Cisco PIX Device Manager

Table Of Contents

Release Notes for Cisco PDM Version 4.1(2) for Firewall Services Module

Contents

Introduction

PDM Software Overview

Switch and Router System Requirements

FWSM Requirements

Browser Requirements

Maximum Configuration File Size

PC and Workstation Requirements

Supported Platforms

Features Introduced in PDM Version 4.1

HTTPS Authentication Proxy

ACL Per User Override

Resource Manager for ACL Memory Pool

Resource Class for PDM Sessions

Suspend/Resume Failover Configuration Sync

Same Security Intra Interface

TFTP Fixup

Syslog Enhancements

Important Notes

One-time Password

Fixups

CLI Command Support

Fully Supported CLI Commands

CLI Commands Not Fully Supported in FWSM

CLI Commands Ignored in Multiple Mode when in System Mode

Miscellaneous CLI Command Operation Limitations

CLI Commands Ignored by PDM in FWSM

PDM Sessions

Caveats

Open Caveats - Version 4.1(2)

Resolved Caveats - Version 4.1(2)

Obtaining Documentation

Cisco.com

Ordering Documentation

Documentation Feedback

Obtaining Technical Assistance

Cisco Technical Support Website

Submitting a Service Request

Definitions of Service Request Severity

Obtaining Additional Publications and Information

Release Notes for Cisco PDM Version 4.1(2) for Firewall Services Module

---

April 2005

Contents

This publication includes the following sections:

•Introduction

•Switch and Router System Requirements

•PC and Workstation Requirements

•Features Introduced in PDM Version 4.1

•Important Notes

•Caveats

•Obtaining Documentation

•Obtaining Technical Assistance

•Obtaining Additional Publications and Information

Introduction

Cisco PDM Version 4.1(2) is a web-based application used to configure and monitor the Firewall Services Module (FWSM) on a Catalyst 6500 series switch or Cisco 7600 series router. PDM Version 4.1(2) requires FWSM Release 2.3 or 2.2 and supports all of the configuration features in this release. For more information, see FWSM Technical Documentation and the FWSM FAQ (Frequently Asked Questions) sections in Cisco.com.message.

---

Note PDM Version 4.1(2) is a single image that supports FWSM Release 2.3 and 2.2. It does not support FWSM Release 1.1 or PIX operating system.

---

PDM Software Overview

PDM Version 4.1(2) is a single image that provides secure administration of the FWSM. PDM is implemented as a signed Java applet, which downloads to your PC or workstation when you point your browser at the FWSM and does not require a plug-in or other software to be preinstalled. PDM manages FWSM Release 2.3 and 2.2 when it runs in single or multiple context modes.

PDM provides a graphical user interface to the FWSM to administer it without requiring knowledge of the command-line interface (CLI). PDM also maintains compatibility with the FWSM CLI and includes a tool for using the standard CLI commands within the PDM application. PDM allows you to graph many aspects of the FWSM, as well as print or export graphs of the traffic through the FWSM and of system activity.

To help you use PDM, the application provides online help as well as a help table of contents, index, and glossary.

Switch and Router System Requirements

The following switch and router models that are supported by the FWSM are:

•Catalyst 6500 series switches with the following required components:

–Supervisor engine with Cisco IOS software or Catalyst operating system

–Multilayer Switch Feature Card (MSFC 2) with Cisco IOS software

•Cisco 7600 series routers, with the following required components:

–Supervisor engine with Cisco IOS software

–MSFC 2 with Cisco IOS software

For more information about supported supervisor engine and software versions and the supported Cisco IOS software, refer to the Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide Version 2.3.

---

Note The FWSM does not support a direct connection to a switch WAN port because WAN ports do not use static virtual local area networks (VLANs). However, the WAN port can connect to the MSFC, which can also connect to the FWSM.

---

For more information on switch or router requirements for FWSM, go to the following website: http://www.cisco.com/univercd/cc/td/doc/product/lan/cat6000/mod_icn/fwsm/index.htm.

The following sections list the system requirements for PDM Version 4.1(2) software.

FWSM Requirements

The FWSM must meet the following requirements to successfully install and run PDM:

•Minimum Software Versions-Verify that your FWSM meets the requirements listed in the Release Notes for the Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Software Release. You must have Release 2.3 or 2.2 installed on the FWSM before using PDM Version 4.1(2). For more information, refer to the Cisco PDM Installation and Configuration Guide for Firewall Services Module.

•Upgrading Software-When you install a new version of PDM, close all browser sessions before launching PDM. For information on upgrading your FWSM, see the following websites:

http://www.cisco.com/cgi-bin/tablebuild.pl/cat6000-fwsm

http://www.cisco.com/univercd/cc/td/doc/product/lan/cat6000/mod_icn/fwsm/index.htm

---

Caution If you are using Management Center for Firewalls, use PDM for monitoring only. All changes made using PDM will be overwritten the next time Management Center for Firewalls synchronizes with the FWSM.

---

Browser Requirements

The following are required to access one or more firewalls through PDM:

•Java Virtual Machine (JVM)-PDM 4.1(2) supports native JVM on Microsoft Internet Explorer 6.0, Java Plug-in 1.4.2 or Java Plug-in 1.5.0. PDM 4.1(2) supports native JVM on Solaris or Red Hat Linux with Java Plug-in 1.4.2.

•HTTP 1.1-For Microsoft Internet Explorer, be sure to use HTTP 1.1 for both proxy and non-proxy connections. This can be changed in Tools > Internet Options > Advanced tab. Scroll down to the "HTTP 1.1 settings" section.

Maximum Configuration File Size

For optimum performance, we recommend a configuration file of no more than 500 KB when using PDM.

FWSM Firewall configuration files over 500 KB may interfere with the performance of PDM on your workstation in the following situations:

•While executing commands such as the write term command and the show running-config command.

•Failover (the configuration synchronization time)

•When you click the Refresh button in PDM for the first time

PC and Workstation Requirements

PDM has different requirements depending on the platform from which it is accessed. PDM is not supported for use on computers equipped with the Macintosh operating system, or other versions of the Windows operating systems.

Supported Platforms

Table 1 lists the supported and recommended platforms for PDM Version 4.1(2).

---

Note The Japanese version of Windows (JOS) is supported in the PDM Version 4.1(2) release.

---

Table 1 Supported Platforms for PDM Version 4.1(2)

	Operating System	Browser	Hardware
Windows	Windows 2000 (Service Pack 3 or higher) or Windows XP operating systems1 (English or Japanese versions)	Internet Explorer 6.0 with native JVM (VM 3809 or higher) , Java Plug-in 1.4.2 or Java Plug-in 5.0 Netscape 7.1 or 7.2 with Java Plug-in 1.4.2 or Java Plug-in 1.5.0	Any Pentium III or Pentium-compatible processor running at 450 MHz or higher. At least 256 MB of RAM. We recommend 192 MB or more. A 1024 x 768 pixel display and at least High Color (16-bit).
SUN Solaris	Sun Solaris 8 or 9	Mozilla 1.7.3 with Java Plug-in 1.4.2	SPARC microprocessor. At least 256 MB of RAM. A 1024 x 768 pixel display and at least 256 colors. High Color (16-bit) recommended.
Linux	Red Hat Linux 9 or Red Hat Enterprise Linux WS version 3	Mozilla 1.7.3 with Java Plug-in 1.4.2	At least 128 MB of RAM. 256 MB recommended. A 1024 x 768 pixel display with at least 256 colors. High Color (16-bit) recommended.

1 PDM is not supported on Windows 3.1, 95, 98, ME or Windows NT 4

---

Note When using Netscape on some Linux platforms, if you select an item under the Properties tab or the Monitoring tab, the entire PDM window shifts a few pixels to the left and up. This movement happens when you select a panel with a text box or a combo box in it.

---

Features Introduced in PDM Version 4.1

The following sections provide new and changed information for this release.

HTTPS Authentication Proxy

This feature provides a secure mechanism for exchanging username and password information between an HTTP client and FWSM using HTTPS.

ACL Per User Override

This feature allows an external server to override the configuration of the access rules policy for that interface. This feature only applies to inbound ACLs.

Resource Manager for ACL Memory Pool

This feature allows you to manage resources for ACLs, including the ACL memory pool or ACL tree instances, which are used when compiling ACLs.

Resource Class for PDM Sessions

This feature allows you to specify the number of PDM sessions for a particular context.

Suspend/Resume Failover Configuration Sync

This feature provides the ability to disable failover synchronization from an active device to a standby device.

Same Security Intra Interface

This feature allows a packet to come in and go out on the same interface. A router might forward a packet to the FWSM so that it can apply the user's firewall policy on that packet.

TFTP Fixup

This feature inspects the TFTP protocol and dynamically creates a connection and xlate if necessary to permit file transfer between a TFTP client and server. This feature was included in FWSM 2.2.

Syslog Enhancements

These enhancements allow you to specify the amount of memory that can be allocated for the syslog messages per context and to optionally deny connections if the syslog queue is full.

Important Notes

This section describes important notes for PDM software Version 4.1.

One-time Password

PDM does not support the one-time password (OTP) authentication mechanism.

Fixups

Both fixup SIP over TCP and fixup SIP over UDP are supported in FWSM Release 1.1, but fixup SIP over UDP cannot be disabled in FWSM Release 1.1. Fixup SIP over UDP can only be disabled in FWSM Release 2.x.

CLI Command Support

This section indicates which CLIs PDM supports.

Fully Supported CLI Commands

PDM parses these commands when uploading or creating the FWSM configuration and gives you full access to all PDM user-interface tabs.

Table 2 lists the CLI commands that PDM fully supports. PDM parses these commands in the FWSM configuration and allows PDM to operate successfully.

Exceptions are noted in the table and occur when PDM cannot parse certain combinations of command statements. Commands that PDM cannot parse stay in the configuration, their values cannot be changed with PDM, and they appear in the list of unparseable commands.

Table 2 Fully Supported CLI Commands 

FWSM Commands
aaa command, include option
aaa command, match acl_name option
aaa-server
access-list and access-group
access-list compiled
access-list ethertype
arp
arp inspection
auth-prompt
class (in System mode)
context (in System mode)
dhcpd
domain-name
enable password
failover
failover lan and show failover lan detail
failover monitor-interface
failover polltime
failover polltime holdtime
filter
fixup protocol
fragment
global
hostname
http
icmp
igmp
interface
ip address
ip audit
ip local pool
ip verify reverse-path
isakmp identity [address | hostname]
logging
mroute
multicast
name
nameif
nat
nat [(if_name)] 0 access-list acl_name
ntp
object-group (network, service)
passwd
pdm
pdm group
pdm history
pdm location
pdm logging
privilege
remote-management
rip
route
router
rpc-server
same-security-traffic
service resetinbound
snmp-server
ssh
static (used for inbound PAT)
sysopt
telnet
tftp-server
timeout
udp
url-block
url-cache
url-server
user-name

CLI Commands Not Fully Supported in FWSM

Table 3 lists commands that cannot be changed. PDM parses these commands in the firewall configuration and handles them transparently.

Table 3 CLI Commands Not Fully Supported in FWSM

FWSM Commands	Result
ca authenticate	All VPN-related commands are ignored.
ca enroll	All VPN-related commands are ignored.
capture	Ignored
crypto	All VPN-related commands are ignored.
established	Ignored
floodguard	Ignored
ftp mode passive	Ignored
gdb enable	Ignored
object-group icmp-type	View-only
object-group network	Nested object groups are read-only
object-group protocol	View-only
object-group service	Nested object groups cannot be added
pager	Ignored
route-map	Ignored
sysopt connection zombie-timeout	Ignored
sysopt nodnsalias	Ignored
sysopt uauth allow-http-cache	Ignored
terminal	Ignored
virtual	Ignored
vpngroup	All VPN-related commands are ignored.

CLI Commands Ignored in Multiple Mode when in System Mode

Table 4 lists the CLI commands that are ignored when PDM 4.1 is operating in multiple mode and set to system mode.

Table 4 Ignored CLI Commands 

FWSM Commands
banner
enable password
ftp mode passive
logging
password
timeout
username
sysopt nodnsalias

Miscellaneous CLI Command Operation Limitations

Table 5 lists miscellaneous CLI command limitations in PDM 4.1(2).

Table 5 Miscellaneous CLI Command Limitations 

FWSM Commands	Result
access-list	Ignored if the access-list is not used anywhere in the configuration.
prefix-list	Ignored if it is not used in an OSPF area (CLI: area <area-id> filter-list prefix)
Discontinuous net masks such as 255.255.0.255. Example CLI: ip address inside 192.168.2.1 255.255.0.255	n/a
Use of aaa ... include and aaa ... match	Limited to monitor-only
No access to write, show pdm, show version, and show curpriv	PDM will not run.
Sharing of ACLs. Example CLI: access-group myACL in interface inside and access-group myACL in interface outside	PDM will display this as expected. However if you make a modification to an ACL that is being shared, PDM will prompt you to duplicate this ACL so that the ACL is no longer shared.

CLI Commands Ignored by PDM in FWSM

These CLI commands are displayed in the list of unparseable commands in PDM. However, PDM does not change or remove these commands from your configuration, and the presence of these commands does not limit your access to the user-interface tabs in PDM. To see ignored commands, select Options > Show Commands Ignored by PDM on Firewall.

PDM Sessions

The FWSM can be configured to support up to five PDM sessions in single mode or five PDM sessions per context in multiple mode up to a total of 32 PDM sessions.

Caveats

The following sections describe the caveats for PDM software Version 4.1(2).

For your convenience in locating caveats in Cisco's Bug Toolkit, the caveat titles listed in this section are taken directly from the Cisco Bug Toolkit database. These caveat titles are not intended to be read as complete sentences because the title field length is limited. In the caveat titles, some truncation of wording or punctuation may be necessary to provide the most complete and concise description. The only modifications made to these titles are as follows:

•Commands are in boldface type.

•Product names and acronyms may be standardized.

•Spelling errors and typos may be corrected.

---

Note To view additional caveat information, use Bug Navigator II on CCO . Bug Navigator II may be accessed at the following website:

http://www.cisco.com/support/bugtools

---

Open Caveats - Version 4.1(2)

The caveats in Table 6 are yet to be resolved in this version.

Table 6 Open Caveats 

ID Number	4.1
	Corrected	Caveat Title
CSCdx28710	No	PDM shows wrong interface on outbound deny ACL
CSCed71185	No	Cannot dismiss a dialog that appears over a status dialog.
CSCeg54076	No	Failover enabled popup incorrect or misleading
CSCeg54474	No	PDM gets stuck at 96% after removing context and doing a refresh
CSCeg56569	No	Accessing online help in 2nd PDM session causes a JavaScript error
CSCeg57996	No	After deleting a resource class, security cntx still shows resource

Resolved Caveats - Version 4.1(2)

The caveats in Table 7 are resolved in this version.

Table 7 Resolved Caveats 

ID Number	4.1
	Corrected	Caveat Title
CSCef51651	Yes	Non-English chars in comments look strange after rereading
CSCeg50981	Yes	Multiple FWSM PDM sessions may cause ACL/object-group to disappear
CSCeg58454	Yes	Local authorization not enabled but privilege level still enforced
CSCeg77442	Yes	Cannot create access rule any any even with NAT 0 exemption
CSCeg80492	Yes	Border panel titles are truncated in Red Hat Linux
CSCeg83598	Yes	Edit NObj when object group used as source will cause validation err
CSCeg85309	Yes	PDM does not work if logged in as a read-only or monitor-only user
CSCeg85328	Yes	Problem accessing monitor screens as a monitor-only user
CSCeg85337	Yes	Screen becomes blank after going to Rate Limit as a read-only user
CSCeg85343	Yes	Monitor-only user shows up as privilege: NA (0)
CSCeg85348	Yes	Unable to access PDM Log if logged in as a monitor-only user
CSCeh25776	Yes	Non english chars messed up few of gui screens
CSCeh29194	Yes	PDM:Can not configure logging deny from syslog tab in PDM
CSCeh45853	Yes	PDM does not run with Java 1.5.0_02
CSCee80083	Yes	Fixup help page instructions for enabling/disabling inconsistent
CSCeg39034	Yes	Logging>Logging Setup: Restore Defaults function limited
CSCeg39297	Yes	DOC: Telnet help has invalid information
CSCeg42521	Yes	online help for same permit intra-intf description missing
CSCeg55247	Yes	Help: invalid option in tcp options help file
CSCeg56007	Yes	PDM Help shows ARP timeout value 0 - 3567586,PDM says 1 - 3567586
CSCeg57683	Yes	Failover online help still has some incorrect info
CSCeg43510	Yes	Disable Secure http warning msg when tcp/0 configured in aaa rules

Obtaining Documentation

Cisco documentation and additional literature are available on Cisco.com. Cisco also provides several ways to obtain technical assistance and other technical resources. These sections explain how to obtain technical information from Cisco Systems.

Cisco.com

You can access the most current Cisco documentation at this URL:

http://www.cisco.com/univercd/home/home.htm

You can access the Cisco website at this URL:

http://www.cisco.com

You can access international Cisco websites at this URL:

http://www.cisco.com/public/countries_languages.shtml

Ordering Documentation

You can find instructions for ordering documentation at this URL:

http://www.cisco.com/univercd/cc/td/doc/es_inpck/pdi.htm

You can order Cisco documentation in these ways:

•Registered Cisco.com users (Cisco direct customers) can order Cisco product documentation from the Ordering tool:

http://www.cisco.com/en/US/partner/ordering/index.shtml

•Nonregistered Cisco.com users can order documentation through a local account representative by calling Cisco Systems Corporate Headquarters (California, USA) at 408 526-7208 or, elsewhere in North America, by calling 1 800 553-NETS (6387).

Documentation Feedback

You can send comments about technical documentation to bug-doc@cisco.com.

You can submit comments by using the response card (if present) behind the front cover of your document or by writing to the following address:

Cisco Systems
Attn: Customer Document Ordering
170 West Tasman Drive
San Jose, CA 95134-9883

We appreciate your comments.

Obtaining Technical Assistance

For all customers, partners, resellers, and distributors who hold valid Cisco service contracts, Cisco Technical Support provides 24-hour-a-day, award-winning technical assistance. The Cisco Technical Support Website on Cisco.com features extensive online support resources. In addition, Cisco Technical Assistance Center (TAC) engineers provide telephone support. If you do not hold a valid Cisco service contract, contact your reseller.

Cisco Technical Support Website

The Cisco Technical Support Website provides online documents and tools for troubleshooting and resolving technical issues with Cisco products and technologies. The website is available 24 hours a day, 365 days a year, at this URL:

http://www.cisco.com/techsupport

Access to all tools on the Cisco Technical Support Website requires a Cisco.com user ID and password. If you have a valid service contract but do not have a user ID or password, you can register at this URL:

http://tools.cisco.com/RPF/register/register.do

---

Note Use the Cisco Product Identification (CPI) tool to locate your product serial number before submitting a web or phone request for service. You can access the CPI tool from the Cisco Technical Support Website by clicking the Tools & Resources link under Documentation & Tools. Choose Cisco Product Identification Tool from the Alphabetical Index drop-down list, or click the Cisco Product Identification Tool link under Alerts & RMAs. The CPI tool offers three search options: by product ID or model name; by tree view; or for certain products, by copying and pasting show command output. Search results show an illustration of your product with the serial number label location highlighted. Locate the serial number label on your product and record the information before placing a service call.

---

Submitting a Service Request

Using the online TAC Service Request Tool is the fastest way to open S3 and S4 service requests. (S3 and S4 service requests are those in which your network is minimally impaired or for which you require product information.) After you describe your situation, the TAC Service Request Tool provides recommended solutions. If your issue is not resolved using the recommended resources, your service request is assigned to a Cisco TAC engineer. The TAC Service Request Tool is located at this URL:

http://www.cisco.com/techsupport/servicerequest

For S1 or S2 service requests or if you do not have Internet access, contact the Cisco TAC by telephone. (S1 or S2 service requests are those in which your production network is down or severely degraded.) Cisco TAC engineers are assigned immediately to S1 and S2 service requests to help keep your business operations running smoothly.

To open a service request by telephone, use one of the following numbers:

Asia-Pacific: +61 2 8446 7411 (Australia: 1 800 805 227)
EMEA: +32 2 704 55 55
USA: 1 800 553-2447

For a complete list of Cisco TAC contacts, go to this URL:

http://www.cisco.com/techsupport/contacts

Definitions of Service Request Severity

To ensure that all service requests are reported in a standard format, Cisco has established severity definitions.

Severity 1 (S1)—Your network is "down," or there is a critical impact to your business operations. You and Cisco will commit all necessary resources around the clock to resolve the situation.

Severity 2 (S2)—Operation of an existing network is severely degraded, or significant aspects of your business operation are negatively affected by inadequate performance of Cisco products. You and Cisco will commit full-time resources during normal business hours to resolve the situation.

Severity 3 (S3)—Operational performance of your network is impaired, but most business operations remain functional. You and Cisco will commit resources during normal business hours to restore service to satisfactory levels.

Severity 4 (S4)—You require information or assistance with Cisco product capabilities, installation, or configuration. There is little or no effect on your business operations.

Obtaining Additional Publications and Information

Information about Cisco products, technologies, and network solutions is available from various online and printed sources.

•Cisco Marketplace provides a variety of Cisco books, reference guides, and logo merchandise. Visit Cisco Marketplace, the company store, at this URL:

http://www.cisco.com/go/marketplace/

•The Cisco Product Catalog describes the networking products offered by Cisco Systems, as well as ordering and customer support services. Access the Cisco Product Catalog at this URL:

http://cisco.com/univercd/cc/td/doc/pcat/

•Cisco Press publishes a wide range of general networking, training and certification titles. Both new and experienced users will benefit from these publications. For current Cisco Press titles and other information, go to Cisco Press at this URL:

http://www.ciscopress.com

•Packet magazine is the Cisco Systems technical user magazine for maximizing Internet and networking investments. Each quarter, Packet delivers coverage of the latest industry trends, technology breakthroughs, and Cisco products and solutions, as well as network deployment and troubleshooting tips, configuration examples, customer case studies, certification and training information, and links to scores of in-depth online resources. You can access Packet magazine at this URL:

http://www.cisco.com/packet

•iQ Magazine is the quarterly publication from Cisco Systems designed to help growing companies learn how they can use technology to increase revenue, streamline their business, and expand services. The publication identifies the challenges facing these companies and the technologies to help solve them, using real-world case studies and business strategies to help readers make sound technology investment decisions. You can access iQ Magazine at this URL:

http://www.cisco.com/go/iqmagazine

•Internet Protocol Journal is a quarterly journal published by Cisco Systems for engineering professionals involved in designing, developing, and operating public and private internets and intranets. You can access the Internet Protocol Journal at this URL:

http://www.cisco.com/ipj

•World-class networking training is available from Cisco. You can view current offerings at this URL:

http://www.cisco.com/en/US/learning/index.html