsupported features when clustering is enabled. We introduced or modified the following commands: channel-group, clacp system-mac, clear cluster info, clear configure cluster, cluster exec, cluster group, cluster interface-mode, cluster-interface, conn-rebalance, console-replicate, cluster master unit, cluster remove unit, debug cluster, debug lacp cluster, enable (cluster group), health-check, ip address, ipv6 address, key (cluster group), local-unit, mac-address (interface), mac-address pool, mtu cluster, port-channel span-cluster, priority (cluster group), prompt cluster-unit, show asp cluster counter, show asp table cluster chash-table, show cluster, show cluster info, show cluster user-identity, show lacp cluster, show running-config cluster.
OSPF, EIGRP, and Multicast for clustering	For OSPFv2 and OSPFv3, bulk synchronization, route synchronization, and spanned EtherChannels are supported in the clustering environment. For EIGRP, bulk synchronization, route synchronization, and spanned EtherChannels are supported in the clustering environment. Multicast routing supports clustering. We introduced or modified the following commands: show route cluster, debug route cluster, show mfib cluster, debug mfib cluster.
Packet capture for clustering	To support cluster-wide troubleshooting, you can enable capture of cluster-specific traffic on the master unit using the cluster exec capture command, which is then automatically enabled on all of the slave units in the cluster. The cluster exec keywords are the new keywords that you place in front of the capture command to enable cluster-wide capture. We modified the following commands: capture, show capture.
Logging for clustering	Each unit in the cluster generates syslog messages independently. You can use the logging device-id command to generate syslog messages with identical or different device IDs to make messages appear to come from the same or different units in the cluster. We modified the following command: logging device-id.
Configure the connection replication rate during a bulk sync	You can now configure the rate at which the ASA replicates connections to the standby unit when using Stateful Failover. By default, connections are replicated to the standby unit during a 15 second period. However, when a bulk sync occurs (for example, when you first enable failover), 15 seconds may not be long enough to sync large numbers of connections due to a limit on the maximum connections per second. For example, the maximum connections on the ASA is 8 million; replicating 8 million connections in 15 seconds means creating 533 K connections per second. However, the maximum connections allowed per second is 300 K. You can now specify the rate of replication to be less than or equal to the maximum connections per second, and the sync period will be adjusted until all the connections are synchronized. We introduced the following command: failover replication rate rate. Also available in 8.4(4.1) and 8.5(1.7).
IPv6 Features
IPv6 Support on the ASA's outside interface for VPN Features.	This release of the ASA adds support for IPv6 VPN connections to its outside interface using SSL and IKEv2/IPsec protocols. This release of the ASA continues to support IPv6 VPN traffic on its inside interface using the SSL protocol as it has in the past. This release does not provide IKEv2/IPsec protocol on the inside interface.
Remote Access VPN support for IPv6: IPv6 Address Assignment Policy	You can configure the ASA to assign an IPv4 address, an IPv6 address, or both an IPv4 and an IPv6 address to an AnyConnect client by creating internal pools of addresses on the ASA or by assigning a dedicated address to a local user on the ASA. The endpoint must have the dual-stack protocol implemented in its operating system to be assigned both types of addresses. Assigning an IPv6 address to the client is supported for the SSL protocol. This feature is not supported for the IKEv2/IPsec protocol. We introduced the following commands: ipv6-vpn-addr-assign, vpn-framed-ipv6-address.
Remote Access VPN support for IPv6: Assigning DNS Servers with IPv6 Addresses to group policies	DNS servers can be defined in a Network (Client) Access internal group policy on the ASA. You can specify up to four DNS server addresses including up to two IPv4 addresses and up to two IPv6 addresses. DNS servers with IPv6 addresses can be reached by VPN clients when they are configured to use the SSL protocol. This feature is not supported for clients configured to use the IKEv2/IPsec protocol. We modified the following command: dns-server value.
Remote Access VPN support for IPv6: Split tunneling	Split tunneling enables you to route some network traffic through the VPN tunnel (encrypted) and to route other network traffic outside the VPN tunnel (unencrypted or "in the clear"). You can now perform split tunneling on IPv6 network traffic by defining an IPv6 policy which specifies a unified access control rule. IPv6 split tunneling is reported with the telemetric data sent by the Smart Call Home feature. If either IPv4 or IPv6 split tunneling is enabled, Smart Call Home reports split tunneling as "enabled." For telemetric data, the VPN session database displays the IPv6 data typically reported with session management. You can include or exclude IPv6 traffic from the VPN "tunnel" for VPN clients configured to use the SSL protocol. This feature is not supported for the IKEv2/IPsec protocol. We introduced the following command: ipv6-split-tunnel-policy.
Remote Access VPN support for IPv6: AnyConnect Client Firewall Rules	Access control rules for client firewalls support access list entries for both IPv4 and IPv6 addresses. ACLs containing IPv6 addresses can be applied to clients configured to use the SSL protocol. This feature is not supported for the IKEv2/IPsec protocol. We modified the following command: anyconnect firewall-rule.
Remote Access VPN support for IPv6: Client Protocol Bypass	The Client Protocol Bypass feature allows you to configure how the ASA manages IPv4 traffic when it is expecting only IPv6 traffic or how it manages IPv6 traffic when it is expecting only IPv4 traffic. When the AnyConnect client makes a VPN connection to the ASA, the ASA could assign it an IPv4, IPv6, or both an IPv4 and IPv6 address. If the ASA assigns the AnyConnect connection only an IPv4 address or only an IPv6 address, you can now configure the Client Bypass Protocol to drop network traffic for which the ASA did not assign an IP address, or allow that traffic to bypass the ASA and be sent from the client unencrypted or "in the clear." For example, assume that the ASA assigns only an IPv4 address to an AnyConnect connection and the endpoint is dual stacked. When the endpoint attempts to reach an IPv6 address, if Client Bypass Protocol is disabled, the IPv6 traffic is dropped; however, if Client Bypass Protocol is enabled, the IPv6 traffic is sent from the client in the clear. This feature can be used by clients configured to use the SSL or IKEv2/IPsec protocol. We introduced the following command: client-bypass-protocol.
Remote Access VPN support for IPv6: IPv6 Interface ID and prefix	You can now specify a dedicated IPv6 address for local VPN users. This feature benefits users configured to use the SSL protocol. This feature is not supported for the IKEv2/IPsec protocol. We introduced the following command: vpn-framed-ipv6-address.
Remote Access VPN support for IPv6: Sending ASA FQDN to AnyConnect client	You can return the FQDN of the ASA to the AnyConnect client to facilitate load balancing and session roaming. This feature can be used by clients configured to use the SSL or IKEv2/IPsec protocol. We introduced the following command: gateway-fqdn.
Remote Access VPN support for IPv6: ASA VPN Load Balancing	Clients with IPv6 addresses can make AnyConnect connections through the public-facing IPv6 address of the ASA cluster or through a GSS server. Likewise, clients with IPv6 addresses can make AnyConnect VPN connections through the public-facing IPv4 address of the ASA cluster or through a GSS server. Either type of connection can be load-balanced within the ASA cluster. For clients with IPv6 addresses to successfully connect to the ASAs public-facing IPv4 address, a device that can perform network address translation from IPv6 to IPv4 needs to be in the network. This feature can be used by clients configured to use the SSL or IKEv2/IPsec protocol. We modified the following commands: show run vpn load-balancing.
Remote Access VPN support for IPv6: Dynamic Access Policies support IPv6 attributes	When using ASA 9.0 or later with ASDM 6.8 or later, you can now specify these attributes as part of a dynamic access policy (DAP): •IPv6 addresses as a Cisco AAA attribute •IPv6 TCP and UDP ports as part of a Device endpoint attribute •Network ACL Filters (client) This feature can be used by clients configured to use the SSL or IKEv2/IPsec protocol.
Remote Access VPN support for IPv6: Session Management	Session management output displays the IPv6 addresses in Public/Assigned address fields for AnyConnect connections, site-to-site VPN connections, and Clientless SSL VPN connections. You can add new filter keywords to support filtering the output to show only IPv6 (outside or inside) connections. No changes to IPv6 User Filters exist. This feature can be used by clients configured to use the SSL protocol. This feature does not support IKEv2/IPsec protocol. We modified the following command: show vpn-sessiondb.
NAT support for IPv6	NAT now supports IPv6 traffic, as well as translating between IPv4 and IPv6 (NAT64). Translating between IPv4 and IPv6 is not supported in transparent mode. We modified the following commands: nat (in global and object network configuration mode), show conn, show nat, show nat pool, show xlate.
DHCPv6 relay	DHCP relay is supported for IPv6. We introduced the following commands: ipv6 dhcprelay server, ipv6 dhcprelay enable, ipv6 dhcprelay timeout, clear config ipv6 dhcprelay, ipv6 nd managed-config-flag, ipv6 nd other-config-flag, debug ipv6 dhcp, debug ipv6 dhcprelay, show ipv6 dhcprelay binding, clear ipv6 dhcprelay binding, show ipv6 dhcprelay statistics, and clear ipv6 dhcprelay statistics.
OSPFv3	OSPFv3 routing is supported for IPv6. Note the following additional guidelines and limitations for OSPFv2 and OSPFv3: Clustering •OSPFv2 and OSPFv3 support clustering. •When clustering is configured, OSPFv3 encryption is not supported. An error message appears if you try to configure OSPFv3 encryption in a clustering environment. •When using individual interfaces, make sure that you establish the master and slave units as either OSPFv2 or OSPFv3 neighbors. •When using individual interfaces, OSPFv2 adjacencies can only be established between two contexts on a shared interface on the master unit. Configuring static neighbors is supported only on point-to-point links; therefore, only one neighbor statement is allowed on an interface. Other •OSPFv2 and OSPFv3 support multiple instances on an interface. •The ESP and AH protocol is supported for OSPFv3 authentication. •OSPFv3 supports Non-Payload Encryption. We introduced or modified the following commands: ipv6 ospf cost, ipv6 ospf database-filter all out, ipv6 ospf dead-interval, ipv6 ospf hello-interval, ipv6 ospf mtu-ignore, ipv6 ospf neighbor, ipv6 ospf network, ipv6 ospf priority, ipv6 ospf retransmit-interval, ipv6 ospf transmit-delay, ipv6 router ospf, ipv6 router ospf area, ipv6 router ospf default, ipv6 router ospf default-information, ipv6 router ospf distance, ipv6 router ospf exit, ipv6 router ospf ignore, ipv6 router ospf log-adjacency-changes, ipv6 router ospf no, ipv6 router ospf redistribute, ipv6 router ospf router-id, ipv6 router ospf summary-prefix, ipv6 router ospf timers, area range, area virtual-link, default, default-information originate, distance, ignore lsa mospf, log-adjacency-changes, redistribute, router-id, summary-prefix, timers lsa arrival, timers pacing flood, timers pacing lsa-group, timers pacing retransmission, show ipv6 ospf, show ipv6 ospf border-routers, show ipv6 ospf database-filter, show ipv6 ospf flood-list, show ipv6 ospf interface, show ipv6 ospf neighbor, show ipv6 ospf request-list, show ipv6 ospf retransmission-list, show ipv6 ospf summary-prefix, show ipv6 ospf virtual-links, show ospf, show run ipv6 router, clear ipv6 ospf, clear configure ipv6 router, debug ospfv3.
Unified ACL for IPv4 and IPv6	ACLs now support IPv4 and IPv6 addresses. You can also specify a mix of IPv4 and IPv6 addresses for the source and destination. The IPv6-specific ACLs are deprecated. Existing IPv6 ACLs are migrated to extended ACLs. ACLs containing IPv6 addresses can be applied to clients configured to use the SSL protocol. This feature is not supported for the IKEv2/IPsec protocol. We modified the following commands: access-list extended, access-list webtype. We removed the following commands: ipv6 access-list, ipv6 access-list webtype, ipv6-vpn-filter.
Mixed IPv4 and IPv6 object groups	Previously, network object groups could only contain all IPv4 addresses or all IPv6 addresses. Now network object groups can support a mix of both IPv4 and IPv6 addresses. Note You cannot use a mixed object group for NAT. We modified the following command: object-group network.
Range of IPv6 addresses for a Network object	You can now configure a range of IPv6 addresses for a network object. We modified the following command: range.
Inspection support for IPv6 and NAT64	We now support DNS inspection for IPv6 traffic. We also support translating between IPv4 and IPv6 for the following inspections: •DNS •FTP •HTTP •ICMP You can now also configure the service policy to generate a syslog message (767001) when unsupported inspections receive and drop IPv6 traffic. We modified the following command: service-policy fail-close.
Remote Access Features
Clientless SSL VPN: Additional Support	We have added additional support for these browsers, operating systems, web technologies and applications: Internet browser support: Microsoft Internet Explorer 9, Firefox 4, 5, 6, 7, and 8 Operating system support: Mac OS X 10.7 Web technology support: HTML 5 Application Support: Sharepoint 2010
Clientless SSL VPN: Enhanced quality for rewriter engines	The clientless SSL VPN rewriter engines were significantly improved to provide better quality and efficacy. As a result, you can expect a better end-user experience for clientless SSL VPN users. We did not add or modify any commands for this feature. Also available in 8.4(4.1).
Clientless SSL VPN: Citrix Mobile Receiver	This feature provides secure remote access for Citrix Receiver applications running on mobile devices to XenApp and XenDesktop VDI servers through the ASA. For the ASA to proxy Citrix Receiver to a Citrix Server, when users try to connect to Citrix virtualized resource, instead of providing the Citrix Server's address and credentials, users enter the ASA's SSL VPN IP address and credentials. We modified the following command: vdi.
Clientless SSL VPN: Enhanced Auto-sign-on	This feature improves support for web applications that require dynamic parameters for authentication.
Clientless SSL VPN: Clientless Java Rewriter Proxy Support	This feature provides proxy support for clientless Java plug-ins when a proxy is configured in client machines' browsers. We did not add or modify any commands for this feature.
Clientless SSL VPN: Remote File Explorer	The Remote File Explorer provides users with a way to browse the corporate network from their web browser. When users click the Remote File System icon on the Cisco SSL VPN portal page, an applet is launched on the user's system displaying the remote file system in a tree and folder view. We did not add or modify any commands for this feature.
Clientless SSL VPN: Server Certificate Validation	This feature enhances clientless SSL VPN support to enable SSL server certificate verification for remote HTTPS sites against a list of trusted CA certificates. We modified the following commands: ssl-server-check, crypto, crypto ca trustpool, crl, certificate, revocation-check.
AnyConnect Performance Improvements	This feature improves throughput performance for AnyConnect TLS/DTLS traffic in multi-core platforms. It accelerates the SSL VPN datapath and provides customer-visible performance gains in AnyConnect, smart tunnels, and port forwarding. We modified the following commands: crypto engine accelerator-bias and show crypto accelerator.
Custom Attributes	Custom attributes define and configure AnyConnect features that have not yet been added to ASDM. You add custom attributes to a group policy, and define values for those attributes. For AnyConnect 3.1, custom attributes are available to support AnyConnect Deferred Upgrade. Custom attributes can benefit AnyConnect clients configured for either IKEv2/IPsec or SSL protocols. We added the following command: anyconnect-custom-attr.
Next Generation Encryption	The National Standards Association (NSA) specified a set of cryptographic algorithms that devices must support to meet U.S. federal standards for cryptographic strength. RFC 6379 defines the Suite B cryptographic suites. Because the collective set of algorithms defined as NSA Suite B are becoming a standard, the AnyConnect IPsec VPN (IKEv2 only) and public key infrastructure (PKI) subsystems now support them. The next generation encryption (NGE) includes a larger superset of this set adding cryptographic algorithms for IPsec V3 VPN, Diffie-Hellman Groups 14 and 24 for IKEv2, and RSA certificates with 4096 bit keys for DTLS and IKEv2. The following functionality is added to ASA to support the Suite B algorithms: •AES-GCM/GMAC support (128-, 192-, and 256-bit keys) –IKEv2 payload encryption and authentication –ESP packet encryption and authentication –Hardware supported only on multi-core platforms •SHA-2 support (256-, 384-, and 512-bit hashes) –ESP packet authentication –Hardware and software supported only on multi-core platforms •ECDH support (groups 19, 20, and 21) –IKEv2 key exchange –IKEv2 PFS –Software only supported on single- or multi-core platforms •ECDSA support (256-, 384-, and 521-bit elliptic curves) –IKEv2 user authentication –PKI certificate enrollment –PKI certificate generation and verification –Software only supported on single- or multi-core platforms New cryptographic algorithms are added for IPsecV3. Note Suite B algorithm support requires an AnyConnect Premium license for IKEv2 remote access connections, but Suite B usage for other connections or purposes (such as PKI) has no limitations. IPsecV3 has no licensing restrictions. We introduced or modified the following commands: crypto ikev2 policy, crypto ipsec ikev2 ipsec-proposal, crypto key generate, crypto key zeroize, show crypto key mypubkey, show vpn-sessiondb.
Support for VPN on the ASASM	The ASASM now supports all VPN features.
Multiple Context Mode Features
Site-to-Site VPN in multiple context mode	Site-to-site VPN tunnels are now supported in multiple context mode.
New resource type for site-to-site VPN tunnels	New resource types, vpn other and vpn burst other, were created to set the maximum number of site-to-site VPN tunnels in each context. We modified the following commands: limit-resource, show resource types, show resource usage, show resource allocation.
Dynamic routing in Security Contexts	EIGRP and OSPFv2 dynamic routing protocols are now supported in multiple context mode. OSPFv3, RIP, and multicast routing are not supported.
New resource type for routing table entries	A new resource class, routes, was created to set the maximum number of routing table entries in each context. We modified the following commands: limit-resource, show resource types, show resource usage, show resource allocation.
Mixed firewall mode support in multiple context mode	You can set the firewall mode independently for each security context in multiple context mode, so some can run in transparent mode while others run in routed mode. We modified the following command: firewall transparent. Also available in Version 8.5(1).
Module Features
ASA Services Module support on the Cisco 7600 switch	The Cisco 7600 series now supports the ASASM. For specific hardware and software requirements, see: http://www.cisco.com/en/US/docs/security/asa/compatibility/asamatrx.html.
ASA 5585-X support for the ASA CX SSP-10 and -20	The ASA CX module lets you enforce security based on the complete context of a situation. This context includes the identity of the user (who), the application or website that the user is trying to access (what), the origin of the access attempt (where), the time of the attempted access (when), and the properties of the device used for the access (how). With the ASA CX module, you can extract the full context of a flow and enforce granular policies such as permitting access to Facebook but denying access to games on Facebook or permitting finance employees access to a sensitive enterprise database but denying the same to other employees. We introduced or modified the following commands: capture, cxsc, cxsc auth-proxy, debug cxsc, hw-module module password-reset, hw-module module reload, hw-module module reset, hw-module module shutdown, session do setup host ip, session do get-config, session do password-reset, show asp table classify domain cxsc, show asp table classify domain cxsc-auth-proxy, show capture, show conn, show module, show service-policy. Also available in 8.4(4.1).
ASA 5585-X Dual SSP support for the SSP-10 and SSP-20 (in addition to the SSP-40 and SSP-60); VPN support for Dual SSPs	The ASA 5585-X now supports dual SSPs using all SSP models (you can use two SSPs of the same level in the same chassis). VPN is now supported when using dual SSPs. We did not modify any commands.

ACL Migration in Version 9.0

The following ACL configurations will be migrated when upgrading to Version 9.0.

•IPv6 ACLs

•Any Keyword

IPv6 ACLs

IPv6 ACLs (ipv6 access-list) will be migrated to extended ACLs (access-list extended); IPv6 ACLs are no longer supported.

If IPv4 and IPv6 ACLs are applied on the same direction of an interface (access-group command), then the ACLs are merged:

•If both IPv4 and IPv6 ACLs are not used anywhere other than the access-group, then the name of the IPv4 ACL is used for the merged ACL; the IPv6 access-list is removed.

•If at least one of the ACLs is used in another feature, then a new ACL is created with the name IPv4-ACL-name_IPv6-ACL-name; the in-use ACL(s) continue to be used for other features. ACLs not in use are removed. If the IPv6 ACL is in use for another feature, it is migrated to an extended ACL of the same name.

Any Keyword

Now that ACLs support both IPv4 and IPv6, the any keyword now represents "all IPv4 and IPv6 traffic." Any existing ACLs that use the any keyword will be changed to use the any4 keyword, which denotes "all IPv4 traffic."

In addition, a separate keyword was introduced to designate "all IPv6 traffic": any6.

---

Note The any4 and any6 keywords are not available for all commands that use the any keyword. For example, the NAT feature uses only the any keyword; any represents IPv4 traffic or IPv6 traffic depending on the context within the specific NAT command.

---

Upgrading the Software

---

Note You can upgrade from any previous release (if available for your model) directly to the latest release. When upgrading to Version 9.0, because of configuration migration, you cannot perform a downgrade; be sure to back up your configuration file in case you want to downgrade.

If you are upgrading to Version 9.0, see the migration section in the release notes for configuration migration information.

If you are upgrading from a pre-8.3 release, see also the Cisco ASA 5500 Migration Guide to Version 8.3 and Later for important information about migrating your configuration.

---

This section describes how to upgrade to the latest version and includes the following topics:

•Viewing Your Current Version

•Downloading the Software from Cisco.com

•Upgrading a Standalone Unit

•Upgrading a Failover Pair or ASA Cluster

---

Note For ASDM procedures, see the ASDM documentation.

---

Viewing Your Current Version

Use the show version command to verify the software version of your ASA.

Downloading the Software from Cisco.com

If you have a Cisco.com login, you can obtain the OS and ASDM images from the following website:

http://www.cisco.com/cisco/software/navigator.html?mdfid=279513386

This procedure assumes you put the images on a TFTP server, although other server types are supported.

Upgrading a Standalone Unit

This section describes how to install the ASDM and operating system (OS) images using TFTP. For FTP or HTTP, see the copy command.

Detailed Steps

	Command	Purpose
Step 1	more system:running-config Example: hostname# more system:running-config	(If there is a configuration migration) The output shows the configuration on the terminal so that you can back up your configuration. Copy the output from this command, then paste the configuration in to a text file. Note If you are upgrading from a pre-8.3 version, then the running configuration is backed up automatically. For other methods of backing up, see the configuration guide.
Step 2	copy tftp://server[/path]/asa_image_name {disk0:/ | disk1:/}[path/]asa_image_name Example: hostname# copy tftp://10.1.1.1/asa901-smp-k9.bin disk0:/asa901-smp-k9.bin	Copies the ASA software to the active unit flash memory. For other methods than TFTP, see the copy command.
Step 3	copy tftp://server[/path]/asdm_image_name {disk0:/ | disk1:/}[path/]asdm_image_name Example: hostname# copy tftp://10.1.1.1/asdm-701.bin disk0:/asdm-701.bin	Copies the ASDM image to the active unit flash memory.
Step 4	configure terminal Example: hostname(config)# configure terminal	If you are not already in global configuration mode, accesses global configuration mode.
Step 5	show running-config boot system Example: hostname(config)# show running-config boot system boot system disk0:/cdisk.bin boot system disk0:/asa841-smp-k9.bin	Shows the current boot images configured (up to 4). The ASA uses the images in the order listed; if the first image is unavailable, the next image is used, and so on. You cannot insert a new image URL at the top of the list; to specify the new image to be first, you must remove any existing entries, and enter the image URLs in the order desired, according to the following steps.
Step 6	no boot system {disk0:/ | disk1:/}[path/]asa_image_name Example: hostname(config)# no boot system disk0:/cdisk.bin hostname(config)# no boot system disk0:/asa841-smp-k9.bin	Removes any existing boot image configurations so you can enter the new boot image as your first choice.
Step 7	boot system {disk0:/ | disk1:/}[path/]asa_image_name Example: hostname(config)# boot system disk0://asa901-smp-k9.bin	Sets the ASA image to boot that you just uploaded. Repeat this command for any backup images you want to use in case this image is unavailable. For example, you can re-enter the images you previously removed in Step 6.
Step 8	asdm image {disk0:/ | disk1:/}[path/]asdm_image_name Example: hostname(config)# asdm image disk0:/asdm-701.bin	Sets the ASDM image to use that you just uploaded. You can only configure one ASDM image to use, so you do not need to first remove the existing configuration.
Step 9	write memory Example: hostname(config)# write memory	Saves the new settings to the startup configuration.
Step 10	reload Example: hostname# reload	Reloads the ASA.

Upgrading a Failover Pair or ASA Cluster

•Software Version Requirements for Zero Downtime Upgrading

•Upgrading an Active/Standby Failover Pair

•Upgrading an ASA Cluster

Software Version Requirements for Zero Downtime Upgrading

The units in a failover configuration or ASA cluster should have the same major (first number) and minor (second number) software version. However, you do not need to maintain version parity on the units during the upgrade process; you can have different versions on the software running on each unit and still maintain failover support. To ensure long-term compatibility and stability, we recommend upgrading all units to the same version as soon as possible.

Table 1-3 shows the supported scenarios for performing zero-downtime upgrades.

Table 1-3 Zero-Downtime Upgrade Support 

Type of Upgrade	Support
Maintenance Release	You can upgrade from any maintenance release to any other maintenance release within a minor release. For example, you can upgrade from 7.0(1) to 7.0(4) without first installing the maintenance releases in between.
Minor Release	You can upgrade from a minor release to the next minor release. You cannot skip a minor release. For example, you can upgrade from 7.0(1) to 7.1(1). Upgrading from 7.0(1) directly to 7.2(1) is not supported for zero-downtime upgrades; you must first upgrade to 7.1(1). For models that are not supported on a minor release, you can skip the minor release; for example, for the ASA 5585, you can upgrade from 8.2 to 8.4 (the model is not supported on 8.3).
Major Release	You can upgrade from the last minor release of the previous version to the next major release. For example, you can upgrade from 7.2(1) to 8.0(1), assuming that 7.2(1) is the last minor version in the 7.X release series. Note Zero downtime upgrades are possible, even when feature configuration is migrated, for example, from 8.2(X) to 8.3(X).

Upgrading an Active/Standby Failover Pair

To upgrade the Active/Standby failover pair, perform the following steps.

Requirements

Perform these steps on the active unit.

Detailed Steps

	Command	Purpose
Step 1	more system:running-config Example: active# more system:running-config	(If there is a configuration migration) The output shows the configuration on the terminal so that you can back up your configuration. Copy the output from this command, then paste the configuration in to a text file. Note If you are upgrading from a pre-8.3 version, then the running configuration is backed up automatically. For other methods of backing up, see the configuration guide.
Step 2	copy tftp://server[/path]/asa_image_name {disk0:/ | disk1:/}[path/]asa_image_name Example: active# copy tftp://10.1.1.1/asa901-smp-k9.bin disk0:/asa901-smp-k9.bin	Copies the ASA software to the active unit flash memory. For other methods than TFTP, see the copy command.
Step 3	failover exec mate copy tftp://server[/path]/filename {disk0:/ | disk1:/}[path/]filename Example: active# failover exec mate copy tftp://10.1.1.1/asa901-smp-k9.bin disk0:/asa901-smp-k9.bin	Copies the software to the standby unit; be sure to specify the same path as for the active unit.
Step 4	copy tftp://server[/path]/asdm_image_name {disk0:/ | disk1:/}[path/]asdm_image_name Example: active# copy tftp://10.1.1.1/asdm-701.bin disk0:/asdm-701.bin	Copies the ASDM image to the active unit flash memory.
Step 5	failover exec mate copy tftp://server[/path]/asdm_image_name {disk0:/ | disk1:/}[path/]asdm_image_name Example: active# failover exec mate copy tftp://10.1.1.1/asdm-701.bin disk0:/asdm-701.bin	Copies the ASDM image to the standby unit; be sure to specify the same path as for the active unit.
Step 6	configure terminal Example: active(config)# configure terminal	If you are not already in global configuration mode, accesses global configuration mode.
Step 7	show running-config boot system Example: hostname(config)# show running-config boot system boot system disk0:/cdisk.bin boot system disk0:/asa841-smp-k9.bin	Shows the current boot images configured (up to 4). The ASA uses the images in the order listed; if the first image is unavailable, the next image is used, and so on. You cannot insert a new image URL at the top of the list; to specify the new image to be first, you must remove any existing entries, and enter the image URLs in the order desired, according to the following steps.
Step 8	no boot system {disk0:/ | disk1:/}[path/]asa_image_name Example: hostname(config)# no boot system disk0:/cdisk.bin hostname(config)# no boot system disk0:/asa841-smp-k9.bin	Removes any existing boot image configurations so you can enter the new boot image as your first choice.
Step 9	boot system {disk0:/ | disk1:/}[path/]asa_image_name Example: hostname(config)# boot system disk0://asa901-smp-k9.bin	Sets the ASA image to boot that you just uploaded. Repeat this command for any backup images you want to use in case this image is unavailable. For example, you can re-enter the images you previously removed in Step 8.
Step 10	asdm image {disk0:/ | disk1:/}[path/]asdm_image_name Example: hostname(config)# asdm image disk0:/asdm-701.bin	Sets the ASDM image to use that you just uploaded. You can only configure one ASDM image to use, so you do not need to first remove the existing configuration.
Step 11	write memory Example: active(config)# write memory	Saves the new settings to the startup configuration.
Step 12	failover reload-standby Example: active# failover reload-standby	Reloads the standby unit to boot the new image. Wait for the standby unit to finish loading. Use the show failover command to verify that the standby unit is in the Standby Ready state.
Step 13	no failover active Example: active# no failover active	Forces the active unit to fail over to the standby unit.
Step 14	reload Example: active# reload	Reloads the former active unit (now the new standby unit). If you want to restore this unit to be active after it reloads, enter the failover active command.

Upgrading an Active/Active Failover Pair

To upgrade two units in an Active/Active failover configuration, perform the following steps.

Requirements

Perform these steps in the system execution space of the primary unit.

Detailed Steps

	Command	Purpose
Step 1	more system:running-config Example: primary# more system:running-config	(If there is a configuration migration) The output shows the configuration on the terminal so that you can back up your configuration. Copy the output from this command, then paste the configuration in to a text file. Note If you are upgrading from a pre-8.3 version, then the running configuration is backed up automatically. For other methods of backing up, see the configuration guide.
Step 2	copy tftp://server[/path]/asa_image_name {disk0:/ | disk1:/}[path/]asa_image_name Example: primary# copy tftp://10.1.1.1/asa901-smp-k9.bin disk0:/asa901-smp-k9.bin	Copies the ASA software to the primary unit flash memory. For other methods than TFTP, see the copy command.
Step 3	failover exec mate copy tftp://server[/path]/filename {disk0:/ | disk1:/}[path/]filename Example: primary# failover exec mate copy tftp://10.1.1.1/asa901-smp-k9.bin disk0:/asa901-smp-k9.bin	Copies the software to the secondary unit; be sure to specify the same path as for the primary unit.
Step 4	copy tftp://server[/path]/asdm_image_name {disk0:/ | disk1:/}[path/]asdm_image_name Example: primary# copy tftp://10.1.1.1/asdm-701.bin disk0:/asdm-701.bin	Copies the ASDM image to the primary unit flash memory.
Step 5	failover exec mate copy tftp://server[/path]/asdm_image_name {disk0:/ | disk1:/}[path/]asdm_image_name Example: primary# failover exec mate copy tftp://10.1.1.1/asdm-701.bin disk0:/asdm-701.bin	Copies the ASDM image to the secondary unit; be sure to specify the same path as for the active unit.
Step 6	failover active group 1 failover active group 2 Example: primary# failover active group 1 primary# failover active group 2	Makes both failover groups active on the primary unit.
Step 7	configure terminal Example: primary(config)# configure terminal	If you are not already in global configuration mode, accesses global configuration mode.
Step 8	show running-config boot system Example: hostname(config)# show running-config boot system boot system disk0:/cdisk.bin boot system disk0:/asa841-smp-k9.bin	Shows the current boot images configured (up to 4). The ASA uses the images in the order listed; if the first image is unavailable, the next image is used, and so on. You cannot insert a new image URL at the top of the list; to specify the new image to be first, you must remove any existing entries, and enter the image URLs in the order desired, according to the following steps.
Step 9	no boot system {disk0:/ | disk1:/}[path/]asa_image_name Example: hostname(config)# no boot system disk0:/cdisk.bin hostname(config)# no boot system disk0:/asa841-smp-k9.bin	Removes any existing boot image configurations so you can enter the new boot image as your first choice.
Step 10	boot system {disk0:/ | disk1:/}[path/]asa_image_name Example: hostname(config)# boot system disk0://asa901-smp-k9.bin	Sets the ASA image to boot that you just uploaded. Repeat this command for any backup images you want to use in case this image is unavailable. For example, you can re-enter the images you previously removed in Step 9.
Step 11	asdm image {disk0:/ | disk1:/}[path/]asdm_image_name Example: hostname(config)# asdm image disk0:/asdm-701.bin	Sets the ASDM image to use that you just uploaded. You can only configure one ASDM image to use, so you do not need to first remove the existing configuration.
Step 12	write memory Example: primary(config)# write memory	Saves the new settings to the startup configuration.
Step 13	failover reload-standby Example: primary# failover reload-standby	Reloads the secondary unit to boot the new image. Wait for the secondary unit to finish loading. Use the show failover command to verify that both failover groups are in the Standby Ready state.
Step 14	no failover active group 1 no failover active group 2 Example: primary# no failover active group 1 primary# no failover active group 2	Forces both failover groups to become active on the secondary unit.
Step 15	reload Example: primary# reload	Reloads the primary unit. If the failover groups are configured with the preempt command, they automatically become active on their designated unit after the preempt delay has passed. If the failover groups are not configured with the preempt command, you can return them to active status on their designated units using the failover active group command.

Upgrading an ASA Cluster

To upgrade all units in an ASA cluster, perform the following steps on the master unit. For multiple context mode, perform these steps in the system execution space.

Detailed Steps

	Command	Purpose
Step 1	more system:running-config Example: master# more system:running-config	(If there is a configuration migration) Back up your configuration file. Copy the output from this command, then paste the configuration in to a text file. For other methods of backing up, see the configuration guide.
Step 2	cluster exec copy tftp://server[/path]/asa_image_name {disk0:/ | disk1:/}[path/]asa_image_name Example: master# copy tftp://10.1.1.1/asa901-smp-k9.bin disk0:/asa901-smp-k9.bin	Copies the ASA software to all units in the cluster. For other methods than TFTP, see the copy command.
Step 3	cluster exec copy tftp://server[/path]/asdm_image_name {disk0:/ | disk1:/}[path/]asdm_image_name Example: master# copy tftp://10.1.1.1/asdm-701.bin disk0:/asdm-701.bin	Copies the ASDM image to all units in the cluster.
Step 4	configure terminal Example: master(config)# configure terminal	If you are not already in global configuration mode, accesses global configuration mode.
Step 5	show running-config boot system Example: hostname(config)# show running-config boot system boot system disk0:/cdisk.bin boot system disk0:/asa841-smp-k9.bin	Shows the current boot images configured (up to 4). The ASA uses the images in the order listed; if the first image is unavailable, the next image is used, and so on. You cannot insert a new image URL at the top of the list; to specify the new image to be first, you must remove any existing entries, and enter the image URLs in the order desired, according to the following steps.
Step 6	no boot system {disk0:/ | disk1:/}[path/]asa_image_name Example: hostname(config)# no boot system disk0:/cdisk.bin hostname(config)# no boot system disk0:/asa841-smp-k9.bin	Removes any existing boot image configurations so you can enter the new boot image as your first choice.
Step 7	boot system {disk0:/ | disk1:/}[path/]asa_image_name Example: hostname(config)# boot system disk0://asa901-smp-k9.bin	Sets the ASA image to boot that you just uploaded. Repeat this command for any backup images you want to use in case this image is unavailable. For example, you can re-enter the images you previously removed in Step 6.
Step 8	asdm image {disk0:/ | disk1:/}[path/]asdm_image_name Example: hostname(config)# asdm image disk0:/asdm-701.bin	Sets the ASDM image to use that you just uploaded. You can only configure one ASDM image to use, so you do not need to first remove the existing configuration.
Step 9	write memory Example: master(config)# write memory	Saves the new settings to the startup configuration.
Step 10	cluster exec unit slave-unit reload noconfirm Example: master# failover reload-standby	Reload each slave unit by repeating this command for each unit name. To avoid connection loss, wait for each unit to come back up before reloading the next unit. To view member names, enter cluster exec unit ?, or enter the show cluster info command.
Step 11	reload noconfirm Example: master# reload	Reloads the master unit. A new election takes place for a new master unit. When the former master unit rejoins the cluster, it will be a slave.

Open Caveats

Table 4 contains open caveats in ASA software Version 9.0(x).

If you are a registered Cisco.com user, view more information about each caveat using the Bug Toolkit at the following website:

http://tools.cisco.com/Support/BugToolkit/

Table 4 Open Caveats in ASA Version 9.0(x) 

Caveat	Description
CSCtg78775	asa passes the first packet but denies the rest in pim bidir mode
CSCtr67875	HW accelerator error PKCS1 v1.5 RSA - cert auth fails with certain certs
CSCtx12834	%ASA-3-210007: LU allocate xlate failed (overlapping NAT rules)
CSCty80078	ASASM shows duplicate link local address on failover
CSCub53088	Arsenal:twice NAT with service type ftp not working.
CSCuc40450	error 'Drop-reason: (punt-no-mem) Punt no memory' need to be specific
CSCuc80004	Traceback seen when editing ACL configured in AAA UAuth
CSCuc89024	With DFP enabled traceback in CP processing after 2 hrs invalid H323 pkt
CSCud24785	Slow throughput of AnyConnect client w/DTLS compared to IPSec IKEv1
CSCud62661	STI Flash write failure corrupts large files
CSCud76481	ASA 8.6/9.x : Fails to parse symbols in LDAP attibute name
CSCud77249	ASA User Identity Through Scansafe still happening after removing user
CSCud80242	UDP port 10000 reserved without any crypto configured
CSCud85382	Threat Detection Syslogs from System Context in Multi-context Mode
CSCud91387	ASA: ScanSafe for https may not allow 302 page moved response
CSCue02806	Removing IPv6 overlapping routes causes traffic failure
CSCue31900	Flapping the CCL or Data spanned port-channel causes intermittent crash
CSCue43407	L2TP/IPsec behind NAT fails to connect if ASA is behind NAT too
CSCue54264	WebVPN: outside PC enabled webvpn to management-access inside interface
CSCue61123	config changes are not reflecting to standby ASA
CSCue62691	ASASM Traceback when issue 'show asp table interface' command
CSCue72961	MFM: Cluster hitless upgrade doesn't work for 9.0.1 to 9.0.2

Resolved Caveats

Table 5 contains resolved caveats in ASA software Version 9.0(2).

If you are a registered Cisco.com user, view more information about each caveat using the Bug Toolkit at the following website:

http://tools.cisco.com/Support/BugToolkit/

Table 5 Resolved Caveats in ASA Version 9.0(2) 

Caveat	Description
CSCsr58601	SCCP does not handle new msg StartMediaTransmissionACK
CSCti14272	Time-based License Expires Pre-maturely
CSCti38856	Elements in the network object group are not converted to network object
CSCtj12159	ASA (8.3.2) traceback in Thread Name: DATAPATH-1-1295
CSCtj87870	Failover disabled due to license incompatible different Licensed cores
CSCtr17899	Some legitimate traffic may get denied with ACL optimization
CSCtr92976	ESMTP inspection corrupts data
CSCts15825	RRI routes are not injected after reload if IP SLA is configured.
CSCts50723	ASA: Builds conn for packets not destined to ASA's MAC in port-channel
CSCtw56859	Natted traffic not getting encrypted after reconfiguring the crypto ACL
CSCtx82335	Reserve 256 byte block pool for ARP processing
CSCty18976	ASA sends user passwords in AV as part of config command authorization.
CSCtz00381	RADIUS client too busy - try later
CSCtz04768	Emails from Smart Call Home are not RFC 2822 Section 2.3 compliant
CSCtz46845	ASA 5585 with IPS inline -VPN tunnel dropping fragmented packets
CSCtz47034	ASA 5585- 10 gig interfaces may not come up after asa reload
CSCtz56155	misreported high CPU
CSCtz64218	ASA may traceback when multiple users make simultaneous change to ACL
CSCtz78718	ASA: access-list with name "ext" is changed to "extended" on boot
CSCtz79578	Port-Channel Flaps at low traffic rate with single flow traffic
CSCtz94191	ASA cut-though proxy stops working if using FQDN ACL
CSCua20850	5500X Software IPS console too busy for irq can cause data plane down.
CSCua28838	ASA:IKEv2 tunnel failure due to IPsec rekey collision
CSCua35337	Local command auth not working for certain commands on priv 1
CSCua44723	ASA nat-pat: 8.4.4 assert crashes related to xlate timeout
CSCua50058	PP : TFTP ACK to last block dropped
CSCua60417	8.4.3 system log messages should appear in Admin context only
CSCua87170	Interface oversubscription on active causes standby to disable failover
CSCua88376	ASA vulnerable to CVE-2003-0001
CSCua91108	ASA unexpected system reboot with Thread Name: UserFromCert Thread
CSCua91189	Traceback in CP Processing when enabling H323 Debug
CSCua93764	ASA: Watchdog traceback from tmatch_element_release_actual
CSCua95621	ASA:write standby command brings down port-channel interface on standby
CSCua99003	WebVPN:"My Mail" option doesn't work for OWA2010
CSCua99091	ASA: Page fault traceback when copying new image to flash
CSCub04470	ASA: Crash in Dispatch Unit with HTTP inspect regex
CSCub08224	ASA 210005 and 210007 LU allocate xlate/conn failed with simple 1-1 NAT
CSCub11582	ASA5550 continous reboot with tls-proxy maximum session 4500
CSCub14196	FIFO queue oversubscription drops packets to free RX Rings
CSCub15394	unexpected policy-map is added on standby ASA when new context is made
CSCub16427	Standby ASA traceback while replicating flow from Active
CSCub16573	ASA: Memory leak due to SNP RT Inspect
CSCub23840	ASA crashes due to nested protocol object-group used in ACL
CSCub24113	ASA does not check aaa-server use before removing commands
CSCub28198	ASA Webvpn rewriter compression not working
CSCub28721	Standby ASA has duplicate ACEs for webtype ACLs after 'write standby'
CSCub31151	"idle-timeout = 0" is not able to configure with AnyConnect IKEv2
CSCub37882	Standby ASA allows L2 broadcast packets with asr-group command
CSCub39677	ASA Webvpn form POST is not rewritten 8.4.1.8 or later
CSCub40805	After some time "show inventory" fails to display Power Supply SN
CSCub59136	ASA: Manual NAT rules are not processed in order
CSCub59536	NAT Config Rejected on Upgrade when Objects Overlap with Failover IP
CSCub61578	ASA: Assert traceback in PIX Garbage Collector with GTP inspection
CSCub62584	ASA unexpectedly reloads with traceback in Thread Name: CP Processing
CSCub70946	ASA traceback under threadname Dispatch Unit due to multicast traffic
CSCub72545	syslog 113019 reports invalid address when VPN client disconnects.
CSCub72990	ASA is max-aging OSPF LSAs after 50 minutes
CSCub75522	ASA TFW sends broadcast arp traffic to all interfaces in the context
CSCub83472	VPNFO should return failure to HA FSM when control channel is down
CSCub84164	ASA traceback in threadname Logger
CSCub84711	OID used for authentication by EKU is trunkated
CSCub89078	ASA standby produces traceback and reloads in IPsec message handler
CSCub94635	Deleting ip local pool cause disconnect of VPN session using other pools
CSCub97263	WebVpn PortForward code signning issue
CSCub99578	High CPU HOG when connnect/disconnect VPN with large ACL
CSCub99704	WebVPN - mishandling of request from Java applet
CSCuc04636	Traceback in Thread Name: accept/http
CSCuc04900	ASA doesn't prohibit changing password to ones previously used
CSCuc06857	Accounting STOP with caller ID 0.0.0.0 if admin session exits abnormally
CSCuc09055	Nas-Port attribute different for authentication/accounting Anyconnect
CSCuc12119	ASA: Webvpn cookie corruption with external cookie storage
CSCuc12967	OSPF routes were missing on the Standby Firewall after the failover
CSCuc14191	ASA: Webvpn rewriter not rewriting eval function call properly
CSCuc14255	Enhance RTCLI implementation of password type (BNF)
CSCuc15034	The "clear crypto ca crls <trustpoint>" command does not work
CSCuc16455	ASA packet transmission failure due to depletion of 1550 byte block
CSCuc16513	'clear config crypto ipsec ikev1' removes ikev2 proposals as well
CSCuc16670	ASA - VPN connection remains up when DHCP rebind fails
CSCuc17257	ASA Traceback - MD5_Update
CSCuc19882	Flash filesystem does not recognize filesnames > 63 characters
CSCuc23984	ASA: Port-channel config not loaded correctly when speed/duplex are set
CSCuc24547	TCP ts_val for an ACK packet sent by ASA for OOO packets is incorrect
CSCuc24919	ASA: May crash in Thread Name: fover_health_monitoring_thread
CSCuc25787	Per tunnel webvpn customizations ignored after ASA 8.2 upgraded to 8.4
CSCuc28903	ASA 8.4.4.6 and higher: no OSPF adj can be build with Portchannel port
CSCuc34345	Multi-Mode ASA crash on ci/console copying config tftp to running-config
CSCuc36831	Crash when removing group-policy
CSCuc40005	PRTG app Javascript as a stream (not content) fails through the rewriter
CSCuc45011	ASA may traceback while fetching personalized user information
CSCuc46026	ASA traceback: ASA reloaded when call home feature enabled
CSCuc46270	ASA never removes qos-per-class ASP rules when VPN disconnects
CSCuc46561	OWA doesn't work after the ASA upgrade
CSCuc48355	ASA webvpn - URLs are not rewritten through webvpn in 8.4(4)5
CSCuc50544	Error when connecting VPN: DTLS1_GET_RECORD Reason: wrong version number
CSCuc56078	Traceback in threadname CP Processing
CSCuc60478	Management access fails via L2TP VPN client on SMP platform
CSCuc60566	ASA IPSEC error: Internal Error, ike_lock trying to unlock bit
CSCuc60950	ASA traceback in Dispatch Unit
CSCuc61985	distribute-list does not show in the router config.
CSCuc63592	HTTP inspection matches incorrect line when using header host regex
CSCuc64108	ASA:DAP User Messages is truncated when action is terminate
CSCuc66227	Port-channel config fails, Error: unable to get MCAST_MAC_TABLE_SIZE
CSCuc75090	Crypto IPSec SA's are created by dynamic crypto map for static peers
CSCuc75093	Log indicating syslog connectivity not created when server goes up/down
CSCuc78176	Cat6000/15.1(1)SY- ASASM/8.5(1.14) PwrDwn due to SW Version Mismatch
CSCuc79304	ASA 9.0:Clientless & anyconnect fail to group-url with port defined
CSCuc79825	5580 - Thread Name: CP Midpath Processing eip pkp_free_ssl_ctm
CSCuc83059	traceback in fover_health_monitoring_thread
CSCuc83170	ipsecvpn-ike:IKEv1 rekey fails when IPCOMP proposal is sent
CSCuc83323	XSS in SSLVPN
CSCuc83828	ASA Logging command submits invalid characters as port zero
CSCuc84079	ASA: Multiple context mode does not allow configuration of 'mount'
CSCuc89163	Race condition can result in stuck VPN context following a rekey
CSCuc97552	Deny rules in crypto acl blocks inbound traffic after tunnel formed
CSCud04867	Incorrect and duplicate logs about status change of port-channel intfs
CSCud07436	APCF Flag no-toolbar fails after upgrade to 8.4.4.9
CSCud07930	ASA webvpn plugin files Expires header incorrectly set
CSCud08203	Smart-tunnel failing to forward tcp connections for certain application
CSCud08385	Smart Tunnel failed for Safari 6.0.1/6.0.2 on OSX10.7 and 10.8
CSCud12924	CA certificates expiring after 2038 display wrong end date on 5500-X
CSCud16105	Called-Station-Id in RADIUS acct stop after failover is standby address.
CSCud17993	ASA-Traceback in Dispatch unit due to dcerpc inspection
CSCud20442	Sharepoint 2010 over clientless - file edition fails with Office 2010
CSCud24452	ASA TACACS authentication on Standby working incorrectly
CSCud29007	License server becomes unreachable due to "signature invalid" error
CSCud29045	ASASM forwards subnet directed bcast back onto that subnet
CSCud36686	Deny ACL lines in crypto-map add RRI routes
CSCud37992	SMP ASA traceback in periodic_handler in proxyi_rx
CSCud41670	ASA nested traceback with url-filtering policy during failover
CSCud46746	DNS resolution for "from-the-box" traffic not working with "names"
CSCud47900	ASA: adding nested object group fails with "IP version mismatch"
CSCud51281	"Failed to update IPSec failover runtime data" msg on the standby unit
CSCud51478	management access missing from multi cont vpn
CSCud67282	data-path: ASA-SM: 8.5.1 traceback in Thread Name: SSH
CSCud72383	IKEV2-L2L: DH handle leak when PFS enabled only on one peer
CSCud89380	ASA: Username with ampersand disconnects ASDM Firewall Dashboards
CSCud89974	flash in ASA5505 got corrupted

End-User License Agreement

For information on the end-user license agreement, go to:

http://www.cisco.com/en/US/docs/security/asa/roadmap/asaroadmap.html

Related Documentation

For additional information on the ASA, see Navigating the Cisco ASA Series Documentation:

http://www.cisco.com/en/US/docs/security/asa/roadmap/asaroadmap.html

Obtaining Software, Documentation, and Submitting a Service Request

For information on obtaining documentation, submitting a service request, and gathering additional information, see the monthly What's New in Cisco Product Documentation, which also lists all new and revised Cisco technical documentation, at:

http://www.cisco.com/en/US/docs/general/whatsnew/whatsnew.html

Subscribe to the What's New in Cisco Product Documentation as an RSS feed and set content to be delivered directly to your desktop using a reader application. The RSS feeds are a free service. Cisco currently supports RSS Version 2.0.

This document is to be used in conjunction with the documents listed in the "Related Documentation" section.

Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)

Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.

©2012-2013 Cisco Systems, Inc. All rights reserved.