The Secure Firewall 3130 and 3140 now support these network modules:

• 2-port 100G QSFP+ network module (FPR3K-XNM-2X100G)

See: Cisco Secure Firewall 3110, 3120, 3130, and 3140 Hardware Installation Guide

The Firepower 9300 now supports these optical transceivers:

• QSFP-40/100-SRBD

• QSFP-100G-SR1.2

• QSFP-100G-SM-SR

On these network modules:

• FPR9K-NM-4X100G

• FPR9K-NM-2X100G

• FPR9K-DNM-2X100G

See: Cisco Firepower 9300 Hardware Installation Guide

The performance profile settings available in the platform settings policy now apply to the Secure Firewall 3100. Previously, this feature was supported on the Firepower 4100/9300, the Secure Firewall 4200, and on threat defense virtual.

See: Configure the Performance Profile

You can now create network groups in addition to network objects while editing a NAT rule.

See: Customizing NAT Rules for Multiple Devices

Device management services configured in the threat defense platform settings (NetFlow, SSH access, SNMP hosts, syslog servers) are now supported on user-defined Virtual Routing and Forwarding (VRF) interfaces.

Platform restrictions: Not supported with container instances or clustered devices.

See: SD-WAN Summary Dashboard

Upgrade impact. Update custom authentication forms.

You can configure active authentication for either an LDAP realm; or a Microsoft Active Directory realm or a realm sequence. In addition, you can configure a passive authentication rule to fall back to active authentication using either a realm or a realm sequence. You can optionally share sessions between managed devices that share the same identity policy in access control rules.

In addition, you have the option to require users to authenticate again when they access the system using a different managed device than they accessed previously.

If you use the HTTP Response Page authentication type, after you upgrade threat defense, you must add <select name="realm" id="realm"></select> to your custom authentication form. This allows the user to choose between realms.

Restrictions: Not supported with Microsoft Azure Active Directory.

New/modified screens:

• Policies > Identity > (edit policy) > Active Authentication > Share active authentication sessions across firewalls

• Identity policy > (edit) > Add Rule > Passive Authentication > Realms & Settings > Use active authentication if passive or VPN identity cannot be established

• Identity policy > (edit) > Add Rule > Active Authentication > Realms & Settings > Use active authentication if passive or VPN identity cannot be established

Determines whether or not users are required to authenticate when their authentication session is sent to a different managed device than one they previously connected to. If your organization requires users to authenticate every time they change locations or sites, you should disable this option.

• (Default.) Enable to allow users to authenticate with any managed device associated with the active authentication identity rule.

• Disable to require the user to authenticate with a different managed device, even if they have already authenticated with another managed device to which the active authentication rule is deployed.

New/modified screens: Policies > Identity > (edit policy) > Active Authentication > Share active authentication sessions across firewalls

You can generate, view, and download (as a zip file) the following reports on configuration changes since your last deployment:

• A policy changes report for each device that previews the additions, changes, or deletions in the policy, or the objects that are to be deployed on the device.

• A consolidated report that categorizes each device based on the status of policy changes report generation.

This is especially useful after you upgrade threat defense devices, so that you can see the changes made by the upgrade before you deploy.

New/modified screens: Deploy > Advanced Deploy.

See: Download Policy Changes Report for Multiple Devices

The management center has changed its direct-download location for software upgrade packages from sourcefire.com to amazonaws.com.

See: Internet Access Requirements

The Download Latest Update scheduled task no longer downloads maintenance releases; now it only downloads the latest applicable patches and VDB updates. To direct-download maintenance (and major) releases to the management center, use System () > Product Upgrades.

See: Software Update Automation

For VDB 363+, the system now installs a smaller VDB (also called VDB lite) on lower memory devices running Snort 2. This smaller VDB contains the same applications, but fewer detection patterns. Devices using the smaller VDB can miss some application identification versus devices using the full VDB.

Lower memory devices: ASA-5508-X and ASA 5516-X