|
Table Of Contents
Release Notes for Cisco PDM Version 4.1 for Firewall Services Module
Switch and Router System Requirements
Maximum Configuration File Size
PC and Workstation Requirements
Resource Manager for ACL Memory Pool
Resource Class for PDM Sessions
Suspend/Resume Failover Configuration Sync
CLI Commands Not Fully Supported in FWSM
CLI Commands Ignored in Multiple Mode when in System Mode
Miscellaneous CLI Command Operation Limitations
CLI Commands Ignored by PDM in FWSM
Resolved Caveats - Version 4.1
Obtaining Documentation and Submitting a Service Request
Release Notes for Cisco PDM Version 4.1 for Firewall Services Module
December 2004
Contents
This publication includes the following sections:
•Switch and Router System Requirements
•PC and Workstation Requirements
•Obtaining Documentation and Submitting a Service Request
Introduction
Cisco PDM Version 4.1 is a web-based application used to configure and monitor the Firewall Services Module (FWSM) on a Catalyst 6500 series switch or Cisco 7600 series router. PDM Version 4.1 requires FWSM Release 2.3 or 2.2 and supports all of the configuration features in this release. For more information, see FWSM Technical Documentation and the FWSM FAQ (Frequently Asked Questions) sections on Cisco.com..
Note PDM Version 4.1 is a single image that supports FWSM Release 2.3 and 2.2. It does not support FWSM Release 1.1 or the PIX operating system.
PDM Software Overview
PDM Version 4.1 is a single image that provides secure administration of the FWSM. PDM is implemented as a signed Java applet, which downloads to your PC or workstation when you point your browser at the FWSM and does not require a plug-in or other software to be preinstalled. PDM manages FWSM Release 2.3 and 2.2 when it runs in single or multiple context modes.
PDM provides a graphical user interface to the FWSM to administer it without requiring knowledge of the command-line interface (CLI). PDM also maintains compatibility with the FWSM CLI and includes a tool for using the standard CLI commands within the PDM application. PDM allows you to graph many aspects of the FWSM, as well as print or export graphs of the traffic through the FWSM and of system activity.
To help you use PDM, the application provides online help as well as a help table of contents, index, and glossary.
Switch and Router System Requirements
The following switch and router models that are supported by the FWSM are:
•Catalyst 6500 series switches with the following required components:
–Supervisor engine with Cisco IOS software or Catalyst operating system
–Multilayer Switch Feature Card (MSFC 2) with Cisco IOS software
•Cisco 7600 series routers, with the following required components:
–Supervisor engine with Cisco IOS software
–MSFC 2 with Cisco IOS software
For more information about supported supervisor engine and software versions and the supported Cisco IOS software, refer to the Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide Version 2.3.
Note The FWSM does not support a direct connection to a switch WAN port because WAN ports do not use static virtual local area networks (VLANs). However, the WAN port can connect to the MSFC, which can also connect to the FWSM.
For more information on switch or router requirements for FWSM, go to the following website: http://www.cisco.com/en/US/products/hw/modules/ps2706/ps4452/tsd_products_support_model_home.html
The following sections list the system requirements for PDM Version 4.1 software.
FWSM Requirements
The FWSM must meet the following requirements to successfully install and run PDM:
•Minimum Software Versions-Verify that your FWSM meets the requirements listed in the Release Notes for the Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Software Release. You must have Release 2.3 or 2.2 installed on the FWSM before using PDM Version 4.1. For more information, refer to the Cisco PDM Installation and Configuration Guide for Firewall Services Module.
•Upgrading Software-When you install a new version of PDM, close all browser sessions before launching PDM. For information on upgrading your FWSM, see the following websites:
http://www.cisco.com/en/US/products/hw/modules/ps2706/ps4452/tsd_products_support_model_home.html
Caution If you are using Management Center for Firewalls, use PDM for monitoring only. All changes made using PDM will be overwritten the next time Management Center for Firewalls synchronizes with the FWSM.
Browser Requirements
The following are required to access one or more firewalls through PDM:
•Java Virtual Machine (JVM)-PDM 4.1 supports native JVM on Microsoft Internet Explorer 6.0, Java Plug-in 1.4.2 or Java Plug-in 5.0. PDM 4.1 supports native JVM on Solaris Red Hat or Linux with Java Plug-in 1.4.2.
•HTTP 1.1-For Microsoft Internet Explorer, be sure to use HTTP 1.1 for both proxy and non-proxy connections. This can be changed in Tools > Internet Options > Advanced tab. Scroll down to the "HTTP 1.1 settings" section.
Maximum Configuration File Size
For optimum performance, we recommend a configuration file of no more than 500 KB when using PDM.
FWSM Firewall configuration files over 500 KB may interfere with the performance of PDM on your workstation in the following situations:
•While executing commands such as write term and show run
•Failover (the configuration synchronization time)
•During a PDM Refresh Operation or loading PDM for the first time
PC and Workstation Requirements
PDM has different requirements depending on the platform from which it is accessed. PDM is not supported for use on computers equipped with the Macintosh operating system, or other versions of the Windows operating systems.
Supported Platforms
Table 1 lists the supported and recommended platforms for PDM Version 4.1.
Note The Japanese version of Windows (JOS) is supported in the PDM Version 4.1 release.
Note When using Netscape on some Linux platforms, if you select an item under the Properties tab or the Monitoring tab, the entire PDM window shifts a few pixels to the left and up. This movement happens when you select a panel with a text box or a combo box in it.
New and Changed Information
The following sections provide new and changed information for this release.
HTTPS Authentication Proxy
This feature provides a secure mechanism for exchanging username and password information between an HTTP client and FWSM using HTTPS.
ACL Per User Override
This feature allows an external server to override the configuration of the access rules policy for that interface. This feature only applies to inbound ACLs.
Resource Manager for ACL Memory Pool
This feature allows you to manage resources for ACLs, including the ACL memory pool or ACL tree instances, which are used when compiling ACLs.
Resource Class for PDM Sessions
This feature allows you to specify the number of PDM sessions for a particular context.
Suspend/Resume Failover Configuration Sync
This feature provides the ability to disable failover synchronization from an active device to a standby device.
Same Security Intra Interface
This feature allows a packet to come in and go out on the same interface. A router might forward a packet to the FWSM so that it can apply the user's firewall policy on that packet.
TFTP Fixup
This feature inspects the TFTP protocol and dynamically creates a connection and xlate if necessary to permit file transfer between a TFTP client and server. This feature was included in FWSM 2.2.
Syslog Enhancements
These enhancements allow you to specify the amount of memory that can be allocated for the syslog messages per context and to optionally deny connections if the syslog queue is full.
Important Notes
This section describes important notes for PDM software Version 4.1.
One-time Password
PDM does not support the one-time password (OTP) authentication mechanism.
Fixups
Both fixup SIP over TCP and fixup SIP over UDP are supported in FWSM Release 1.1, but fixup SIP over UDP cannot be disabled in FWSM Release 1.1. Fixup SIP over UDP can only be disabled in FWSM Release 2.x.
CLI Command Support
This section indicates which CLIs PDM supports.
Fully Supported CLI Commands
PDM parses these commands when uploading or creating the FWSM configuration and gives you full access to all PDM user-interface tabs.
Table 2 lists the CLI commands that PDM fully supports. PDM parses these commands in the FWSM configuration and allows PDM to operate successfully.
Exceptions are noted in the table and occur when PDM cannot parse certain combinations of command statements. Commands that PDM cannot parse stay in the configuration, their values cannot be changed with PDM, and they appear in the list of unparseable commands.
CLI Commands Not Fully Supported in FWSM
Table 3 lists commands that cannot be changed. PDM parses these commands in the firewall configuration and handles them transparently.
CLI Commands Ignored in Multiple Mode when in System Mode
Table 4 lists the CLI commands that are ignored when PDM 4.1 is operating in multiple mode and set to system mode.
Table 4 Ignored CLI Commands
FWSM Commandsbanner
enable password
ftp mode passive
logging
password
timeout
username
sysopt nodnsalias
Miscellaneous CLI Command Operation Limitations
Table 5 lists miscellaneous CLI command limitations in PDM 4.1.
PDM does not support the one-time password (OTP) authentication mechanism.
CLI Commands Ignored by PDM in FWSM
These CLI commands are displayed in the list of unparseable commands in PDM. However, PDM does not change or remove these commands from your configuration, and the presence of these commands does not limit your access to the user-interface tabs in PDM. To see ignored commands, select Options > Show Commands Ignored by PDM on Firewall.
PDM Sessions
The FWSM can be configured to support up to five PDM sessions in single mode or five PDM sessions per context in multiple mode up to a total of 32 PDM sessions.
Caveats
The following sections describe the caveats for PDM software Version 4.1.
For your convenience in locating caveats in Cisco's Bug Toolkit, the caveat titles listed in this section are taken directly from the Cisco Bug Toolkit database. These caveat titles are not intended to be read as complete sentences because the title field length is limited. In the caveat titles, some truncation of wording or punctuation may be necessary to provide the most complete and concise description. The only modifications made to these titles are as follows:
•Commands are in boldface type.
•Product names and acronyms may be standardized.
•Spelling errors and typos may be corrected.
Note To view additional caveat information, use Bug Navigator II on CCO. Bug Navigator II may be accessed at the following website:
http://tools.cisco.com/Support/BugToolKit/action.do?hdnAction=searchBugs
Open Caveats - Version 4.1
The caveats in Table 6 are yet to be resolved in this version.
Resolved Caveats - Version 4.1
The caveats in Table 7 are resolved in this version.
Obtaining Documentation and Submitting a Service Request
For information on obtaining documentation, submitting a service request, and gathering additional information, see the monthly What's New in Cisco Product Documentation, which also lists all new and revised Cisco technical documentation, at:
http://www.cisco.com/en/US/docs/general/whatsnew/whatsnew.html
Subscribe to the What's New in Cisco Product Documentation as a Really Simple Syndication (RSS) feed and set content to be delivered directly to your desktop using a reader application. The RSS feeds are a free service and Cisco currently supports RSS version 2.0.
This document is to be used in conjunction with the appropriate documentation for your Cisco FWSM system.
CCSP, the Cisco Square Bridge logo, Follow Me Browsing, and StackWise are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn, and iQuick Study are service marks of Cisco Systems, Inc.; and Access Registrar, Aironet, ASIST, BPX, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Empowering the Internet Generation, Enterprise/Solver, EtherChannel, EtherFast, EtherSwitch, Fast Step, FormShare, GigaDrive, GigaStack, HomeLink, Internet Quotient, IOS, IP/TV, iQ Expertise, the iQ logo, iQ Net Readiness Scorecard, LightStream, Linksys, MeetingPlace, MGX, the Networkers logo, Networking Academy, Network Registrar, Packet, PIX, Post-Routing, Pre-Routing, ProConnect, RateMUX, ScriptShare, SlideCast, SMARTnet, StrataView Plus, SwitchProbe, TeleRouter, The Fastest Way to Increase Your Internet Quotient, TransPath, and VCO are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.
All other trademarks mentioned in this document or Website are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0411R)
Cisco PDM Release Notes for Firewall Services Module Version 4.1
Copyright © 2004 Cisco Systems, Inc.
All rights reserved.