Chapter 1. Introduction

Chapter 2. Supported Platforms and Environments in Version 6.2.0.x

Chapter 3. Management Capability in Version 6.2.0.x

Management Capability: Firepower Management Center

Local Management Capability: ASA FirePOWER Module, Firepower Device Manager, and 7000 and 8000 Series Devices

Chapter 4. Features and Functionality

New Features and Functionality Added in Version 6.2.0.x

New or Changed Functionality in Version 6.2.0.x

Features and Functionality Introduced in Version 6.2.0

Changed Functionality in Version 6.2.0

Chapter 5. Terminology and Documentation for Version 6.2.0.x

Product Terminology and Branding in Version 6.2.0.x

Documentation for Version 6.2.0.x

Known Documentation Issues in Version 6.2.0.x

Chapter 6. Product Compatibility in Version 6.2.0.x

Integrated Product Compatibility

Web Browser Compatibility in Version 6.2.0.3

Web Browser Compatibility in Version 6.2.0.2

Web Browser Compatibility in Version 6.2.0.1

Screen Resolution Compatibility

Chapter 7. Update vs. Reimage vs. Deploy

Chapter 8. Important Update Notes

Update Paths to Version 6.2.0.x

Update Interface Options

Update Sequence Guidelines

Update Sequence for Firepower Management Centers in High Availability

Update Sequence for Firepower Threat Defense Devices in High Availability

Update Sequence for Clustered Firepower Threat Defense Devices

Update Sequence for 7000 and 8000 Series Devices in High Availability

Update Sequence for Stacked 8000 Series Devices

Preupdate Readiness Checks

Run a Readiness Check through the Shell

Run a Readiness Check through the Firepower Management Center Web Interface

Pre-Update Configuration and Event Backups

Traffic Flow and Inspection During the Update

Time and Disk Space Requirements for Updating to Version 6.2.0.3

Time and Disk Space Requirements for Updating to Version 6.2.0.2

Time and Disk Space Requirements for Updating to Version 6.2.0.1

Post Update Tasks

Chapter 9. Update to Version 6.2.0.x

Update Procedures Listed by Platform

Update Firepower Management Centers and Firepower Management Centers Virtual

Update Firepower Threat Defense Devices Using the Firepower Management Center

Update Firepower Threat Defense Devices with the Firepower Device Manager

Update 7000 and 8000 Series Devices, NGIPSv, and ASA FirePOWER Modules Using the Firepower Management Center

Update ASA FirePOWER Modules Managed with ASDM

Chapter 10. Uninstall Version 6.2.0.x

Uninstall 7000 and 8000 Series Managed Devices

Uninstall Firepower NGIPSv Devices

Uninstall ASA FirePOWER Modules Managed By Firepower Management Center

Uninstall Firepower Threat Defense Devices and Firepower Threat Defense Virtual Managed By Firepower Management Center

Uninstall Firepower Management Centers

Uninstall ASA FirePOWER Modules Managed By ASDM

Uninstall from Firepower Threat Defense Devices Managed by Firepower Device Manager

Chapter 11. Resolved Issues

Issues Resolved in Version 6.2.0.3

Issues Resolved in Version 6.2.0.2

Issues Resolved in Version 6.2.0.1

Issues Resolved in Version 6.2.0

Chapter 12. Known Issues

Known Issues in Version 6.2.0.3

Known Issues in Version 6.2.0.2

Known Issues in Version 6.2.0.1

Known Issues in Version 6.2.0

Chapter 13. For Assistance

Chapter 1. Introduction

These release notes are valid for the following versions: Version 6.2.0.1, Version 6.2.0.2, and Version 6.2.0.3. This document describes how to update or reimage your appliances to Version 6.2.0.x.

Even if you are familiar with the process, make sure you thoroughly read and understand these release notes.

Chapter 2. Supported Platforms and Environments in Version 6.2.0.x

The following table lists the supported platforms for Version 6.2.0.x:

Supported Platforms and Environments

Supported Platform

Supported Environment

Firepower Management Centers: MC750, MC1000, MC1500, MC2000, MC2500, MC3500, MC4000, MC4500

—

64-bit Firepower Management Center Virtual

- VMware vSphere/VMware ESXi 5.5

- VMware vSphere/VMware ESXi 6.0

- Amazon Web Services (AWS) VPC/EC2

- Kernel-based virtual machine (KVM)

7000 and 8000 Series devices: 7010, 7020, 7030, 7050, 7110, 7115, 7120, 7125, 8120, 8130, 8140, 8250, 8260, 8270, 8290, 8350, 8360, 8370, 8390, AMP7150, AMP8050, AMP8150, AMP8350, AMP8360, AMP8370, AMP8390

—

NGIPSv (virtual managed devices)

- VMware vSphere/VMware ESXi 5.5

- VMware vSphere/VMware ESXi 6.0

Cisco ASA with FirePOWER Services: ASA 5506-X, ASA 5506H-X, ASA 5506W-X, ASA 5508-X, ASA 5512-X, ASA 5515-X, ASA 5516-X, ASA 5525-X, ASA 5545-X, ASA 5555-X, ASA 5585-X-SSP-10, ASA 5585-X-SSP-20, ASA 5585-X-SSP-40, ASA 5585-X-SSP-60

Note:
You can also configure these devices as an ASA FirePOWER module managed by ASDM.

ASA OS, for ASA FirePOWER:

- 9.5(2), 9.5(3) except 5506 models

- 9.6(x)

- 9.7(x)

- 9.8(x)

Note that the ASA 5506-X does not support ASA Version 9.5(2).

ASDM Version 7.7(1) and later.

The ASA 5506-X, ASA 5508-X, and ASA 5516-X require ROMMON Version 1.1.8 or later.

Cisco ASA with Firepower Threat Defense: ASA 5506-X, ASA 5506H-X, ASA 5506W-X, ASA 5508-X, ASA 5512-X, ASA 5515-X, ASA 5516-X, ASA 5525-X, ASA 5545-X, ASA 5555-X

Note:
You can also configure these devices as Firepower Threat Defense managed by Firepower Device Manager. For more information, see the System Management topic in the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager.

—

Firepower 9300 appliance with Firepower Threat Defense and the Firepower 4100 series with Firepower Threat Defense: Firepower 4110, Firepower 4120, Firepower 4140, Firepower 4150

FXOS Version 2.1(1) and later, or Version 2.2(1) and later.

The Firepower 9300 appliance requires ROMMON Version 1.0.10 or later.

Firepower Threat Defense Virtual

- VMware vSphere/VMware ESXi 5.5

- VMware vSphere/VMware ESXi 6.0

- AWS VPC/EC2

- KVM

- Microsoft Azure Standard D3

- Microsoft Azure Standard D3_v2

Chapter 3. Management Capability in Version 6.2.0.x

- Management Capability: Firepower Management Center

- Local Management Capability: ASA FirePOWER Module, Firepower Device Manager, and 7000 and 8000 Series Devices

Management Capability: Firepower Management Center

You can use the Firepower Management Center web interface to configure and manage the Firepower Management Center and its managed devices. Alternatively, you can use the UI on specific device platforms to configure and manage those specific device platforms (see Local Management Capability: ASA FirePOWER Module, Firepower Device Manager, and 7000 and 8000 Series Devices).

If a managed device is running Version 6.2.0.x, you must use at least Version 6.2.0 of the Firepower Management Center to manage the device. If a Firepower Management Center is running Version 6.2.0.x, it can manage devices running the versions specified in the table below.

Device Version Requirements to be Managed by Firepower Management Center Running Version 6.2.0.x

Device

Minimum Required Version for Device

7000 and 8000 Series managed devices

Version 6.1.0

NGIPSv virtual managed devices

Version 6.1.0

ASA with FirePOWER Services on ASA 5512-X, ASA 5515-X, ASA 5525-X, ASA 5545-X, ASA 5555-X, ASA 5585-X-SSP-10, ASA 5585-X-SSP-20, ASA 5585-X-SSP-40, ASA 5585-X-SSP-60

Version 6.1.0

ASA with FirePOWER Services on ASA 5506-X, ASA 5506W-X, ASA 5506H-X, ASA 5508-X, ASA 5516-X

Version 6.1.0

Firepower Threat Defense on ASA 5506-X, ASA 5506W-X, ASA 5506H-X, ASA 5508-X, ASA 5512-X, ASA 5515-X, ASA 5516-X, ASA 5525-X, ASA 5545-X, ASA 5555-X

Version 6.1.0

Firepower Threat Defense on Firepower 9300 (with SM-24, SM-36, or SM-44 security modules)

Version 6.1.0

Firepower Threat Defense on Firepower 4110, Firepower 4120, Firepower 4140, Firepower 4150

Version 6.1.0

Firepower Threat Defense Virtual

On VMware: Version 6.1.0

On AWS: Version 6.1.0

On KVM: Version 6.1.0

On Azure: Version 6.2.0

Local Management Capability: ASA FirePOWER Module, Firepower Device Manager, and 7000 and 8000 Series Devices

On select device platforms tailored for smaller deployments, you can use a GUI to configure and manage the devices. These platforms include the ASA FirePOWER module managed with ASDM or devices running Firepower Threat Defense managed by Firepower Device Manager.

Also, you can use a web interface to perform limited configuration on 7000 and 8000 Series devices.

Alternatively, you can use the Firepower Management Center web interface to configure and manage these devices (see Management Capability: Firepower Management Center).

ASA FirePOWER Module Managed with ASDM

Supported Platforms: ASA 5506-X, ASA 5506H-X, ASA 5506W-X, ASA 5508-X, ASA 5516-X, ASA 5512-X, ASA 5515-X, ASA 5525-X, ASA 5545-X, ASA 5555-X, ASA 5585-X-SSP-10, ASA 5585-X-SSP-20, ASA 5585-X-SSP-40, ASA 5585-X-SSP-60

You can use ASDM to configure and manage an ASA FirePOWER module running Version 6.2.0.x.

See the Cisco ASA with FirePOWER Services Local Management Configuration Guide for more information.

Firepower Threat Defense Devices Managed by Firepower Device Manager

Supported Platforms: ASA 5506-X, ASA 5506H-X, ASA 5506W-X, ASA 5508-X, ASA 5512-X, ASA 5515-X, ASA 5516-X, ASA 5525-X, ASA 5545-X, ASA 5555-X

You can use the Firepower Device Manager to configure and manage a Firepower Threat Defense device running Version 6.2.0.x.

See the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager for more information.

7000 and 8000 Series Devices

Supported Platforms: 7010, 7020, 7030, 7050, 7110, 7115, 7120, 7125, 8120, 8130, 8140, 8250, 8260, 8270, 8290, 8350, 8360, 8370, 8390, AMP7150, AMP8050, AMP8150, AMP8350, AMP8360, AMP8370, AMP8390

You can use the web interface for a 7000 or 8000 Series device running Version 6.2.0.x to manage limited configurations on that device. You must use the Firepower Management Center for some device configurations not accessible from the 7000 and 8000 Series web interface.

See the Firepower Management Center Configuration Guide for more information.

Chapter 4. Features and Functionality

Features and functionality introduced in previous versions may be superseded by new features and functionality in later versions.

- New Features and Functionality Added in Version 6.2.0.x

- New or Changed Functionality in Version 6.2.0.x

- Features and Functionality Introduced in Version 6.2.0

- Changed Functionality in Version 6.2.0

New Features and Functionality Added in Version 6.2.0.x

The following table lists the features introduced in Version 6.2.0.x:

New Features in Version 6.2.0.2

Feature

Description

Supported Platforms

Snort Processes

Version 6.2.0.2 adds the configure snort preserve-connections {enable | disable} command to the Firepower Threat Defense CLI. This command determines whether to preserve existing connections on routed and transparent interfaces in case the Snort process goes down. This option is enabled by default, but you can disable it. When disabled, all new or existing connections are dropped when Snort goes down. When enabled, connections that were already allowed remain established, but new connections cannot be established until Snort is again available.

Note that you cannot permanently disable this command on a Firepower Threat Defense device managed by Firepower Device Manager; existing connections may drop when the settings revert to default during the next configuration deployment.

- Firepower Threat Defense

New or Changed Functionality in Version 6.2.0.x

The following features have new or changed functionality in Version 6.2.0.x:

- In Version 6.2.0.3, if you modify the AMP for Endpoints connection to the Cisco cloud in the Firepower Management Center UI, the Firepower Management Center keeps the previous identifer when communicating with the AMP cloud and continues to receive retrospective alerts.

- In Version 6.2.0.1, due to memory limitations, some device models (7100 Family, ASA 5506-X, ASA 5506H-X, ASA 5506W-X, ASA 5508-X, ASA 5512-X, ASA 5515-X, ASA 5516-X, and ASA 5525-X) perform most URL filtering with a smaller, less granular, set of categories and reputations. To avoid storing the full category and reputation database on lower-memory devices, the system may perform cloud lookups to determine category and reputation for sites not in the local database. (CSCuz66673)

- Version 6.2.0.1 adds the All applications including unidentified applications option for Version 6.2.0 users. This option is added to Intelligent Application Bypass Settings in the access control policy advanced settings. When selected, if one of the IAB inspection performance thresholds is met, the system trusts any application that exceeds any flow bypass threshold regardless of the application type. For more information, see the Firepower Management Center Configuration Guide, Version 6.2.0 or the Cisco ASA with Firepower Services Local Management Configuration Guide, Version 6.2.0.

Features and Functionality Introduced in Version 6.2.0

This tables includes the new and updated features and functionality included in Version 6.2.0.

Features in Version 6.2.0: Migration Enablers

New Feature

Description

Supported Platforms

Migration Tool

Migrating from Cisco ASA-to-Firepower Threat Defense can be a daunting task for customer is with multiple access control lists (ACLs), Network Address Translation policies, and related configuration objects. The migration tool is specifically designed to assist this migration process. The tool allows you to convert ASA configurations (ACL, NAT and related objects) to Firepower Threat Defense configurations, which you can then import into the Firepower Management Center. The migration tool supports the conversion of up to 600,000 total access rule elements per ASA configuration file.

- 64-bit Firepower Management Center Virtual (VMware and KVM)

REST API

Firepower Version 6.2.0 allows REST clients to create and configure interfaces for Firepower Threat Defense devices through the Firepower Management Center REST API. This feature enables the Firepower Management Center to interact with various Cisco products and services as well as those from third-party vendors. Implementation of these APIs is ideal in the following scenarios:

- Large enterprises that want to control policy changes in Firepower through other Cisco systems such as Application Centric Infrastructure (ACI) or through their own proprietary orchestration solutions

- Managed security service providers that want to adopt software-defined networking, application-centric infrastructure, and network function virtualization solutions

Note:
SDN controllers do not have a way to automatically insert Firepower Threat Defense devices in the traffic path.

- Firepower Management Center

- 64-bit Firepower Management Center Virtual

Packet Tracer and Capture

The Packet Tracer and Capture offers the ability to show all the processing steps that a packet takes, the outcomes, and whether the traffic is blocked or allowed. This allows users to initiate and display output of tracing from the Firepower Management Center. The tracing information includes information from SNORT and preprocessors about verdicts and action taken while processing a packet.

- Firepower Threat Defense

Features for Version 6.2.0: Architecture

New Feature

Description

Supported Platforms

Integrated Routing and Bridging (IRB)

Customers often want to have multiple physical interfaces configured to be part of the same VLAN. The IRB feature meets this demand by allowing users to configure bridges in routed mode, and enables the devices to perform L2 switching between interfaces (including subinterfaces).

- Firepower Threat Defense on ASA 5506-X, ASA 5506W-X, ASA 5506H-X, ASA 5508-X ASA 5512-X, ASA 5515-X, ASA 5516-X, ASA 5525-X, ASA 5545-X, or ASA 5555-X

- Firepower Threat Defense on Firepower 4100 Series

- Firepower Threat Defense on Firepower 9300

Interchassis Clustering

Clustering lets you group multiple FXOS chassis Firepower Threat Defense devices together as a single logical device. A cluster provides all the convenience of a single device (management and integration into a network) while achieving the increased throughput and redundancy of multiple devices. Firepower Version 6.2.0 supports clustering across multiple chassis (interchassis clustering), allowing for higher scalability. You can use the Firepower Management Center to automatically discover all nodes of a cluster.

- Firepower Threat Defense on Firepower 4100 Series

- Firepower Threat Defense on Firepower 9300 Appliances

Policy Change Improvement

Deploying policy changes to a Firepower Threat Defense device can result in restarting the SNORT process and the related loss of some packets. As part of a continuing effort to address this issue, Firepower Version 6.2.0 allows you to configure actions separately for fault conditions, such as SNORT Busy/Overload or SNORT Down. This feature allows you to emphasize either continuity or security by checking a checkbox option in the Firepower Management Center.

Firepower Threat Defense (inline mode only)

Features for Version 6.2.0: Platform/Integration

New Feature

Description

Supported Platforms

Firepower Threat Defense on Microsoft Azure

In Firepower Version 6.2.0, Cisco Firepower Threat Defense Virtual is available in the Microsoft Azure Marketplace. This new platform enables you to secure workloads consistently across the data center and public cloud. Managed centrally by an on-premises Firepower Management Center, Firepower Threat Defense Virtual provides advanced threat protection in the Azure environment without forcing customers to return traffic to the data center.

- Firepower Threat Defense virtual

Firepower Threat Grid API Key Integration

This feature streamlines the process of associating a Threat Grid account with your Firepower Management Center.

- Firepower Management Center

- 64-bit Firepower Management Center Virtual

ISE and SGT tags without Identity

Before Firepower Version 6.2.0, you had to create a realm and identity policy to perform user control based on ISE Security Group Tag (SGT) data, even if you did not want to configure passive authentication using ISE. In Firepower Version 6.2.0, you no longer need to create a realm or identity policy to perform user control based on ISE Security Group Tag (SGT) data.

- Firepower Management Center

- Firepower Management Center Virtual

- 7000 and 8000 Series

- NGIPSv

- ASA with FirePOWER Services

- Firepower Threat Defense

- Firepower Threat Defense Virtual

TS Agent (VDI Identity Support)

To design policies that enforce rules based on the user’s identity, you must be able to identify the user correctly. This is a problem in a shared environment, where multiple users are using the same IP address, identifying which user certain traffic applies to becomes difficult.

Firepower now provides the ability to better identify individual users in shared environments, such as Citrix’s Virtual Desktop Infrastructure (VDI), to accurately enforce user-based policy rules on the firewall.

Rather than just associating a user with an IP address, Firepower now associates the user with both the IP address and a port range combination through the use of a new agent deployed on the Windows Terminal Server. The Cisco Terminal Services Agent (TS Agent) intercepts every log in to the terminal server and assigns a port range to every user that logs in. Using RESTful APIs it communicates this information (user, IP address and port range) to the Firepower Management Center, which in turn communicates it to the individual Firepower Threat Defense devices.

Now, when User 1 logs in, Firepower Threat Defense devices not only see the IP address, but also know the port range assigned to the user. Based on the IP address and the port range, Firepower Threat Defense devices properly map the traffic to User 1. When User 2 logs in, a new port range is assigned which enables the Firepower Threat Defense devices to map the appropriate traffic to that user while applying any specific policy rules to that user and their traffic.

- Firepower Management Center

- Firepower Management Center Virtual

Features for Version 6.2.0: Firepower Threat Defense and Threat

New Feature

Description

Supported Platforms

Site-to-Site VPN

The site-to-site VPN with public key infrastructure (PKI) support is an addition to the current capability of site-to-site VPN with preshared keys. The Firepower Device Manager (FDM) also allows you to configure site-to-site VPN with pre shared keys.

- Firepower Threat Defense managed by Firepower Management Center

- Firepower Threat Defense Virtual

PKI Support for Firepower Management Center

PKI is required to create certificate-based trusted identities for devices establishing site-to-site VPN tunnels. This feature allows you to associate PKI certificate data with devices on the Firepower Management Center.

- Firepower Threat Defense

- Firepower Threat Defense Virtual

User-based Indications of Compromise (IOCs)

This feature allows you to generate user-based IOCs from intrusion events or view the associations of users and IOCs. You can also enable and disable eventing of a given IOC per user (against false positives). With this feature, you can correlate IOCs and events to both hosts and users and give them more visibility and alerting options on a per-user basis.

- Firepower Management Center

- 64-bit Firepower Management Center Virtual

- 7000 and 8000 Series

- NGIPSv

- ASA with FirePOWER Services

- Firepower Threat Defense managed by Firepower Management Center

- Firepower Threat Defense Virtual

URL Lookups

This feature allows you to perform a bulk lookup of URLs (up to 250 URLs at a time) to obtain information such as reputation, category, and matching policy. You can also export the results as a file of comma-separated values.

The feature reduces the manual work necessary to determine if your organization is protected against a malicious URL or if you should add a custom rule for a specific IOC. You can use this feature to reduce the number of custom rules, which in turn reduces the chance of performance degradation due to extensive custom rule lists.

- Firepower Management Center Virtual

- 64-bit Firepower Management Center Virtual

FlexConfig

The FlexConfig feature allows you use the Firepower Management Center to deploy ASA CLI template-based functionality to Firepower Threat Defense devices. This feature allows you to enable some of the most valuable ASA functions that are not currently available on Firepower Threat Defense devices. This functionality is structured as templates and objects that work together in a policy. The default templates are officially supported by Cisco TAC.

The targeted features unlocked by FlexConfig potentially include:

- Non-Inspection Templates:

- Routing (EIGRP, PBR, and IS-IS)

- Netflow (NSEL) export

- MPF connection limits, timeouts (including DCD), and Normalizer settings

- Platform sysopt commands

- Proxy ARP Neighbor Discovery (sysopt noproxyarp interface)

- IPv6 Prefix Delegation

- IPV6

- WCCP

- VXLAN

- Application Layer Inspection Templates:

- ALGs default configuration

- GTPv1/v2 support

- Diameter inspection

- LISP inspection

- SCTP support and inspection

- SIP

- SS7 inspection

- Firepower Threat Defense

- Firepower Threat Defense Virtual

Changed Functionality in Version 6.2.0

Version 6.2.0

- Version 6.2.0 introduces new functionality related to latency-based performance settings in access control policies. In Version 6.2.0 and later, by default, new access control policies obtain latency-based performance settings from the latest intrusion rule update. You can choose to overwrite these settings with custom settings. For more information, see "Latency-Based Performance Setting Configuration” in the Firepower Management Center Configuration Guide.

When you update to Version 6.2.0, the system determines whether existing access control policies use default or custom latency-based performance settings and continues as appropriate under the following conditions:

- If existing policies use default settings, the system sets the Apply Settings From option to Installed Rule Update. When you deploy the access control policy, the system obtains the latency-based performance settings from the latest intrusion rule update and uses them in that policy.

- If existing policies do not use default settings, the system sets the Apply Settings From option to Custom and retains the preupgrade settings.

- Version 6.2.0 does not support international characters in URLS for URL objects or inline values in access control policy rules. (CSCux24338)

- Private keys are no longer mandatory when importing certificates. (CSCvb13045)

- Generated troubleshoot now includes captive portal information. (CSCvb26174)

- If you create an access control policy or NAT policy referencing an object or object group that contains an invalid character in the name, the system now generates an Unsupported object names are used in the policy for devices error message and does not save the policy. (CSCvb29308)

- The ASA-to-Firepower Threat Defense migration process failed if the ASA configuration file included an access list entry (ACE) with an interface object configured as source network, destination network, or both. Now, the migration tool converts this ASA configuration to a disabled Firepower Threat Defense rule. (CSCvb49745)

Chapter 5. Terminology and Documentation for Version 6.2.0.x

- Product Terminology and Branding in Version 6.2.0.x

- Documentation for Version 6.2.0.x

- Known Documentation Issues in Version 6.2.0.x

Product Terminology and Branding in Version 6.2.0.x

The terminology and branding used in Version 6.2.0.x may differ from the terminology used in previous releases as summarized in the following table. See the Firepower System Compatibiltiy Guide for more information about terminology and branding changes.

Product Terminology and Branding

Name

Description

Firepower System

Firepower

Refers to the product line.

Firepower Management Center

Management Center

Refers to Firepower management software running on physical or virtual Firepower platforms.

Cisco ASA with FirePOWER Services

ASA device running an ASA FirePOWER module

ASA FirePOWER module

Refers to Firepower software running on an ASA operating system installed on an ASA platform.

ASA FirePOWER module managed with ASDM

Refers to ASA FirePOWER module local configuration interface accessible with ASDM.

Firepower Threat Defense

Refers to Firepower Threat Defense software running on a Firepower operating system installed on an ASA, Firepower 9300 appliance, Firepower 4100 series, or virtual platform.

Firepower Device Manager

Refers to Firepower Threat Defense local configuration interface accessible with specific Firepower Threat Defense platforms.

Documentation for Version 6.2.0.x

The following documents were updated for Version 6.2.0.x to reflect the addition of new features and functionality and to address reported documentation issues:

For additional information about updating and configuring your system, see the documents in the Cisco Firepower System Documentation Roadmap.

For parallel ASA versions, see the ASA documentation roadmap and release notes (including known issues).

For the FXOS documentation roadmap and release notes (including known issues) for parallel FXOS versions, see the Cisco FXOS Documentation roadmap.

Known Documentation Issues in Version 6.2.0.x

- The Cisco ASA with FirePOWER Services Local Management Configuration Guide refers to creating new, custom access control and system policies. ASA with FirePOWER Services does not support multiple custom policies. Instead, edit and deploy the system-provided policies.

- The Firepower Management Center Configuration Guide does not state that if you deploy an access control rule, SSL rule, or identity rule with geolocation network conditions and the system detects an IP address that appears to be moving from country to country, the system incorrectly reports the continent rule as unknown country.

- The Cisco ASA with FirePOWER Services Local Management Configuration Guide states After you establish remote management and register the Cisco ASA with FirePOWER Services to a Firepower Management Center, you must manage the ASA FirePOWER module from the Firepower Management Center instead of ASDM but does not state that once remote management is established, you cannot access ASA FirePOWER configuration with the ASDM manager.

Chapter 6. Product Compatibility in Version 6.2.0.x

- Integrated Product Compatibility

- Web Browser Compatibility in Version 6.2.0.3

- Web Browser Compatibility in Version 6.2.0.2

- Web Browser Compatibility in Version 6.2.0.1

- Screen Resolution Compatibility

Integrated Product Compatibility

The required versions for the following integrated products vary by Firepower version:

- Cisco Identity Services Engine (ISE)

- Cisco AMP Threat Grid

- Cisco Firepower System User Agent

For more information about the required versions, see the Firepower System Compatibility Guide.

Web Browser Compatibility in Version 6.2.0.3

Firepower web UI for Version 6.2.0.3 have been tested on the browsers listed in the following table:

Caution

The Chrome browser does not cache static content, such as images, CSS, or Javascript, with the system-provided self-signed certificate. This may cause the system to redownload static content when you refresh. To avoid this, add a self-signed certificate to the trust store of the browser/OS or use another web browser.

Supported Web Browsers

Browser

Required Enabled Options and Settings

Google Chrome 60

JavaScript, cookies

Mozilla Firefox 55

JavaScript, cookies, TLS v1.1 or v1.2

Note:
If you use a self-signed certificate on the Firepower Management Center and the Login screen takes a long time to load, enter about:support in a Firefox web browser search bar and click Refresh Firefox. Note that you may lose existing Firefox settings when you refresh Firefox. For more information, see Click Here .The Firepower Management Center uses a self-signed certificate by default; we recommend that you replace that certificate with a certificate signed by a trusted certificate authority. For more information on replacing server certificates, see the section on system configuration in the Firepower Management Center Configuration Guide for your version.

Microsoft Internet Explorer 10 and 11

JavaScript, cookies, TLS v1.1 or v1.2, 128-bit encryption, Active scripting security setting, Compatibility View, set Check for newer versions of stored pages to Automatically

Note:
If you use the Microsoft Internet Explorer 11 browser, you must disable Include local directory path when uploading files to server in your Internet Explorer settings through Tools > Internet Options > Security > Custom level ....

Apple Safari 8 and 9

—

Microsoft Edge

—

Web Browser Compatibility in Version 6.2.0.2

Firepower web UI for Version 6.2.0.2 have been tested on the browsers listed in the following table:

Caution

The Chrome browser does not cache static content, such as images, CSS, or Javascript, with the system-provided self-signed certificate. This may cause the system to redownload static content when you refresh. To avoid this, add a self-signed certificate to the trust store of the browser/OS or use another web browser.

Supported Web Browsers

Browser

Required Enabled Options and Settings

Google Chrome 57

JavaScript, cookies

Mozilla Firefox 53

JavaScript, cookies, TLS v1.1 or v1.2

Note:
If you use a self-signed certificate on the Firepower Management Center and the Login screen takes a long time to load, enter about:support in a Firefox web browser search bar and click Refresh Firefox. Note that you may lose existing Firefox settings when you refresh Firefox. For more information, see Click Here .The Firepower Management Center uses a self-signed certificate by default; we recommend that you replace that certificate with a certificate signed by a trusted certificate authority. For more information on replacing server certificates, see the section on system configuration in the Firepower Management Center Configuration Guide for your version.

Microsoft Internet Explorer 10 and 11

JavaScript, cookies, TLS v1.1 or v1.2, 128-bit encryption, Active scripting security setting, Compatibility View, set Check for newer versions of stored pages to Automatically

Note:
If you use the Microsoft Internet Explorer 11 browser, you must disable Include local directory path when uploading files to server in your Internet Explorer settings through Tools > Internet Options > Security > Custom level ....

Apple Safari 8 and 9

—

Microsoft Edge

—

Web Browser Compatibility in Version 6.2.0.1

Firepower web UI for Version 6.2.0.1 have been tested on the browsers listed in the following table:

Caution

The Chrome browser does not cache static content, such as images, CSS, or Javascript, with the system-provided self-signed certificate. This may cause the system to redownload static content when you refresh. To avoid this, add a self-signed certificate to the trust store of the browser/OS or use another web browser.

Supported Web Browsers

Browser

Required Enabled Options and Settings

Google Chrome 56

JavaScript, cookies

Mozilla Firefox 52

JavaScript, cookies, TLS v1.1 or v1.2

Note:
If you use a self-signed certificate on the Firepower Management Center and the Login screen takes a long time to load, enter about:support in a Firefox web browser search bar and click Refresh Firefox. Note that you may lose existing Firefox settings when you refresh Firefox. For more information, see Click Here .The Firepower Management Center uses a self-signed certificate by default; we recommend that you replace that certificate with a certificate signed by a trusted certificate authority. For more information on replacing server certificates, see the section on system configuration in the Firepower Management Center Configuration Guide for your version.

Microsoft Internet Explorer 10 and 11

JavaScript, cookies, TLS v1.1 or v1.2, 128-bit encryption, Active scripting security setting, Compatibility View, set Check for newer versions of stored pages to Automatically

Note:
If you use the Microsoft Internet Explorer 11 browser, you must disable Include local directory path when uploading files to server in your Internet Explorer settings through Tools > Internet Options > Security > Custom level ....

Apple Safari 8 and 9

—

Microsoft Edge

—

Screen Resolution Compatibility

When you access user interfaces to manage Firepower, we recommend using the screen resolutions in the table below. The user interfaces are compatible with lower resolutions, but a higher resolution optimizes the display.

Recommended Screen Resolutions by Web Interface

Web Interface

Recommended Screen Resolution

Firepower Management Centers

At least 1280 pixels wide

7000 and 8000 Series devices

ASDM (managing ASA FirePOWER)

1024 pixels wide by 768 pixels high

Firepower Device Manager (managing Firepower Threat Defense)

1024 pixels wide by 768 pixels high

Chapter 7. Update vs. Reimage vs. Deploy

In most cases, it is best to perform a traditional update from Version 6.2.0 to Version 6.2.0.x as described in Update Paths to Version 6.2.0.x.

However, the following cases require you to reimage and/or deploy your appliance:

- If you are moving from ASA with FirePOWER Services to Firepower Threat Defense, you must reimage your ASA device to deploy Firepower Threat Defense.

- If you are recreating a Firepower Threat Defense Virtual device in a different environment than before, you must redeploy your virtual platform to Firepower Threat Defense. For example, if you were using VMware before and now want to deploy in AWS, you must redeploy rather than update.

- If you are unable or disinclined to follow the required update path as described in Update Paths to Version 6.2.0.x, you must reimage and/or deploy your appliance.

In rare cases, you may need to reimage your device. You must reimage to Version 6.2.0 only; see Firepower Release Notes Version 6.2.0.

Chapter 8. Important Update Notes

Before you begin the update process to Version 6.2.0.x, you should familiarize yourself with the behavior of the system during the update process, as well as with any compatibility issues or required pre- or post update configuration changes.

Caution

Do not reboot or shut down your appliance during the update until you see the login prompt. The system may appear inactive during the prechecks; this is expected behavior and does not require you to reboot or shut down your appliance.

- Update Paths to Version 6.2.0.x

- Update Interface Options

- Update Sequence Guidelines

- Preupdate Readiness Checks

- Pre-Update Configuration and Event Backups

- Traffic Flow and Inspection During the Update

- Time and Disk Space Requirements for Updating to Version 6.2.0.3

- Time and Disk Space Requirements for Updating to Version 6.2.0.2

- Time and Disk Space Requirements for Updating to Version 6.2.0.1

- Post Update Tasks

Update Paths to Version 6.2.0.x

Firepower Management Center Update Paths

The following table describes update paths for Firepower Management Centers, including Firepower Management Center Virtual:

Firepower Management Center Platform

Update Path

MC750, MC1000, MC1500, MC2000, MC2500, MC3500, MC4000, MC4500

Firepower Management Center Virtual: VMware

Version 5.4.1.1+ > Version 6.0.0 Pre-Installation Package > Version 6.0.0 > Version 6.0.1 Preinstall > Version 6.0.1 > Version 6.1.0 Pre-Installation Package > Version 6.1.0 > Version 6.2.0

Firepower Management Center Virtual: AWS

Version 6.0.1 > Version 6.1.0 Pre-Installation Package > Version 6.1.0 > Version 6.2.0

Firepower Management Center Virtual: KVM

Version 6.1.0 > Version 6.2.0

Firepower Threat Defense Update Paths—With Firepower Management Center

This table describes update paths for Firepower Threat Defense devices managed by a Firepower Management Center.

Firepower Threat Defense Platform

Update Path

ASA 5506-X, ASAS 5506H-X, ASA 5506W-X, ASA 5508-X, 16-X

ASA 5512-X, ASA 5515-X, ASA 5525-X, ASA 5545-X, ASA 5555-X

Firepower Threat Defense Virtual: VMware

Firepower Threat Defense Virtual: AWS

Firepower 4110, 4120, 4140

Firepower 9300 with SM-24, SM-36, or SM-44 modules

Version 6.0.1 > Version 6.1.0 Pre-Installation Package > Version 6.1.0 > Version 6.2.0

Firepower Threat Defense Virtual: KVM

Firepower 4150

Version 6.1.0 > Version 6.2.0

Firepower Threat Defense Virtual: Azure

Version 6.2.0

Firepower Threat Defense Update Paths—With Firepower Device Manager

This table describes update paths for Firepower Threat Defense devices managed by Firepower Device Manager.

Firepower Threat Defense Platform

Update Path

ASA 5506-X, ASA 5506H-X, ASA 5506W-X, ASA 5508-X, ASA 5516-X

ASA 5512-X, ASA 5515-X, ASA 5525-X, ASA 5545-X, ASA 5555-X

Version 6.1.0 > Version 6.2.0

NGIPS Update Paths—With Firepower Management Center

This table describes update paths for NGIPS devices (including ASA FirePOWER modules) managed by a Firepower Management Center.

NGIPS Platform

Update Path

Firepower 7010, 7020, 7030, 7050, 7110, 7115, 7120, 7125

Firepower 8120, 8130, 8140, 8250, 8260, 8270, 8290, 8350, 8360, 8370, 8390

AMP7150, AMP8050, AMP8150, AMP8350, AMP8360, AMP8370, AMP8390

ASA FirePOWER: ASA 5512-X, ASA 5515-X, ASA 5525-X, ASA 5545-X, ASA 5555-X

ASA FirePOWER: ASA 5585-X-SSP-10, ASA 5585-X-SSP-20, ASA 5585-X-SSP-40, ASA 5585-X-SSP-60

NGIPSv: VMware

Version 5.4.0.2 > Version 6.0.0 Pre-Installation Package > Version 6.0.0 > Version 6.0.1 Preinstall > Version 6.0.1 > Version 6.1.0 Pre-Installation Package > Version 6.1.0 > Version 6.2.0

ASA FirePOWER: ASA 5506-X, ASA 5506H-X, ASA 5506W-X, ASA 5508-X, ASA 5516-X

Version 5.4.1.1 > Version 6.0.0 Pre-Installation Package > Version 6.0.0 > Version 6.0.1 Preinstall > Version 6.0.1 > Version 6.1.0 Pre-Installation Package > Version 6.1.0 > Version 6.2.0

NGIPS Update Paths—ASA FirePOWER with ASDM

This table describes update paths for ASA FirePOWER modules managed by ASDM.

ASA FirePOWER NGIPS Platform

Update Path

ASA 5506-X, ASA 5506H-X, ASA 5506W-X, ASA 5508-X, ASA 5516-X

Version 5.4.1.1 > Version 6.0.0 Pre-Installation Package > Version 6.0.0 > Version 6.0.1 Preinstall > Version 6.0.1 > Version 6.1.0 Pre-Installation Package > Version 6.1.0 > Version 6.2.0

ASA 5512-X, ASA 5515-X, ASA 5525-X, ASA 5545-X, ASA 5555-X

ASA 5585-X-SSP-10, ASA 5585-X-SSP-20, ASA 5585-X-SSP-40, ASA 5585-X-SSP-60

Version 6.0.0 > Version 6.0.1 Preinstall > Version 6.0.1 > Version 6.1.0 Pre-Installation Package > Version 6.1.0 > Version 6.2.0

Update Interface Options

If you are locally managing the ASA FirePOWER module with ASDM, use the ASDM to perform the update. To configure the ASA FirePOWER module through ASDM, see the Cisco ASA with FirePOWER Services Local Management Configuration Guide.

If you are locally managing a Firepower Threat Defense device with the Firepower Device Manager, use the Firepower Device Manager to update your Firepower Threat Defense device. To configure the Firepower Device Manager, see the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager.

Otherwise, use the Firepower Management Center to update first the Firepower Management Center and then the devices it manages. To configure the Firepower Management Center or its managed devices, see the Firepower Management Center Configuration Guide.

For more information about management, see Management Capability in Version 6.2.0.x.

Update Sequence Guidelines

Update your Firepower Management Center to at least Version 6.2.0 before updating the devices it manages. Then, use the Firepower Management Center to redeploy policies to all managed devices before updating those devices to Version 6.2.0.x.

Note the following update sequence complications when you have high availability or device stacking configured:

- Update Sequence for Firepower Management Centers in High Availability

- Update Sequence for Firepower Threat Defense Devices in High Availability

- Update Sequence for Clustered Firepower Threat Defense Devices

- Update Sequence for 7000 and 8000 Series Devices in High Availability

- Update Sequence for Stacked 8000 Series Devices

Update Sequence for Firepower Management Centers in High Availability

To ensure continuity of operations, do not simultaneously update Firepower Management Centers in a high availability pair. The following steps allow you to safely update the pair.

Step 1

Pause the synchronization of the active Firepower Management Center of the high availability pair on the High Availability tab of the Integration page ( System > Integration) as described in the Pausing Communication Between Paired Firepower Management Centers topic in the Firepower Management Center Configuration Guide, Version 6.2.0.

Step 2

Update the standby Firepower Management Center in the high availability pair.
The Firepower Management Center switches from standby to active so both Firepower Management Centers in the high availability pair are active.

The update completes.

Step 3

Update the other Firepower Management Center within the pair.
The update is complete.

Step 4

Click Make-Me-Active on the High Availability tab of one of the Firepower Management Center web UIs.
The Firepower Management Center you do not make active automatically switches to standby mode.

Caution:
Policy changes during the update process may be lost when reestablishing high availability depending on which appliance you choose to be active after upgrade.

If you register a managed device and deploy policies to a Firepower Management Center in a high availability scenario where both appliances are active, this deployment is not supported. Before you resolve a pair of active Firepower Management Centers, you must export any policies and unregister any managed devices from the standby Firepower Management Center. You may then register the managed devices and import the policies to the active Firepower Management Center.

Step 5

Restart the communication as described in the Restarting Communication Between Paired Firepower Management Centers topic of the Firepower Management Center Configuration Guide, Version 6.2.0.

Update Sequence for Firepower Threat Defense Devices in High Availability

Update the FXOS chassis of Firepower Threat Defense devices in a high availability pair to the most recent compatible FXOS version before installing the most recent Firepower version. For more information on FXOS versions, see the Firepower System Compatibility Guide.

Caution

You must always update the FXOS version on the standby device of a Firepower Threat Defense high availability pair. Do not update the FXOS version of the active device.

Step 1

Update the FXOS version on the standby Firepower Threat Defense device within the high availability pair.

Step 2

Switch the active peer, so the standby Firepower Threat Defense device is now the active device.

Step 3

Update the FXOS version on the standby Firepower Threat Defense device within the high availability pair.

What to Do Next

Update the Firepower Threat Defense high availabiltiy pair to the most recent Firepower version.

When you install a Firepower update on Firepower Threat Defense devices in a high availability pair, the devices update one at a time. When the update starts, Firepower first applies it to the standby device, which goes into maintenance mode until any necessary processes restart and the device is processing traffic again. Once the standby Firepower Threat Defense update is complete, the active Firepower Threat Defense automatically fails over to standby mode and then updates.

Update Sequence for Clustered Firepower Threat Defense Devices

When you update clustered Firepower 9300 or Firepower 4100 series devices running Firepower Threat Defense, the system updates the security modules one at a time—first the secondary security modules, then the primary security module. Modules operate in maintenance mode while they update.

During the primary security module update, although traffic inspection and handling continues normally, the system stops logging events. Event logging resumes after the full update is completed.

Caution

Updating FXOS reboots the device, which can affect traffic in a clustered environment until at least one module comes online. In an intra-chassis cluster, traffic drops if the cluster does not use an optional hardware bypass (fail‑to‑wire) module or if bypass is disabled. Traffic passes without inspection if bypass is enabled. In an inter‑chassis cluster, traffic drops during the reboot if chassis reboots overlap before at least one module comes online; traffic is unaffected if there is no reboot overlap.

For more information, see the Firepower Threat Defense Cluster for the FXOS Chassis chapter of the Firepower Management Center Configuration Guide and the About Clustering on the FXOS Chassis chapter of the Cisco FXOS Firepower Chassis Manager Configuration Guide.

Events for traffic processed during the logging downtime appear with out-of-sync timestamps after the update is complete. However, if the logging downtime was significant, the system may prune the oldest events before they can be logged.

Update Sequence for 7000 and 8000 Series Devices in High Availability

Note

You cannot locally update 7000 and 8000 Series devices in a high availability pair. You must update from the managing Firepower Management Center.

When you install an update on 7000 and 8000 Series devices in a high availability pair, the system updates the devices one at a time. When the update starts, the system first applies it to the standby device, which goes into maintenance mode until any necessary processes restart and the device is processing traffic again. The system then updates the active device, which follows the same process.

Update Sequence for Stacked 8000 Series Devices

When you install an update on 8000 Series stacked devices, Firepower updates the stacked devices simultaneously. Each device resumes normal operation when the update is complete. Note the following scenarios:

- If the active device completes the update before all of the standby devices, the stack operates in a limited, mixed-version state until all devices have completed the update.

- If the active device completes the update after all of the standby devices, the stack resumes normal operation when the update is complete on the active device.

Preupdate Readiness Checks

System update readiness checks contain a series of robustness checks that assess the preparedness of the system for an update. The readiness check identifies issues with the system, including issues with the integrity of the database, version inconsistencies, and device registration.

While the readiness check is optional, we strongly recommend launching a readiness check before you update.

Note

The readiness check cannot assess your preparedness for VDB, SRU, or GeoDB updates; the readiness check is a system update readiness check.

You must upload the update package and run the readiness check through the shell or Firepower Management Center web interface BEFORE updating the appliances. The readiness check cannot execute if the update package is not uploaded to the managing Firepower Management Center. If your appliance fails the readiness check, correct the issues and run the readiness check again. See Run a Readiness Check through the Shell and Run a Readiness Check through the Firepower Management Center Web Interface for more information.

Caution

Do not reboot or shut down your appliance during the readiness check.

Caution

If you encounter issues with the readiness check that you cannot resolve, do not begin the update. Instead, contact Cisco TAC.

- Run a Readiness Check through the Shell

- Run a Readiness Check through the Firepower Management Center Web Interface

Run a Readiness Check through the Shell

You can run a readiness check through the shell on any appliance running Version 6.1.0 and later. Note that you cannot update directly from Version 6.1.0 to Version 6.2.0.x. For more information, see the Update Paths to Version 6.2.0.x. The time required to run the readiness check varies depending on your appliance model and database size.

Step 1

Download the update from the Support site.

Note:
Download the update package directly from the Support site. If you transfer an update file by email, it may become corrupted.

Step 2

Upload the update package to the appliance.

Step 3

Redeploy configuration changes to any managed devices. Otherwise, the eventual update of the managed devices may fail.

Step 4

Access the shell through the CLI for your appliance as a user with administrator privileges.

Step 5

At the prompt, run the readiness check as the root user, where updatefilename is the name of the update you downloaded:
sudo install_update.pl --readiness-check /var/sf/updates/updatefilename

Step 6

Monitor the progress of the readiness check in the command prompt window. When the readiness check is complete, the system reports the success or failure in the command prompt window.

Step 7

Access the full readiness check report in /var/log/sf/$rpm_name/upgrade_readiness, where $rpm_name is the truncated update package name.

Run a Readiness Check through the Firepower Management Center Web Interface

You can use the web interface on a Firepower Management Center running Version 6.1.0 and later to run a readiness check to assess the preparedness of the Firepower Management Center's managed devices for the update.

Note

The readiness check feature does not support clustered, stacked, clustered stacks, or devices in high availability pairs.

The time required to run the readiness check varies depending on your appliance model and database size.

Step 1

Download the update from the Support site.

Note:
Download the update package directly from the Support site. If you transfer an update file by email, it may become corrupted.

Step 2

Upload the update package to the Firepower Management Center.

Step 3

Redeploy configuration changes to any managed devices. Otherwise, the eventual update of the managed devices may fail.

Step 4

On the Firepower Management Center's System > Updates window, click the install icon next to the update you want to run the readiness check.

Step 5

Choose the appliances you want to, and click Launch Readiness Check.

Step 6

Monitor the progress of the readiness check in the command prompt window. When the readiness check is complete, the system reports the success or failure in the Readiness Check Status window.

Step 7

Access the full readiness check report in /var/log/sf/$rpm_name/upgrade_readiness.

Pre-Update Configuration and Event Backups

Before you begin the update, we strongly recommend that you back up current event and configuration data to an external location. If you back up to an external location, verify the external backup is successful before updating the system.

The Firepower Management Center purges locally stored backups from previous updates. To retain archived backups, store the backups externally. Use the Firepower Management Center to back up event and configuration data for itself and the devices it manages. For more information on the backup and restore feature, see the Firepower Management Center Configuration Guide.

Use the Firepower Device Manager to back up event and configuration data for the device it manages. For more information on the backup and restore feature, see the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager.

Traffic Flow and Inspection During the Update

When you update your sensing devices, traffic either drops throughout the update or traverses the network without inspection depending on how your devices are configured and deployed: routed or transparent, inline vs passive, bypass mode settings, and so on. We strongly recommend performing the update in a maintenance window or at a time when the interruption will have the least impact on your deployment.

Note

When you update devices in a high availability pair, the system performs the update one device at a time to avoid traffic interruption.

This section discusses traffic behavior during the followng update stages:

- The update itself, including related reboots

- FXOS updates on clustered Firepower Threat Defense devices

- Configuration deployments after the update

Traffic Behavior During the Update

The following table describes how updates, including related device reboots, affect traffic flow for different deployments. Note that switching, routing, NAT, and VPN are not performed during the update process, regardless of how you configure any inline sets.

Update Traffic Behavior

Device

Deployment

Traffic Behavior

Firepower Threat Defense

inline with optional hardware bypass module, bypass enabled (Bypass: Standby or Bypass‑Force)

passed without inspection

inline with optional hardware bypass module, bypass disabled (Bypass: Disabled)

dropped

Firepower Threat Defense

Firepower Threat Defense Virtual

inline with no hardware bypass module

dropped

inline in tap mode

egress packet immediately, copy not inspected

passive

uninterrupted, not inspected

7000 and 8000 Series

inline with optional hardware bypass module, bypass enabled (Bypass Mode: Bypass)

passed without inspection

Note that traffic is interrupted briefly at two points:

- At the beginning of the update process as link goes down and up (flaps) and the network card switches into hardware bypass.

- After the update finishes as link flaps and the network card switches out of bypass. Inspection resumes after the endpoints reconnect and reestablish link with the device interfaces.

The hardware bypass option is not supported on nonbypass network modules on Firepower 8000 Series devices, or SFP transceivers on Firepower 7000 Series.

inline with optional hardware bypass module, bypass disabled (Bypass Mode: Non‑Bypass)

dropped

7000 and 8000 Series

NGIPSv

inline with no hardware bypass module

dropped

inline in tap mode

egress packet immediately, copy not inspected

passive

uninterrupted, not inspected

routed, switched

dropped

ASA FirePOWER

routed or transparent, fail-open (Permit Traffic)

passed without inspection

(requires the latest supported ASA OS version; otherwise, traffic dropped)

routed or transparent, fail-close (Close Traffic)

dropped

Caution

Rebooting the ASA FirePOWER module on an ASA 5585-X, including a reboot that occurs during a module upgrade, causes traffic to drop for up to thirty seconds on the interfaces on the ASA FirePOWER hardware module while the module reboots.

Traffic Behavior When Updating FXOS on Clustered Firepower Threat Defense Devices

Updating FXOS reboots the chassis, which can affect traffic in a clustered environment until at least one module comes online. Whether and how traffic is affected depends on the cluster type:

- Intra-chassis cluster—Traffic drops if the cluster does not use an optional hardware bypass (fail‑to‑wire) module or if bypass is disabled. Traffic passes without inspection if bypass is enabled.

- Inter-chassis cluster—Traffic drops during the overlap if multiple chassis reboots overlap before at least one module comes online. Traffic is unaffected if there is no reboot overlap.

For example, there would be no reboot overlap, and no dropped traffic, if you complete the FXOS update first on one chassis and then on another. Depending on when each update is initiated, there could be reboot overlap (and dropped traffic) if you update multiple chassis simultaneously.

The following table summarizes this behavior.

Traffic Behavior During an FXOS Update of Clustered Firepower Threat Defense Devices

Device Model

Deployment

Traffic Behavior

Firepower 9300

intra-chassis cluster without optional hardware bypass module

dropped

intra-chassis cluster with optional hardware bypass module, bypass disabled

dropped

intra-chassis cluster with optional hardware bypass module, bypass enabled

passed without inspection

Firepower 9300

Firepower 4100 Series

inter-chassis cluster with no reboot overlap

unaffected

inter-chassis cluster with reboot overlap before at least one module comes online

dropped

Traffic Behavior During Configuration Deployment

During the upgrade process, you deploy configurations either twice (standalone devices) or three times (devices managed by the Firepower Management Center). When you deploy, resource demands may result in a small number of packets dropping without inspection. In most cases, the deployment immediately after the upgrade restarts the Snort process. During subsequent deployments, the Snort process restarts only if, before deploying, you modify specific policy or device configurations that always restart the process when deployed. See the configuration guide for your platform for configurations that restart the Snort process.

The following table describes how different devices handle traffic during Snort process restarts. Note that traffic during the restart is handled essentially the same as during an upgrade. An exception is that whether traffic drops or passes in inline deployments is influenced by software bypass settings instead of hardware bypass settings.

Restart Traffic Effects by Managed Device Model

Device Model

Interface Configuration

Restart Traffic Behavior

7000 and 8000 Series, NGIPSv

inline, Failsafe enabled or disabled

passed without inspection

A few packets might drop if Failsafe is disabled and Snort is busy but not down.

inline, tap mode

egress packet immediately, copy bypasses Snort

passive

uninterrupted, not inspected

7000 and 8000 Series

routed, switched, transparent

dropped

Firepower Threat Defense, Firepower Threat Defense Virtual

inline, Snort Fail Open: Down: disabled

dropped

inline, Snort Fail Open: Down: enabled

passed without inspection

routed, transparent (including EtherChannel, redundant, subinterface)

dropped

ASA FirePOWER

routed or transparent with fail-open (Permit Traffic)

passed without inspection

routed or transparent with fail-close (Close Traffic)

dropped

Time and Disk Space Requirements for Updating to Version 6.2.0.3

The following table provides disk space and time guidelines for the update. Note that when you use the Firepower Management Center to update a managed device, the Firepower Management Center requires additional disk space on its /Volume partition.

Caution

Do not reboot or shut down your appliance during the update until you see the login prompt. The system may appear inactive during the prechecks; this is expected behavior and does not require you to reboot or shut down your appliance.

Note

The following guidelines do not include the time required to complete the readiness check. For more information about the readiness check, see Preupdate Readiness Checks.

If you encounter issues with the progress of your update, contact Cisco TAC.

Time and Disk Space Requirements

Appliance

Space on /

Space on /Volume

Space on /Volume on Manager

Time to Update From Version 6.2.0

Time to Update from Version 6.2.0.2

Firepower Management Center

18 MB

3352 MB

668 MB

75 minutes

37 minutes

Firepower Management Center Virtual

19 MB

3342 MB

668 MB

hardware dependent

7000 and 8000 Series managed device

17 MB

3526 MB

554 MB

38 minutes

19 minutes

NGIPSv device

17 MB

842 MB

202 MB

hardware dependent

ASA FirePOWER module

3361 MB

15 MB

521 MB

3 hours

97 minutes

Cisco ASA with Firepower Threat Defense

2302 MB

131 MB

384 MB

118 minutes

76 minutes

Firepower 9300 appliance running Firepower Threat Defense

1355 MB

—

319 MB

18 minutes

12 minutes

Firepower 4100 series security appliance running Firepower Threat Defense

1361

—

319 MB

20 minutes

12 minutes

Firepower Threat Defense Virtual device

17 MB

842 MB

384 MB

hardware dependent

Time and Disk Space Requirements for Updating to Version 6.2.0.2

The following table provides disk space and time guidelines for the update. Note that when you use the Firepower Management Center to update a managed device, the Firepower Management Center requires additional disk space on its /Volume partition.

Caution

Do not reboot or shut down your appliance during the update until you see the login prompt. The system may appear inactive during the prechecks; this is expected behavior and does not require you to reboot or shut down your appliance.

Note

The following guidelines do not include the time required to complete the readiness check. For more information about the readiness check, see Preupdate Readiness Checks.

If you encounter issues with the progress of your update, contact Cisco TAC.

Time and Disk Space Requirements

Appliance

Space on /

Space on /Volume

Space on /Volume on Manager

Time to Update From Version 6.2.0

Time to Update from Version 6.2.0.1

Firepower Management Center

35 MB

1665 MB

428 MB

36 minutes

30 minutes

Firepower Management Center Virtual

21 MB

2834 MB

428 MB

hardware dependent

7000 and 8000 Series managed device

17 MB

2110 MB

458 MB

54 minutes

35 minutes

NGIPSv device

19 MB

612 MB

195 MB

hardware dependent

ASA FirePOWER module

17 MB

2014 MB

383 MB

40 minutes

80 minutes

Cisco ASA with Firepower Threat Defense

144 MB

1808 MB

295 MB

95 minutes

59 minutes

Firepower 9300 appliance or Firepower 4100 series security appliance running Firepower Threat Defense

1060 MB

1060 MB

274 MB

12 minutes

9 minutes

Firepower Threat Defense Virtual device

143 MB

998 MB

295 MB

hardware dependent

Time and Disk Space Requirements for Updating to Version 6.2.0.1

The following table provides disk space and time guidelines for the update. Note that when you use the Firepower Management Center to update a managed device, the Firepower Management Center requires additional disk space on its /Volume partition.

Caution

Do not reboot or shut down your appliance during the update until you see the login prompt. The system may appear inactive during the prechecks; this is expected behavior and does not require you to reboot or shut down your appliance.

Note

The following guidelines do not include the time required to complete the readiness check. For more information about the readiness check, see Preupdate Readiness Checks.

If you encounter issues with the progress of your update, contact Cisco TAC.

Time and Disk Space Requirements

Appliance

Space on /

Space on /Volume

Space on /Volume on Manager

Time to Update From Version 6.2.0

Firepower Management Center

49.5 MB

1236.9 MB

218.3 MB

28 minutes

Firepower Management Center Virtual

22.8 MB

1488 MB

218.3 MB

hardware dependent

7000 and 8000 Series managed device

17.32 MB

1134 MB

184.4 MB

22 minutes

NGIPSv device

18.80 MB

720.8 MB

97.6 MB

hardware dependent

ASA FirePOWER module

16.78 MB

96.17 MB

205.8 MB

69 minutes

Cisco ASA with Firepower Threat Defense

143.33 MB

944.8 MB

158.2 MB

62 minutes

Firepower 9300 appliance or Firepower 4100 series security appliance running Firepower Threat Defense

524 MB

524 MB

136.8 MB

12 minutes

Firepower Threat Defense Virtual device

9.6 MB

143.6 MB

158.2 MB

hardware dependent

Post Update Tasks

After you perform the update on the Firepower Management Center or managed devices, you must deploy configuration changes to the devices.

Note

You must deploy configuration changes first after updating the Firepower Management Center and then again after updating its managed devices.

When you deploy configuration changes, resource demands may result in a small number of packets dropping without inspection. Additionally, deploying some configurations requires the Snort process to restart, which temporarily interrupting traffic inspection. Whether traffic drops during this interruption or passes without further inspection depends on the model of the managed device and how it handles traffic. For more information, see the Firepower Management Center Configuration Guide.

There are several additional post update steps you should take to ensure that your deployment is performing properly, which include the following include:

- Verify that the update succeeded.

- Make sure that all appliances in your deployment are communicating successfully.

- Update your intrusion rules and vulnerability database (VDB) and deploy configuration changes.

- Make configuration changes based on new features and functionality.

- Redeploy policies and configuration.

Chapter 9. Update to Version 6.2.0.x

Before you begin the update, you must thoroughly read and understand these release notes, especially Important Update Notes and Preupdate Readiness Checks.

- Update Procedures Listed by Platform

- Update Firepower Management Centers and Firepower Management Centers Virtual

- Update Firepower Threat Defense Devices Using the Firepower Management Center

- Update Firepower Threat Defense Devices with the Firepower Device Manager

- Update 7000 and 8000 Series Devices, NGIPSv, and ASA FirePOWER Modules Using the Firepower Management Center

- Update ASA FirePOWER Modules Managed with ASDM

Update Procedures Listed by Platform

If you want to update:

See:

Firepower Management Centers: MC750, MC1000, MC1500, MC2000, MC2500, MC3500, MC4000, MC4500

Update Firepower Management Centers and Firepower Management Centers Virtual

Firepower Management Center Virtual

7000 and 8000 Series devices: 7010, 7020, 7030, 7050, 7110, 7115, 7120, 7125, 8120, 8130, 8140, 8250, 8260, 8270, 8290, 8350, 8360, 8370, 8390, AMP7150, AMP8050, AMP8150, AMP8350, AMP8360, AMP8370, AMP8390

Update 7000 and 8000 Series Devices, NGIPSv, and ASA FirePOWER Modules Using the Firepower Management Center

NGIPSv (virtual managed devices)

Cisco ASA with FirePOWER Services: ASA 5506-X, ASA 5506H-X, ASA 5506W-X, ASA 5508-X, ASA 5512-X, ASA 5515-X, ASA 5516-X, ASA 5525-X, ASA 5545-X, ASA 5555-X, ASA 5585-X-SSP-10, ASA 5585-X-SSP-20, ASA 5585-X-SSP-40, ASA 5585-X-SSP-60

If managing with the Firepower Management Center:

Update 7000 and 8000 Series Devices, NGIPSv, and ASA FirePOWER Modules Using the Firepower Management Center

If managing with ASDM:

Update ASA FirePOWER Modules Managed with ASDM

Cisco ASA with Firepower Threat Defense: ASA 5506-X, ASA 5506H-X, ASA 5506W-X, ASA 5508-X, ASA 5512-X, ASA 5515-X, ASA 5516-X, ASA 5525-X, ASA 5545-X, ASA 5555-X

If managing with the Firepower Management Center:

Update Firepower Threat Defense Devices Using the Firepower Management Center

If managing with Firepower Device Manager:

Update Firepower Threat Defense Devices with the Firepower Device Manager

Firepower 9300 with Firepower Threat Defense (with SM-24, SM-36, or SM-44 security modules)

Update Firepower Threat Defense Devices Using the Firepower Management Center

Firepower 4100 series with Firepower Threat Defense: Firepower 4110, Firepower 4120, Firepower 4140, Firepower 4150

Firepower Threat Defense Virtual

Update Firepower Management Centers and Firepower Management Centers Virtual

Use the procedure in this section to update your Firepower Management Centers and Firepower Management Center Virtuals.

If your appliance is in a high availability configuration, see Update Sequence Guidelines.

Caution

Do not reboot or shut down your appliance during the update until you see the login prompt. The system may appear inactive during the prechecks; this is expected behavior and does not require you to reboot or shut down your appliance.

The following Firepower versions reboot during the update procedure: Version 6.2.0, Version 6.2.0.1.

Step 1

If you want to update Firepower Management Centers in a high availability pair, see Update Sequence for Firepower Management Centers in High Availability.

Step 2

Update to the minimum version as described in Update Paths to Version 6.2.0.x.

Step 3

Read these release notes and complete any preupdate tasks. For more information, see the following sections:

- Product Compatibility in Version 6.2.0.x

- Important Update Notes

Step 4

Download the update from the Support site:

- For Firepower Management Center (MC750, MC1500, MC2000, MC3500, MC4000) and Firepower Management Center Virtual:
Sourcefire_3D_Defense_Center_S3_Patch-6.2.0.x-xxx.sh

- For Firepower Management Center (MC1000, MC2500, MC4500) :

Sourcefire_Defense_Center_M4_Patch-6.2.0.x-xxx.sh

Note:
Download the update package directly from the Support site. If you transfer an update file by email, it may become corrupted.

Step 5

Upload the update to the Firepower Management Center by choosing System > Updates, then clicking Upload Update on the Product Updates tab. Browse to the update and click Upload. The update is uploaded to the Firepower Management Center. The web interface shows the type of update you uploaded, its version number, and the date and time it was generated.

Step 6

Redeploy configuration changes to any managed devices. Otherwise, the eventual update of the managed devices may fail.
When you deploy before updating the Firepower Management Center, resource demands may result in a small number of packets dropping without inspection. Additionally, deploying some configurations restarts the Snort process, which interrupts traffic inspection. Whether traffic drops during this interruption or passes without further inspection depends on how the device handles traffic. For more information, see Configurations that Restart the Snort Process When Deployed or Activated and Snort® Restart Traffic Behavior in the Firepower Management Center Configuration Guide, Version 6.2.0.

Step 7

(Optional) Run a readiness check on the Firepower Management Center as described in Run a Readiness Check through the Shell and Run a Readiness Check through the Firepower Management Center Web Interface.
Caution:
If you encounter issues with the readiness check that you cannot resolve, do not begin the update. Instead, contact Cisco TAC.

Step 8

Make sure that the appliances in your deployment are successfully communicating and that there are no issues reported by the health monitor.

Step 9

Click the System Status icon and view the Tasks tab in the Message Center to make sure that there are no tasks in progress.
You must wait until any long-running tasks are complete before you begin the update. Tasks that are running when the update begins are stopped, become failed tasks, and cannot be resumed; you must manually delete them from the Tasks tab after the update finishes.

Step 10

On the System > Updates window, click the install icon next to the update you are installing.

Step 11

Choose the Firepower Management Center and click Install. Confirm that you want to install the update and reboot the Firepower Management Center.
The update process begins. You can begin monitoring the update’s progress in the Tasks tab of the Message Center. However, after the Firepower Management Center finishes its necessary pre-update checks, you are logged out. When you log back in, the Upgrade Status page appears. The Upgrade Status window displays a progress bar and provides details about the script currently running. Click show log for current script to see the update log.

If the update fails for any reason, the page displays an error message indicating the time and date of the failure, which script was running when the update failed, and instructions on how to contact Cisco TAC. Do not restart the update.

Caution:
If you encounter any other issue with the update (for example, if a manual refresh of the Update Status page shows no progress for several minutes), do not restart the update. Instead, contact Cisco TAC.

When the update finishes, the Firepower Management Center displays a success message and reboots.

Step 12

After the update finishes, clear your browser cache and relaunch the browser. Otherwise, the user interface may exhibit unexpected behavior.

Step 13

Log into the Firepower Management Center.

Step 14

Choose Help > About and confirm that the software version is listed correctly: Version 6.2.0.x. Also note the versions of the intrusion rule update and VDB on the Firepower Management Center; you will need this information later.

Step 15

Verify that the appliances in your deployment are successfully communicating and that there are no issues reported by the health monitor.

Step 16

If the intrusion rule update available on the Support site is newer than the rule set on your Firepower Management Center, import the newer rule set. Do not autoapply the imported rules when working with Version 6.2.0.x.
For information on intrusion rule updates, see the Firepower Management Center Configuration Guide.

Step 17

If the VDB available on the Support site is newer than the VDB installed during the update, install the latest VDB. Do not autodeploy VDB updates when working with Version 6.2.0.x.
Installing a VDB update restarts the Snort process when you deploy configuration changes, temporarily interrupting traffic inspection. Whether traffic drops during this interruption or passes without further inspection depends on the model of the managed device and how it handles traffic. For more information, see the Firepower Management Center Configuration Guide.

Step 18

Redeploy policies to all managed devices.
Click Deploy and choose all available devices, then click Deploy.

Note:
You must redeploy configuration changes before updating any managed devices or you may have to reimage your appliances.

In most cases, deploying for the first time after you update the Firepower Management Center restarts the Snort process, which interrupts traffic inspection. Whether traffic drops during this interruption or passes without further inspection depends on how the device handles traffic. For more information, see Snort® Restart Traffic Behavior in the Firepower Management Center Configuration Guide.

Step 19

If a later patch is available on the Support site, update to the latest patch as described in the Firepower Release Notes roadmap for that version. You must update to the latest patch to take advantage of product enhancements and security fixes.

Step 20

If you updated Firepower Management Centers in a high availability pair, see Update Sequence for Firepower Management Centers in High Availability

Update Firepower Threat Defense Devices Using the Firepower Management Center

Use this procedure to update Firepower Threat Defense devices running at least Version 6.2.0. A Firepower Management Center must be running at least Version 6.2.0 to update Firepower Threat Defense devices to Version 6.2.0.x.

You can autodownload files for Firepower Threat Defense devices managed by the Firepower Management Center. You can update multiple devices at once but only if they use the same update file.

If your appliance is in a high availability or clustered configuration, see the Update Sequence Guidelines.

Note

You cannot update an ASA with FirePOWER Services device directly to Firepower Threat Defense. For more information, see the Update vs. Reimage vs. Deploy section of the Firepower Release Notes Version 6.2.0.

The following Firepower versions reboot during the update procedure: Version 6.2.0, Version 6.2.0.1.

For devices running or hosted on a non-Firepower appliance (for example, ASA OS or FXOS), resolving an issue may require that you update the operating system in addition to Firepower. We recommend you update to the latest supported version.

Note

Switching the management of a Firepower Threat Defense device resets device configuration to system default settings. If you need to switch the management of a Firepower Threat Defense device from the Firepower Management Center to a Firepower Device Manager, execute the configure manager local CLI command and register the Firepower Threat Defense device to a Firepower Management Center. Note that switching the management of a Firepower Threat Defense device resets device configuration to system default settings. For more information, see the Firepower Threat Defense Command Reference Guide.

Caution

Do not reboot or shut down your appliance during the update until you see the login prompt. The system may appear inactive during the prechecks; this is expected behavior and does not require you to reboot or shut down your appliance.

Step 1

Update to the minimum version as described in Update Paths to Version 6.2.0.x.

Step 2

Read these release notes and complete any preupdate tasks. For more information, see the following sections:

- Product Compatibility in Version 6.2.0.x

- Important Update Notes

Step 3

Update the software on the device’s managing Firepower Management Center; see Update Firepower Management Centers and Firepower Management Centers Virtual.

Step 4

Use the managing Firepower Management Center to deploy configuration changes to the managed devices. Otherwise, the eventual update may fail.
In most cases, deploying for the first time after you update the Firepower Management Center restarts the Snort process, which interrupts traffic inspection. Whether traffic drops during this interruption or passes without further inspection depends on how the device handles traffic. For more information, see Snort® Restart Traffic Behavior in the Firepower Management Center Configuration Guide.

Step 5

If you are updating a Firepower 9300 appliance or Firepower 4100 series, update to the latest supported FXOS version for this patch as described in the Cisco FXOS release notes. See the FXOS release notes landing page, the FXOS Compatibility Guide, and the Firepower Compatibility Guide for more information. If a Firepower 9300 appliance or a Firepower 4100 series device is in a high availability pair, you must update the standby device’s FXOS chassis manager before updating the Firepower software. See Update Sequence for Firepower Management Centers in High Availability for more information.
Updating to FXOS Version 2.0.1 or later causes an expected disruption in traffic. Updating FXOS also reboots the chassis, which drops traffic or passes it uninspected in an intra-chassis cluster depending on whether the cluster uses an enabled hardware bypass module, and drops traffic in an inter-chassis cluster only if chassis reboots overlap before at least one module comes online.

Step 6

Download the update from the Support site:

- For Firepower Threat Defense running on the ASA 5506-X, ASA 5506H-X, ASA 5506W-X, ASA 5508-X, ASA 5512-X, ASA 5515-X, ASA 5516-X, ASA 5525-X, ASA 5545-X, ASA 5555-X, or any supported virtual platform (VMware, AWS, KVM, Microsoft Azure):

Cisco_FTD_Patch-6.2.0.x-xxx.sh

- For Firepower Threat Defense running on the Firepower 4110, Firepower 4120, Firepower 4140, Firepower 4150, Firepower 9300 appliance, and Firepower Threat Defense Virtual:

Cisco_FTD_SSP_Patch-6.2.0.x-xxx.sh

Note:
Download the update package directly from the Support site. If you transfer an update file by email, it may become corrupted.

Step 7

Upload the update to the Firepower Management Center by choosing System > Updates, then clicking Upload Update on the Product Updates tab. Browse to the update and click Upload. The update is uploaded to the Firepower Management Center. The web UI shows the type of update you uploaded, its version number, and the date and time it was generated. The page also indicates whether a reboot is required as part of the update.

Step 8

(Optionally) Run a readiness check on the Firepower Threat Defense device as described in Run a Readiness Check through the Shell and Run a Readiness Check through the Firepower Management Center Web Interface.
Caution:
If you encounter issues with the readiness check that you cannot resolve, do not begin the update. Instead, contact Cisco TAC.

Step 9

Make sure that the appliances in your deployment are successfully communicating and that there are no issues reported by the health monitor.

Step 10

On the System > Updates window, click the install icon next to the update you are installing.

Step 11

Choose the devices on which you want to install the update.

Step 12

Click Install. Confirm that you want to install the update and reboot the devices. The update process begins. You can monitor the update's progress on the Tasks tab of the Message Center.
Note that managed devices may reboot twice during the update; this is expected behavior.

Caution:
If you encounter issues with the update (for example, if messages in the Tasks tab of the Message Center show no progress for several minutes or indicate that the update has failed), do not restart the update. Instead, contact Cisco TAC.

Step 13

After the update process finishes, choose Devices > Device Management and confirm that the devices you updated have the correct software version.

Step 14

Verify that the appliances in your deployment are successfully communicating and that there are no issues reported by the health monitor.

Step 15

Redeploy policies to all managed devices.
Click Deploy and choose all available devices, then click Deploy.

When you deploy for the first time after updating a device, resource demands may result in a small number of packets dropping without inspection. The deploy does not otherwise interrupt traffic inspection unless, since the previous deploy, you have modified specific policy or device configurations that always restart the Snort process when you deploy them. If you have modified any of these configurations, traffic drops or passes without further inspection during the restart depending on how the device handles traffic.

For more information, see Configurations that Restart the Snort Process When Deployed or Activated and Snort® Restart Traffic Behavior in the Firepower Management Center Configuration Guide, Version 6.2.0.

Step 16

If a later patch is available on the Support site, update to the latest patch as described in the Firepower Release Notes for that version. You must update to the latest patch to take advantage of product enhancements and security fixes.

Update Firepower Threat Defense Devices with the Firepower Device Manager

Step 1

Download the update from the Support site:

- For Firepower Threat Defense running on the ASA 5506-X, ASA 5506H-X, ASA 5506W-X, ASA 5508-X, ASA 5512-X, ASA 5515-X, ASA 5516-X, ASA 5525-X, ASA 5545-X, ASA 5555-X:

Cisco_FTD_Patch-6.2.0.x-xxx.sh

Step 2

Follow instructions for updating as described in the System Management topic in the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager.

Update 7000 and 8000 Series Devices, NGIPSv, and ASA FirePOWER Modules Using the Firepower Management Center

Use this procedure to update 7000 and 8000 Series devices, NGIPSv virtual managed devices, and ASA FirePOWER modules running at least Version 6.2.0. A Firepower Management Center must be running at least Version 6.2.0 to update these devices to Version 6.2.0.x.

You can update multiple devices at once but only if they use the same update file.

If your appliance is in a high availability or stacked configuration, see Update Sequence Guidelines.

Note

If you are locally managing the ASA FirePOWER module through ASDM, do not update the ASA FirePOWER module using the Firepower Management Center. For more information, see Update ASA FirePOWER Modules Managed with ASDM.

Caution

Do not reboot or shut down your appliance during the update until you see the login prompt. The system may appear inactive during the prechecks; this is expected behavior and does not require you to reboot or shut down your appliance.

The following Firepower versions reboot during the update procedure: Version 6.2.0, Version 6.2.0.1.

For devices running or hosted on a non-Firepower appliance (for example, ASA OS or FXOS), resolving an issue may require that you update the operating system in addition to Firepower. We recommend you update to the latest supported version.

Step 1

Update to the minimum version as described in Update Paths to Version 6.2.0.x.

Step 2

Read these release notes and complete any preupdate tasks. For more information, see the following sections:

- Product Compatibility in Version 6.2.0.x

- Important Update Notes

Step 3

Update the software on the device’s managing Firepower Management Center; see Update Firepower Management Centers and Firepower Management Centers Virtual.

Step 4

Use the managing Firepower Management Center to deploy configuration changes to the managed devices. Otherwise, the eventual update may fail.
In most cases, deploying for the first time after you update the Firepower Management Center restarts the Snort process, which interrupts traffic inspection. Whether traffic drops during this interruption or passes without further inspection depends on how the device handles traffic. For more information, see Snort® Restart Traffic Behavior in the Firepower Management Center Configuration Guide, Version 6.2.0..

Step 5

If you are updating an ASA device, update to the latest supported ASA version as described in the notes for that ASA release. For more information see the Click Here landing page, Cisco ASA Compatibility matrix, and the Firepower Compatibility Guide.

Step 6

Download the update from the Support site:

- For 7000 and 8000 Series:

Sourcefire_3D_Device_S3_Patch-6.2.0.x-xxx.sh

- For NGIPSv:

Sourcefire_3D_Device_Virtual64_VMware_Patch-6.2.0.x-xxx.sh

- For ASA with FirePOWER Services running on the ASA 5506-X, ASA 5506H-X, ASA 5506W-X, ASA 5508-X, ASA 5512-X, ASA 5515-X, ASA 5516-X, ASA 5525-X, ASA 5545-X, ASA 5555-X, ASA 5585-X-SSP-10, ASA 5585-X-SSP-20, ASA 5585-X-SSP-40, and ASA 5585-X-SSP-60:

Cisco_Network_Sensor_Patch-6.2.0.x-xxx.sh

Note:
Download the update package directly from the Support site. If you transfer an update file by email, it may become corrupted.

Step 7

(Optionally) Run a readiness check on the device as described in Run a Readiness Check through the Shell and Run a Readiness Check through the Firepower Management Center Web Interface.
Caution:
If you encounter issues with the readiness check that you cannot resolve, do not begin the update. Instead, contact Cisco TAC.

Step 8

Make sure that the appliances in your deployment are successfully communicating and that there are no issues reported by the health monitor.

Step 9

On the System > Updates window, click the install icon next to the update you are installing.

Step 10

Choose the devices where you want to install the update.
If you are updating stacked 7000 and 8000 Series devices, choosing one member of the stack automatically chooses the other devices in the stack. You must update members of a stack together.

Step 11

Click Install. Confirm that you want to install the update and reboot the devices. The update process begins. You can monitor the update's progress on the Tasks tab of the Message Center.
Note that managed devices may reboot twice during the update; this is expected behavior.

Caution:
If you encounter issues with the update (for example, if messages in the Tasks tab of the Message Center show no progress for several minutes or indicate that the update has failed), do not restart the update. Instead, contact Cisco TAC.

Step 12

After the update process finishes, choose Devices > Device Management and confirm that the devices you updated have the correct software version.

Step 13

Verify that the appliances in your deployment are successfully communicating and that there are no issues reported by the health monitor.

Step 14

Redeploy policies to all managed devices.
Click Deploy and choose all available devices, then click Deploy.

When you deploy for the first time after updating a device, resource demands may result in a small number of packets dropping without inspection. The deploy does not otherwise interrupt traffic inspection unless, since the previous deploy, you have modified specific policy or device configurations that always restart the Snort process when you deploy them. If you have modified any of these configurations, traffic drops or passes without further inspection during the restart depending on how the device handles traffic. For more information, see Configurations that Restart the Snort Process When Deployed or Activated and Snort® Restart Traffic Behavior in the Firepower Management Center Configuration Guide, Version 6.2.0.

Update ASA FirePOWER Modules Managed with ASDM

Use this procedure to update ASA FirePOWER modules using ASDM running at least Version 6.2.0. Locally managed ASA FirePOWER modules managed with ASDM do not require Firepower Management Centers to update.

The following Firepower versions reboot during the update procedure: Version 6.2.0, Version 6.2.0.1.

For devices running or hosted on a non Firepower appliance (for example, ASA OS or FXOS), resolving an issue may require that you update the operating system in addition to Firepower. We recommend you update to the latest supported version.

Step 1

Update to the minimum version as described in Update Paths to Version 6.2.0.x.

Step 2

Read these release notes and complete any preupdate tasks. For more information, see the following sections:

- Product Compatibility in Version 6.2.0.x

- Important Update Notes

Step 3

If you are updating an ASA device, update to the latest supported ASA version as described in the notes for that ASA release. For more information see the Click Here landing page, Cisco ASA Compatibility matrix, and the Firepower Compatibility Guide.

Step 4

Download the update from the Support site:

Cisco_Network_Sensor_Patch-6.2.0.x-xxx.sh

Note:
Download the update package directly from the Support site. If you transfer an update file by email, it may become corrupted.

Step 5

Deploy configuration changes. Otherwise, the eventual update may fail.

Step 6

Choose Configuration > ASA FirePOWER Configuration > Updates.

Step 7

Click Upload Update.

Step 8

Click Choose File to navigate to and choose the update.

Step 9

Click Upload.

Step 10

Choose Monitoring > ASA FirePOWER Monitoring > Task Status to view the task queue and make sure that there are no jobs in process.
Tasks that are running when the update begins are stopped and cannot be resumed; you must manually delete them from the task queue after the update finishes. The task queue automatically refreshes every 10 seconds. You must wait until any long-running tasks are complete before you begin the update.

Step 11

Choose Configuration > ASA FirePOWER Configuration > Updates.

Step 12

Click the install icon next to the update you uploaded.
The update process begins. You can begin monitoring the update’s progress in the task queue.

Step 13

After the update finishes, reconnect ASDM to the ASA device as described in the ASA Firepower Module Quick Start Guide.

Step 14

Access the ASA FirePOWER module interface and refresh the window. Otherwise, the interface may exhibit unexpected behavior.

Step 15

If the intrusion rule update available on the Support site is newer than the rule set on your ASA FirePOWER module, import the newer rule set. Do not autoapply the imported rules when working with Version 6.2.0.x.

Step 16

If the VDB available on the Support site is newer than the VDB installed during the update, install the latest VDB. Do not autodeploy VDB updates when working with Version 6.2.0.x.
Installing a VDB update causes a short pause in traffic flow and processing, and may also cause a few packets to pass uninspected. For more information, see the Cisco ASA with FirePOWER Services Local Management Configuration Guide.

Step 17

Deploy configuration changes.
Deploying may cause a short pause in traffic flow and processing, and may also cause a few packets to pass uninspected. For more information, see the Cisco ASA with FirePOWER Services Local Management Configuration Guide.

Chapter 10. Uninstall Version 6.2.0.x

You must uninstall updates locally. You cannot use a Firepower Management Center to uninstall the update from a managed device.

To watch the uninstallation process, access the device through the shell and navigate to the /var/log/sf/<uninstaller file name folder> directory, then execute the tail –f main_upgrade_script.log shell command. Once the uninstallation process is complete, the system generates a upgrade completed message in the file main_upgrade_script.log.

Order of Uninstallation

Uninstall the update in the reverse order that you installed it. That is, first uninstall the update from managed devices, then from Firepower Management Centers.

Uninstall the Update from Clustered or High Availability Appliances

Clustered devices, devices in high availability pairs, and Firepower Management Centers in high availability pairs must run the same Firepower version. Although the uninstallation process triggers an automatic failover, appliances in mismatched pairs or clusters do not share configuration information, nor do they install or uninstall updates as part of their synchronization. If you need to uninstall an update from redundant appliances, plan to perform the uninstallations in immediate succession.

To ensure continuity of operations, uninstall the update from clustered devices and paired Firepower Management Centers one at a time. First, uninstall the update from the secondary appliance. Wait until the uninstallation process is complete, then immediately uninstall the update from the primary appliance.

Note

If the uninstallation process on a clustered device, devices in a high availability pair, or a paired Firepower Management Center fails, do not restart the uninstall or change configurations on its peer. Instead, contact Cisco TAC.

Uninstall the Update from Stacked Devices

All devices in a stack must run the same Firepower version. Uninstalling the update from any of the stacked devices causes the devices in that stack to enter a limited, mixed-version state.

To minimize impact on your deployment, we recommend you uninstall an update from stacked devices simultaneously. The stack resumes normal operation when the uninstallation completes on all devices in the stack.

Uninstall the Update from Devices Deployed Inline

Managed devices do not perform traffic inspection, switching, routing, or related functions while the update is being uninstalled. Depending on how your devices are configured and deployed, the uninstallation process may also affect traffic flow and link state. See Pre-Update Configuration and Event Backups for more information.

After the Uninstall

After you uninstall the update, there are several steps you should take to ensure that your deployment is performing properly. These include verifying that the uninstall succeeded and that all appliances in your deployment are communicating successfully.

The next sections include detailed instructions not only on performing the uninstallation, but also on completing any post-update steps. Make sure you complete all of the listed tasks.

- Uninstall 7000 and 8000 Series Managed Devices

- Uninstall Firepower NGIPSv Devices

- Uninstall ASA FirePOWER Modules Managed By Firepower Management Center

- Uninstall Firepower Threat Defense Devices and Firepower Threat Defense Virtual Managed By Firepower Management Center

- Uninstall Firepower Management Centers

- Uninstall ASA FirePOWER Modules Managed By ASDM

- Uninstall from Firepower Threat Defense Devices Managed by Firepower Device Manager

Uninstall 7000 and 8000 Series Managed Devices

Uninstalling the update results in a device running the previous version. For information on uninstalling a previous version, see to the Firepower System Release Notes for that version.

Uninstalling the update reboots the device. Appliances do not perform traffic inspection, switching, routing, or related functions during the update. Depending on how your devices are configured and deployed, the update process may also affect traffic flow and link state. For more information, see Pre-Update Configuration and Event Backups.

Step 1

Read and understand Order of Uninstallation.

Step 2

Log into the device as admin, through SSH or the virtual console.

Step 3

At the CLI prompt, enter expert to access the bash shell.

Step 4

At the bash shell prompt, type sudo su -.

Step 5

Type the admin password to continue the process with root privileges.

Step 6

At the prompt, enter the following on a single line: install_update.pl /var/sf/updates/filename_Patch_Uninstaller-[version]-[build].sh The uninstallation process begins.
Note:
If you encounter issues with the uninstallation, do not restart the uninstallation. Instead, contact Cisco TAC.

Step 7

After the uninstallation finishes, the device reboots.

Step 8

Log into the managing Firepower Management Center and choose Devices > Device Management. Confirm that the device where you uninstalled the update has the correct software version..

Step 9

Verify that the appliances in your deployment are successfully communicating with the Firepower Management Center and that there are no issues reported by the health monitor.

Uninstall Firepower NGIPSv Devices

Uninstalling the update results in a device running the previous version. For information on uninstalling a previous version, see to the Firepower System Release Notes for that version.

Uninstalling the update reboots the device. Appliances do not perform traffic inspection, switching, routing, or related functions during the update. Depending on how your devices are configured and deployed, the update process may also affect traffic flow and link state. For more information, see Pre-Update Configuration and Event Backups.

Step 1

Read and understand Order of Uninstallation.

Step 2

Log into the device as admin, through SSH or the virtual console.

Step 3

At the CLI prompt, enter expert to access the bash shell.

Step 4

At the bash shell prompt, type sudo su -.

Step 5

Type the admin password to continue the process with root privileges.

Step 6

At the prompt, enter the following on a single line: install_update.pl /var/sf/updates/filename_Patch_Uninstaller-[version]-[build].sh The uninstallation process begins.
Note:
If you encounter issues with the uninstallation, do not restart the uninstallation. Instead, contact Cisco TAC.

Step 7

After the uninstallation finishes, the device reboots.

Step 8

Log into the managing Firepower Management Center and choose Devices > Device Management. Confirm that the device where you uninstalled the update has the correct software version..

Step 9

Verify that the appliances in your deployment are successfully communicating with the Firepower Management Center and that there are no issues reported by the health monitor.

Uninstall ASA FirePOWER Modules Managed By Firepower Management Center

Uninstalling the update results in a device running the previous version. For information on uninstalling a previous version, see to the Firepower System Release Notes for that version.

Uninstalling the update reboots the device. Appliances do not perform traffic inspection, switching, routing, or related functions during the update. Depending on how your devices are configured and deployed, the update process may also affect traffic flow and link state. For more information, see Pre-Update Configuration and Event Backups.

Step 1

Read and understand Order of Uninstallation.

Step 2

Log into the device as admin, through SSH or the virtual console.

Step 3

At the CLI prompt, enter expert to access the bash shell.

Step 4

At the bash shell prompt, type sudo su -.

Step 5

Type the admin password to continue the process with root privileges.

Step 6

At the prompt, enter the following on a single line: install_update.pl /var/sf/updates/filename_Patch_Uninstaller-[version]-[build].sh The uninstallation process begins.
Note:
If you encounter issues with the uninstallation, do not restart the uninstallation. Instead, contact Cisco TAC.

Step 7

After the uninstallation finishes, the device reboots.

Step 8

Log into the managing Firepower Management Center and choose Devices > Device Management. Confirm that the device where you uninstalled the update has the correct software version..

Step 9

Verify that the appliances in your deployment are successfully communicating with the Firepower Management Center and that there are no issues reported by the health monitor.

Uninstall Firepower Threat Defense Devices and Firepower Threat Defense Virtual Managed By Firepower Management Center

Uninstalling the update results in a device running the previous version. For information on uninstalling a previous version, see to the Firepower System Release Notes for that version.

Uninstalling the update reboots the device. Appliances do not perform traffic inspection, switching, routing, or related functions during the update. Depending on how your devices are configured and deployed, the update process may also affect traffic flow and link state. For more information, see Pre-Update Configuration and Event Backups.

Step 1

Read and understand Order of Uninstallation.

Step 2

Log into the device as admin, through SSH or the virtual console.

Step 3

At the CLI prompt, enter expert to access the bash shell.

Step 4

At the bash shell prompt, type sudo su -.

Step 5

Type the admin password to continue the process with root privileges.

Step 6

At the prompt, enter the following on a single line: install_update.pl /var/sf/updates/filename_Patch_Uninstaller-[version]-[build].sh The uninstallation process begins.
Note:
If you encounter issues with the uninstallation, do not restart the uninstallation. Instead, contact Cisco TAC.

Step 7

After the uninstallation finishes, the device reboots.

Step 8

Log into the managing Firepower Management Center and choose Devices > Device Management. Confirm that the device where you uninstalled the update has the correct software version..

Step 9

Verify that the appliances in your deployment are successfully communicating with the Firepower Management Center and that there are no issues reported by the health monitor.

Uninstall Firepower Management Centers

Uninstalling the update results in a device running the previous version. For information on uninstalling a previous version, see to the Firepower System Release Notes for that version.

Step 1

Read and understand Order of Uninstallation.

Step 2

On the managing Firepower Management Center, make sure that the appliances in your deployment are successfully communicating with the Firepower Management Center and that there are no issues reported by the health monitor.

Step 3

On the managed device, click the system status icon and view the Tasks tab in the Message Center to make sure there are no tasks in progress. Tasks that are running when the uninstallation begins are stopped, become failed tasks, and cannot be resumed; you must manually delete them from the Tasks tab after the uninstallation completes.

Step 4

Choose System > Updates.

Step 5

Click the install icon next to the uninstaller that matches the update you want to remove, then confirm that you want to uninstall the update and reboot the device. You can monitor the uninstallation progress in the Tasks tab of the Message Center.
Note:
Do not use the UI to perform any other tasks until the uninstallation is complete and the device reboots. Before the uninstallation completes, the web interface may become unavailable and the device may log you out. This is expected behavior; log in again to view the Tasks tab. If the uninstallation is still running, do not use the web interface until the uninstallation is complete. If you encounter issues with the uninstallation (for example, if the Tasks tab indicates that the update has failed or if the Tasks tab shows no progress for several minutes), do not restart the uninstallation. Instead, contact Cisco TAC.

Step 6

After the uninstallation is complete, the appliance reboots.

Step 7

Clear your browser cache and force a reload of the browser. Otherwise, the user interface may exhibit unexpected behavior.

Step 8

Log in to the device.

Step 9

Choose Help > About and confirm that the correct software version is listed.

Step 10

On the managing Firepower Management Center, verify that the appliances in your deployment successfully communicate with the Firepower Management Center and that there are no issues reported by the health monitor.

Uninstall ASA FirePOWER Modules Managed By ASDM

Uninstalling the update results in a device running the previous version. For information on uninstalling a previous version, see to the Firepower System Release Notes for that version.

Uninstalling the update reboots the device. Depending on how your devices are configured and deployed, the update process may also affect traffic flow. For more information, see Pre-Update Configuration and Event Backups.

Step 1

Read and understand Order of Uninstallation.

Step 2

Log into the device as admin, through SSH or the virtual console.

Step 3

At the CLI prompt, type expert to access the bash shell.

Step 4

At the bash shell prompt, type sudo su -.

Step 5

Type the admin password to continue the process with root privileges.

Step 6

At the prompt, enter the following on a single line: install_update.pl /var/sf/updates/filename_Patch_Uninstaller-6.1.0.X-57xxx.sh The uninstallation process begins.
Note:
If you encounter issues with the uninstallation, do not restart the uninstallation. Instead, contact Cisco TAC.

Step 7

After the uninstallation finishes, the device reboots.

Step 8

Verify that the appliances in your deployment are successfully communicating with the Firepower Management Center and that there are no issues reported by the health monitor.

Uninstall from Firepower Threat Defense Devices Managed by Firepower Device Manager

You cannot uninstall Firepower Threat Defense devices managed by Firepower Device Manager. You must reimage the appliance. See the Firepower Threat Defense Command Reference Guide for more information.

Chapter 11. Resolved Issues

For devices running or hosted on a non-Firepower appliance (for example, ASA OS or FXOS), resolving an issue may require that you update the operating system in addition to Firepower. We recommend you update to the latest supported version.

The following defects are resolved in Version 6.2.0.x:

- Issues Resolved in Version 6.2.0.3

- Issues Resolved in Version 6.2.0.2

- Issues Resolved in Version 6.2.0.1

- Issues Resolved in Version 6.2.0

Issues Resolved in Version 6.2.0.3

The following table addresses resolved caveats at the time of publication of these release notes. If you have a Cisco support contract, use the following dynamic queries for an updated list of resolved caveats, run the provided query in the Bug Search Tool:

- Resolved Firepower Management Center caveats in Version 6.2.0.3

- Resolved Firepower Management Center caveats in Version 6.2.0.3

- Resolved ASA FirePOWER Module caveats in ASA Version 9.7.x

Security Issues in Version 6.2.0.3

Security Issue

CSCvd07072

Cisco Firepower SSL Logging Denial of Service Vulnerability

Security Issue

CSCve12652

Cisco Firepower System Software Secure Sockets Layer Policy Bypass Vulnerability

Caveat ID Number

Description

CSCuy65203

Inline result showing would have dropped

CSCva30652

spurious high unmanaged disk usage on /dev/shm alerts

CSCvb22670

SFDCNotificationd dumps core if stopped after SFDataCorrelator

CSCvb34534

access control policy search highlight incorrectly highlights

CSCvb44254

ASA 5506-X Firepower Threat Defense Reset Button

CSCvb72561

Mperf causing high CPU and stays constantly high .

CSCvb87476

Proxy configuration can't be saved from UI, under some circumstances

CSCvc06133

Firepower Management Center freezes when attempt is made to sort the App Detectors

CSCvc06397

Upgrade ASA on Firepower Threat Defense managed by Management Center breaks Malware cloud lookup

CSCvc09017

Show Nat flows on Firepower 7000/8000 series devices displays incorrect data

CSCvc39550

Unable to expand or scroll if more than 11 DHCP relay agents configured in Management Center

CSCvc46599

Error message Unable to translate SSL cipher suite 65535 needs cleaning up

CSCvc46914

Rule copy and paste reset to top instead of the rule being edited

CSCvc49556

Diskmanager not managing /var/cisco/umpd properly

CSCvc51553

Unclear to user that DB check is running after ungraceful shutdown

CSCvc54659

Sub-interface entries not getting removed from bridge group interface after net-mode change

CSCvc57886

Search in access control policy returning incorrect results.

CSCvc59913

Mismatched VLAN tagged traffic has inconsistent access control rule matches.

CSCvc66770

Mishandled rule index numbers on multipage access control policies with collapsed rule categories

CSCvc68564

logrotate fails if permission on .conf file is incorrect - perm should be checked

CSCvc91394

Making minor changes to included/excluded users in a realm may cause unexpected behavior

CSCvc94207

Use of manage_procs.pl can result in a stack coming out of maintenance mode

CSCvc94589

Evaluation of sfims for OpenSSL Jan 2017

CSCvc96254

Route cannot be added under Management Interface

CSCvc96927

Management Interfaces Proxy settings disabled after 6.1.0 Management Center upgrade

CSCvc99959

Possible error in PDF/SWF decompression

CSCvd01405

Health monitoring for 8000 series firmware needs to try again for comms failure

CSCvd15607

DHCP server : Not able to configure DHCP server on BVI member (Redundant) - Transparent mode.

CSCvd16631

Excessive logging from sip preprocessor function SipSessionSnortCallback

CSCvd22778

Firepower Threat Defense high availability creation failed due to DB lock issue

CSCvd27999

PerlMessageHand_11 core on Firepower Management Center Virtual while system is shutting down

CSCvd28945

modbus false postive on MODBUS_BAD_LENGTH

CSCvd35905

upgraded 6.x Management Center incorrectly deploys obsoleted detectors to 6.x devices

CSCvd37120

Snort is unable to map the filename if there are unsupported characters.

CSCvd39490

ADI discards all but one IP address from a session notification

CSCvd51190

Snort reloads cause memory leaks and CPU increase

CSCvd51302

When import HTTPS Server Certificate fails, UI is blank without error

CSCvd56035

Custom NAP rule with inline normalization enabled does not enable normalization

CSCvd59199

Mismatch between internal database entries prevents correct session propagation

CSCvd62879

Repeated same DiskMgr logs flooding messages log - causing small log retention period

CSCvd70549

Query Cisco CSI for Unknown URLs option is not properly synchronized in Management Center pairs

CSCvd73687

Access Control Policy page conflict detection can show conflicts when there are none.

CSCvd78338

Correlation Events and Syslog Events show incorrect local rule SID

CSCvd86594

Need ability to enable PPTP inspection

CSCvd89890

Policy deploy hangs at 40% with the object names end with [ _ ]

CSCvd91019

Unable to delete third party vulnerabilities when the host count associated with them is > 100

CSCvd94044

7000 and 8000 Series Device with Passive Interface does not Failover when Active device powers off

CSCvd95667

Data channel traffic on windows FTP server aren't matching the pin hole session as expected

CSCvd96322

CSM backup failed on Secondary Firepower Management Center

CSCvd99119

Unable to import if Access Control rules has Realm as matching condition

CSCvd99574

Snort process at 100% and takes excessive amount of time to parse IPS rules.

CSCve02069

2048 byte block depletion with continuous SSL traffic and decrypt resign enabled on Threat Defense

CSCve02220

eStreamer certificate generates errors with a McAfee ESM generationQualifier verification failed

CSCve08217

Maximum File Events limit reduces to smaller number after upgrade to 6.1.0

CSCve08961

Stack entering bypass due to disk space health alert

CSCve10406

SFDataCorrelator will not stop on Threat Defense device due to database connection corruption

CSCve10708

Upgrade file-transfer from Firepower Management Center to Firepower device times out after one hour

CSCve11915

POP3 payload inspection not proper on snort with the file detection policy

CSCve15155

Host input operations can overwhelm high availability transactions

CSCve17116

Access control rule is not matched correctly if src zone and dst zone have different types

CSCve18975

Nothing is shown when clicked on Policy Assignements

CSCve34181

Static URL/DNS lists are not included in backup

CSCve34924

When expanding individual categories in Access Control Policy rule ID changes

CSCve35722

Running Patch Uninstaller causes cc-integrity.sh to fail; no UI.

CSCve35816

SFDataCorrelator segfault due to null pointer dereference in handle_host_address_changes()

CSCve39775

Multiple login messages different username and same realm/IP/timestamp scrambles SFDaco

CSCve41306

Firepower Management Center Interface Type Mismatch with Syslog Server Ip Type error

CSCve44987

eStreamer service sends corrupt messages and spams log files with Not connected

CSCve46036

SFDataCorrelator segfault due to null field in internally generated logoff event

CSCve46186

Snort memcals for startup memory incorrect on Firepower Threat Defense

CSCve47333

Management Center not deactivating smart licenses for Firepower Threat Defense devices

CSCve47800

Port Scan: IP Protocol scanning not getting detected.

CSCve47868

Snort not triggering Event 123:7 FRAG3_ANOMALY_BADSIZE_LG

CSCve47923

eStreamer log spam Unable to open directory

CSCve51315

record_count for interface stats from the sensor are being set to 0, coring SFDatacorrelator.

CSCve53544

Firepower Management Center high availability sync fails if file name contains 2 dots [ .. ]

CSCve61591

BitTorrent traffic not blocked consistently on resumed sessions.

CSCve63017

Migration lock not removed even if migration fails

CSCve64643

REST API internal error when removing AP rule from API that moved via GUI

CSCve72760

Missing column netmap_num from the join on event_extra_data table.

CSCve73229

Platform settings applied to more than 1 Threat Defense device do not vary

CSCve73601

Threat Defense: Blocking Facebook post/chat/comments/likes application not working for Firefox

CSCve74585

SFDataCorrelator crash or exit when event table contains large highest index

CSCve74902

REST identity application and ADI leak File Descriptors

CSCve79949

Poor performance of packet logs UI due to query not using index

CSCve82386

Configuring an IP pool for a diagnostic port channel interface on an Threat Defense cluster fails

CSCve85240

Access control policy uneditable if copying large Policy, insert/move 50+ rules into category

CSCve90940

DNS Security Intelligence feeds are not automatically push to sensors

CSCve94250

SFDataCorrelator coring due to ids_event_msg_map message being null

CSCve94848

MC2000 and MC4000 can rarely hang during boot

CSCve95026

ids_event_alerter causes high CPU on Threat Defense device when UUID is missing from EOAttributes

CSCve95168

Unicode file support over SMB on Firepwer Threat Defense

CSCve97997

Multiple CLAM update tasks created in the AQ ,during device registration.

CSCve99153

Access control policy/Pre-filter rules are negated and readded on usage of icmp objects

CSCve99203

256 low block count leads to traffic failures due to alloc to inspect snort

CSCve99622

Intrusion event of old session is missing after update and config deploy

CSCvf02208

Management Center: Deleting 1 category in nested access control policy deletes all categories

CSCvf05977

Firepower Threat Defense management interface link flaps when IPv6 gateway is configured

CSCvf09887

Performance graphs are inconsistent when processed_total_packets is 0

CSCvf09949

Incorrect access control rule is matched in Threat Defense device when it is setup in passive mode

CSCvf10781

SFDataCorrelator segfaults repeatedly when processing SSL certificate details

CSCvf15216

When SSL rules are enabled and sensor is over subscribed, rules are not correctly enforced.

CSCvf15265

SFDataCorrelator takes a long time to start due to large firewall_rule_cache table

CSCvf16288

after captive portal authentication, packet is incorrectly associated with realm ID 0

CSCvf16799

DH Ephemeral Keys with Known Key SSL Policy and session reuse causes client to close session.

CSCvf18368

Long traffic connections matching Do Not Decrypt SSL rules may be blocked

CSCvf22098

Management interface bootstrap fails with IPv6 only configuratiom and no available DHCPv4 servers

CSCvf36025

SFDataCorrelator segfaults during loading of compliance rules

CSCvf38056

SSL flows failing due to Flow tables and Flow ID's overflowing

CSCvf38081

SSL policy Category lookup fails for URLs that aren't in local database

CSCvf39476

Rules getting pushed after the Default Block All Rule on Firepower Threat Defense device

CSCvf43107

Estreamer Cores - SSLCert length handling

CSCvf54853

Large database size for devices upgraded from 6.1.0.x to 6.2.0.x

CSCvf55850

access-list rules missing after policy deployment on Firepower Threat Defense

CSCvf71086

Port-channel cannot be configured as a passive interface

CSCvf75781

Firepower Threat Defense device may leave cluster due to disk space alert

Issues Resolved in Version 6.2.0.2

The following table addresses resolved caveats at the time of publication of these release notes. If you have a Cisco support contract, use the following dynamic queries for an updated list of resolved caveats, run the provided query in the Bug Search Tool:

- Resolved Firepower Management Center Virtual caveats in Version 6.2.0.2

- Resolved Firepower Management Center Virtual caveats in Version 6.2.0.2

- Resolved ASA FirePOWER Module caveats in ASA Version 9.7.x

Caveat ID Number

Description

CSCvc57886

'Search' in access control policy returning incorrect results.

CSCva78299

access control Policy Report Differs from access control Policy Web Interface

CSCvc24013

Firepower Management Center not providing options to restrict ICMP types for certain codes

CSCvd69506

Network range with a space after the dash removes current and subsequent ACP rules

CSCvc10913

SFDataCorrelator polling for status of file analysis can fail in certain circumstances

CSCvd05788

Communication channel is blocked if recurring backup fails due to disk space on remote server

CSCvc09017

Show Nat flows on series 3 displays incorrect data

CSCvd14261

Fail to create Threat Defense high availability due to previous failed attempt

CSCve17179

Firepower Management Center high availability Sync can delete csm config files

CSCvd38500

Performance issue with Device listing page

CSCvd75631

Threat Defense DHCP Client tries to request a DHCP address instead of declining

CSCve47923

eStreamer log spam "Unable to open directory"

CSCve44987

eStreamer service sends corrupt messages and spams log files with "Not connected"

CSCuy50039

In Task Status page the task is stucked/spinning

CSCvd23471

ASA may traceback while loading a large context config during bootup

CSCvd04066

PBR config is blocked in FlexConfig

CSCvc53358

Interfaces not interpreted in hardware when contexts have 'lag' in their name

CSCvd37902

nse interface intialization has not occurred, but still receiving packets

CSCvc37876

Policy deploy fails due to inconsistency in HA Primary Threat Defense device in the backend

CSCvc56921

Altering logging settings like disabling syslog causes IPS and File policies to become disabled

CSCvc50598

Comparison reports for intrusion policy between 2 revisions is not working correctly

CSCvc04546

Discard does not rollback the updated Firepower Recommendation.

CSCvd60359

During backup intrusion policy error message on save should be intuitive.

CSCuy93365

Flowbit auto-resolution not working properly

CSCvd72697

Intrusion policy commit is slow because prepare statement is called multiple times

CSCva90055

change impact_flag on IPS/snort rule to red/orange/yellow/blue/gray

CSCvb28212

False warnings in DB Integrity Check for rule_comments/rule_comment_map

CSCvd32767

Unable to use objects inside IPS rules

CSCvc16184

Cannot re-arrange order of Network Analysis Rules

CSCvd62553

Policy deploy with NAP fails when adaptive profiles or auto detect setting is disabled in NAP

CSCvc48768

Search Option does not work for network objects under NAP editor

CSCur46880

Encapsulated traffic not matching hardware rules

CSCvd12448

Message "CSR access problem for ME 25" flooding dmesg

CSCvb40875

Default inspect statements are missing on ASA 5500-x and 2100 device running Threat Defense

CSCvd34691

Firepower: With SafeSearch on, users can't access multiple websites.

CSCvd55859

Snort segfault while processing malware cache.

CSCvd01332

With Safesearch configured but disabled, can lead to cores

CSCvd80218

Able to create Bridge group interface from global domain but device is in leaf domain

CSCvd90766

Deployment failed and internal error occurred when deleting Port channel inline set and deploy

CSCvd38316

Deployment is getting failed in high availability pair due to cluster inline-set interface.

CSCve01438

IP Address/Mask validation for Stanby Address missing during high availability formation

CSCvd83682

PPPoE User Name field should allow more characters

CSCve41306

Firepower Management Center 'Interface Type Mismatch with Syslog Server Ip Type' error

CSCvc10668

Unable to edit network objects when they are shared between devices

CSCvd65669

Standard ACL elements deployed in wrong order

CSCvb63720

Pseudo rule IDs are not unique when multiple DNS policies are deployed simultaneously

CSCvd09003

Checking for conflicts in variable sets doesn't work on network groups

CSCva92910

Too many addresses in HOME_NET results in failed deployment

CSCvd35243

C-groups modification during policy apply causes AAB to trigger.

CSCvb13791

Not able to login to Firepower 4100 using 'connect ftd' CLI

CSCvc94908

Qos Rule and interface widget doesn't display stats for QoS rules

CSCvd56292

Default "global_policy" service-policy removed after reboot

CSCvd18507

SFDataCorrelator segfault due to multi-threaded curl on HTTPS

CSCvb24824

Suspected latency during shared memory lookup (with URL Retry enabled)

CSCvc17167

URL Filtering stopped working due to major version change in the BC database

CSCvc92397

Webpages loads very slowly when URL retry is enabled

CSCvd90101

Report generation fails if the remote storage device is unmounted by another action

CSCvb16465

Security Intelligence category goes missing from Security Intelligence events after time

CSCve35816

SFDataCorrelator segfault due to null pointer dereference in handle_host_address_changes()

CSCvd76935

Unchecked host count growth after SFDataCorrelator reconfigure

CSCvd41052

Scheduler Queue Corruption leads to connectivity failures or failover problems after 9.6(2)

CSCvd74162

snort core in alert action.

CSCvd66343

Unable to block bittorent traffic when download is resumed after moving to a new network

CSCvc84361

Cisco Firepower Threat Defense and Cisco ASA with FirePOWER Module Denial of Service Vulnerability

CSCvc51173

Enabling SSL Policy may result in detection engine exits

CSCve02069

2048 byte block depletion with continuous SSL traffic and decrypt resign enabled on Threat Defense.

CSCvd93722

SSL Block action when Extended Master Secret is used with SSL Policy Known Key Decrypt

CSCvd41054

SSL Trusted CAs not deployed to sensor in some cases

CSCvc07857

Unable to disable Proxy Auth on Management Center by un-checking the proxy auth box

CSCvd11997

Database settings for a fresh deployment were not saved

CSCvd92322

ICMP Any in dst/src ports are saved incorrectly, which can result in broken pre-filter policy

CSCuy17170

After upgrading to 6.0, you cannot remove tasks from the taskbar

CSCvd04922

captive portal ntlm needs to handle token received in POST in addition to GET.

CSCvc93679

Firepower doesn't support userPrincipalName attribute for login with ISE / Active authentication

CSCvd94183

Intermittent failure in User Group lookup.

CSCvd77847

Management Center deployment fails due to error after creating a domain with devices

CSCva06227

Only 1500 Group Members are downloaded per group for an AD Realm

CSCvd45766

PxGrid sent MAB and internal ISE DB info to /var/log/messages cause outage on Management Center

CSCvd73834

Show user information in connection events for flows hitting early deny

CSCvd27278

UIMP fails importing all users if any user in the import list has been deleted

CSCvd71808

Users are removed from groups after scheduled user/group download

CSCva98254

Trying to delete an identity realm that is in use breaks the identity realm

CSCvc91320

"Failed to set user name for lights-out management" error when trying to change admin pw on FMC1500

Issues Resolved in Version 6.2.0.1

The following table addresses resolved caveats at the time of publication of these release notes. If you have a Cisco support contract, use the following dynamic queries for an updated list of resolved caveats, run the provided query in the Bug Search Tool:

- Resolved Firepower Management Center caveats in Version 6.2.0.1

- Resolved Firepower Management Center Virtual caveats in Version 6.2.0.1

- Resolved ASA FirePOWER Module caveats in ASA Version 9.7.x

Caveat ID Number

Description

CSCvb39435

Import of Access control Policy fails after upgrade to 6.1

CSCuz46366

Files not Sandboxed even when they are under file limit.

CSCvb69285

Policy Export fails partially in Firepower ASDM 6.1

CSCvb63352

SafeSearch breaks for retransmitted packets

CSCvb19716

FR Scale: Large File Copy (>4GB) Fails In SFTunnel

CSCvb82371

AC policy:Deployment failure is happening due to rule update issue

CSCvb08840

Policy cant be applied when SRU and automated deploys run in parallel

CSCvb63664

Passive Authentication with User Agent is not working for some users

CSCvb85231

Intrusion Email Alert is not working

CSCvb67792

Intrusion Emails no longer send after upgrading to 6.1

CSCvb24807

After 6.1 upgrade, stale entries in fireamp_cloud table cause UI problem

CSCvc51117

ASA to FTD migration may fail when invalid characters are used in an access-list name

CSCvb66611

ASA to FTD migration script creates nested port group objects, which causes deployment to fail

CSCvc09761

Cannot delete multiple rules at a time from ASA migrated Prefilter Policies

CSCvc52158

FQDN objects getting imported in FMC from migration tool generated .sfo

CSCvc36047

Having "0" at the object service PING service icmp echo 0 causes migration to fail

CSCvc48702

Migration fails when SLA monitor configuration is present

CSCvb20859

Migration report succeed but sfo creation & cleanup fails intermittently

CSCvc18928

Unable to import ASA config file in migration tool i.e 6.1.0-330

CSCva59135

When a migration activity in progress new migration need to be blocked

CSCuz90632

Backup done remotely can't be restored locally

CSCvb24755

Cardmanager on ASA5585-SSP-40 SFR exits due to a SIGPIPE signal

CSCuz40408

system support capture traffic parser rejects slash used in net filter

CSCvc54134

Device goes into reboot loop one after another until failover cable is removed

CSCvd20947

Unable to deploy AC policy to an FTD HA pair due to an object description with the '&' character

CSCvc33995

Context Explorer performance issues due to query incorrectly joining two event tables

CSCvb24378

Add ability to enable or disable default inspect configuration

CSCvb51382

FTD:Not able to login to converged cli using SSH

CSCvb52751

DB error after trying to add and survey network in whitelist profile

CSCvb27494

Cisco Firepower Malware Detection Bypass Vulnerability

CSCvc12727

snort core file when processing bltd packets

CSCvb67848

SSL widgets lack data labels in 6.1

CSCvb52344

some perl processes leak semaphores

CSCvc76394

Time-ordered EQE queries against partitioned event tables are not optimized

CSCvc05376

FMC Database issues causing Missing Passive User Sessions via User Agent failure

CSCvc49789

OptimizeTables.pl always fails on 6.1.0

CSCvb35499

Upgrade 6.0.1.2 to 6.1.0-330 fails at 560_install_version_masked_apps.pl

CSCvb01821

Policy deployment failing on FMC for VMWare

CSCvb96776

Frangelico: FMC HA: HA establishment fails due to large database files copy

CSCuz95008

eStreamer 5.4 clients are unable to process userID info on 6.0 Firepower Management Center metadata

CSCvc53293

Estreamer cores found in DC-HA setup

CSCvc30591

estreamer should use correct datastore for user identity mapping.

CSCvb88976

High unmanaged disk usage due to large flow_chunk table

CSCvc05323

snort is restarting and filling the disk with logs.

CSCvb79079

Adding syslog to Access Control Rule may result in loss of Real Time Eventing

CSCvb70786

ids_event_alert coring on 6.1.0

CSCvc44292

ids_event_alerter can crash or infinite-loop

CSCva23034

Latency in FMC HA synchronization

CSCvc10655

access control Policy Deployment failed after patch installation(6.1.0.330 to 6.1.0.1.30)

CSCvb91730

Attempting to change copper SFP interfeace type (inline/switched/routed) results in error

CSCva12703

SCALE: Health alarms are not displayed in UMS

CSCvc37927

Import fails with duplicate object name when the object names differs by case only

CSCvc52214

Import with config involving inline values fails

CSCvb02417

adaptive profiling performance scales badly in some cases

CSCvb42559

Firepower Management Center Smart Licensing bypasses Proxy Configuration when in eval mode

CSCvc06397

Upgrade on Off-box ASA-FTD breaks Malware cloud lookup.

CSCvc48851

Network Object not listed under the custom rule editor in NAP

CSCvc01694

Enable flow control on stacking interfaces

CSCvb78786

Network Discovery fails to parse zones in ND rules under certain conditions

CSCvb36847

Event QoS in legacy mode does not have an entry for interface stats

CSCva07265

Incorrect rule being logged for application rules that go pending.

CSCvb65052

Network based AC rules don't always match if preceded by a rule with application/url

CSCvb52057

SafeSearch dropping legitimate traffic since paf not marking packet flags

CSCvb46555

Segmentation fault at HttpPacketModification, httpModProcess

CSCvc49641

Snort process segfaults processing traffic in firewall (ngfw).

CSCvb77099

Traffic misses matching AC rule

CSCvc44398

URL not extracted from reassembled requests

CSCvb24768

Security Zone is "Unknown" after upgrade to 6.1

CSCvb55593

DHCP Relay configuration does not display in UI after 6.1 upgrade

CSCvb53091

platform settings page fails to load when applied to multiple stacks

CSCvb75591

Security Intelligence DNS Feed based logs not sent to external Syslog

CSCvb68226

Constant failovers on ASA high availability pair due to SSP module failure

CSCvb85507

Evaluation of sfims for CVE-2016-5195 (DIRTY CoW)

CSCvb97742

FP or AMP 7000/8000 series sensor kernel deadlock on 6.1

CSCvc26880

oom condition leads to repeated RCU stall warnings

CSCvc50232

SFR upgrade to 6.1.0 causes erroneous HA failovers and/or traffic loss under load on 5585-40,60

CSCvb96160

CWE-200 - M4-FMC - TLS/SSL Birthday attacks on 64-bit block ciphers

CSCvc23451

Evaluation of sfims for NTP November 2016

CSCva90011

FR - CVE-2011-3389 -TLS/SSL is enabling BEAST attack

CSCvc64050

ASAConfig uses wrong interface IDs after module unit rejoins multi context ASA cluster

CSCvb81176

Bird fix for segfault needs to be ported to EC and FR

CSCva89342

Interfaces get deleted on SFR during Multi-context HA configuration sync

CSCvb66334

OOM keeps running, series3 units keep crashing, requiring reboot

CSCvb40343

PM generated commands can break dhcrelay if using more than 22 lifs

CSCvc73128

Reservation of core 0 for system processes in arc.conf is ignored by ARC.pm

CSCvb57747

Deploy during intrusion rule update install may cause all subsequent policy applies to fail

CSCvb68292

Httpmod preprocessor does not get disabled when safesearch rules are disabled

CSCvc57533

Policy Deployment may fail due to delta splitting logic fail

CSCvc11916

Removing special characters from UI in AC rule does not remove characters from lina config

CSCvb92968

Two PM instances running simultaneously

CSCva30652

spurious high unmanaged disk usage on /dev/shm alerts

CSCvc32479

Cannot load proxy information for dynamical analysis (sandbox)

CSCvb16413

URL Filtering option on GUI being unset/disabled intermittenly

CSCvb65642

Firepower FMC Risk Reporting has spelling mistakes!

CSCvb94393

SFDataCorrelator malware lookups take too long - UI shows timeout action

CSCuy91156

Cisco Firepower System Software FTP Malware Vulnerability

CSCvb40344

File policy oversubscription when many hosts process file.

CSCva89328

FTD gets into a bad state in which it has severe performance degradation

CSCuy65203

Inline result showing "would have dropped"

CSCvc08844

Retry packets never time out and keep being sent to Snort

CSCvc08057

Snort core is seen on FTD during rate limiting test

CSCvb74873

Snort crash during SMB inspection in file_capture_stop

CSCvb61018

some application and file policy combinations can cause snort to core

CSCvb52625

unexpected ACK packet for MDI malware file traffic connection

CSCvb62292

Cisco Firepower Detection Engine SSL Denial of Service Vulnerability

CSCvb92740

HTTPS pages take 30+ sec to load with SSL decryption and URL category rules enabled together

CSCvb38524

IPS and File detection is not working if Applications are FTP, FTP Data

CSCvc03589

Seg fault on SSL after policy apply

CSCvc11251

segfault in ns_net_mbrwq_release while processing SSL flow.

CSCvc55369

Snort segfault in process_ssl

CSCvc30521

SSL Handshake not completing for "Do Not Decrypt" action with large server certificate

CSCvb94411

SSL policy rules may match undecryptable actions too early in certain configurations

CSCvc09753

SSL rules with URL categories defined are not processed correctly

CSCvc10937

Platform settings policy so not appear to work for Firepower stacks

CSCvc43324

Changing admin user password may fail for systems not using LOM.

CSCux46182

"Failed to run troubleshoot script / failed (256)" on secondary DC.

CSCvc53628

'Available Ports' tab hangs when editing prefilter rule ports

CSCvb63264

Default Prefilter Policies are not imported properly on FMC2000

CSCvb03905

PrefilterPolicy DefaultAction Issue with 6.1.x FMC upgraded from 6.0.x managing 6.0.x FTD Device

CSCvc12080

Rules from prefilter policy do not retain order when saving policy

CSCvb46146

Don't allow different upgrade to start when upgrade is in failed state

CSCvc12702

bltd segfault processing checksum (computeChecksum).

CSCvb36748

captive portal support for ips on a stick

CSCuy05562

Deleting users from analysis->users doesn't remove sessions from sensor

CSCvc24316

Firepower Management Center does not handle Postured user session updates from ISE servers

CSCvb69906

Users are removed from groups after scheduled user/group download (database problem)

CSCvb92474

user_ip_map files being skipped while pushed from FMC to Sensor due to DaCo crash

Issues Resolved in Version 6.2.0

Caveat ID Number

Description

CSCuw70987, CSCux50957, CSCux86317

Resolved multiple vulnerabilities within the third party Open SSH, as described in CVE-2015-5600, CVE-2015-6565, CVE-2016-0777, and CVE-2016-0778.

CSCuw88390, CSCuw88396, CSCuw89094

Addressed a cross-site scripting (XSS) vulnerability, as described in CVE-2015-6363 and CVE-2016-1294.

CSCux41304, CSCuz52366, CSCvb24543, CSCvb48536

Addressed multiple vulnerabilities that generated denial of service in OpenSSL, as described in CVE-2015-3194, CVE-2015-3195, CVE-2015-3196, CVE-2016-2105, CVE-2016-2106 CVE-2016-2107, CVE-2016-2108, CVE-2016-2109, CVE-2016-2176, CVE-2016-2177, CVE-2016-2178, CVE-2016-2179, CVE-2016-2180, CVE-2016-2181, CVE-2016-2182, CVE-2016-2183, CVE-2016-6302, CVE-2016-6303, CVE-2016-6304, CVE-2016-6305, CVE-2016-6306 CVE-2016-6307 CVE-2016-6308 CVE-2016-6309 CVE-2016-7052 CVE-2015-3194, CVE-2015-3195 and CVE-2015-3196.

CSCux42288

Addressed a vulnerability issue in the third party Java, as described in CVE-2015-6420.

CSCux90163

Resolved a vulnerability where a user without Admin without privileges could delete other users' scheduled tasks.

CSCuy32284

Addressed a vulnerability in the third party GNU C Library, as described in CVE-2015-7547.

CSCuz52939, CSCvb24561, CSCvb24562

Addressed multiple vulnerabilities in the third party product Libxml2, as described in CVE-2016-2073, CVE-2016-444, and CVE-2016-4448.

CSCuz92632

Addressed multiple vulnerabilities in the third party product NTP, as described in CVE-2016-4953, CVE-2016-4954, CVE-2016-4955, CVE-2016-4956, and CVE-2016-4957.

CSCvb24566, CSCvb24564 CSCuz52935

Address multiple vulnerabilities in the Libarchive, as described in CVE-2016-1541, CVE-2016-5844, and CVE-2016-6250.

CSCuu96447

In some cases, if you deleted the permanent license from the Licenses page System > Licenses, the Device Management page Devices > Device Management did not display Unlicensed for devices the permanent license was deleted from when it should have, and policy deploy would fail.

CSCux64898

In some cases, if you deployed an access control policy with the default action set to Block and executed the configure network management-interface disable-event-channel CLI command, Firepower continued to generate intrusion and connection events when it should not have.

CSCux78211

Resolved an issue where, if an ASA FirePOWER module in high availability experienced a partial failure, the device did not failover when it should have.

CSCux91934

Resolved an issue where, if you deployed an SSL policy configured with a rule associated with an expired SSL certificate, Firepower used an incorrect SSL rule.

CSCuy28088

Cannot apply FP8130-CTRL-LIC to AMP8050.

CSCuy49371

If you clicked Create Email Alert on the Alerts page Policies > Actions > Alerts and enabled Retrospective Events configuration on the Advanced Malware Protection Alerts tab, then saved and applied, the email alerts generated by Firepower when the alert was triggered were truncated. Emails should not have been truncated.

CSCuy51566

If you updated a Firepower Management Center from Version 5.4.x to Version 6.0.0 or later and created a new sub domain and deployed a network discovery policy, you could not delete any objects or object groups referenced by the network discovery policy in the global domain.

CSCuy57756

In some cases, if you broke a Firepower Threat Defense high availability pair, one of the devices in the pair stayed in standalone mode and Firepower could not recreate the high availability pair.

CSCuy67210

Not able to disable notifications on the Firesight manager Web interface.

CSCuy68648

Resolved an issue where, if you added a security zone on a Firepower Management Center running Version 5.4.0 or later and updated Firepower to Version 6.0.0 or later and deleted the security zone, Firepower generated an Object deletion restricted. Remove object from the following: Access control policies error even if the security zone was not referenced within a rule.

CSCuy83201

Fatal errors on applying policy from 6.0.0.1 with different vulnerability database.

CSCuz17315

Resolved an issue where Firepower generated erroneous Error found during SSL flow after server certificate messages for evicted SSL flows.

CSCuz17723

Firepower 9300 devices' high availability status is displayed incorrectly/inconsistent in the Firepower Management Center.

CSCuz24872

Original Client IP does not populate for dropped events when inline normalization enabled.

CSCuz46366

Firepower incorrectly allowed you configure sandbox file sizes from 0 MB to 100 MB on the Files and Malware Settings section on the Advanced tab of the access control editor. Firepower only supports capturing files as large as 10 MB. If you configured the sandbox environment to a file size larger than 10 MB, Firepower did not capture the file.

CSCuz49023

Resolved an issue where despite configuration of impact flag alerting for an eStreamer client, Firepower did not stream impact flag data.

CSCuz54417

If you deployed an SSL policy containing application rule conditions for SMTPS, POP3S, and IMAPS traffic, Firepower might have incorrectly displayed Unknown as the application protocol in the Connection Events page Analysis > Connections > Events.

CSCuz78239

DLL-Load vulnerability in Snort on Windows platforms.

CSCuz92255

Resolved an issue where, if you tested the default storage type on the Remote Stage Device section of the Configuration page System > Configuration, Firepower incorrectly generated a Please enter valid host. Please enter a valid Directory path. error message.

CSCuz92983

Policy deployment fails with mode 10 Gbit Full-Duplex for lag interface.

CSCuz94444

Resolved an issue where the associated client incorrectly rejected resigned certificates for Apple related products and you could not log into iTunes.

CSCuz95008

Resolved an issue where, if you requested pre 6.0.0 metadata from a Firepower Management Center with eStreamer running Version 6.0.0. or later, Firepower incorrectly sent the userID field to the eStreamer client instead of the configured LDAP username.

CSCuz99677

Resolved an issue where, if you created a new user with an administrator role and deployed configuration, Firepower incorrectly displayed the default admin user as the user deploying the configuration instead of the newly created user.

CSCva00234

Resolved an issue where policy comparison did not include the high availability health modules when it should have.

CSCva01674

sfestreamer crashes when we have 4 management interfaces on Firepower Management Center.

CSCva12481

Disk manager marks conn-unified as deleted.

CSCva28854

Under rare conditions, when 7000 and 8000 Series devices where firstboot policy apply failed, file handles are depleted on the device which caused health/hardware alarms and a variety of malfunctions.

CSCva29636

Resolved an issue where, if you configure network management for a Firepower Threat Defense virtual device, the console incorrectly provided an HTTPS address to complete the installation when it should not have.

CSCva37443

If your ASA configuration file contained an invalid ICMP service object, the ASA-to-Firepower Threat Defense migration tool failed, but did not log adequate information to troubleshooting logs. Migration no longer fails under this condition. Instead, the tool excludes the invalid ICMP objects from the conversion, converts the related ASA access rules to disabled Firepower Threat Defense rules, and adds a comment to the rules describing the unsupported case.

CSCva38608

Resolved an issue where SHA1 signed certificate with a modern browser and Firepower generated untrusted certificate errors for modern browser.

CSCva41164

Version 6.2.0 does not support access control policy names including the $ character.

CSCva47456

Resolved an issue where, if Firepower requested a URL lookup and the cloud did not immediately return a URL category, the cached request incorrectly remained marked as Pending instead of updating the URL type to Uncategorzied.

CSCva49869

Report generation did not give a failed message, continues in queue for week.

CSCva51022

If you deployed a pair of network object groups to a Firepower Threat Defense high availability pair and the network object group IP addresses on either the active and standby device overlapped with the IP addresses on the other device within the pair, deployment failed and Firepower generated a Deployment failed due to configuration error message in the Message Center.

CSCva51662

Resolved an issue where, if you clicked Launch Readiness Check while another readiness check is in the queue and closed the dialog window, Firepower incorrectly started a new readiness check task .

CSCva57174

On a Firepower Threat Defense Virtual with RIP and redistribution configured, even if you disabled RIP and redeployed, the device continued to use RIP.

CSCva58269

Resolved an issue where, if you created alerts associated with a domain and then deleted the domain, Firepower did not remove the alerts from the database when it should have.

CSCva58393

User is able to apply smart licenses on AWS HB device.

CSCva58411

Resolved an issue where, if you added smart licenses to a Firepower Threat Defense high availability pair, the smart licensing widget on the dashboard page did not load.

CSCva59135

The ASA-to-Firepower Threat Defense migration tool can convert only one ASA configuration file at a time. If you started a conversion while a conversion task was in progress, Firepower displayed an Error 500 Internal server error message. Firepower now displays a warning message that a migration is already in progress.

CSCva63604

Resolved an issue where, if a security module on a Firepower Threat Defense cluster with an access control policy containing more than 10,000 rules reloaded, the security module failed to re-join the cluster and generated a All data interfaces have been shutdown due to clustering being disabled. To recover either enable clustering or remove cluster group configuration warning.

CSCva67943

Resolved an issue where, if you enabled common criteria (CC) mode on an appliance for security certifications compliance and the syslog server certificate did not contain serverAuth, Firepower incorrectly passed connections to the syslog server when they should have failed.

CSCva72899

Access control policy report fails if category has span across 50 rules.

CSCva81548

Improved configuration deployment performance.

CSCva82945

The Interfaces tab of the device management page for a Firepower Threat Defense device now displays the current status for interfaces on the device.

CSCva89328

Resolved an issue where, if you deployed an intrusion rule containing an AppID web application condition and a managed device experienced a high volume of traffic containing an excessive amount of similar connection types that did not apply to the AppID application, the application detection process took more time than it normally should and caused latency for other traffic matches.

CSCva89342

If you created an ASA Firepower module high available pair configured for multi-context mode and deployed one or more security zone from the managing Firepower Management Center, then the standby ASA Firepower module within the pair restarted, the standby ASA Firepower module incorrectly removed all security zones and interfaces.

CSCva93408, CSCva93158

Improved the RPC decoder.

CSCva99998

Resolved an issue where Firepower did not restrict read-only users from editing the blacklist page when it should have.

CSCvb02417

Adaptive profiling performance scales badly in some cases.

CSCvb02846

Resolved a rare issue where, if you switched Firepower Management Center high availability peers twice and viewed the Smart Licenses page System > Licenses > Licenses > Smart Licenses, the table of devices and any edit windows failed to load.

CSCvb05694

Resolved an issue where, if you deployed an SSL policy and traffic with an HTTP tunnel matched the SSL policy, Firepower dropped some traffic and experienced high CPU use and overall latency.

CSCvb08840

Resolved an issue where, if you enabled automated intrusion rule updates for an ASA Firepower module managed by ASDM, and the device simultaneously deployed automated deployments, the device experienced issues.

CSCvb11574

Resolved an issue where, if you deployed an access control policy containing a custom application detector and deleted the application detector, Firepower did not generate a warning that the application detector must be removed from the access control policy prior to deletion.

CSCvb11642

Resolved an issue where, if you created a network discovery policy configured to detect hosts and a correlation policy containing a rule set to trigger if discovery event occurs and the OS information for a host has changed, then added a condition for if OS name is unknown and added a remediation Nmap scan, discovery events matching the rules did not generated corresponding Nmap scans.

CSCvb11931

Resolved an issue where, if Firepower experienced an issue processing the first session of SMTP traffic between a client and an SMTP server, Firepower did not correctly identify the subsequent SMTP sessions as SMTP for the client-server pair and displayed Unknown in the Application Protocol column of the Connection Events page Analysis > Connections > Events.

CSCvb12453

Resolved an issue where, if you enabled common criteria (CC) mode on an appliance for security certifications compliance and the syslog server certificate did not contain host name matching the name of the server, connections to the syslog server incorrectly passed when they should have failed.

CSCvb12791

Resolved an issue where, if you enabled Common Criteria (CC) mode on an appliance for security certifications compliance and the syslog server certificate and/or intermediate certificate(s) have been revoked, Firepower incorrectly established a TLS connection with the syslog server without checking the revocation status.

CSCvb14402

Traffic by Initiator Report for User Renders No Output.

CSCvb19366

Cisco Firepower Management Center Information Disclosure Vulnerability.

CSCvb19716

Resolved an issue where Firepower Management Center high availability synchronization failed if the total size of the database files and logs totaled more than 4GB.

CSCvb20859

Intermittently, if the ASA-to-Firepower Threat Defense migration tool could not migrate an ASA configuration because the access control list was not applied via a valid access-group command, Firepower did not complete internal operations related to that migration, and you could not start another migration.

CSCvb24378

You can now enable or disable default inspection with the command line interface on a Firepower Threat Defense device using configure inspection <inspection_name> enable|disable.

CSCvb24768

Resolved an issue where, in some cases, if you updated a system containing at least one security zone to Version 6.1 or later, the Interfaces page Devices > Interfaces might incorrectly displayed the security zone state as Unknown .

CSCvb24807

In rare cases, after you updated the Firepower Management Center to Version 6.10, the dynamic analysis page AMP > AMP Management would not load.

CSCvb25963

Resolved an issue where, if you formed a Firepower 4100 series series or Firepower 9300 high availability pair with devices containing named interfaces and assigned a portchannel from the FXOS chassis manager, then edited the Interfaces tab of the high availability pair listed on the Device Management page Devices > Device Management and saved, Firepower did not include the interfaces created for the high availability pair when it should and, in some cases, deployment failed.

CSCvb26266

Resolved an issue where, if you enabled captive portal on a system and updated to Version 6.1.0, captive portal did not work.

CSCvb28158

Workflow set with User Preferences not honored by Search Constraints.

CSCvb28202

False warnings in database Integrity Check for PlatformSettings object.

CSCvb32484

Upgrade to 6.1 fails at 600_schema/000_install_csm.sh.

CSCvb32873

Cannot create new Application Filter Objects 6.1 on ASA managed by ASDM.

CSCvb35499

Resolved an issue where, in some cases, if you updated a system from Version 6.1.0 to Version 6.1.0.x, the update failed.

CSCvb35861

Resolved an issue where, if you created a high availability pair and synchronization requests overload the Tasks tab in the Message Center, Firepower experienced disk space issues and intermittent login issues.

CSCvb36645

Resolved an issue where, if incoming HTTP, TCP, or SSH traffic did not contain an SGT value in the header, traffic matched against the default access control policy instead of any other configured policy.

CSCvb36847

Event QoS in legacy mode does not have an entry for interface stats.

CSCvb39325

Resolved an issue where incoming HTTP and HTTPS traffic containing XFF fields caused system issues.

CSCvb39435

If you updated Firepower from a version earlier than Version 6.1.0 to Version 6.1.0 and immediately exported the access control policy, then imported the policy, importing the access control policy failed.

CSCvb40344

If you deployed a file policy to a device with an excessive amount of endpoints configured, Firepower experienced high CPU and memory use. As a workaround, you could redeploy configuration.

CSCvb41047

Resolved an issue where Firepower generated an incorrect Health monitoring running behind schedule health warning if the Firepower Management Center did not receive any health events from registered devices.

CSCvb42559

Firepower Management Center Smart Licensing bypasses Proxy Configuration when in evaluation mode.

CSCvb43868

Upgrade failing for v6.0.1 at 600_schema/000_install_csm.sh.

CSCvb44812

Resolved an issue where Firepower 4100 series series devices generated excessive logging and experienced storage space issues.

CSCvb44268

Resolved an issue where the Appliance Status widget did not load if you had 400 or more devices attached to a Firepower Management Center.

CSCvb46146

If updating Firepower failed and you attempted to update to a different version from the one that failed without resolving the original failure, the new install also failed and could cause Firepower to become unrecoverable.

CSCvb46555

Resolved an issue where, if you enabled Safe Search in an access control policy and deployed, Firepower incorrectly generated Primary Detection Engine Exiting health alerts.

CSCvb47847

Resolved an issue where, if you updated a system from Version 6.0.1.1 or later to Version 6.1.0, Firepower experienced a variety of issues such as update failure or Firepower Management Center login failure.

CSCvb51077

Resolved an issue where, if you added a remediation as a response to a rule in a correlation policy on a Firepower Management Center and created a high availability pair, then switch high availability peers, the new active Firepower Management Center did not correctly synchronize the correlation policy and the remediation experienced issues.

CSCvb52057

Resolved an issue where, if you deployed an access control policy containing rules with Safe Search enabled, some websites experienced latency when loading.

CSCvb57521

Firepower Management Center/Firepower Threat Defense - Multiple default routes with same metric or gateway exists.

CSCvb57747

Deploy during intrusion rule update install may cause all subsequent policy applies to fail.

CSCvb60088

Firepower Threat Defense policy deployment fails with Syslog Event class All.

CSCvb61055

Security Intelligence synchronization failure results in disk becoming full.

CSCvb61156

Resolved an issue where, if a Firepower Management Center running Version 6.1.0 managed a device running a version earlier than Version 6.1.0, Firepower did not generate any new discovery events and removed the network map several days after the Firepower Management Center updated to Version 6.1.0.

CSCvb61480

In some cases, if Firepower processed SIP packets, traffic containing voice or video content might have appeared distorted or experienced latency.

CSCvb61836

Resolved an issue where Firepower logged extraneous policy information during deployment and, in some cases, deploying large policies failed.

CSCvb65648

Resolved an issue where, if you deployed an access control policy containing an identity policy that referenced a realm or access control rules containing groups or users from the realm and you deleted the realm, Firepower incorrectly generated a System defined Objects cannot be Altered. Please use a different Object error and you could not edit the access control policy.

CSCvb66591

If you configured a realm for an Active Directory (AD) server to download users and groups, then created a Firepower Management Center high availability pair and the downloads contained large amounts of users and groups, Firepower Management Center high availability registration failed.

CSCvb67568

Resolved a rare issue where, if you created a realm and deployed an access control policy containing rules, then clicked Download users and groups and configured a User Agent connection, the user to group mapping became incorrect and access control rules using groups did not match when it should.

CSCvb68226

SFR upgrade to 6.1 causes constant failover between ASA FirePOWER module high availability pair.

CSCvb69742

6.0.0 pre install 5.4.0.999 nfp kernel modules fail to unload followed by outage.

CSCvb69906

Intermittently, if you created a realm and deployed an access control policy containing rules, then downloaded users and groups (including scheduled downloads), the user-to-group mapping could become incorrect, and access control rules using groups might not have matched when they should have.

CSCvb70125

Resolved an issue where policy deploy failed if you configured captive portal on a Firepower Management Center then updated the Firepower Management Center and its managed devices, then tried to redeploy.

CSCvb74873

If you enabled SMB File Inspection in a file policy and deployed to a device managed by theFirepower Management Center, Firepower generated Primary detection engine exited unexpectedly warning messages, and Firepower could experience issues.

CSCvb75591

If you deployed a DNS rule with a blacklist action containing a Security Intelligence DNS feed, Firepower did not send the Security Intelligence events to the external syslog if one was configured.

CSCvb78786

Firepower ignored security zone constraints on network discovery rules if the network discovery policy contained rules constrained by zones that included interfaces from multiple devices. This condition was present if the rules used single zones with interfaces from multiple devices (for example, Zone 1 included interfaces from Device 1 and Device 2) or multiple rules used different zones (for example if Rule 1 used Zone 1, which included interfaces from Device 1, and Rule 2 used Zone 2, which included interfaces from Device 2).

CSCvb79079

Resolved an issue where, if you added a syslog alert to an access control rule and deployed on an ASA FirePOWER module managed by ASDM, the device incorrectly generated excessive logging from prefilter policies.

CSCvb80872

Resolved an issue where, in some cases, updating a system to Version 6.1.0 and deploying to a registered device generated a Deployment failed in policy and object collection. If problem persists after retrying, contact TAC error message.

CSCvb88561

Resolved an issue where, if Firepower processed HTTP traffic containing XFF headers, Firepower experienced issues and generated erroneous detection engine health warnings.

CSCvb91730

Attempting to change copper SFP interface type (inline/switched/routed) results in error.

CSCvb91613

Snort cores after reload when processing XFF addresses.

CSCvb94411

In some cases, if you deployed an SSL policy containing an SSL rule with the action set to Do Not Decrypt placed above an SSL rule with the action set to Decrypt - Resign, Firepower incorrectly identified the sessions as undecryptable and matched against the wrong rule with an undecryptable action instead of the correct rule.

CSCvb97742

7000 and 8000 Series devices with low memory could experience a traffic outage and not recover.

CSCvc05323

Resolved an issue where snort restarts caused Firepower to generate extraneous NGFW Rule Engine Failed to write connection event log messages.

CSCvc08057

Resolved an issue where Firepower Threat Defense devices experienced Snort cores while performing QoS rate limiting on destination interface objects.

CSCvc08912

No input validation on Firepower Threat Defense Platform Setting syslog Logging Filter.

CSCvc09761

Cannot delete multiple rules at a time from ASA migrated Prefilter Policies.

CSCvc10655

Resolved an issue where deploying policies to a Firepower Threat Defense device failed after updating to a new Firepower version.

CSCvc14561

Resolved an issue where the Firepower Management Center web interface was not available after enabling compliance mode.

CSCvc26880

Resolved an issue where, if a Firepower 8350 device or AMP8350 device produced an unusually large stream of messages on the serial port console or, if you enabled it, the Lights-out Management (LOM) console, the device became unresponsive.

CSCvc30591

eStreamer should use correct datastore for user identity mapping.

CSCvc31852

Resolved an issue where the Firepower Management Center Tasks tab displayed an incorrect amount of time taken for policy deployment.

CSCvc36047

Having 0 at the object service PING service icmp echo 0 causes migration to fail.

CSCvc37923

Resolved an issue where Firepower did not recover from a disk write error caused by disk full even after the disk full issue was resolved, causing excessive logging.

CSCvc37927

Import fails with duplicate object name when the object names differs by case only.

CSCvc44398

URL not extracted from reassembled requests.

CSCvc49641

Snort process segfaults processing traffic in firewall.

CSCvc49789

OptimizeTables.pl always fails on 6.1.0.

CSCvc53628

Available Ports tab hangs when editing prefilter rule ports.

CSCvc54134

Resolved an issue where, when a Firepower Threat Defense high availability pair simultaneously rebooted, the pair continuously rebooted until the failover cable was removed.

CSCvc55170

Firepower Management Center login stops working if resume sync is selected after upgrade.

CSCvc58398

Firepower Management Center warnings needed during high availability configuration that configuration on the standby Firepower Management Center will be wiped.

CSCvd78303

Resolved an issue where the Firepower Threat Defense device running Version 6.1.0.1 or Version 6.1.0.2 stopped passing traffic after 213 days of uptime and experienced a range of issues from limited connectivity to a traffic outage.

Chapter 12. Known Issues

The following tables address known issues open at the time of publication of these release notes. For an updated list of known issues, run the provided query in the Bug Search Tool.

- Known Issues in Version 6.2.0.3

- Known Issues in Version 6.2.0.2

- Known Issues in Version 6.2.0.1

- Known Issues in Version 6.2.0

Known Issues in Version 6.2.0.3

The following table addresses open caveats at the time of publication of these release notes. If you have a Cisco support contract, use the following dynamic queries for an updated list of open caveats, run the provided query in the Bug Search Tool:

- Open Firepower Management Center caveats in Version 6.2.0.3

- Open Firepower Management Center Virtual caveats in Version 6.2.0.3

- Open ASA FirePOWER Module caveats in ASA Version 9.7.x

Caveat ID Number

Description

CSCve34221

Internal server error seen on the UI when we enable CC mode

CSCve70800

Prebuilt reports fail to generate immediately due to DiskManager handling of drains

CSCvf27180

Time to upgrade from 6.2.0.3-362 to 6.2.2-1310 takes too long -- 3hr 27mins.

CSCvf61706

White-List page throws error when automatically populated from Analysis > Hosts events page

Known Issues in Version 6.2.0.2

The following table addresses open caveats at the time of publication of these release notes. If you have a Cisco support contract, use the following dynamic queries for an updated list of open caveats, run the provided query in the Bug Search Tool:

- Open Firepower Management Center caveats in Version 6.2.0.2

- Open Firepower Management Center Virtual caveats in Version 6.2.0.2

- Open ASA FirePOWER Module caveats in ASA Version 9.7.1.x

Caveat ID Number

Description

CSCvd78319

User groups are not available in access control rule after switching to ASDM management

CSCve45573

Internal error message while loading access control policy in Japanese environment

CSCve49858

AMP file detection on windows SMB shares fails after drive is mapped for 30 minutes or more.

CSCve29893

ASA to Threat Defense 6.1.0.2 Migration tool introduces special character "#" to migrate rules

CSCve54036

Mis-match between actual device version and Management Center stored version causes deploy failures

CSCvc24310

Correlation events showing up with random SI Category

CSCve02220

estreamer certificate generates errors with a McAfee ESM generationQualifier verification failed

CSCve53812

SFDataCorrelator still in local management mode after deployed from Management Center

CSCvd63482

SSL Policy goes out of date after Firepower Threat Defense failover

CSCve46186

Snort memcals for startup memory incorrect on Firepower Threat Defense

CSCve45238

Smart Licensing registration fails even after importing CA Cert into Trusted CA Objects

CSCve54719

Policy deployment failure when PF setting contains Security Zone associated with multiple interface

CSCve49778

Threat Defense ICMP platform settings security zones with multiple interfaces not handled properly

CSCvd29934

synchronization and dhcpd daemon exited 100 time(s) while Registering

CSCvc46599

Error message "Unable to translate SSL cipher suite 65535" needs cleaning up

CSCvd74319

Manager gets deleted after upgrade on Firepower 9300 - 6.2.0.1-41

CSCvd58745

ADI process exits one time while registering Firepower Threat Defense device routed/transparent mode

CSCvc16688

Domain join with subdomain with broader object schema fails

CSCve46036

SFDataCorrelator segfault due to null field in internally generated logoff event

CSCvc22001

Should not allow configuration of multiple realms pointing to the same domain.

CSCve55696

UIMP continues to attempt import for deleted users

CSCve45994

User session propagation in Management Center stalls if bookmark is set to the future then corrected

CSCvb63380

Deleting a user from the Firepower Management Center does not function

Known Issues in Version 6.2.0.1

The following table addresses open caveats at the time of publication of these release notes. If you have a Cisco support contract, use the following dynamic queries for an updated list of open caveats, run the provided query in the Bug Search Tool:

- Open Firepower Management Center caveats in Version 6.2.0.1

- Open Firepower Management Center Virtual caveats in Version 6.2.0.1

- Open ASA FirePOWER Module caveats in ASA Version 9.7.1.x

Caveat ID Number

Description

CSCvd78319

User groups are not available in AC rule after Offbox to Onbox switch

CSCvd63482

SSL Policy goes out of date after FTD failover

CSCvc11489

NGFW NAT policy apply failure after editing IPv6 network object

CSCvd29934

synchronization and dhcpd daemon exited 100 time(s) while Registering a FTD to FMC

CSCvd92322

ICMP Any in dst/src ports are saved incorrectly, which can result in broken pre-filter policy

CSCvd71863

After a patch upgrade from 6.2.0-362, software version is not being updated in DatabaseInfo

CSCvd74319

Manager gets deleted after upgrade on SSP3RU - 6.2.0.1-41

CSCvd58745

ADI process exited one time while registering FTD routed or transparent mode to 6.2.0.1-36 FMC

CSCvc16688

Domain join with subdomain with broader object schema fails

CSCvc22001

Should not allow configuration of multiple realms pointing to the same domain.

CSCvc24051

When user cannot be identified change user display from 'Unknown' to something more intuitive

CSCvb63380

Deleting a user from the FMC does not function

Known Issues in Version 6.2.0

Caveat ID Number

Description

CSCun43602

The configured IPv6 address for an ASA FirePOWER module does not display when you run the show module 1 details CLI command.

CSCuw79243

If you deploy an intrusion policy to a clustered or stacked 7000 and 8000 Series devices (in Version 6.0.0 known as a high availability pair), Firepower incorrectly counts all devices in the cluster or stack rather than indicating one device for the cluster or stack.

CSCuv86562

Traceback: ASA crash in thread name fover_health_monitoring_thread.

CSCuy65203

If you deploy an intrusion policy with Drop when Inline enabled, intrusion events that use the detection_filter keyword and are set to drop and generate now display Dropped instead of Would be dropped.

CSCux67809

Executing the show crypto key mypubkey rsa CLI command on an ASA FirePOWER running Firepower Threat Defense erroneously generates device output.

CSCux64898

In some cases, if you deploy an access control policy with the default action set to Block and execute the configure network management-interface disable-event-channel CLI command, Firepower continues to generate intrusion and connection events when it should not.

CSCux65770

In some cases, if you attempt to log into Firepower with the incorrect password, Firepower incorrectly locks you out of Firepower after two attempts instead of three attempts.

CSCuz17020

Snort is not able to decode traffic.

CSCuz70987

run_qemu_kvm.sh core dumped on 5506 when device low on memory.

CSCuz81740

The Firepower Threat Defense device overwrites core files configuration of FXOS when it should not.

CSCva40041

If you enable failopen on a series 3 device configured with inline sets and then update the device, the device may incorrectly drop link connectivity for up to 10 seconds before it goes into hardware bypass mode.

CSCva40867

If you switch an ASA FirePOWER module from being managed by ASDM to being managed by an Firepower Management Center and the initial device registration fails, but the device eventually successfully registers to the Firepower Management Center, the network map does not update the status of the device after the failed registration attempt and the Firepower Management Center does not generate an connection events or file events for the device when it should.

CSCva54597

Firepower does not deploy the correct Regular Expression Limits default values within the access control policy when you deploy configuration.

CSCva74166

The show environment CLI command does not work on Firepower Threat Defense devices.

CSCvb11320

If you edit latency-based performance setting values on the Advanced tab of the access control policy editor page and deploy to a registered Firepower Threat Defense device, Firepower does not save the correct latency rule values when it should.

CSCvb39435

If you deploy a file policy to a device with an excessive amount of endpoints configured, Firepower may experience high CPU use and network latency. As a workaround, redeploy configuration.

CSCvb46169

GRE tunnel flow matches QoS rule ID 0.

CSCvb61021

The show ipv6 ospf neighbor CLI command does not work on Firepower Threat Defense devices. As a workaround, execute the system support diagnostic-cli CLI command and then execute the show ipv6 ospf neighbor CLI command again.

CSCvb61805

Firepower Device Manager 5506 deployment takes about a minute more in Version 6.2.0.

CSCvb62117

You cannot change the master role, remove a unit, or execute on a selected unit from a clustered Firepower Threat Defense device via the following CLI commands: cluster primary security module, cluster exec unit, and cluster remove unit. To use these commands, you must include the unit number as seen from the output of the show cluster info CLI command:

cluster master unit unit-1-1.

CSCvb62508

Missing suboptions under capture command from converged cli to capture only blacklisted blocked packets.

CSCvb75308

Rate Limiting may not take effect on trusted FTP/TFTP data channel in a cluster deployment.

CSCvb77003

Firepower Device Manager- Unable to filter connection events using zones.

CSCvb79547

If you are using ASDM to manage an ASA FirePOWER module, access control policy comparison does not work. This means you cannot display the differences between your running configuration and your planned changes.

CSCvb80626

In rare cases, Firepower Threat Defense Virtual with low memory allocation does not detect some of intrusion policy violations.

CSCvb88724

The clear conn CLI command on the Firepower Threat Defense device only allows you to enter a single IP address for the source or destination; any connections matching the IP address for either the source OR destination are cleared. The CLI help shows that you can enter both a source and destination IP address, but you can only enter 1 address.

CSCvb92548

ASA matches incorrect ACL with object-group-search enabled.

CSCvc01792

Some Firepower Threat Defense commands are model-specific, but may be visible on non-supported models. If you enter an unsupported command, you see the following error: -ERROR: % Invalid input detected at '^' marker. Check your command in the Firepower Threat Defense Command Reference Guide for model limitations.

CSCvc03720

The clear mac-address-table CLI command is only supported on devices deployed in transparent mode when it should be supported on devices deployed in transparent and routed mode. As a workaround, execute the system support diagnostic-cli CLI command for devices deployed in routed mode.

CSCvc05098

If the active Firepower Management Center of a high availability pair fails and the standby Firepower Management Center continues to process traffic while the pair is in a degraded state, then the active Firepower Management Center recovers, Firepower incorrectly displays unknown user for events generated during the degraded state for up to 24 hours before correcting.

CSCvc09167

Firewall rules may not be in sync with firmware rules following policy apply.

CSCvc26721

Management interface receives no traffic after port flap or failover on 5506/5508/5516.

CSCvc35890

If you deploy configuration, Firepower may experience a prolonged amount of time writing syslogs and incorrectly trigger Automatic Application Bypass (AAB) when it should not.

CSCvc38425

ASA with FirePOWER module generates traceback and reloads.

CSCvc41387

If you click the help icon next to the filter textbox, Firepower incorrectly generates an Error 404: Page not found error. As a workaround, search the Online Help Help > Online for intrusion policy keywords.

CSCvc46502

If intra-clustered Firepower Threat Defense devices configured with passive mode or inline tap interfaces experience fragmented traffic, virtual reassembly may fail and the device incorrectly drops traffic. As a workaround, restart the device.

CSCvc50022

Firepower may not be able to process as many HTTP connections in Version 6.2.0 compared to Version 6.1.0.

CSCvc51442

Firepower Threat Defense virtual: ESXi standalone having trouble with serial number.

CSCvc51459

If you run the managed_pruning.pl CLI command on an Firepower Management Center and click Purge Event database & (2), the script generates an extraneous warning after purging the database.

CSCvc52879

Reloading Active unit in Active/Standby ASA failover pair is not triggering a failover.

CSCvc53140

OSPF retransmissions and VPN tunnels lost after Active ASA reload.

CSCvc53558

If you add a 10GB management interface to a Firepower Management Center, adding fails and Firepower generates an unable to change mode for eth2 error.

CSCvc54069

If you create a VPN connection with a reverse route that is same as the already present static route on a Firepower Threat Defense device, then restart the device, the static route breaks and you cannot successfully use the VPN connection.

CSCvc55105

The web interface pages of a Firepower Management Center running Version 6.2.0 takes longer to load than the pages of a Firepower Management Center running Version 6.1.0.x

CSCvc55674

A resource depletion issue can occur on the ASA 5516-X if more than 500 concurrent IPsec or SSL connections are established to the unit. This is unrelated to the maximum IPsec/IKE endpoint count and pertains only to IPsec (either ESP or NAT-T) or SSL connections. The resource depletion will trigger an error and prevent new IPsec or SSL connections from being created to the unit. This issue is specific to the ASA 5506/5508/5516-X family of devices, but is most likely to be seen with the ASA 5516-X. No other ASA FirePOWER modules are affected by this issue.

CSCvc56526

CEP records edit page take minutes to load.

CSCvc56717

In some cases, if Firepower experiences a database error and you attempt to create a domain, you may not be able to delete a domain or move a device to a domain.

CSCvc56746

The Objects page in the FC2000 and FC4000 web interface takes more time to load in Version 6.2 compared to Version 6.1.x.

CSCvc56767

The FC2000 web interface takes more time to save an access control policy in Version 6.2 compared to Version 6.1.x.

CSCvc56919

Traffic drops for reverse UDP/TCP IPv6 traffic over IPv4 tunnel.

CSCvc58132

When upgrading Firepower Threat Defense, Firepower may fail to detect applications during the upgrade. Issue will be automatically resolved once deployment is manually triggered post upgrade.

CSCvc58296

In some cases, if you update Firepower and configure Open Shortest Path First (OSPF) in the Dynamic Routing tab of the Virtual router page (Devices > Devices Management > Virtual routers > Dynamic Routing), Firepower does not display the available routes when it should. As a workaround, restart the managed device.

.

CSCvc58453

Firepower Threat Defense devices running FXOS Version 2.1.1(64) do not support Firepower Version 6.1.0.

CSCvc58272

ASA incorrectly processing negative numbers in wrappers, resulting in graphical webvpn issue.

CSCvc58398

Firepower Management Center warnings needed during high availability configuration that configuration on standby will be wiped.

CSCvc59613

If you assign both an active and standby MAC address to a registered Firepower 4100 series or Firepower 9300 high availability pair with the Add Interface MAC Address option in the High Availability tab of the Integration page System > Integration and deploy, then edit the interfaces and delete the interface, Firepower does not delete the MAC address associated with the interface after synchronizing the pair and redeploying fails. As a workaround, delete both the interface and the MAC address associated with the interface, then synchronize changes and redeploy.

CSCvc59811

If you place an access control rule configured to Allow a subdomain URL (site.example.com) above an access control rule configured to Block the domain URL (example.com), the system may block request to subdomain URL. As a workaround, create an access control to Allow each subdomain URL (site.example.com, site2.example.com, etc.) you do not want blocked instead of the rule to block the domain URL, then save and redeploy.

CSCvc60254

SIP: 200 OK messages with multiple seqments not reassembled correctly.

CSCvc62252

Tracking route is up while the reachability is down.

CSCvc62492

ASA: File system becomes read-only after very long up time.

CSCvc62556

Traceback in ASA Cluster Thread Name: qos_metric_daemon.

CSCvc63722

Report Generation of large no of Events is failing.

CSCvc63954

ASA traceback in Thread Name: Event mib process.

CSCvc64050

ASAConfig uses wrong interface IDs after slave unit rejoins multi context ASA cluster.

CSCvc65262

After Snort restart, UDP processing performance may decrease.

CSCvc65409

Traceback observed on gtpv2_process_msg on cluster.

CSCvc65470

In some cases, connection events and security intelligence events generated from identity policy activity show the Initiator User 0 instead of the username.

CSCvc65528

Pages in the MC4000 web interface take more time to load in Version 6.2.0 compared to Version 6.1.x.

CSCvc68358

The show lacp CLI command does not work on ASA 5585-X devices.

CSCvc74395

If you deploy an access control policy containing an access rule with Original Client IP, logging enabled and an SSL rule with the default actions set to Decrypt - Resign, Firepower does not display the Action and Access control rule columns of some generated events in the Connection Events page Analysis > Connections > Connection Events.

CSCvc75561

If you use non-ASCII characters in a Flex Config object, the Flex Config policy fails to deploy. As a workaround, replace the non-ASCII characters with the ASCII equivalents.

CSCvc76439

If you create a GID:135 intrusion rule, the rule does not save and Firepower generates a failed to set the rule state error.

CSCvc79719

SMB upload - Malware block miss on first attempt.

CSCvc81525

In rare cases, Firepower Threat Defense devices managed by the Firepower Device Manager and ASA with FirePOWER Services devices managed with ASDM can experience an exhaustion of database handles, which prevents any attempt to upgrade to Version 6.2.0. Prior to running the upgrade, contact Cisco TAC to enable upgrade by restarting the appropriate processes.

CSCvc82066

If you update a Firepower Management Center from Version 6.1.0 to 6.2.0 and deploy, deployment may fail and Firepower may generate a mtu 9188 ^ ERROR: % Invalid input detected at '^' marker. error message. As a workaround, change the MTU value before you update to Version 6.2.0.

CSCvc92934

If you deploy an access control policy containing an access control rule configured to Allow a subdomain URL (site.example.com) placed before an access control rule configured to Block the domain URL (example.com) that references an SSL policy with decryption enabled, the system may inconsistently match traffic against the HTTPs certificate instead of the actual URL and navigating to the subdomain may get blocked when it should not.

Chapter 13. For Assistance

Thank you for choosing Firepower.

For information on obtaining documentation, using the Cisco Bug Search Tool (BST), submitting a service request, and gathering additional information about Cisco NGFW and NGIPS devices, see What’s New in Cisco Product Documentation at: Click Here .

Subscribe to What’s New in Cisco Product Documentation, which lists all new and revised Cisco technical documentation, as an RSS feed and deliver content directly to your desktop using a reader application. The RSS feeds are a free service.

If you have any questions about installing or running Firepower, contact TAC Support:

- Visit the Cisco Support site at Click Here .

- Email Cisco Support at mailto:tac@cisco.com.

- Call Cisco Support at 1.408.526.7209 or 1.800.553.2447.

Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: Click Here . Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)

Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.