Table of Contents

ISA3000-Release-Notes.fm

Release Notes for the Cisco ISA 3000 Industrial Security Appliance

The following release notes support the Cisco ISA 3000. These release notes are updated to describe new features, limitations, troubleshooting, recommended configurations, caveats, and how to obtain support and documentation.

Contents

This publication consists of the following sections:

- Image Information and Supported Platforms

- Related Documentation

- Known Limitations

- Caveats

- Obtaining Documentation and Submitting a Service Request

Image Information and Supported Platforms

Note You must have a Cisco.com account to download the software.

The following images support the ISA 3000:

- ASA 9.4(1.225) asa941-225-lfbff-k8.SPA

- ASDM 7.5(1)

- SFR 5.4.1.211 Base (1-Feb-2015) 5.4.1.2-23 Patch (21-Jul-2015)

- Defense Center 5.4.1 Patch (18-Feb-2015) 5.4.1.2-38 Patch (25-Aug-2015)

- CSM 4.9 (17-Aug-2015)

Related Documentation

The following documentation is available:

- Product Document of Compliance for the Cisco ISA 3000 Industrial Security Appliance

http://www.cisco.com/c/dam/en/us/td/docs/security/Firewalls/ISA3000/ISA3000-PDOC.pdf

- Cisco ISA 3000 Industrial Security Appliance Hardware Installation Guide

http://www.cisco.com/c/dam/en/us/td/docs/security/Firewalls/ISA3000/ISA3000-HIG.pdf

- Open Source Used In ISA-3000-2 Cisco Adaptive Security Appliance 9.4.1 TTM

http://www.cisco.com/c/dam/en/us/td/docs/security/Firewalls/ISA3000/ISA-3000-OSD.pdf

- Navigating the Cisco ASA Series Documentation

http://www.cisco.com/en/US/docs/security/asa/roadmap/asaroadmap.html

- Release Notes for the Cisco ASA Series, 9.4(x)

http://www.cisco.com/c/en/us/td/docs/security/asa/asa94/release/notes/asarn94.html

- Release Notes for Cisco ASDM, 7.5(x)

http://www.cisco.com/c/en/us/td/docs/security/asdm/7_5/release/notes/rn75.html

- ASDM Software Downloads

https://software.cisco.com/download/release.html?mdfid=279513399&softwareid=280775064&release=7.5.1&relind=AVAILABLE&rellifecycle=&reltype=latest

Known Limitations

This release has the following limitations or deviations for expected behavior:

The ISA 3000 software does not support the hardware provided alarm LEDs. Under extreme CPU temperature conditions (too warm or too cold) the Alarm Out LED will turn RED.

If you upgrade your version of FirePOWER to 5.4.1.2, in some cases, if you register a ISA FirePOWER module to your Defense Center and reboot the ISA FirePOWER module, the data channel connection between the Defense Center and the VMware tool on the virtual ASA device experiences a disruption in connectivity. As a workaround, re-register your ISA device. (CSCuu18450).

Please refer to FirePOWER 5.4.12 release notes at:

http://www.cisco.com/c/en/us/td/docs/security/firesight/5403/relnotes/FireSIGHT-System-Release-Notes-version5403-and-5412.html

Caveats

Caveats describe unexpected behavior in Cisco software and hardware releases. Caveats listed as open in a prior release are carried forward to the next release as either open or closed (resolved).

If you are a registered Cisco.com user, view more information about each caveat using the Bug Toolkit at the following website:

http://tools.cisco.com/Support/BugToolKit/

The following sections list caveats for Cisco release name:

Open Caveats

- CSCuv43805

Ping failed with an MTU size of 256 and a fragment packet size of 3000 and above.

Conditions:

1. Login to ASA

2. fragment size 256 outside

3. fragment chain 256 outside

4. mtu outside 256

Workaround:

None

- CSCuv10417

After mode change from transparent to routed mode l2tp-ipsec ssl-clientless is missing.

Conditions:

Switch over between transparent to routed mode.

ciscoasa(config)# show firewall

Firewall mode: Transparent

ciscoasa(config)# show running-config all | in vpn-tunn -----------> available

vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec ssl-clientless

ciscoasa(config)# configure factory-default

ciscoasa(config)# no firewall transparent

ciscoasa(config)# show firewall

Firewall mode: Router

ciscoasa(config)#

ciscoasa(config)# show running-config all | in vpn-tunn --------------> Missing

vpn-tunnel-protocol ikev1 ikev2

ciscoasa(config)#

Workaround:

Using the clear configure all CLI command to get missing parameter in VPN feature.

ciscoasa(config)# clear configure all

ciscoasa(config)# show running-config all | in vpn-tunnel

vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec ssl-clientless

- CSCuu66121

If the modbus preprocessor rules are enabled, and the preprocessor is disabled, the preprocessor is not automatically enabled by snort.

Workaround:

None

- CSCuu18450

Health events process is not re-started on DC after registered ASA

Symptom:

Sensor loses heartbeat.

This caveat might also affect NTP/sfipproxy because restarting sfmb service also restarts the sfipproxy service.

Workaround:

None

End-User License Agreement

For information on the end-user license agreement, go to http://www.cisco.com/go/warranty.

Obtaining Documentation and Submitting a Service Request

For information on obtaining documentation, using the Cisco Bug Search Tool (BST), submitting a service request, and gathering additional information, see What’s New in Cisco Product Documentation at: http://www.cisco.com/en/US/docs/general/whatsnew/whatsnew.html.

Subscribe to What’s New in Cisco Product Documentation, which lists all new and revised Cisco technical documentation, as an RSS feed and deliver content directly to your desktop using a reader application. The RSS feeds are a free service.

© 2012-2015 Cisco Systems, Inc. All rights reserved.