Table Of Contents
Release Notes for the Cisco ASA Series, Version 9.1(x)
Important Notes
Limitations and Restrictions
System Requirements
New Features
New Features in Version 9.1(2)
New Features in Version 9.1(1)
Upgrading the Software
Viewing Your Current Version
Downloading the Software from Cisco.com
Upgrading a Standalone Unit
Upgrading a Failover Pair or ASA Cluster
Software Version Requirements for Zero Downtime Upgrading
Upgrading an Active/Standby Failover Pair
Upgrading an Active/Active Failover Pair
Upgrading an ASA Cluster
Open Caveats
Resolved Caveats
Resolved Caveats in Version 9.1(2)
Resolved Caveats in Version 9.1(1)
End-User License Agreement
Related Documentation
Obtaining Software, Documentation, and Submitting a Service Request
Release Notes for the Cisco ASA Series, Version 9.1(x)
Released: December 3, 2012
Updated: May 24, 2013
This document contains release information for Cisco ASA software Version 9.1(1) and 9.1(2). This document includes the following sections:
•
Important Notes
•Limitations and Restrictions
•System Requirements
•New Features
•Upgrading the Software
•Open Caveats
•Resolved Caveats
•End-User License Agreement
•Related Documentation
•Obtaining Software, Documentation, and Submitting a Service Request
Important Notes
•ASA CX software module SSD—An SSD is required to install the ASA CX software module on the ASA 5500-X series. Non-Cisco SSDs are not supported.
•Downgrading issues—Upgrading to Version 9.0 and later includes ACL migration (see the 9.0 release notes). Therefore, you cannot downgrade from 9.0 and later with a migrated configuration. Be sure to make a backup copy of your configuration before you upgrade so you can downgrade using the old configuration if required.
•Per-session PAT disabled when upgrading— Starting in Version 9.0, by default, all TCP PAT traffic and all UDP DNS traffic use per-session PAT (see the xlate per-session command in the command reference). If you upgrade to Version 9.0 or later from an earlier release, to maintain the existing functionality of multi-session PAT, the per-session PAT feature is disabled during configuration migration. The ASA adds the following deny rules:
xlate per-session deny tcp any4 any4
xlate per-session deny tcp any4 any6
xlate per-session deny tcp any6 any4
xlate per-session deny tcp any6 any6
xlate per-session deny udp any4 any4 eq domain
xlate per-session deny udp any4 any6 eq domain
xlate per-session deny udp any6 any4 eq domain
xlate per-session deny udp any6 any6 eq domain
To enable per-session PAT after you upgrade, enter:
The above deny rules are cleared so that only the default permit rules are still in place, thus enabling per-session PAT.
•No Payload Encryption for export—You can purchase some models with No Payload Encryption. For export to some countries, payload encryption cannot be enabled on the Cisco ASA series. The ASA software senses a No Payload Encryption model, and disables the following features:
–Unified Communications
–VPN
You can still install the Strong Encryption (3DES/AES) license for use with management connections and encrypted route messages for OSPFv3. For example, you can use ASDM HTTPS/SSL, SSHv2, Telnet and SNMPv3. You can also download the dynamic database for the Botnet Traffic Filer (which uses SSL) and redirect traffic to Cloud Web Security.
•Two ASA caches are used for processing server certificate verification information. The global cache is 30 seconds while the session cache is 30 minutes, although the cache timeout values are not configurable.
Note The ciscoasa(config-webvpn)#debug menu webvpn 214 cache <timeout> command can change the global cache timeout, but it is only used for debug purposes.
Limitations and Restrictions
•Clientless SSL VPN with a self-signed certificate on the ASA—When the ASA uses a self-signed certificate or an untrusted certificate, Firefox 4 and later and Safari are unable to add security exceptions when browsing using an IPv6 address HTTPS URL (FQDN URL is OK): the "Confirm Security Exception" button is disabled. See: https://bugzilla.mozilla.org/show_bug.cgi?id=633001. This caveat affects all SSL connections originating from Firefox or Safari to the ASA (including clientless SSL VPN connections, and ASDM connections). To avoid this caveat, configure a proper certificate for the ASA that is issued by a trusted certificate authority. For Internet Explorer 9 and later, use compatibility mode.
•Citrix Mobile Receiver and accessing Virtual Desktop Infrastructure (VDI):
–CSD is not supported.
–HTTP redirect is not supported.
–Using Citrix Receiver mobile clients to access web interface of Citrix servers is not supported.
–Certificate or smart card authentication is not supported as a means of auto sign-on.
–You must install XML service and configure on XenApp and XenDesktop servers.
–Make sure the ports 443, 1494, 2598, and 80 are open on any intermediate firewalls between the ASA and the XenApp/XenDesktop server.
–The password-expire-in-days notification on tunnel group that is used by VDI is not supported.
•When configuring for IKEv2, for security reasons you should use groups 21, 20, 19, 24, 14, and 5. We do not recommend Diffie Hellman Group1 or Group2. For example, use
crypto ikev2 policy 10
group 21 20 19 24 14 5
•With a heavy load of users (around 150 or more) using a WebVPN plugin, you may experience large delays because of the processing overload. Using Citrix web interface reduces the ASA rewrite overhead. To track the progress of the enhancement request to allow WebVPN plug files to be cached on the ASA, refer to CSCud11756.
•(ASA 5510, ASA 5520, ASA 5540, and ASA 5550 only) We strongly recommend that you enable hardware processing using the crypto engine large-mod-accel command instead of software for large modulus operations such as 2048-bit certificates and DH5 keys. If you continue to use software processing for large keys, you could experience significant performance degradation due to slow session establishment for IPsec and SSL VPN connections. We recommend that you initially enable hardware processing during a low-use or maintenance period to minimize a temporary packet loss that can occur during the transition of processing from software to hardware.
Note For the ASA 5540 and ASA 5550 using SSL VPN, in specific load conditions, you may want to continue to use software processing for large keys. If VPN sessions are added very slowly and the ASA runs at capacity, then the negative impact to data throughput is larger than the positive impact for session establishment.
The ASA 5580/5585-X platforms already integrate this capability; therefore, crypto engine commands are not applicable on these platforms.
System Requirements
For information about ASA/ASDM software and hardware requirements and compatibility, including module compatibility, see Cisco ASA Compatibility:
http://www.cisco.com/en/US/docs/security/asa/compatibility/asamatrx.html
For VPN compatibility, see the Supported VPN Platforms, Cisco ASA 5500 Series:
http://www.cisco.com/en/US/docs/security/asa/compatibility/asa-vpn-compatibility.html
New Features
•New Features in Version 9.1(2)
•New Features in Version 9.1(1)
Note New, changed, and deprecated syslog messages are listed in the syslog message guide.
New Features in Version 9.1(2)
Released: May 14, 2013
Table 1 lists the new features for ASA Version 9.1(2).
Note Features added in 8.4(6) are not included in 9.1(2) unless they are explicitly listed in this table.
Table 1 New Features for ASA Version 9.1(2)
Feature
|
Description
|
Encryption Features
|
Support for IPsec LAN-to-LAN tunnels to encrypt failover and state link communications
|
Instead of using the proprietary encryption for the failover key (the failover key command), you can now use an IPsec LAN-to-LAN tunnel for failover and state link encryption.
Note Failover LAN-to-LAN tunnels do not count against the IPsec (Other VPN) license.
We introduced or modified the following commands: failover ipsec pre-shared-key, show vpn-sessiondb.
|
Additional ephemeral Diffie-Hellman ciphers for SSL encryption
|
The ASA now supports the following ephemeral Diffie-Hellman (DHE) SSL cipher suites:
•DHE-AES128-SHA1
•DHE-AES256-SHA1
These cipher suites are specified in RFC 3268, Advanced Encryption Standard (AES) Ciphersuites for Transport Layer Security (TLS).
When supported by the client, DHE is the preferred cipher because it provides Perfect Forward Secrecy. See the following limitations:
•DHE is not supported on SSL 3.0 connections, so make sure to also enable TLS 1.0 for the SSL server.
hostname(config)# ssl server-version tlsv1 sslv3
hostname(config) # ssl client-version any
•Some popular applications do not support DHE, so include at least one other SSL encryption method to ensure that a cipher suite common to both the SSL client and server can be used.
•Some clients may not support DHE, including AnyConnect 2.5 and 3.0, Cisco Secure Desktop, and Internet Explorer 9.0.
We modified the following command: ssl encryption.
Also available in 8.4(4.1).
|
Management Features
|
Support for administrator password policy when using the local database
|
When you configure authentication for CLI or ASDM access using the local database, you can configure a password policy that requires a user to change their password after a specified amount of time and also requires password standards such as a minimum length and the minimum number of changed characters.
We introduced the following commands: change-password, password-policy lifetime, password-policy minimum changes, password-policy minimum-length, password-policy minimum-lowercase, password-policy minimum-uppercase, password-policy minimum-numeric, password-policy minimum-special, password-policy authenticate enable, clear configure password-policy, show running-config password-policy.
Also available in 8.4(4.1).
|
Support for SSH public key authentication
|
You can now enable public key authentication for SSH connections to the ASA on a per-user basis. You can specify a public key file (PKF) formatted key or a Base64 key. The PKF key can be up to 4096 bits. Use PKF format for keys that are too large to for the ASA support of the Base64 format (up to 2048 bits).
We introduced the following commands: ssh authentication.
Also available in 8.4(4.1); PKF key format support is only in 9.1(2).
|
AES-CTR encryption for SSH
|
The SSH server implementation in the ASA now supports AES-CTR mode encryption.
|
Improved SSH rekey interval
|
An SSH connection is rekeyed after 60 minutes of connection time or 1 GB of data traffic.
We introduced the following command: show ssh sessions detail.
|
Support for Diffie-Hellman Group 14 for the SSH Key Exchange
|
Support for Diffie-Hellman Group 14 for SSH Key Exchange was added. Formerly, only Group 1 was supported.
We introduced the following command: ssh key-exchange.
Also available in 8.4(4.1).
|
Support for a maximum number of management sessions
|
You can set the maximum number of simultaneous ASDM, SSH, and Telnet sessions.
We introduced the following commands: quota management-session, show running-config quota management-session, show quota management-session.
Also available in 8.4(4.1).
|
The default Telnet password was removed
|
To improve security for management access to the ASA, the default login password for Telnet was removed; you must manually set the password before you can log in using Telnet. Note: The login password is only used for Telnet if you do not configure Telnet user authentication (the aaa authentication telnet console command).
Formerly, when you cleared the password, the ASA restored the default of "cisco." Now when you clear the password, the password is removed.
The login password is also used for Telnet sessions from the switch to the ASASM (see the session command). For initial ASASM access, you must use the service-module session command, until you set a login password.
We modified the following command: passwd.
Also available in 9.0(2).
|
Platform Features
|
Support for Power-On Self Test (POST)
|
The ASA runs its power-on self-test at boot time even if it is not running in FIPS 140-2-compliant mode.
Additional tests have been added to the POST to address the changes in the AES-GCM/GMAC algorithms, ECDSA algorithms, PRNG, and Deterministic Random Bit Generator Validation System (DRBGVS).
|
Improved pseudo-random number generation (PRNG)
|
The X9.31 implementation has been upgraded to use AES-256 encryption instead of 3DES encryption to comply with the Network Device Protection Profile (NDPP) in single-core ASAs.
|
Support for image verification
|
Support for SHA-512 image integrity checking was added.
We modified the following command: verify.
Also available in 8.4(4.1).
|
Support for private VLANs on the ASA Services Module
|
You can use private VLANs with the ASASM. Assign the primary VLAN to the ASASM; the ASASM automatically handles secondary VLAN traffic. There is no configuration required on the ASASM for this feature; see the switch configuration guide for more information.
|
CPU profile enhancements
|
The cpu profile activate command now supports the following:
•Delayed start of the profiler until triggered (global or specific thread CPU%)
•Sampling of a single thread
We modified the following command: cpu profile activate [n-samples] [sample-process process-name] [trigger cpu-usage cpu% [process-name].
Also available in 8.4(6).
|
DHCP Features
|
DHCP relay servers per interface (IPv4 only)
|
You can now configure DHCP relay servers per-interface, so requests that enter a given interface are relayed only to servers specified for that interface. IPv6 is not supported for per-interface DHCP relay.
We introduced or modified the following commands: dhcprelay server (interface config mode), clear configure dhcprelay, show running-config dhcprelay.
|
DHCP trusted interfaces
|
You can now configure interfaces as trusted interfaces to preserve DHCP Option 82. DHCP Option 82 is used by downstream switches and routers for DHCP snooping and IP Source Guard. Normally, if the ASA DHCP relay agent receives a DHCP packet with Option 82 already set, but the giaddr field (which specifies the DHCP relay agent address that is set by the relay agent before it forwards the packet to the server) is set to 0, then the ASA will drop that packet by default. You can now preserve Option 82 and forward the packet by identifying an interface as a trusted interface.
We introduced or modified the following commands: dhcprelay information trusted, dhcprelay informarion trust-all, show running-config dhcprelay.
|
Module Features
|
ASA 5585-X support for network modules
|
The ASA 5585-X now supports additional interfaces on network modules in slot 1. You can install one or two of the following optional network modules:
•ASA 4-port 10G Network Module
•ASA 8-port 10G Network Module
•ASA 20-port 1G Network Module
Also available in 8.4(4.1).
|
ASA 5585-X DC power supply support
|
Support was added for the ASA 5585-X DC power supply.
Also available in 8.4(5).
|
Support for ASA CX monitor-only mode for demonstration purposes
|
For demonstration purposes only, you can enable monitor-only mode for the service policy, which forwards a copy of traffic to the ASA CX module, while the original traffic remains unaffected.
Another option for demonstration purposes is to configure a traffic-forwarding interface instead of a service policy in monitor-only mode. The traffic-forwarding interface sends all traffic directly to the ASA CX module, bypassing the ASA.
We modified or introduced the following commands: cxsc {fail-close | fail-open} monitor-only, traffic-forward cxsc monitor-only.
|
Support for the ASA CX module and NAT 64
|
You can now use NAT 64 in conjunction with the ASA CX module.
We did not modify any commands.
|
NetFlow Features
|
Support for NetFlow flow-update events and an expanded set of NetFlow templates
|
In addition to adding the flow-update events, there are now NetFlow templates that allow you to track flows that experience a change to their IP version with NAT, as well as IPv6 flows that remain IPv6 after NAT.
Two new fields were added for IPv6 translation support.
Several NetFlow field IDs were changed to their IPFIX equivalents.
For more information, see the Cisco ASA Implementation Note for NetFlow Collectors.
|
Firewall Features
|
EtherType ACL support for IS-IS traffic (transparent firewall mode)
|
In transparent firewall mode, the ASA can now pass IS-IS traffic using an EtherType ACL.
We modified the following command: access-list ethertype {permit | deny} is-is.
Also available in 8.4(5).
|
Decreased the half-closed timeout minimum value to 30 seconds
|
The half-closed timeout minimum value for both the global timeout and connection timeout was lowered from 5 minutes to 30 seconds to provide better DoS protection.
We modified the following commands: set connection timeout half-closed, timeout half-closed.
|
Remote Access Features
|
IKE security and performance improvements
|
The number of IPsec-IKE security associations (SAs) can be limited for IKE v1 now, as well as IKE v2.
We modified the following command: crypto ikev1 limit.
|
The IKE v2 Nonce size has been increased to 64 bytes.
There are no ASDM screen or CLI changes.
|
For IKE v2 on Site-to-Site, a new algorithm ensures that the encryption algorithm used by child IPsec SAs is not higher strength than the parent IKE. Higher strength algorithms will be downgraded to the IKE level.
This new algorithm is enabled by default. We recommend that you do not disable this feature.
We introduced the following command: crypto ipsec ikev2 sa-strength-enforcement.
|
For Site-to-Site, IPsec data-based rekeying can be disabled.
We modified the following command: crypto ipsec security-association.
|
Improved Host Scan and ASA Interoperability
|
Host Scan and the ASA use an improved process to transfer posture attributes from the client to the ASA. This gives the ASA more time to establish a VPN connection with the client and apply a dynamic access policy.
Also available in 8.4(5).
|
Clientless SSL VPN:
Windows 8 Support
|
This release adds support for Windows 8 x86 (32-bit) and Windows 8 x64 (64-bit) operating systems.
We support the following browsers on Windows 8:
•Internet Explorer 10 (desktop only)
•Firefox (all supported Windows 8 versions)
•Chrome (all supported Windows 8 versions)
See the following limitations:
•Internet Explorer 10:
–The Modern (AKA Metro) browser is not supported.
–If you enable Enhanced Protected Mode, we recommend that you add the ASA to the trusted zone.
–If you enable Enhanced Protected Mode, Smart Tunnel and Port Forwarder are not supported.
•A Java Remote Desktop Protocol (RDP) plugin connection to a Windows 8 PC is not supported.
Also available in 9.0(2).
|
Cisco Secure Desktop:
Windows 8 Support
|
CSD 3.6.6215 was updated to enable selection of Windows 8 in the Prelogin Policy operating system check.
See the following limitations:
•Secure Desktop (Vault) is not supported with Windows 8.
Also available in 9.0(2).
|
Monitoring Features
|
NAT-MIB cnatAddrBindNumberOfEntries and cnatAddrBindSessionCount OIDs to allow polling for Xlate count.
|
Support was added for the NAT-MIB cnatAddrBindNumberOfEntries and cnatAddrBindSessionCount OIDs to support xlate_count and max_xlate_count for SNMP.
This data is equivalent to the show xlate count command.
Also available in 8.4(5).
|
NSEL
|
Flow-update events have been introduced to provide periodic byte counters for flow traffic. You can change the time interval at which flow-update events are sent to the NetFlow collector. You can filter to which collectors flow-update records will be sent.
We introduced or modified the following commands: flow-export active refresh-interval, flow-export event-type.
Also available in 8.4(5).
|
New Features in Version 9.1(1)
Released: December 3, 2012
Table 2 lists the new features for ASA Version 9.1(1).
Note Features added in 8.4(4.x), 8.4(5), 8.4(6), and 9.0(2) are not included in 9.1(1) unless they were listed in the 9.0(1) feature table.
Table 2 New Features for ASA Version 9.1(1)
Feature
|
Description
|
Module Features
|
Support for the ASA CX SSP for the ASA 5512-X through ASA 5555-X
|
We introduced support for the ASA CX SSP software module for the ASA 5512-X, ASA 5515-X, ASA 5525-X, ASA 5545-X, and ASA 5555-X. The ASA CX software module requires a Cisco solid state drive (SSD) on the ASA. For more information about the SSD, see the ASA 5500-X hardware guide.
We modified the following commands: session cxsc, show module cxsc, sw-module cxsc.
|
Upgrading the Software
Note You can upgrade from any previous release (if available for your model) directly to the latest release. When upgrading to Version 9.0, because of configuration migration, you cannot perform a downgrade; be sure to back up your configuration file in case you want to downgrade.
If you are upgrading to Version 9.0, see the migration section in the release notes for configuration migration information.
If you are upgrading from a pre-8.3 release, see also the Cisco ASA 5500 Migration Guide to Version 8.3 and Later for important information about migrating your configuration.
This section describes how to upgrade to the latest version and includes the following topics:
•Viewing Your Current Version
•Downloading the Software from Cisco.com
•Upgrading a Standalone Unit
•Upgrading a Failover Pair or ASA Cluster
Note For ASDM procedures, see the ASDM documentation.
Viewing Your Current Version
Use the show version command to verify the software version of your ASA.
Downloading the Software from Cisco.com
If you have a Cisco.com login, you can obtain the OS and ASDM images from the following website:
http://www.cisco.com/cisco/software/navigator.html?mdfid=279513386
This procedure assumes you put the images on a TFTP server, although other server types are supported.
Upgrading a Standalone Unit
This section describes how to install the ASDM and operating system (OS) images using TFTP. For FTP or HTTP, see the copy command.
Detailed Steps
| |
Command
|
Purpose
|
Step 1
|
more system:running-config
Example:
hostname# more system:running-config
|
(If there is a configuration migration) The output shows the configuration on the terminal so that you can back up your configuration. Copy the output from this command, then paste the configuration in to a text file.
Note If you are upgrading from a pre-8.3 version, then the running configuration is backed up automatically.
For other methods of backing up, see the configuration guide.
|
Step 2
|
copy tftp://server[/path]/asa_image_name
{disk0:/ | disk1:/}[path/]asa_image_name
Example:
hostname# copy
tftp://10.1.1.1/asa911-smp-k8.bin
disk0:/asa911-smp-k8.bin
|
Copies the ASA software to the active unit flash memory. For other methods than TFTP, see the copy command.
|
Step 3
|
copy tftp://server[/path]/asdm_image_name
{disk0:/ | disk1:/}[path/]asdm_image_name
Example:
hostname# copy
tftp://10.1.1.1/asdm-711.bin
disk0:/asdm-711.bin
|
Copies the ASDM image to the active unit flash memory.
|
Step 4
|
configure terminal
Example:
hostname(config)# configure terminal
|
If you are not already in global configuration mode, accesses global configuration mode.
|
Step 5
|
show running-config boot system
Example:
hostname(config)# show running-config boot
system
boot system disk0:/cdisk.bin
boot system disk0:/asa841-smp-k8.bin
|
Shows the current boot images configured (up to 4). The ASA uses the images in the order listed; if the first image is unavailable, the next image is used, and so on. You cannot insert a new image URL at the top of the list; to specify the new image to be first, you must remove any existing entries, and enter the image URLs in the order desired, according to the following steps.
|
Step 6
|
no boot system {disk0:/ |
disk1:/}[path/]asa_image_name
Example:
hostname(config)# no boot system
disk0:/cdisk.bin
hostname(config)# no boot system
disk0:/asa841-smp-k8.bin
|
Removes any existing boot image configurations so you can enter the new boot image as your first choice.
|
Step 7
|
boot system {disk0:/ |
disk1:/}[path/]asa_image_name
Example:
hostname(config)# boot system
disk0://asa911-smp-k8.bin
|
Sets the ASA image to boot that you just uploaded.
Repeat this command for any backup images you want to use in case this image is unavailable. For example, you can re-enter the images you previously removed in Step 6.
|
Step 8
|
asdm image {disk0:/ |
disk1:/}[path/]asdm_image_name
Example:
hostname(config)# asdm image
disk0:/asdm-711.bin
|
Sets the ASDM image to use that you just uploaded. You can only configure one ASDM image to use, so you do not need to first remove the existing configuration.
|
Step 9
|
write memory
Example:
hostname(config)# write memory
|
Saves the new settings to the startup configuration.
|
Step 10
|
reload
Example:
hostname# reload
|
Reloads the ASA.
|
Upgrading a Failover Pair or ASA Cluster
•Software Version Requirements for Zero Downtime Upgrading
•Upgrading an Active/Standby Failover Pair
•Upgrading an Active/Active Failover Pair
•Upgrading an ASA Cluster
Software Version Requirements for Zero Downtime Upgrading
The units in a failover configuration or ASA cluster should have the same major (first number) and minor (second number) software version. However, you do not need to maintain version parity on the units during the upgrade process; you can have different versions on the software running on each unit and still maintain failover support. To ensure long-term compatibility and stability, we recommend upgrading all units to the same version as soon as possible.
Table 1-3 shows the supported scenarios for performing zero-downtime upgrades.
Table 1-3 Zero-Downtime Upgrade Support
Type of Upgrade
|
Support
|
Maintenance Release
|
You can upgrade from any maintenance release to any other maintenance release within a minor release.
For example, you can upgrade from 7.0(1) to 7.0(4) without first installing the maintenance releases in between.
|
Minor Release
|
You can upgrade from a minor release to the next minor release. You cannot skip a minor release.
For example, you can upgrade from 7.0(1) to 7.1(1). Upgrading from 7.0(1) directly to 7.2(1) is not supported for zero-downtime upgrades; you must first upgrade to 7.1(1). For models that are not supported on a minor release, you can skip the minor release; for example, for the ASA 5585, you can upgrade from 8.2 to 8.4 (the model is not supported on 8.3).
|
Major Release
|
You can upgrade from the last minor release of the previous version to the next major release.
For example, you can upgrade from 7.2(1) to 8.0(1), assuming that 7.2(1) is the last minor version in the 7.X release series.
Note Zero downtime upgrades are possible, even when feature configuration is migrated, for example, from 8.2(X) to 8.3(X).
|
Upgrading an Active/Standby Failover Pair
To upgrade the Active/Standby failover pair, perform the following steps.
Requirements
Perform these steps on the active unit.
Detailed Steps
| |
Command
|
Purpose
|
Step 1
|
more system:running-config
Example:
active# more system:running-config
|
(If there is a configuration migration) The output shows the configuration on the terminal so that you can back up your configuration. Copy the output from this command, then paste the configuration in to a text file.
Note If you are upgrading from a pre-8.3 version, then the running configuration is backed up automatically.
For other methods of backing up, see the configuration guide.
|
Step 2
|
copy tftp://server[/path]/asa_image_name
{disk0:/ | disk1:/}[path/]asa_image_name
Example:
active# copy
tftp://10.1.1.1/asa911-smp-k8.bin
disk0:/asa911-smp-k8.bin
|
Copies the ASA software to the active unit flash memory. For other methods than TFTP, see the copy command.
|
Step 3
|
failover exec mate copy
tftp://server[/path]/filename {disk0:/ |
disk1:/}[path/]filename
Example:
active# failover exec mate copy
tftp://10.1.1.1/asa911-smp-k8.bin
disk0:/asa911-smp-k8.bin
|
Copies the software to the standby unit; be sure to specify the same path as for the active unit.
|
Step 4
|
copy tftp://server[/path]/asdm_image_name
{disk0:/ | disk1:/}[path/]asdm_image_name
Example:
active# copy tftp://10.1.1.1/asdm-711.bin
disk0:/asdm-711.bin
|
Copies the ASDM image to the active unit flash memory.
|
Step 5
|
failover exec mate copy
tftp://server[/path]/asdm_image_name
{disk0:/ | disk1:/}[path/]asdm_image_name
Example:
active# failover exec mate copy
tftp://10.1.1.1/asdm-711.bin
disk0:/asdm-711.bin
|
Copies the ASDM image to the standby unit; be sure to specify the same path as for the active unit.
|
Step 6
|
configure terminal
Example:
active(config)# configure terminal
|
If you are not already in global configuration mode, accesses global configuration mode.
|
Step 7
|
show running-config boot system
Example:
hostname(config)# show running-config boot
system
boot system disk0:/cdisk.bin
boot system disk0:/asa841-smp-k8.bin
|
Shows the current boot images configured (up to 4). The ASA uses the images in the order listed; if the first image is unavailable, the next image is used, and so on. You cannot insert a new image URL at the top of the list; to specify the new image to be first, you must remove any existing entries, and enter the image URLs in the order desired, according to the following steps.
|
Step 8
|
no boot system {disk0:/ |
disk1:/}[path/]asa_image_name
Example:
hostname(config)# no boot system
disk0:/cdisk.bin
hostname(config)# no boot system
disk0:/asa841-smp-k8.bin
|
Removes any existing boot image configurations so you can enter the new boot image as your first choice.
|
Step 9
|
boot system {disk0:/ |
disk1:/}[path/]asa_image_name
Example:
hostname(config)# boot system
disk0://asa911-smp-k8.bin
|
Sets the ASA image to boot that you just uploaded.
Repeat this command for any backup images you want to use in case this image is unavailable. For example, you can re-enter the images you previously removed in Step 8.
|
Step 10
|
asdm image {disk0:/ |
disk1:/}[path/]asdm_image_name
Example:
hostname(config)# asdm image
disk0:/asdm-711.bin
|
Sets the ASDM image to use that you just uploaded. You can only configure one ASDM image to use, so you do not need to first remove the existing configuration.
|
Step 11
|
write memory
Example:
active(config)# write memory
|
Saves the new settings to the startup configuration.
|
Step 12
|
failover reload-standby
Example:
active# failover reload-standby
|
Reloads the standby unit to boot the new image.
Wait for the standby unit to finish loading. Use the show failover command to verify that the standby unit is in the Standby Ready state.
|
Step 13
|
no failover active
Example:
active# no failover active
|
Forces the active unit to fail over to the standby unit.
|
Step 14
|
reload
Example:
active# reload
|
Reloads the former active unit (now the new standby unit). If you want to restore this unit to be active after it reloads, enter the failover active command.
|
Upgrading an Active/Active Failover Pair
To upgrade two units in an Active/Active failover configuration, perform the following steps.
Requirements
Perform these steps in the system execution space of the primary unit.
Detailed Steps
| |
Command
|
Purpose
|
Step 1
|
more system:running-config
Example:
primary# more system:running-config
|
(If there is a configuration migration) The output shows the configuration on the terminal so that you can back up your configuration. Copy the output from this command, then paste the configuration in to a text file.
Note If you are upgrading from a pre-8.3 version, then the running configuration is backed up automatically.
For other methods of backing up, see the configuration guide.
|
Step 2
|
copy tftp://server[/path]/asa_image_name
{disk0:/ | disk1:/}[path/]asa_image_name
Example:
primary# copy
tftp://10.1.1.1/asa911-smp-k8.bin
disk0:/asa911-smp-k8.bin
|
Copies the ASA software to the primary unit flash memory. For other methods than TFTP, see the copy command.
|
Step 3
|
failover exec mate copy
tftp://server[/path]/filename {disk0:/ |
disk1:/}[path/]filename
Example:
primary# failover exec mate copy
tftp://10.1.1.1/asa911-smp-k8.bin
disk0:/asa911-smp-k8.bin
|
Copies the software to the secondary unit; be sure to specify the same path as for the primary unit.
|
Step 4
|
copy tftp://server[/path]/asdm_image_name
{disk0:/ | disk1:/}[path/]asdm_image_name
Example:
primary# copy tftp://10.1.1.1/asdm-711.bin
disk0:/asdm-711.bin
|
Copies the ASDM image to the primary unit flash memory.
|
Step 5
|
failover exec mate copy
tftp://server[/path]/asdm_image_name
{disk0:/ | disk1:/}[path/]asdm_image_name
Example:
primary# failover exec mate copy
tftp://10.1.1.1/asdm-711.bin
disk0:/asdm-711.bin
|
Copies the ASDM image to the secondary unit; be sure to specify the same path as for the active unit.
|
Step 6
|
failover active group 1
failover active group 2
Example:
primary# failover active group 1
primary# failover active group 2
|
Makes both failover groups active on the primary unit.
|
Step 7
|
configure terminal
Example:
primary(config)# configure terminal
|
If you are not already in global configuration mode, accesses global configuration mode.
|
Step 8
|
show running-config boot system
Example:
hostname(config)# show running-config boot
system
boot system disk0:/cdisk.bin
boot system disk0:/asa841-smp-k8.bin
|
Shows the current boot images configured (up to 4). The ASA uses the images in the order listed; if the first image is unavailable, the next image is used, and so on. You cannot insert a new image URL at the top of the list; to specify the new image to be first, you must remove any existing entries, and enter the image URLs in the order desired, according to the following steps.
|
Step 9
|
no boot system {disk0:/ |
disk1:/}[path/]asa_image_name
Example:
hostname(config)# no boot system
disk0:/cdisk.bin
hostname(config)# no boot system
disk0:/asa841-smp-k8.bin
|
Removes any existing boot image configurations so you can enter the new boot image as your first choice.
|
Step 10
|
boot system {disk0:/ |
disk1:/}[path/]asa_image_name
Example:
hostname(config)# boot system
disk0://asa911-smp-k8.bin
|
Sets the ASA image to boot that you just uploaded.
Repeat this command for any backup images you want to use in case this image is unavailable. For example, you can re-enter the images you previously removed in Step 9.
|
Step 11
|
asdm image {disk0:/ |
disk1:/}[path/]asdm_image_name
Example:
hostname(config)# asdm image
disk0:/asdm-711.bin
|
Sets the ASDM image to use that you just uploaded. You can only configure one ASDM image to use, so you do not need to first remove the existing configuration.
|
Step 12
|
write memory
Example:
primary(config)# write memory
|
Saves the new settings to the startup configuration.
|
Step 13
|
failover reload-standby
Example:
primary# failover reload-standby
|
Reloads the secondary unit to boot the new image.
Wait for the secondary unit to finish loading. Use the show failover command to verify that both failover groups are in the Standby Ready state.
|
Step 14
|
no failover active group 1
no failover active group 2
Example:
primary# no failover active group 1
primary# no failover active group 2
|
Forces both failover groups to become active on the secondary unit.
|
Step 15
|
reload
Example:
primary# reload
|
Reloads the primary unit. If the failover groups are configured with the preempt command, they automatically become active on their designated unit after the preempt delay has passed. If the failover groups are not configured with the preempt command, you can return them to active status on their designated units using the failover active group command.
|
Upgrading an ASA Cluster
To upgrade all units in an ASA cluster, perform the following steps on the master unit. For multiple context mode, perform these steps in the system execution space.
Detailed Steps
| |
Command
|
Purpose
|
Step 1
|
more system:running-config
Example:
master# more system:running-config
|
(If there is a configuration migration) Back up your configuration file. Copy the output from this command, then paste the configuration in to a text file.
For other methods of backing up, see the configuration guide.
|
Step 2
|
cluster exec copy
tftp://server[/path]/asa_image_name
{disk0:/ | disk1:/}[path/]asa_image_name
Example:
master# copy
tftp://10.1.1.1/asa911-smp-k8.bin
disk0:/asa911-smp-k8.bin
|
Copies the ASA software to all units in the cluster. For other methods than TFTP, see the copy command.
|
Step 3
|
cluster exec copy
tftp://server[/path]/asdm_image_name
{disk0:/ | disk1:/}[path/]asdm_image_name
Example:
master# copy tftp://10.1.1.1/asdm-711.bin
disk0:/asdm-711.bin
|
Copies the ASDM image to all units in the cluster.
|
Step 4
|
configure terminal
Example:
master(config)# configure terminal
|
If you are not already in global configuration mode, accesses global configuration mode.
|
Step 5
|
show running-config boot system
Example:
hostname(config)# show running-config boot
system
boot system disk0:/cdisk.bin
boot system disk0:/asa841-smp-k8.bin
|
Shows the current boot images configured (up to 4). The ASA uses the images in the order listed; if the first image is unavailable, the next image is used, and so on. You cannot insert a new image URL at the top of the list; to specify the new image to be first, you must remove any existing entries, and enter the image URLs in the order desired, according to the following steps.
|
Step 6
|
no boot system {disk0:/ |
disk1:/}[path/]asa_image_name
Example:
hostname(config)# no boot system
disk0:/cdisk.bin
hostname(config)# no boot system
disk0:/asa841-smp-k8.bin
|
Removes any existing boot image configurations so you can enter the new boot image as your first choice.
|
Step 7
|
boot system {disk0:/ |
disk1:/}[path/]asa_image_name
Example:
hostname(config)# boot system
disk0://asa911-smp-k8.bin
|
Sets the ASA image to boot that you just uploaded.
Repeat this command for any backup images you want to use in case this image is unavailable. For example, you can re-enter the images you previously removed in Step 6.
|
Step 8
|
asdm image {disk0:/ |
disk1:/}[path/]asdm_image_name
Example:
hostname(config)# asdm image
disk0:/asdm-711.bin
|
Sets the ASDM image to use that you just uploaded. You can only configure one ASDM image to use, so you do not need to first remove the existing configuration.
|
Step 9
|
write memory
Example:
master(config)# write memory
|
Saves the new settings to the startup configuration.
|
Step 10
|
cluster exec unit slave-unit reload
noconfirm
Example:
master# failover reload-standby
|
Reload each slave unit by repeating this command for each unit name. To avoid connection loss, wait for each unit to come back up before reloading the next unit.
To view member names, enter cluster exec unit ?, or enter the show cluster info command.
|
Step 11
|
reload noconfirm
Example:
master# reload
|
Reloads the master unit. A new election takes place for a new master unit. When the former master unit rejoins the cluster, it will be a slave.
|
Open Caveats
Table 4 contains open caveats in the latest maintenance release.
If you are running an older release, and you need to determine the open caveats for your release, then add the caveats in these sections to the resolved caveats from later releases. For example, if you are running Version 9.1(1), then you need to add the caveats in this section to the resolved caveats from 9.1(2) and higher to determine the complete list of open caveats.
If you are a registered Cisco.com user, view more information about each caveat using the Bug Toolkit at the following website:
http://tools.cisco.com/Support/BugToolkit/
Table 4 Open Caveats in ASA Version 9.1
Caveat
|
Description
|
CSCud84290
|
ASA: Random traceback with HA setup with 9.1.(1)
|
CSCue46275
|
Connections not timing out when the route changes on the ASA
|
CSCue80593
|
ASA unable to execute reload command
|
CSCue88423
|
ASA traceback in datapath thread with netflow enabled
|
CSCue90343
|
ASA 9.0.1 & 9.1.1 - 256 Byte Blocks depletion
|
CSCue92144
|
"Failed to update IPSec failover runtime data" msg on the standby unit
|
CSCue95008
|
ASA - Threat detection doesn't parse network objects with IP 'range'
|
CSCuf07393
|
ASA assert traceback during xlate replication in a failover setup
|
CSCuf48288
|
Multiple crashes on ASA after upgrading to 9.x from 8.3.2
|
CSCuf51902
|
TFTP to and from server using IPv6 on ASA fails in transparent mode.
|
CSCug24468
|
Unable to associate PRSM with AD_Realm.
|
CSCug33233
|
ASA Management lost after a few days of uptime
|
CSCug36561
|
Management access does not trigger 6 in 4 ASA IKEV1 tunnel
|
CSCug45674
|
ASA : HTTP Conn from the box, broken on enabling TCP-State-Bypass
|
CSCug52778
|
asa traceback in idfw_nb_process
|
CSCug55657
|
ASA does not assign MTU to AnyConnect client in case of IKEv2
|
CSCug55969
|
ASA uses different mapped ports for SDP media port and RTP stream
|
CSCug64098
|
ASA 9.1.1-7 traceback with Checkheaps thread
|
CSCug66457
|
ASA : "ERROR:Unable to create router process" & routing conf is lost
|
CSCug66471
|
ASA: Form on sharepoint 2010 does not open when accessing through webvpn
|
CSCug71714
|
DHCPD appends trailing dot to option 12 [hostname] in DHCP ACK
|
CSCug72196
|
ASA outputs warning when crypto map ACL contains "permit any any"
|
CSCug72498
|
ASA scansafe redirection drops packets if tcp mss is not set
|
CSCug76721
|
ipsecvpn-datapath: assert crash with Thread Name: IPsec message handler
|
CSCug76763
|
HTTP redirect not happen when Passwd mgmt is enabled for Radius server
|
CSCug77782
|
ASA5585 - 9.1.1 - Traceback on IKEv2Daemon Thread
|
CSCug78248
|
ASA does not send username attribute in RADIUS access request
|
CSCug78561
|
ASA Priority traffic not subject to shaping in Hierarchical QoS
|
CSCug80680
|
Traceback in Thread Name: Dispatch Unit
|
CSCug82458
|
assert on "cp_syslog_from_dp_context" failed: file "syslog.c", line 245
|
CSCug83036
|
ASA-L2TP-IPSec: PAT xlate for UDP1701 hijacks incoming L2TP conns
|
CSCug83315
|
ASA Traceback in Thread name "WCCP V2 Protocol"
|
CSCug87445
|
SVC_UDP Module is in flow control with DTLS tunnel and UDP traffic
|
Resolved Caveats
•Resolved Caveats in Version 9.1(2)
•Resolved Caveats in Version 9.1(1)
Resolved Caveats in Version 9.1(2)
Table 5 contains open caveats in ASA Version 9.1(2).
If you are a registered Cisco.com user, view more information about each caveat using the Bug Toolkit at the following website:
http://tools.cisco.com/Support/BugToolkit/
Table 5 Resolved Caveats in ASA Version 9.1(2)
Caveat
|
Description
|
CSCti07431
|
1/5 minute input rate and output rate are always 0 with user context.
|
CSCti38856
|
Elements in the network object group are not converted to network object
|
CSCtj87870
|
Failover disabled due to license incompatible different Licensed cores
|
CSCto50963
|
ASA SIP inspection - To: in INVITE not translated after 8.3/8.4 upgrade
|
CSCtr04553
|
Traceback while cleaning up portlist w/ clear conf all or write standby
|
CSCtr17899
|
Some legitimate traffic may get denied with ACL optimization
|
CSCtr65927
|
dynamic policy PAT fails with FTP data due to latter static NAT entry
|
CSCts15825
|
RRI routes are not injected after reload if IP SLA is configured.
|
CSCts50723
|
ASA: Builds conn for packets not destined to ASA's MAC in port-channel
|
CSCtw56859
|
Natted traffic not getting encrypted after reconfiguring the crypto ACL
|
CSCtx55513
|
ASA: Packet loss during phase 2 rekey
|
CSCty18976
|
ASA sends user passwords in AV as part of config command authorization.
|
CSCty59567
|
Observing traceback @ ipigrp2_redist_metric_incompatible+88
|
CSCtz46845
|
ASA 5585 with IPS inline -VPN tunnel dropping fragmented packets
|
CSCtz47034
|
ASA 5585- 10 gig interfaces may not come up after asa reload
|
CSCtz56155
|
misreported high CPU
|
CSCtz64218
|
ASA may traceback when multiple users make simultaneous change to ACL
|
CSCtz70573
|
SMP ASA traceback on periodic_handler for inspecting icmp or dns trafic
|
CSCtz79578
|
Port-Channel Flaps at low traffic rate with single flow traffic
|
CSCua13405
|
Failover Unit Stuck in Cold Standby After Boot Up
|
CSCua20850
|
5500X Software IPS console too busy for irq can cause data plane down.
|
CSCua22709
|
ASA traceback in Unicorn Proxy Thread while processing lua
|
CSCua35337
|
Local command auth not working for certain commands on priv 1
|
CSCua44723
|
ASA nat-pat: 8.4.4 assert traceback related to xlate timeout
|
CSCua60417
|
8.4.3 system log messages should appear in Admin context only
|
CSCua87170
|
Interface oversubscription on active causes standby to disable failover
|
CSCua91189
|
Traceback in CP Processing when enabling H323 Debug
|
CSCua93764
|
ASA: Watchdog traceback from tmatch_element_release_actual
|
CSCua99091
|
ASA: Page fault traceback when copying new image to flash
|
CSCub04470
|
ASA: Traceback in Dispatch Unit with HTTP inspect regex
|
CSCub08224
|
ASA 210005 and 210007 LU allocate xlate/conn failed with simple 1-1 NAT
|
CSCub11582
|
ASA5550 continous reboot with tls-proxy maximum session 4500
|
CSCub14196
|
FIFO queue oversubscription drops packets to free RX Rings
|
CSCub16427
|
Standby ASA traceback while replicating flow from Active
|
CSCub23840
|
ASA traceback due to nested protocol object-group used in ACL
|
CSCub37882
|
Standby ASA allows L2 broadcast packets with asr-group command
|
CSCub58996
|
Cisco ASA Clientless SSLVPN CIFS Vulnerability
|
CSCub61578
|
ASA: Assert traceback in PIX Garbage Collector with GTP inspection
|
CSCub62584
|
ASA unexpectedly reloads with traceback in Thread Name: CP Processing
|
CSCub63148
|
With inline IPS and heavy load ASA could drop ICMP or DNS replies
|
CSCub72545
|
syslog 113019 reports invalid address when VPN client disconnects.
|
CSCub75522
|
ASA TFW sends broadcast arp traffic to all interfaces in the context
|
CSCub83472
|
VPNFO should return failure to HA FSM when control channel is down
|
CSCub84164
|
ASA traceback in threadname Logger
|
CSCub89078
|
ASA standby produces traceback and reloads in IPsec message handler
|
CSCub98434
|
ASA: Nested Crash in Thread Dispatch Unit - cause: SQLNet Inspection
|
CSCub99578
|
High CPU HOG when connnect/disconnect VPN with large ACL
|
CSCub99704
|
WebVPN - mishandling of request from Java applet
|
CSCuc06857
|
Accounting STOP with caller ID 0.0.0.0 if admin session exits abnormally
|
CSCuc09055
|
Nas-Port attribute different for authentication/accounting Anyconnect
|
CSCuc12119
|
ASA: Webvpn cookie corruption with external cookie storage
|
CSCuc12967
|
OSPF routes were missing on the Standby Firewall after the failover
|
CSCuc14644
|
SIP inspect NATs Call-ID in one direction only
|
CSCuc16455
|
ASA packet transmission failure due to depletion of 1550 byte block
|
CSCuc16670
|
ASA - VPN connection remains up when DHCP rebind fails
|
CSCuc24547
|
TCP ts_val for an ACK packet sent by ASA for OOO packets is incorrect
|
CSCuc24919
|
ASA: May traceback in Thread Name: fover_health_monitoring_thread
|
CSCuc28903
|
ASA 8.4.4.6 and higher: no OSPF adj can be build with Portchannel port
|
CSCuc34345
|
Multi-Mode treceback on ci/console copying config tftp to running-config
|
CSCuc40450
|
error 'Drop-reason: (punt-no-mem) Punt no memory' need to be specific
|
CSCuc45011
|
ASA may traceback while fetching personalized user information
|
CSCuc46026
|
ASA traceback: ASA reloaded when call home feature enabled
|
CSCuc46270
|
ASA never removes qos-per-class ASP rules when VPN disconnects
|
CSCuc48355
|
ASA webvpn - URLs are not rewritten through webvpn in 8.4(4)5
|
CSCuc50544
|
Error when connecting VPN: DTLS1_GET_RECORD Reason: wrong version number
|
CSCuc55719
|
Destination NAT with non single service (range, gt, lt) not working
|
CSCuc56078
|
Traceback in threadname CP Processing
|
CSCuc60950
|
Traceback in snpi_divert with timeout floating-conn configured
|
CSCuc61985
|
distribute-list does not show in the router config.
|
CSCuc63592
|
HTTP inspection matches incorrect line when using header host regex
|
CSCuc65775
|
ASA CIFS UNC Input Validation Issue
|
CSCuc74488
|
ASA upgrade fails with large number of static policy-nat commands
|
CSCuc74758
|
Traceback: deadlock between syslog lock and host lock
|
CSCuc75090
|
Crypto IPSec SA's are created by dynamic crypto map for static peers
|
CSCuc75093
|
Log indicating syslog connectivity not created when server goes up/down
|
CSCuc78176
|
Cat6000/15.1(1)SY- ASASM/8.5(1.14) PwrDwn due to SW Version Mismatch
|
CSCuc79825
|
ASA: Traceback in Thread Name CP Midpath Processing eip pkp_free_ssl_ctm
|
CSCuc83059
|
traceback in fover_health_monitoring_thread
|
CSCuc83323
|
XSS in SSLVPN
|
CSCuc83828
|
ASA Logging command submits invalid characters as port zero
|
CSCuc89163
|
Race condition can result in stuck VPN context following a rekey
|
CSCuc92292
|
ASA may not establish EIGRP adjacency with router due to version issues
|
CSCuc95774
|
access-group commands removed on upgrade to 9.0(1)
|
CSCuc98398
|
ASA writes past end of file system then can't boot
|
CSCud02647
|
traffic is resetting uauth timer
|
CSCud16590
|
ASA may traceback in thread emweb/https
|
CSCud17993
|
ASA-Traceback in Dispatch unit due to dcerpc inspection
|
CSCud20887
|
ASA reloads after issuing "show inventory" command
|
CSCud21714
|
BTF traceback in datapth when apply l4tm rule
|
CSCud24452
|
ASA TACACS authentication on Standby working incorrectly
|
CSCud28106
|
IKEv2: ASA does not clear entry from asp table classify crypto
|
CSCud29045
|
ASASM forwards subnet directed bcast back onto that subnet
|
CSCud32111
|
Deny rules in crypto acl blocks inbound traffic after tunnel formed
|
CSCud36686
|
Deny ACL lines in crypto-map add RRI routes
|
CSCud37992
|
SMP ASA traceback in periodic_handler in proxyi_rx
|
CSCud41507
|
Traffic destined for L2L tunnels can prevent valid L2L from establishing
|
CSCud41670
|
ASA nested traceback with url-filtering policy during failover
|
CSCud57759
|
DAP: debug dap trace not fully shown after +1000 lines
|
CSCud62661
|
STI Flash write failure corrupts large files
|
CSCud65506
|
ASA5585: Traceback in Thread Name:DATAPATH when accessing webvpn urls
|
CSCud67282
|
data-path: ASA-SM: 8.5.1 traceback in Thread Name: SSH
|
CSCud69251
|
traceback in ospf_get_authtype
|
CSCud69535
|
OSPF routes were missing on the Active Firewall after the failover
|
CSCud70273
|
ASA may generate Traceback while running packet-tracer
|
CSCud77352
|
Upgrade ASA causes traceback with assert during spinlock
|
CSCud81304
|
TRACEBACK, DATAPATH-8-2268, Multicast
|
CSCud84454
|
ASA in HA lose shared license post upgrade to 9.x
|
CSCud89974
|
flash in ASA5505 got corrupted
|
CSCud90534
|
ASA traceback with Checkheaps thread
|
CSCue02226
|
ASA 9.1.1 - WCCPv2 return packets are dropped
|
CSCue03220
|
Anyconnect mtu config at ASA not taking effect at client
|
CSCue04309
|
TCP connection to multicast MAC - unicast MAC S/ACK builds new TCP conn
|
CSCue05458
|
16k blocks near exhaustion - process emweb/https (webvpn)
|
CSCue11669
|
ASA 5505 not Forming EIGRP neighborship after failover
|
CSCue15533
|
ASA:Crash while deleting trustpoint
|
CSCue18975
|
ASA: Assertion traceback in DATAPATH thread after upgrade
|
CSCue25524
|
Webvpn: Javascript based applications not working
|
CSCue31622
|
Secondary Flows Lookup Denial of Service Vulnerability
|
CSCue32221
|
LU allocate xlate failed (for NAT with service port)
|
CSCue34342
|
ASA may crash due to watchdog timer while getting mapped address
|
CSCue35150
|
ASA in multicontext mode provides incorrect SNMP status of failover
|
CSCue35343
|
Memory leak of 1024B blocks in webvpn failover code
|
CSCue49077
|
ASA: OSPF fails to install route into asp table after a LSA update
|
CSCue54264
|
WebVPN: outside PC enabled webvpn to management-access inside interface
|
CSCue55461
|
ESMTP drops due to MIME filename length >255
|
CSCue59676
|
ASA shared port-channel subinterfaces and multicontext traffic failure
|
CSCue62470
|
mrib entries mayy not be seen upon failover initiated by auto-update
|
CSCue62691
|
ASASM Traceback when issue 'show asp table interface' command
|
CSCue63881
|
ASA SSHv2 Denial of Service Vulnerability
|
CSCue67446
|
The ASA hardware accelerator encountered an error (Bad checksum)
|
CSCue73708
|
Group enumeration still possible on ASA
|
CSCue77969
|
Character encoding not visible on webvpn portal pages.
|
CSCue82544
|
ASA5585 8.4.2 Traceback in Thread Name aaa while accessing Uauth pointer
|
CSCue88560
|
ASA Traceback in Thread Name : CERT API
|
CSCue99041
|
Smart Call Home sends Environmental message every 5 seconds for 5500-X
|
CSCuf02988
|
ASA: Page fault traceback in aaa_shim_thread
|
CSCuf06633
|
ASA crash in Thread Name: UserFromCert
|
CSCuf07810
|
DTLS drops tunnel on a crypto reset
|
CSCuf11285
|
ASA 9.x cut-through proxy ACL incorrectly evaluated
|
CSCuf16850
|
split-dns cli warning msg incorrect after client increasing the limit
|
CSCuf27811
|
ASA: Pending DHCP relay requests not flushed from binding table
|
CSCuf34123
|
ASA 8.3+ l2l tunnel-group name with a leading zero is changed to 0.0.0.0
|
CSCuf34754
|
Framed-IP-Address not sent with AC IKEv2 and INTERIM-ACCOUNTING-UPDATE
|
CSCuf47114
|
ASA 9.x: DNS inspection corrupts PTR query before forwarding packet
|
CSCuf57102
|
FIPS: Continuous RNG test reporting a length failure
|
CSCuf58624
|
snmp engineID abnormal for asa version 8.4.5 after secondary asa reload
|
CSCuf65912
|
IKEv2: VPN filter ACL lookup failure causing stale SAs and crash
|
CSCuf77065
|
Arsenal: Single Core Saleen Admin Driver Fix Revert Bug
|
CSCuf77294
|
ASA traceback with Thread Name: DATAPATH-3-1041
|
CSCuf77606
|
ASA-SM crash in Thread Name: accept/http
|
CSCuf89220
|
ASA IDFW : Unable to handle contacts in DC user groups
|
CSCug03975
|
ASA 9.1(1) Reboot while applying regex dns
|
CSCug14707
|
ASA 8.4.4.1 Keeps rebooting when FIPS is enabled: FIPS Self-Test failure
|
CSCug19491
|
ASA drops some CX/CSC inspected HTTP packets due to PAWS violation
|
CSCug22787
|
Change of behavior in Prefill username from certificate SER extraction
|
CSCug30086
|
ASA traceback on thread Session Manager
|
CSCug59177
|
Page fault on ssh thread
|
Resolved Caveats in Version 9.1(1)
There are no resolved caveats in Version 9.1(1).
End-User License Agreement
For information on the end-user license agreement, go to:
http://www.cisco.com/univercd/cc/td/doc/es_inpck/eu1jen__.pdf
Related Documentation
For additional information on the ASA, see Navigating the Cisco ASA Series Documentation:
http://www.cisco.com/en/US/docs/security/asa/roadmap/asaroadmap.html
Obtaining Software, Documentation, and Submitting a Service Request
For information on obtaining documentation, submitting a service request, and gathering additional information, see the monthly What's New in Cisco Product Documentation, which also lists all new and revised Cisco technical documentation, at:
http://www.cisco.com/en/US/docs/general/whatsnew/whatsnew.html
Subscribe to the What's New in Cisco Product Documentation as an RSS feed and set content to be delivered directly to your desktop using a reader application. The RSS feeds are a free service. Cisco currently supports RSS Version 2.0.
This document is to be used in conjunction with the documents listed in the "Related Documentation" section.
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)
Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.
©2012-2013 Cisco Systems, Inc. All rights reserved.
Feedback
