Table Of Contents
Release Notes for Cisco Security Manager 3.2
What's New in Security Manager 3.2
Cisco Security Manager 3.2 Download and Installation Instructions
Cisco Security Manager 3.2 Service Pack 2 Download and Installation Instructions
Backup and Restore Known Problems
Catalyst 6500/7600 Configuration
Diagnostics, Monitoring, and Troubleshooting Tools
Site-to-Site/Remote Access/SSL VPN Configuration
Using AUS with a Custom HTTPS Port Number for Security Manager Server
Limit on the Number of Keywords Supported for MARS Events Lookup from a Policy
Obtaining Documentation and Submitting a Service Request
Release Notes for Cisco Security Manager 3.2
Revised: June 20, 2008Contents
Introduction
Note
This document is occasionally updated after initial release; therefore, a hardcopy or PDF version of the document might not contain the latest information. We recommend that you refer to the online version (http://www.cisco.com/en/US/docs/security/security_management/cisco_security_manager/security_manager/3.2/release/notes/csmrn32.html) whenever possible.
Note
This document contains release note information for the following:
•
Cisco Security Manager (Security Manager) enables you to manage security policies on Cisco security devices. Security Manager supports integrated provisioning of firewall, VPN, and IPS services across IOS routers, PIX and ASA security appliances, and Catalyst 6500/7600 services modules (FWSM, VPNSM, VPN SPA, and ISDM-2). Security Manager also supports provisioning of many platform-specific settings, for example, interfaces, routing, identity, QoS, logging, and so on.
Security Manager efficiently manages a wide range of networks, from small networks consisting of a few devices to large networks with thousands of devices. Scalability is achieved through a rich feature set of device grouping capabilities and objects and policies that can be shared.
Security Manager supports multiple configuration views optimized around different task flows and use cases.
•
The Auto Update Server (AUS) is a tool for upgrading PIX security appliance software images, ASA software images, PIX Device Manager (PDM) images, Adaptive Security Device Manager (ASDM) images, and PIX security appliance and ASA configuration files. Cisco IOS routers that have dynamic IP addresses communicate with AUS that is running the Cisco Networking Services (CNS) Gateway Protocol to provide their IP addresses.
Security Manager can interoperate with AUS. To manage the devices in Security Manager, you must provide the device identity and the AUS information when you add a device. Security Manager uses the device identity information to retrieve the device IP address from an AUS that can be reached.
Note
This release note document includes ID numbers and headlines for each known problem identified in the document and a description of each. This document also includes a list of resolved problems. If you accessed this document from Cisco.com, you can click any ID number, which takes you to the appropriate release note enclosure in the Bug Toolkit. The release note enclosure contains symptoms, conditions, and workaround information.
What's New in Security Manager 3.2
•
•
–
–
–
–
–
–
•
•
•
–
–
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Installation Notes
You can install Security Manager 3.2 server software directly, or you can upgrade the software on a server where either Security Manager 3.0.2, 3.1, or 3.1.1 is installed. In addition to reading these installation notes, we strongly recommend that you refer to the Installation Guide for Cisco Security Manager 3.2 for important information regarding server requirements, server configuration, and post-installation tasks.
Note
Before you can successfully upgrade to Security Manager 3.2 from a prior version of Security Manager (versions 3.0.2, 3.1, or 3.1.1 only), you must make sure that the Security Manager database does not contain any pending data, in other words, data that has not been committed to the database. If the Security Manager database contains pending data, you must commit or discard all uncommitted changes, then back up your database before you perform the upgrade. For instructions, see "Upgrading Server Applications" in the Installation Guide for Cisco Security Manager 3.2.
Note
Cisco Security Manager 3.2 Download and Installation Instructions
Note
To download and install Cisco Security Manager 3.2:
Step 1
Step 2
Note
Step 3
Note
Step 4
The InstallShield Wizard extracts files to a temporary directory and checks their integrity while it constructs the Cisco Security Manager Setup application, which starts automatically.
Note
Tip
Cisco Security Manager 3.2 Service Pack 2 Download and Installation Instructions
Service Pack 2 is a superset of Service Pack 1, so you can install it with or without installing Service Pack 1 first.
Note
To download and install Cisco Security Manager 3.2 Service Pack 2:
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Step 7
Step 8
Step 9
Note
Important Notes
•
•
•
•
•
We recommend that you install Security Manager and Performance Monitor on separate systems. Also, we recommend that you do not upgrade Security Manager to 3.2 if you have Performance Monitor 3.1 running on the same server. The next version of Performance Monitor, 3.2, will be released shortly, at which point, both the applications can coexist on the same server.
•
•
•
•
•
HTTP_PORT=<port_number>HTTPS_PORT=<port_number>When you start the client the next time, it uses the updated port numbers, based on the protocol selected, to communicate with the server.
•
1.
2.
3.
4.
5.
6.
7.
Note
•
•
•
•
•
Caution
Resolved Problems
Service Pack 2 is a superset of Service Pack 1, so it contains all of the problem resolutions included in Service Pack 1 as well as those in Service Pack 2 itself.
•
•
Table 3 identifies the problems that were documented in the Security Manager 3.1.1 release notes as known problems and that have since been resolved. For information on resolved problems that were resolved in earlier releases, please refer to the release note document for each previous release.
Note
Table 1 Resolved Problems in Service Pack 2
Description: This problem occurs after downloading (in Cisco Security Manager) an Advanced Integration Module (AIM)-specific 6.0(5)E2 package and standard 6.0(5) package from Cisco.com. The problem is that the user cannot deploy the AIM-specific 6.0(5)E2 package to AIM.
Description: This problem occurs after downloading (in Cisco Security Manager) the E2 engine upgrade package and an E2-based signature update from Cisco.com. The problem is that Cisco Security Manager fails to push the E2-based signature update to the Advanced Integration Module (AIM).
Table 2 Resolved Problems in Service Pack 1
Description: A duplicate order_id in the same policy group might occur when multiple firewall policy groups are modified with an insertion.
Description: While creating an inline interface pair, if you cancel the create dialog or an error occurs, the Cisco Security Manager interface retains the inline pair name.
Description: An error occurs when deployment job or Config Archive rollback is performed on an IOS/IPS device.
Description: In an IPS sensor, after the user clicks Interface and adds an inline pair, and then creates a VLAN group using that inline pair, the user cannot edit the inline pair. The inline pair can be edited if the VLAN group is deleted. After editing, the VLAN group can be added back.
Description: Cisco Security Manager lists IDSM inline interface pairs in the VLAN groups interface list.
Description: The fonts used for the auto refresh text in Deployment Manager is difficult to read.
Description: Discovery/Rediscovery/Deployment fails with a JDOM exception when http authentication has not been correctly set up on a device or if the user does not have the correct privilege level assigned.
Description: The subinterface of a VLAN group assigned to a virtual sensor is not discovered under the following conditions: For an IPS device, use CLI to add an inline pair interface, and then create a VLAN group, using this inline pair interface, with a subinterface.
Description: While submitting changes to the device, Security Manager hangs for a long time at the validating screen.
Description: All policies are deleted on the Security Contexts when you deploy to a device or when you do a preview config.
Description: Scheduled deployment job reports that devices are not available when the scheduled time elapses. This problem is known to occur on Catalyst 6000 devices only.
Description: After you upgrade from Security Manager 3.1 to 3.1.1 or 3.2, the three default reports in the IEV client started from Security Manager: Top Alerts, Top Attackers, and Top Victims, stop functioning.
Description: Synchronization between Security Manager and AIM-IPS modules is lost when the user attempts to configure more than one monitoring mode (inline and promiscuous).
Description: Security Manager 3.1.1 discovering an FWSM 3.1(x) blade in multi-context mode with active/active failover configured fails.
Description: TACACS+ should be supported for authentication for remote access purposes.
Description: Cisco Security Manager attempts to connect to the IPS subsystem during deployment on an IOS-IPS device even if the user is not managing the IPS subsystem on the device. This results in deployment failure if HTTPS is not configured on the device.
Description: In certain situations, a FlexConfig might become locked and uneditable.
Description: The "no pdm history enable" command is incorrectly imported as part of an object-group.
Description: When you deploy large configuration changes to PIX 6.2 devices, deployment fails with the "Error: 24112 : IO error during SSL communication" message recorded in the transcript.
Description: Cisco Security Manager doesn't support changes to LDAP attributes in ASA 8.0.
Description: Cisco Security Manager does not properly support the "no shutdown" command.
Description: Need support for importing Cisco Catalyst 3750-24TS switches and Cisco Catalyst 3550-24 PWR switches.
Description: Discovery of an IPS sensor fails if only the host name is supplied.
Description: After upgrading to Cisco Security Manager 3.2 from an earlier version, changes to the access rules of a firewall are not saved.
Description: After upgrading to Cisco Security Manager 3.2 from an earlier version, admin settings are not retrieved properly.
Description: Context discovery fails for ASA multi mode devices running 2.x images with both standalone discovery and discovery through a chassis.
Table 3 Resolved Problems in Security Manager 3.2
Description: When you create an access rule for a PIX 6.x device, you can specify a time range in the GUI; however, the device does not support the time range feature in the ACE and no warning is displayed during activity validation or deployment.
Description: Values in the Logging Level column of the Individually Rate Limited Syslog Messages table are not used and are overwritten after rediscovery.
Description: On a PC with many users, only the person who installs Security Manager Client can see the desktop and Start menu shortcuts that show that Security Manager Client is installed.
Description: Device import discovers an enabled policy map and its related commands as service policy rules and traffic flow objects. Security Manager does not preserve the original policy map names on a device.
Description: Dynamic NAT rules that are discovered are duplicated by Security Manager without removing the original rules during the next deployment.
Description: Deployment fails for a Network Admission Control (NAC) policy. The ip admission command is not recognized on the device.
Description: A static NAT network rule that was discovered from a device configuration is flagged as invalid during activity validation.
Description: If other software that uses OpenSSL (such as Legato or Veritas backup software) is installed on the same machine as Security Manager, the apache server fails to start.
Description: The signature policy icon appears blank when the device is removed from a shared signature policy.
Description: When you enable an SSL VPN connection profile on an ASA security appliance managed by AUS and configure the auto-signon command in an ASA user group, deployment of configuration changes to the device fails when you enable the device to request AUS for updates. This problem occurs when the same auto-signon commands have been configured in the same ASA user group on the device. Although deployment is shown as successful in the Deployment Manager window, an error is recorded in the AUS event report that the file was not downloaded to the device.
Description: When you configure a PIX device with a PKI configuration, AUS deployment fails because Security Manager generates the CLI commands in the wrong order.
Description: When you install only Common Services 3.0.5 or AUS 3.1 from the Security Manager DVD, an IEV error message is displayed even if you did not select Security Manager 3.1 during installation.
Description: In a site-to-site VPN configuration, the LDAP Server URL field in the CA Information tab of the PKI Enrollment dialog box is mandatory if one of the "CRL..." options is selected from the Revocation Check Support list. This means you cannot add a CA server to a PKI object without entering the URL of the LDAP server from which the CRL is downloaded, even if the CA server does not use LDAP as the querying protocol for revoking certificates on the device.
Description: When you deploy to a large scale DMVPN topology after configuring On-Demand Routing (ODR) as the routing protocol, the Cisco Discovery Protocol (CDP) is not enabled for the multipoint GRE (mGRE) tunnels. This problem occurs when CDP is not enabled at the global level on all supported interfaces.
Description: In a hub-and-spoke VPN topology in which the assigned technology is GRE Dynamic IP, when you configure a static routing protocol as your secured IGP, the CLI commands for static routes are not generated for the protected networks in the tunnel.
Description: Deployment fails due to invalid characters defined in the SDP device name formula.
Description: When you associate interfaces with another bridge-group and provision it in Security Manager, the deployment shows an error; however, the device in this case has been provisioned correctly.
Description: If you delete the contents of a text field when editing an OSPF interface policy, Security Manager does not save the changes.
Description: If two filter commands of the same type are defined with the same port ranges (service) or overlapping port ranges and overlapping networks, deployment to a device fails. The device does not accept overlapping filter commands.
Description: For ASA 7.2 HTTP Maps, if the body match maximum is set to 0 (zero), the device accepts the command as "body-match-maximum" but shows it in show run as "body-match-maximum 0". This causes the delta to always contain the removal of the http policy-map subcommands and adding them back.
Description: Deployment and preview configuration fail for static routing policies after a database upgrade.
Description: When you change the authentication type used by an OSPF interface from MD5 to clear-text or disable authentication, the identification number of the MD5 authentication key (ip ospf message-digest-key command) is not removed from the interface after deployment.
Description: The access rules table might not finish loading for a newly discovered device if the discovered configuration has access-list remarks that contain quotes or double quotes.
Description: If you select the Custom Method List option to use a remote AAA server for authorization in a PPP policy and modify the default authorization method defined in the AAA policy, the AAA authorization command for network connections is not generated on the device after deployment.
Description: If a router has been configured to use the default authorization method defined in the AAA policy for a PPP connection and the AAA network authorization settings are changed in the AAA policy, the aaa authorization network {default | list-name} command might not be generated in the preview configuration due to a conflict with the authorization method defined in the PPP policy.
Description: When you create overlapping global rules on different interfaces for PIX/ASA/FWSM devices, Security Manager returns an error about overlapping IP ranges even though the global interfaces are different.
Description: WAAS inspection rules are not shown in the inspection rules table for FWSM devices.
Description: DCE RPC inspection maps are not shown in the inspection rules table or the policy object manager.
Description: Unable to edit the interface name and direction of a blocking interface under the "Router" and "Catalyst 6500" tabs of the IPS Blocking policy.
Description: Find/Replace does not find any matching results even though the value to search for does exist in the rule table.
Description: The AAA include/exclude commands can each have multiple instances, but the current rule file models them as a single instance command and therefore leaves only one instance after processing.
Description: Deployment to file or device might fail with a Null Pointer Exception for an IOS router device with NAT rules configured.
Description: After a vlan inline pair is created, if you try to modify the interface name, the edit vlan inline pair UI screen does not allow you to save the changed information.
Known Problems
This section contains information about the problems known to exist in Cisco Security Manager 3.2. The known problems are arranged into the following tables:
Note
•
•
•
•
AUS Known Problems
Table 4 AUS Known Problems
Description: A user logs out from the CiscoWorks session after launching AUS, but the AUS GUI remains open. If another user with a different role opens a new CiscoWorks session, other users can navigate the AUS GUI briefly in the original window. This problem occurs whether the CiscoWorks server or the Cisco Secure Access Control Server (ACS) manages authentication and authorization for AUS.
Description: If you configure an ASA device in transparent mode and use AUS to deploy configuration changes from Security Manager to the device, deployment is shown as successful, although the device does not contain the deployed changes. The AUS event report shows that the file was successfully sent to the device without error and a "Wakeup information for process auto-update lost" message is recorded in the device log.
Backup and Restore Known Problems
Table 5 Backup and Restore Known Problems
Description: Although Security Manager 3.2 supports upgrades only from the following previous versions: 3.0.2, 3.0.2 SP1, 3.1, 3.1.1, 3.1.1 SP1 and SP2, restoring a Security Manager database earlier than 3.0.2 goes through properly on a 3.2 server, without any error message or termination of this operation.
Catalyst 6500/7600 Configuration
Table 6 Catalyst 6500/7600 Configuration
Description: Deployment fails when you attempt to change the running mode of the data port VLAN from Trunk (IPS) to Capture (IDS) from the IDSM Data Port VLANs dialog box and the following error message is displayed:
Command Rejected: Remove trunk allowed vlan configuration from data port 1 before configuring capture allowed-vlansDescription: If you modify the allowed VLANs of an IDSM data port that has been configured as a capture port and deploy configurations to the device, the following error occurs:
"Capture not allowed on a SPAN destination port"Description: Deployment might fail when you attempt to modify the physical port configuration type from access to trunk mode for a Catalyst switch and keep the Enable DTP negotiation check box selected in the trunk port mode.
Description: If you are adding a Cisco Catalyst 6500 Series switch that contains an Intrusion Detection System Services Module (IDSM), and import fails during discovery of the IDSM, the resulting error message will contain non-specific information.
Client Software
Table 7 Client Software
Description: When you upgrade to Security Manager 3.1.1 from 3.0.2, you are prompted that a Java Virtual Machine is being installed and you are asked if you want to override the directory. No is preselected, but you should select Yes.
Description: When you install Security Manager client 3.2, security applications, such as Cisco Security Agent that are running on your system, might prevent the execution of certain installation steps and the operation fails.
Deployment
Table 8 Deployment
Description: Deployment fails if access rules containing certain options are associated with Layer 2 interfaces of ISR routers.
Description: When you deploy an inspection rule with the gtp-map command, the deployment fails and an error message states that the signaling timeout value is less than the PDP timeout value.
Description: After Security Manager successfully deploys the configuration file to CNS, and Cisco IOS routers configured for CNS poll and apply the configuration changes at the predefined polling period, the Status column in the Deployment Manager window continues to display the job state as "Deploying".
Description: You cannot use SSH when deploying IOS-IPS category settings to a device. Instead, configure the device to use SSL for deployment.
Description: When an QoS policy class map has an ACL that is shared with another policy map, removing the interface associated with the QoS policy class map causes an error.
Description: When deploying configuration changes from Cisco Security Manager to a FWSM, saving the configuration on the device fails; however, deployment reports it as successful.
Description: When a device has an ACL object with an underscore in its name assigned to both a NAT policy and an AIM-IPS monitoring policy, deployment to the device fails.
Device Management
Table 9 Device Management
Description: If you change the credentials for the admin context when using HTTPS as the transport protocol, Security Manager cannot connect to the system execution space (for FWSM). Ensure that you define the same credentials for both the admin context and the system execution space when using HTTPS.
Description: A device's certificate is changed after retrieving the config file from the AUS server. The certificate stored in Security Manager would be out of sync with the device, hence cause the preview to fail with certificate mismatched error.
Diagnostics, Monitoring, and Troubleshooting Tools
Table 10 Diagnostics, Monitoring, and Troubleshooting Tools
Description: During installation of Security Manager server 3.1 on systems that do not contain C: drive, IEV server fails to install and an error message is displayed. Also, an error is logged in the server installation log file.
Description: You cannot start IEV client from Security Manager client on a system in which the Symantec Client Firewall Port Scanning Module or Symantec Secure Port application is running.
Description: If your Security Manager client session is active when you perform policy lookup from the MARS GUI, the existing Security Manager client window is not brought to the foreground or into focus by default.
Description: If you create duplicates of a base rule in the Access Rules page of Security Manager, the events matching the second identical rule are only displayed in MARS when you perform a lookup.
Description: An error message is not displayed if you delete an access rule in Security Manager and perform lookup from the MARS events query results page that was opened by performing a lookup from the same access rule in Security Manager.
Description: When you start the Security Manager client from the read-only policy query page in MARS, the read-only page is refreshed and is displayed blank. However, you are prompted to install the Security Manager client and the page for downloading the application is opened.
Description: If you try to perform events lookup from the default signature, a "Policy not found" error message is displayed. However, if you edit the default signature and save it, the policy icon changes to show that a local policy is configured on the device and you can navigate to events in MARS.
Description: When you try to start the Security Manager client from the read-only policy query window in MARS, the File Download dialog box appears prompting you to confirm whether you want to download the CsmContentProvider file to your system.
Description: The disconnection between the Host Name field in the Device Properties page and the Host Name field in the policy page under the Device Admin section of the Security Manager GUI causes problems on FWSM blades with multiple contexts because a unique context cannot be identified during policy lookup from MARS events.
Description: MARS user credentials for events lookup are retained in the Security Manager cache even after you change the authentication mechanism to prompt the user for Security Manager credentials instead of MARS credentials.
Description: When you look up a MARS event generated by an access rule, disabled rules in the Security Manager rules table are not shown as inactive in the read-only policy query window.
Description: If you configured the option to use Security Manager credentials for events lookup, neither the query page in MARS nor the login dialog box is displayed and events lookup fails.
Discovery
Table 11 Discovery
Description: Device level overrides for policy objects corresponding to object groups can be created after discovering only the inventory policies like interfaces.
Description: When using HTTPS as the transport protocol, the connection to the security contexts in an FWSM can hang if the connectivity between the Security Manager server and the device is unstable.
Description: The interface parameter is not discovered for the AAA-server building block discovered from IOS routers.
Description: If you upgrade the operating system version on a PIX device, rediscovering policies on the device might fail if the device includes RIP policies. Unassign the RIP policy before rediscovering the device.
Firewall Services
Table 12 Firewall Services
Description: Security Manager does not support TCP flag specifications, such as urg, fin, psh, and ack, in access rules. As a result, during discovery, Security Manager drops the specifications.
Description: Security Manager does not support ACE options such as DSCP, ToS, or precedence. As a result, during discovery, Security Manager drops the options.
Description: Although the GUI allows you to enable the Object Group Search option for FWSM devices, the FWSM does not expand object groups when listing access rules after a "show access-list" command and Hit Count results are inaccurately displayed.
Description: Security Manager does not check if the firewall rules that you configured in Security Manager permit management traffic (SSH and HTTPS) to the IOS device being managed. As a result, after firewall rules are deployed to the device, connection to the device might be lost.
Description: IOS 87x ISR routers do not support BGP as a routing protocol or as a service in ACLs when the device has only 24 MB of memory; however, BGP is supported when the device has more than 24 MB memory. Security Manager does not detect the amount of memory available on the device and cannot enforce any restrictions. As a result, job deployment containing an ACL with ACEs having BGP will fail.
Description: IOS devices require that HTTP is used as the traffic type for authentication proxy, which generates the command ip http server. Security Manager does not remove the CLI when authentication proxy is unassigned from the device in Security Manager.
Description: If an AuthProxy configured on an IOS device has a user-specified name that does not comply with the naming convention used by Security Manager, the name is not removed if the device is discovered and the policy is unassigned.
Description: IOS devices use standard ACLs for filtering; however, standard ACLs are not recognized when Hit Count reports are generated.
Description: If Security Manager tries to deploy AAA server groups to a device that already has the maximum number of AAA server groups, deployment fails.
Description: IOS inspection port-map commands are not generated if inspection rules configured in Security Manager conflict with port definitions of predefined inspection protocols.
Description: Some options are omitted from rules that are created using the Import Rules tool, for example, empty port values and destination port values that are not validated for 'eq' and 'neq' for IOS devices.
Description: Rule section changes are not reported in the activity reports.
Description: AAA Server policy objects cannot be reused because of mismatched interfaces. This might result from an interface role used to define an interface that is not matched to a physical interface after rediscovery. For PIX/ASA7.x devices, this might result from using "inside" (or an interface name that starts with "inside") to describe the interface.
Description: Changes to the match-condition order for a gtp-map used in a PIX 7.0 or PIX 7.1 device do not get deployed to the device.
Description: After you upgrade from Security Manager 3.0.1 to 3.1 or Security Manager 3.0.2 to 3.1.1, the command "ip http server" is deployed to an IOS router if the router already has the command "ip http secure-server". Command "ip http server" will turn on the HTTP server on the router.
Description: On FWSM 3.2, when the Webfilter url-server type is selected in N2H2/SmartFilter, the url-server command will be removed and redeployed on each deployment to the device.
Description: ASA 8.x supports new service object groups that are not supported by Security Manager 3.2. If you configure a new service object group and use it in ACEs in the device, Security Manager 3.2 can discover the device; however, the access list is only partially discovered. The ACEs using the new service object group will not be discovered in Security Manager.
Guest
