Features and Issues
September 30, 2026
- September 30, 2026 features
- September 30, 2026 resolved issues
August 7, 2026
- August 7, 2026 resolved issues
May 29, 2026
- May 29, 2026 features
- May 29, 2026 resolved issues
April 24, 2026
- April 24, 2026 features
- April 24, 2026 resolved issues
February 19, 2026
December 15, 2025
November 20, 2025
August 14, 2025
Open issues

Features and Issues

September 30, 2026

September 30, 2026 features

Table 1. Device management features in Version 20260925
Feature	Minimum Threat Defense	Details
Version 10.1.0 Firewall Threat Defense	10.1.0	You can now manage Version 10.1.0 of Firewall Threat Defense with Cloud-Delivered Firewall Management Center. Refer to Cisco Security Cloud Control: Secure Firewall Threat Defense Management.

Table 2. Encrypted traffic handling features in Version 20260925
Feature	Minimum Threat Defense	Details
DNS inspection for DNS over HTTPS and DNS over QUIC	10.1.0	You can now use DNS policies to handle decrypted DNS over HTTPS (DoH) and DNS over QUIC (DoQ) traffic, including DoH over HTTP/1.1, HTTP/2, and HTTP/3. Sinkhole actions support only A and AAAA DNS record types. For DNS over HTTP/3 and DNS over QUIC, the Sinkhole and Domain Not Found actions cannot inject a sinkhole address or an NXDOMAIN response; those actions behave as Block.
Enhanced encrypted traffic visibility for SSH and STUN	10.1.0	The encrypted visibility engine (EVE) can now derive fingerprints from SSH key exchange initiation and STUN binding request attributes, and identify client processes for SSH and STUN traffic. This information is available in connection events and EVE dashboards, and can be used for policy enforcement. Refer to View Encrypted Visibility Engine events.

Table 3. Health monitoring features in Version 20260925
Feature	Minimum Threat Defense	Details
Identity mapping limits monitoring for Secure Firewall 200	Any	The Identity Limits Monitor health module for the Secure Firewall 200 monitors two download limits and generates alerts when either limit is exceeded: A cumulative limit of 10,000 user sessions, SXP/SGT mappings, endpoint profiles, and dynamic objects. A separate limit of 10,000 user-group mappings. When a limit is reached, the device stops downloading objects for the affected category. Refer to Health alerts for the Secure Firewall 200.

Table 4. Identity features in Version 20260925

Feature

Minimum Threat Defense

Details

Higher identity mapping limits (Beta)

10.1.0

More efficient memory use allows most devices to support more identity mappings, which associate IP addresses with identity information.

The native instance (application mode) limit is based on model. Except for the Secure Firewall 200, most devices at least doubled their previous limit. The container instance (multi-instance mode) limit depends on available memory and also increased for instances with 24 GB or less and 256 GB or more RAM. We also greatly increased the maximum number of user groups and dynamic objects you can use in an access control policy.

The system uses two health modules to alert you to issues related to mappings. The Snort Identity Memory Usage health module alerts when identity memory use is high. The Identity Limits Monitor health module for the Secure Firewall 200 alerts when the device exceeds its mapping limits.

Refer to Maximum mappings per device for the new maximum values.

Note

This is a Beta feature with Firewall Threat Defense Version 10.1.0. Support may be limited. Taking full advantage of the new maximums can increase memory use on the device. Carefully evaluate and monitor memory use in larger deployments, and apply identity mapping filters if necessary.

Microsoft Entra ID RA VPN as an identity source (Beta)

10.1.0

You can now use Microsoft Entra ID-authenticated remote access VPN sessions for identity-based access control. When a user authenticates with Microsoft Entra ID using SAML, the system correlates the VPN session with user and group data from the corresponding Entra ID realm. You can then use this identity information in access control rules. You do not need to configure a separate identity policy.

Deployment restrictions: Not supported with clustered devices.

Note

This is a Beta feature with Firewall Threat Defense Version 10.1.0. Support may be limited.

Refer to Remote Access VPN for Microsoft Entra ID-authenticated users.

Passive identity without the dynamic attributes connector

Any

You can now configure the passive identity agent identity source without enabling the dynamic attributes connector.

Refer to Identity Source: Passive Identity Agent.

Resynchronize identity information on managed devices

10.1.0

When a device’s identity information is missing, incomplete, or out of sync with Cloud-Delivered Firewall Management Center, rules with user conditions may not match traffic as expected. A new Resynchronize identity option on the Device Management page reinitializes the identity feed connections and resynchronizes user identities from Cloud-Delivered Firewall Management Center to the device. Use this action only after standard troubleshooting, and generate troubleshooting files for Cloud-Delivered Firewall Management Center and devices before you begin. The reinitialization may briefly interrupt ongoing user sessions.

Refer to Resynchronize identities.

Table 5. Logging and analysis features in Version 20260925
Feature	Minimum Threat Defense	Details
Default logging for new access control rules	Any	By default, connection logging is disabled in new access control rules—except Monitor rules, which automatically log the ends of monitored connections. You can now change this default so that connection logging is enabled in new access control rules. Changing the default does not change existing rules, and logging remains configurable for individual rules. For rules with Block actions, you can enable default beginning-of-connection logging. For rules with Allow, Trust, and Interactive Block actions, you can enable default beginning- or end-of-connection logging. If you change a rule’s action, the system replaces the rule’s logging settings with the defaults for the new action. To configure this setting, use the access control preferences, which apply to all access control policies on Cloud-Delivered Firewall Management Center: Administration > Configuration > Access Control Preferences. Refer to Configure access control preferences.
Cluster syslog class	10.1.0	Firewall Threat Defense now provides a `cluster` syslog class for messages in the 747, 748, and 785 ranges. You can set the logging level and destination for all cluster-related messages as a group. Refer to Syslog message classes and associated message ID numbers

Table 6. Public and private cloud features in Version 20260925
Feature	Minimum Threat Defense	Details
Firewall Threat Defense Virtual compute options for public clouds	10.1.0	We added support for these cloud compute options for Firewall Threat Defense Virtual: Alibaba Cloud ECS instance families: c7nex, c8i, c8ine, and c9i AWS EC2 instance families: C6id, C7a, C7i, C7i-flex, M5, M6a, M6i, M6in, M7a, M7i, M7i-flex, R6i, R6id, and R7i Azure VM sizes: Standard_D8s_v6 and Standard_D16s_v6 Google Cloud Compute Engine machine types: t2d-standard-4, t2d-standard-8, and t2d-standard-16 OCI compute shapes: VM.Standard.E5.Flex and VM.Standard.E6.Flex Refer to Cisco Secure Firewall Threat Defense Virtual Getting Started Guide, Version 10.1.
Unlimited performance tier (FTDvU) for AWS	10.1.0	Firewall Threat Defense Virtual for AWS now supports an unlimited performance tier (FTDvU). This tier does not rate limit and the remote access VPN session limit depends on the allocated resources: 20,000 sessions with 32 vCPU and 64 GB RAM 32,000 sessions with 64 vCPU and 128 GB RAM Refer to Deploy Firewall Threat Defense Virtual Unlimited.

Table 7. Routing features in Version 20260925
Feature	Minimum Threat Defense	Details
Multicast routing over static virtual tunnel interfaces	10.1.0	You can securely deliver real-time multicast applications, such as video streaming, financial data feeds, and data replication, over your VPN infrastructure by using IPsec tunnels configured with static VTI. Refer to Multicast routing over static virtual tunnel interface tunnel.
Support for up to 250 virtual routers on the Secure Firewall 4200 and 6100	10.1.0	Secure Firewall 4200 and 6100 now support up to 250 virtual routers. Previously, the limit was 100. Refer to Maximum number of virtual routers by device model.

Table 8. Threat detection and application identification features in Version 20260925
Feature	Minimum Threat Defense	Details
Expanded Snort ML inspection for web traffic	10.1.0	Expanding its coverage of web-based threats, the snort_ml inspector now examines URL queries, URL-encoded POST data, and multipart/form-data POST data in addition to the HTTP URI. Also, the inspector is now enabled in the security over connectivity default policies. Previously, it was only enabled in maximum detection. Refer to SnortML.

Table 9. Troubleshooting and serviceability features in Version 20260925
Feature	Minimum Threat Defense	Details
BGP-4 MIB support for SNMP monitoring	10.1.0	You can now monitor BGP peer connections on Firewall Threat Defense devices using SNMP polling of the BGP-4 MIB. The supported objects provide BGP peer state, administrative status, total inbound and outbound messages, the number of transitions into the Established state, and the time since the peer entered—or was last in—the Established state. BGP over IPv6 and VRF- or context-specific data are not supported. Refer to Supported tables and objects in MIBs.
Scheduled diagnostic data collection	10.1.0	Use the Firewall Threat Defense CLI to schedule diagnostic `show` commands to run in the background and log their output. New CLI commands are: `system support monitor`: schedule tasks for data collection `show monitor`: view active scheduled tasks or details for a specific task `clear monitor`: stop an individual task or all tasks Platform restrictions: Not supported with Secure Firewall 200. Refer to system support monitor, show monitor, and clear monitor.

Table 10. Upgrade features in Version 20260925
Feature	Minimum Threat Defense	Details
All-or-none option for unattended device upgrade	Any	When you start an unattended upgrade, a new Require all devices to be eligible to advance option allows you to enforce an "all or none" requirement. If a selected device cannot upgrade for any reason, no devices upgrade. For example, if one device cannot get the upgrade package or pass required checks, the entire process stops. Disable this option to let eligible devices proceed independently. Refer to Upgrade Firewall Threat Defense in unattended mode.

Table 11. URL filtering features in Version 20260925
Feature	Minimum Threat Defense	Details
Contextual information on HTTP response pages	Any	You can now include contextual information when you block a website to help your users understand why it happened. This includes basic information like the requested URL and its category and reputation, but can also include session details like username, application, protocol, source and destination addresses and ports, geolocation, and the matching access control rule. To use this feature, configure a custom HTTP response page in the access control policy. In the HTML, use variables to show the information you want. For example, use `{{REPUTATION}}` to show the URL reputation. For a full list of supported variables, see the online help.

Table 12. Zero trust access features in Version 20260925

Feature

Minimum Threat Defense

Details

Universal ZTNA enhancements

10.1.0

Upgrade impact. Upgrading a universal ZTNA device interrupts traffic until the post-upgrade deploy.

Universal ZTNA has these enhancements:

Additional model support. Universal ZTNA no longer requires 16 cores and is now supported on all device models.
No reboots. To minimize disruption, enabling or disabling universal ZTNA requires only a deployment, not a device reboot.
IPv6 support. Universal ZTNA now supports IPv6 for connections to the device, and connections from the device to protected applications. The outer and inner connections can use different IP versions. IPv6 source NAT is also supported.
Automatic trustpoints. When you deploy universal ZTNA, the system automatically creates the trustpoints required for certificate-based authentication with Secure Access.

Note

Due to framework changes, upgrading a universal ZTNA device to Version 10.1+ from older versions disables the feature. Traffic is interrupted until you deploy from Cloud-Delivered Firewall Management Center.

Refer to Universal Zero Trust Network Access.

September 30, 2026 resolved issues

This table lists the resolved security issues in this software release.

Table 13. Resolved security issues in Cloud-Delivered Firewall Management Center Version 20260925
ID	Headline
CSCun06870	Controller-card force reload on httpd task when specific HTTP packets
CSCup24077	Multiple Vulnerabilities in OpenSSL - June 2014
CSCur05790	SORA / evaluation for CVE-2014-6271 and CVE-2014-7169
CSCvm39026	Cisco Prime Network Registrar Cross-Site Request Forgery Vulnerability
CSCvn20662	Cisco Prime Network Registrar Denial of Service Vulnerability
CSCvs77733	Cisco Prime Network Registrar DHCP Denial of Service Vulnerability
CSCvw29606	N9K: Software crash due to Platform Manager service
CSCvw89875	Cisco NX-OS Software Unauthenticated Arbitrary File Actions Vulnerability
CSCwo75024	Columns missing from event partitions
CSCwr31700	RADIUS external auth doing one request per interface when bad username/password attempted
CSCwr32596	Missing Policy Based Routes on FMC PBR Page
CSCwr99016	FMC should fail the policy deployment in case of any interface/zone installation issues.
CSCws03165	Cannot replace FDM UI certificate due to "SSP Server Unavailable" error
CSCws15477	FMC unified events exclude filtering is not working when integrated with SAL
CSCws25319	Restarting Talos agent process leads to resetting the talos agent health file
CSCws34032	ASA/FTD - 'logging tcp-block-reduction' CLI Commands for TCP Syslog Queue Management
CSCws50416	Snort 3 Rule update not working if version field not updated

This table lists the resolved functional issues in this software release.

Table 14. Resolved functional issues in Cloud-Delivered Firewall Management Center Version 20260925
ID	Headline
CSCub86784	Circuits pane in CTC is not refreshed
CSCuh16026	15454: AR-MXP cocaLc reset issue +CONTBUS alarm
CSCuh68008	PSK value of wlan gets to its default by reconfiguringOtherWlanParameter
CSCuh96104	AQI Alarm Threshold cannot be configured using GUI
CSCui31588	UTS: TNC-E STBY OSC link has pkt loss over a long period of activity
CSCui32078	CT5760 channel 120, 124, 128 are unselectable in DCA List
CSCui85802	11.91EMP: AP high availability config and AP Static IP Address Issue
CSCul38239	Consecutive attempts for SSH login/logout causing TNC forcible reload
CSCul50623	MXP-10x10G: TNC crash setting Loopback=Terminal on 100G_LC_C trunk port.
CSCva49095	diagnostics.sh [FAIL]: numd-site-2 spr node is not available
CSCvb20460	ChangeCredentialUsernameRequest not working when remotedb are configured
CSCvb56017	ChangeSubscriberAvps does not properly delete specific AVPs
CSCvc05055	Zones drawn using cmx do not synchronize to prime
CSCvi22335	Change to use address list option for RFC 5549 support
CSCvk05917	Running with DNSSEC and DNS64 may cause crashes
CSCvk37162	TCP translations unable to delete in a specific scenario
CSCvk45018	BFD is blocked over Unnumbered Interfaces
CSCvm86368	Old HA messages remain stalled over new ones
CSCvn03816	Use of release-grace-period can cause issues with DHCPv4
CSCvn43874	DNS64 may return NODATA instead of synthesized resource records
CSCvn49047	CPNR installation/upgrade fails with krb5-libs-1.15.1-34.el7.x86_64 rpm version
CSCvn59292	Primary Channel Name characters limited to 30 under DPI Settings, needs to be extended
CSCvn59343	Import from Devices is failing for an output TS with a custom PID defined, with custom stream type
CSCvn66597	REST GET request for CCMRRSets can hang
CSCvn80051	Resilient-reserved - both streaming - TSs are only switched for one lineup upon backup
CSCvo02059	Backup failover partner can run low or out of Prefix Delegation Leases
CSCvo06487	DNS does not include OPT RR in TCP responses to DNS queries
CSCvo06952	Lease is not failover-updated for long periods
CSCvo17243	Error while importing services from device on scrambling tab if output TS without ONID / TSID exists
CSCvo47961	Evaluation licenses do not work with CPNR 10.0
CSCvp01612	Server may fail to remove stale DHCPv6 reservation leases
CSCvp35481	Higher convergence for Multi-Site BGW with External Connectivity on restore
CSCvp38509	DNS update returns SERVFAIL when update contains duplicate entries
CSCvp40356	Windows DHCP server sends IPv6 responses twice
CSCvp44505	CCM can crash connecting to cluster with v4 and v6 addresses
CSCvr13333	Assure systemctl daemon-reload is done after updating nwreg service file
CSCvr37252	Extensions that put dhcp-parameter-request-list option can hang DHCP server
CSCvr52416	DHCPv4 option 118 is not echoed back to client as required by RFC3011
CSCvr87868	Automatic replica polling may fail for some clusters
CSCvr98740	Sample lease notification client can hang if output is to file
CSCvs07064	CDNS may fall back to using root hints instead of exceptions
CSCvu30191	Glean traffic from HSRP standby generates syslog %ARP-4-OWN_SRCMAC: on HSRP active
CSCvu39141	Web UI can crash with long options configuration
CSCvu42328	N3500 NAT may create stale tcp translation entries with zero time-left
CSCvu64601	High memory usage after streaming high volume of telemetry data for more than 6 days
CSCvu92422	Server can leak memory when Failover is used with Prefix Delegation
CSCvv01406	EIGRP Neighbor flapped when adjust the time to past
CSCvv11391	DME init sequence race condition exposed in 64-bit image
CSCvv17653	N3500 blackholes twice NAT out- >in traffic in WARP mode with inside mutipath
CSCvv22051	KIM : Downstream VNI 1:n support
CSCvv41340	Telemetry with certificate over IPv6 fails
CSCvv55774	N9k/VXLAN VLAN - IGMP snooping enabled, IGMP Membership Query Source pruning failure
CSCvv60794	Multicast routing over GRE in VRF fails
CSCvv65514	Telemetry - Unable to retrieve data for the dn
CSCvv65667	MAC ACL + MAC packet classification could not let IPv6 NS/NA pass through in N9K-C93600CD-GX
CSCvv69606	N9K-GX \| 9.3(x) \| Interface down or CDP/UDLD/BFD traffic impacted due to transceiver speeds on quad.
CSCvv71655	Vxlan l2fm/mtm core seen during static mac install
CSCvv80860	Nexus switch "sla_sender" crash
CSCvv92396	Banner: VSH Process crash seen during "show banner motd" command execution
CSCvv95514	N9K: Telemetry - Ignore bash escape sequence before actual string
CSCvv96721	Nexus 3K/9K: CDP core due to signal 6 upon receiving CDP packet
CSCvv99888	Default routed pbr-statistics not counted if more than one object-group in ACL
CSCvw02706	DEVICE_TEST-2-AUTHENTICATION_FAIL: Module 27 ACT2-Instance-2
CSCvw23087	N9K: Command parsing error on configuring an interface as a trunk
CSCvw29402	TCAM region carving lost for ing-sup after ASCII reload/replay on Tahoe EOR
CSCvw30328	copy r s getting aborted %SYSMGR-3-CFGWRITE_SRVFAILED
CSCvw33231	ACLQOS Process Crash due to Heartbeat Failure
CSCvw33260	J-WR: Netstack cored@ ip_enabled, ip_static_route_is_intf_ready performing ND ISSU from bin - > upg
CSCvw35337	VXLAN BGP EVPN: flapping NGOAM-blocked port causes loop to go undetected
CSCvw36505	Macsec ports in Auth-pending state after changing to should secure policy with Empty keychain
CSCvw37437	HW resource leak in polcfgtable due to flaps of port-channel with multiple members and storm-control
CSCvw41589	Nexus 3K/9K - VRRP with object tracking leading to Master-Mater
CSCvw42160	Jericho: TX Mcast discards(congestion) are not reported under "show interface/show int counter err".
CSCvw42667	dhcp_snoop process may crash
CSCvw48498	N9K - NXAPI : %SAFE_STR CONSTRAINT: strncpy_s: slen is zero, error code=401
CSCvw48872	Memory leak in pltfm-config process, PC_MEM_acl_compat_cfg_t
CSCvw49048	JSON formatted outputs inconsistent with unicast routing table.
CSCvw49456	Nexus switch "ipfib" crash
CSCvw51632	Elysian_TOR: Observing PTP port flap which is connected to STU(GM)
CSCvw54690	VXLAN EVPN: BGP failed to import EVPN route when VNI is up
CSCvw55744	When NAT Sampling timeout is configured, TCP translation timeout never takes effect
CSCvw56696	NXOS: VLAN Manager crashes with VLAN mapping configuration change
CSCvw57079	Steady CPU load increase once the number of SNMP TCP sessions exceeds 30
CSCvw57171	DCNM 11.4.1 device discovery using SVI causes devices to be stuck in migration mode
CSCvw58434	seeing NAT core on running NAT sanity in N3548 in J release
CSCvw59799	Hairpin of L2 multicast NLB KA frames on the same interface it was received
CSCvw60407	TAH-MOD L3VPC - BGP/OSPF dont come upon when control traffic comes via MCT
CSCvw60409	HSRP vmac is not cleared and remains as static entry after shutting down SVI.
CSCvw60736	N9K-C9348GC link up delay after reloaded
CSCvw64503	Target port on SLA (udp-jitter) probe is getting changed to a new one other than the configured port
CSCvw64700	J-rel/WF/SNMP: Spinners FRU-CONTROL-MIB OIDs has incorrect values
CSCvw66700	N3600/N9500-R does not send arp request for glean vxlan encapsulated IP traffic
CSCvw68515	J: BGP-3-BFD_SES_ADD: error Failed to create too big mts msg - Multihop bfd is not installed
CSCvw68897	segmentation fault on call home service turn on after enabling smart license
CSCvw69648	'vpc orphan-port suspend' configuration can't be removed on interfaces associated to vPC PO
CSCvw70948	vPC BGW : multisite bgp-if is up for 30s after peer-link failure on vpc secondary
CSCvw71912	Improper error message printing causing RPM crash
CSCvw75391	n9k TRM L2/L3 mixed mode anchor DR wont form OILs after recovery from maintenance mode
CSCvw76953	"ip routing multicast holddown 0" does not propagate in running config
CSCvw78632	Elysian_TOR: Wrong delivery order and incorrect Timestamp(T1) carried by Follow-up pkt
CSCvw78982	High memory usage by "MRIB" process on 9.3(3)
CSCvw80134	VPC Vxlan:Traffic drop after exiting maintenance mode
CSCvw80210	On N9K-C9332C - 100G macsec links stop forwarding traffic
CSCvw81012	Nexus Crash In HSRP Engine process after Configuring 250+ HSRP Groups
CSCvw81106	STOMP generated on heavenly when using 1G xcvr
CSCvw82677	Cosmetic: Resource temporarily unavailable message hitting while collecting tac-pac or sh tech det
CSCvw83952	VXLAN EVPN Loop Detection failing
CSCvw84051	ISIS routes are not removed from routing table when the interface goes down.
CSCvw85172	not able to configure port_counters on Tahoe EOR
CSCvw86078	N9k:-FX and Other Platforms - DHCP Binding lease will not refresh
CSCvw89757	Ethpm Process Memory Leak in ETHPM_MEM_pm_cfg_tlv_t
CSCvw92732	Vfc interface mode should not be set to E
CSCvw97160	VXLAN BUM Loop in fabric
CSCvx00033	copp_pss_restore_match_cfg: Failed to add match to copp db
CSCvx00331	N3K-C36180YC-R Not Forward BUM Traffic received on VLAN range (3968 to 4047 and 4094)
CSCvx01231	Enh: Add more debug capability for N9K EOR PSU flap
CSCvx02717	After upgrade 9.x N9k cannot be downgraded via install all
CSCvx04061	Incorrect NIV programming after changing from VPC HIF to orphan port
CSCvx07013	"no negotiate auto" command missing after upgrade to 7.0(3)I7(9)
CSCvx09137	Nexus 9K Linecard Memory Leak in /tmp/logs/l2mcast_lib.log
CSCvx10027	N3548X: Unidirectional traffic towards vPC legs dropped at MCT link after downstream switch reload
CSCvx14495	Nexus 3548/3548X : Flood traffic dropped on some members of L2 PO after reload
CSCvx16469	J-rel : netflow CLIs not responding with 2 millions of flows
CSCvx19094	36180 may experience system power loss during ATS switchover
CSCwh04468	Connection events sent to Syslog Server has "unknown" syslog facility
CSCwh51909	Message for upgrade_resume.sh failure failure due to resuming on /new-root should be enhanced
CSCwn37490	ACP copy not possible in Firepower Management Center
CSCwn58286	Policy deployment failure after creating domains in FMC
CSCwo81874	'configure network management-data-interface' allows to configure same IP on data and mgmt interface
CSCwq39149	Manually Downloading VDB Update Requires Manually Refreshing the Web Browser to get the VDB Update to be Displayed on the Page
CSCwq61583	FMC API: RAVPN sub-endpoints are unstable (When concurrent GET API calls are made, some might fail returning 404 'Resource not found' error for available UUIDs)
CSCwr00252	Policy Import failure: Object ID Collision Causes ClassCastException
CSCwr07401	Disabled manual nat rule is replacing the almost replica manual NAT rule
CSCwr10103	System support trace logging random port numbers for packets encapsulated in AH header.
CSCwr31381	FMC SNMP alerts due to daemon exited after upgrade
CSCwr57566	Unable to create interface object with a "same" name as earlier when we had a network connectivity issue
CSCwr63381	Cannot register ftd to cdFMC, if there are more than 1000 ACPs
CSCwr65973	Allow upgrade_rollback.sh to handle mysqld in User Disabled status
CSCwr74751	Device- >Certificates page not loading with error "Error in fetching certificate details"
CSCwr76081	security intelligence block list event logging can't be disabled
CSCwr87762	deployment to FTD from cdFMC after migration from on-prem FMC failed due to handling of DHCP IPv6 pool object
CSCwr87834	Improve logging for correction actions that would lead to mark the network discovery policy dirty
CSCwr95502	RADIUS External authentication doesn't work after migration between FMC platforms.
CSCwr96253	UI does not display dynamic objects when API request does not have ObjectType:IP field
CSCwr98702	FMC May Display URL Filtering Registration Failure Alerts Despite Successful URL FilteringUpdates.
CSCwr98814	'Convert and auto-import' option from the policy sync tab, is currently not correctly copying overridden rule actions to Snort3 rules.
CSCws03538	Policy Export/Import Issue, Users not getting imported to the access control rule.
CSCws04267	Searching with '_3' returns multiple unrelated device matches within Device Listing page
CSCws06997	FTD upgrade failed at 999_z_must_remain_last_finalize_boot.sh
CSCws08837	Device certificate parsing fails on FMC UI when FXOS timezone is set to numeric POSIX format TZ
CSCws10193	Unused Network/Host objects do not include group objects
CSCws15230	FMC Audit Logs for configuration change entries show FMC IP instead of FMC Hostname in host field.
CSCws16081	Incorrect Numbering and Missing Policy Rules in ACP Reports on FMC GUI.
CSCws18263	FTD-side fix for Message asa_log_client exited 1 time(s) seen multiple times
CSCws20043	FMC HA- Stale alert not removed from standby FMC after disabling the health module
CSCws21169	High availability configuration is removed during registration of FTD in suspended state
CSCws21377	SFDataCorrelator process on the FMC was stuck during initialization
CSCws22782	FMC's API response contains "-1" for port values
CSCws24166	FMC Realms GUI Time::Piece parsing error upon navigation in FMC GUI
CSCws26939	reader command fails to process vpn event unified log files
CSCws27027	DB Integrity checks failing due to broken permissions/references for custom IDS rule
CSCws28726	Platform settings missing in FMC REST API response for Firepower 3100/4200 multi-instance logical devices
CSCws31878	External auth login for FTD managed by a newer FMC version may fail for new changes done on the server
CSCws33395	FTD Upgrade failure: '999_z_must_remain_last_finalize_boot.sh' Script Fails Due to Missing/Inaccessible 'messages' File in 'var/log'
CSCws38637	Remove old source-fire NAT policy system for new versions
CSCws39245	Actual username does not appear in SSL policy under child domain only
CSCws47377	Misleading FMC Health Policy description claims threshold support for ASP Drop alerts where none exists
CSCws49517	FMC assigns protocol value -9999 when 'All' is selected and port is manually entered in access-list rule
CSCws60512	FMC login fails with 'Unable to authorize access' due to API Explorer not logging out user sessions
CSCws61866	Upload package post Restore is failing with "Permission Denied" Error
CSCws64717	Deployment fails when interface has . or _ symbol
CSCws67580	FMC: Geolocation database updates not synchronized to standby FMC in high availability pair
CSCws68981	Deployment Failure while removing Passive Interface in OSPF and Interface configuration at the same time
CSCws69152	VMSBackend is not starting with 6GB heapspace in 4700
CSCws82789	Unable to Edit or Delete Unused Intrusion Policies After Migration
CSCws82823	CLISH locks up for other commands and deploy is stalled when ping or traceroute is executed in CLISH and cannot be aborted
CSCws84421	When the FMC language is set to Japanese, the Device Name changes to an IP address.
CSCws91813	The EoRevisionStore table shows a pattern of size increase early in the week followed by pruning at week's end.
CSCws92318	FMC: Deployments fail when secondary FTD is active in HA due to SF tunnel reconnection race condition
CSCws98494	FMC unable to start CSDAC if primary DNS server is inaccessible or cannot properly resolve addresses
CSCws98529	Fatal error: Error running script 200_pre/500_stop_system.sh while upgrading FTD MI-HA
CSCwt03935	Allow new Radius user login when Radius user reached maximum limit
CSCwt10812	Deployment failure on WM device post FMC upgrade - Failed to download required packages
CSCwt39899	Partial domain deletion removes FTD from domains
CSCwt76773	Add a upgrade pre-check for duplicate object names and fix them accordingly
CSCwt90730	lamplighter "java.lang.OutOfMemoryError: Java heap space" errors in feed_data_manager.log
CSCwu06620	FMC Site-to-Site VPN dashboard shows lower IPv4 VTI tunnel count than Site-to-Site VPN topology page for the same topology
CSCwu16308	Backend processing fail for Domain name change, update this process to revert the changes
CSCwu26480	FMC Displays Green Status After Standby FTD is Removed from the Network
CSCwv18841	Azure Marketplace template sets incorrect size for FTDv

August 7, 2026

August 7, 2026 resolved issues

This table lists the resolved security issues in this software release.

Table 15. Resolved security issues in Cloud-Delivered Firewall Management Center Version 20260722
ID	Headline
CSCwt81457	Cisco Secure Firewall Management Center Software Session Fixation Issue
CSCwt95974	Cisco Secure Firewall Management Center Software Authentication Bypass Vulnerability
CSCwt95997	Cisco Secure Firewall Management Center Software Static Credential Vulnerability

This table lists the resolved functional issues in this software release.

Table 16. Resolved functional issues in Cloud-Delivered Firewall Management Center Version 20260722
ID	Headline
CSCwt27532	Access to UI from specific IP Address getting blocked
CSCwt87846	Deployment Preview, rollback version are missing resulting in preview , rollback functionality not working
CSCwu00518	Allow User Configuration to Restrict Number of Parallel Backups in Configuration File
CSCwu23327	FMC may partially persist configuration when REST API session replacement overlaps activity approval, contributing to integrity and deployment failures with policy/configuration
CSCwu36751	cdFMC getting deployment failure due to the failure in resolving the object
CSCwu54055	FMC UI - VPN configuration save takes very long
CSCwu60911	Device registration or Save operations fails
CSCwu60954	Occasionally cdFMC crossLaunch immediately logs the user out
CSCwv23051	FMC fails to upload AnyConnect/Secure Client images exceeding 200 MB
CSCwv24858	Snort 3 system-defined rule action override fails when the rule belongs to multiple same-named rule groups
CSCwv31630	Block deployment if device is participating in VPN topology where data is corrupted (manifesting in a way that the topology isn't seen on the UI)
CSCwv52841	cdFMC: FTD backups are failing

May 29, 2026

May 29, 2026 features

Table 17. Features in Version 20260506
Feature	Supported Threat Defense	Details
Administration
Device Backup Enhancements: Improved Usability and Scalability	Any	The device backup process has been reengineered with an intuitive user interface, delivering enhanced usability and optimized system performance. Key improvements: Advanced Search: Locate devices efficiently by filtering results based on device type and device groups. Unified Backup Notifications: Monitor backup progress through a consolidated dashboard. View aggregate counts for successful, running, and failed backups, or drill down into individual device tracking for large-scale operations. This update also includes node-level progress monitoring for cluster devices. Node-Level Restore: Download backups for specific nodes within a cluster for restoration, providing greater granularity and control. Streamlined Device Actions: Execute bulk operations efficiently by selecting devices, clusters, or groups through a simplified checkbox interface. Downloadable Reports: Export job-level backup progress reports to facilitate troubleshooting and expedite collaboration with Cisco TAC.
Enhanced Performance	7.4.7 and upcoming releases	Optimizes backup performance to significantly reduce processing time for high-volume devices.
Device Management
Maximum Firewall Threat Defense Devices Supported	Any	Cloud-Delivered Firewall Management Center supports up to 2,000 Firewall Threat Defense devices per deployment. This total can include a combination of standalone devices, devices in high-availability pairs, and devices that are cluster nodes.
Policy Management
NAT Templates	Any	NAT templates provide predefined NAT configurations for common use cases, helping administrators quickly create NAT rules with minimal manual input. NAT templates are useful when configuring standard outbound internet access or publishing internal resources to external networks. The internet access template creates a dynamic Auto NAT rule that translates traffic from internal hosts to the destination interface IP address. The internal resource access template creates a static Auto NAT rule that maps an internal resource to a translated address so that the resource is reachable from an external network. New/modified pages: Policies > Network Policies > NAT

May 29, 2026 resolved issues

This table lists the resolved security issues in this software release.

Table 18. Resolved security issues in Cloud-Delivered Firewall Management Center Version 20260506
ID	Headline
CSCwt25941	Multiple command injections in Remote::SF::Troubleshootingtool (only targets FTD)
CSCwt25947	Command injection in Remote::SF::Troubleshootingtool::deviceDeleteLogFiles (only targets FTD)

This table lists the resolved functional issues in this software release.

Table 19. Resolved functional issues in Cloud-Delivered Firewall Management Center Version 20260506
ID	Headline
CSCwo65977	Security Zones show "No Data" when attempting to edit ACP policies rules in FMC GUI post 7.7 upgrade - Indexing issue
CSCws92132	SASE: Restrict the tunnel ID field to 30 characters and custom IKE identity string
CSCws82979	Dynamic object not being updated in FMC when ADI has problems with ADI.conf
CSCws99933	Unable to Access the Access Control Policy.
CSCwt29200	FTD OOM due to hundreds of concurrent SF::DataService::Client::ProcessManifest calls invoking exec_perl.pl processes
CSCwt34022	Scheduled Task (schedule) for device backup has removed the unregistered device from its list for FTD HA device
CSCwt60089	Prometheus snapshot failing on cdFMC due to too many open files.
CSCwb83546	Default External Browser Package needs to be updated
CSCws94688	DAP Records fetch group policies displayed by their UUID instead of names (policies beyond the first 25 listed alphabetically due to the limit of 25 set when grouppolicies called in DAP)
CSCwt34828	The chassis actual status is Offline, but it shown as healthy in the new UI
CSCwt35794	Admin with RO Object Permissions unable to add Static Route for named interfaces

April 24, 2026

April 24, 2026 features

Table 20. Features in Version 20260315

Feature

Supported Threat Defense

Details

Model migration

Migrate Firepower 1100 to Secure Firewall 1200

See feature details

You can now use Cloud-Delivered Firewall Management Center to migrate configurations from the Firepower 1100 to the Secure Firewall 1200, with these version requirements:

Source device (Firepower 1100): Version 7.3+
Target device (Secure Firewall 1210): Version 7.6+
Target device (Secure Firewall 1230, 1240, and 1250): Version 7.7+

Refer to Migrate Firewall Threat Defense devices.

Migrate Firepower 2100 to Secure Firewall 1200

See feature details

You can now use Cloud-Delivered Firewall Management Center to migrate configurations from the Firepower 2100 to the Secure Firewall 1200, with these version requirements:

Source device (Firepower 2100): Version 7.4+
Target device (Secure Firewall 1210): Version 7.6+
Target device (Secure Firewall 1230, 1240, and 1250): Version 7.7+

Refer to Migrate Firewall Threat Defense devices.

Usability

Device Management page enhancements

Any

A redesigned user interface has been launched for the Device Management page, offering better usability and enhanced performance.

Key improvements include:

Advanced Search: Find devices more easily using multiple device-related criteria for more precise results.
Device Status Banner: Quickly view the number of devices in Normal, Error, and Offline states, displayed with a color-coded legend for easy identification.
Performance Enhancements: Enjoy faster page loading time and pagination that supports up to 1,000 devices per page.
Streamlined Device Actions: Perform device actions and bulk operations more efficiently through an intuitive side panel.
Centralized Troubleshooting: Access diagnostic tools such as Packet Tracer and Packet Capture from a single, convenient troubleshooting panel.

Note

This enhanced interface is currently in a preliminary phase. You can switch back to the legacy UI to access any features that are not yet available in the new interface.

Updated screens: Go to Devices > Device Management and enable the New Device Management UI toggle button.

April 24, 2026 resolved issues

This table lists the resolved issues in this software release.

Table 21. Resolved issues in Cloud-Delivered Firewall Management Center Version 20260315
ID	Headline
CSCwo65977	Security Zones show "No Data" when attempting to edit ACP policies rules in FMC GUI post 7.7 upgrade - Indexing issue
CSCws92132	SASE: Restrict the tunnel ID field to 30 characters and custom IKE identity string
CSCws82979	Dynamic object not being updated in FMC when ADI has problems with ADI.conf
CSCws99933	Unable to Access the Access Control Policy.
CSCwt29200	FTD OOM due to hundreds of concurrent SF::DataService::Client::ProcessManifest calls invoking exec_perl.pl processes
CSCwt34022	Scheduled Task (schedule) for device backup has removed the unregistered device from its list for FTD HA device
CSCwt60089	Prometheus snapshot failing on cdFMC due to too many open files.
CSCwb83546	Default External Browser Package needs to be updated
CSCws94688	DAP Records fetch group policies displayed by their UUID instead of names (policies beyond the first 25 listed alphabetically due to the limit of 25 set when grouppolicies called in DAP)
CSCwt34828	The chassis actual status is Offline, but it shown as healthy in the new UI
CSCwt35794	Admin with RO Object Permissions unable to add Static Route for named interfaces

February 19, 2026

Table 22. Features in Version 20260122
Feature	Minimum Threat Defense	Details
Device Management
Secure traffic using Cisco Secure Access and Firewall Threat Defense devices	Any	Cisco Secure Access is a cloud-based security service edge (SSE) solution that protects users from internet threats and enables secure access to the internet, SaaS applications, and private resources from any location. Secure Firewall seamlessly integrates with Secure Access for securing your traffic. Cloud-Delivered Firewall Management Center simplifies and automates the IPsec IKEv2 tunnel configuration from Firewall Threat Defense devices to Secure Access using the new SASE wizard. For more information, see Secure traffic using Cisco Secure Access and Firewall Threat Defense devices.

December 15, 2025

Table 23. Features in Version 20251121

Feature

Minimum Threat Defense

Details

Deployment and policy management

Simultaneous editing of access control policies by multiple users

Any

In previous releases, if two or more users simultaneously edited an access control policy, the first user who saved would retain their changes, and all other users would immediately lose all of their edits. Now, these users have the ability to selectively merge their changes, and changes that do not conflict with the first user’s saved changes will automatically be accepted. This improves collaboration between users and reduces the need to lock the policy during edits.

Tenable vulnerability management

10.0.0

Tenable Vulnerability Management is a platform that helps organizations understand, report, and manage known vulnerabilities. When used with the Cloud-Delivered Firewall Management Center, the Tenable connector creates a dynamic object with a list of IP addresses known to have Common Vulnerability Exposures (CVEs) and populates those IP addresses as host entries.

Real-time Policy Analyzer and Optimizer

Any

This feature detects and reports anomalies, such as shadowing or redundancy, in access control rules, when they are being created or edited in the Cloud-Delivered Firewall Management Center in order to streamline policy management. To use this feature, enable AIOps Insights in Security Cloud Control.

Encrypted traffic handling

New decryption policy user interface, including basic and advanced policy creation

10.0.0

Easily create standard decryption policies using a new interface tailored to the most common and effective scenarios, with single-page certificate management. Or, stick with the legacy wizard and advanced rules-based policy editor.

After Cloud-Delivered Firewall Management Center upgrade, existing policies are labeled as legacy policies and continue to work as before. You can switch from a standard policy to legacy, but not from legacy to standard.

Change server certificates without impacting decryption by using an internal certificate to decrypt/reencrypt traffic

10.0.0

You can now use a certificate and key defined in the decryption rule to decrypt traffic. This certificate and key can be the internal server's certificate or it can be a different certificate; in addition, you can change the certificate and key at any time. You can replace the certificate using the API, a system like the Automated Certificate Management Environment (ACME), or using Object Management.

Hardware

Secure Firewall 200

10.0.0

The Secure Firewall 200 is an affordable security appliance for branch offices and remote locations that balances cost and features. During deployment, the system alerts you to any unsupported configurations.

Version restrictions: In Version 10.0.0, the Secure Firewall 220 is the only supported device in the Secure Firewall 200 series.

Secure Firewall 6100

10.0.0

The Secure Firewall 6100 is an ultra-high-end firewall for demanding data center and telecom networks. It has exceptional price-to-performance, modular capability, and high throughput.

The Secure Firewall 6100 supports Spanned EtherChannel and Individual interface clustering for up to 4 nodes.

View field-replaceable memory module details for the Secure Firewall 6100

10.0.0

You can view details, including operational status, for the field-replaceable memory module on the Secure Firewall 6100.

New/modified screens: Choose Devices > Device Management, then edit the device and select the Device tab. In the System section, click View next to Inventory > Memory.

New/modified Firewall Threat Defense commands: show inventory

New/modified FXOS commands: show dimm detail

DC power supply for the Secure Firewall 4200

7.4.3, 7.6.2. 7.7.0

The FPR4200-PWR-DC for Secure Firewall 4200 is a 1500 W DC power supply. The dual power supply modules can supply up to 1500 W power across the input voltage range (48 VDC to 60 VDC). The load is shared when both power supply modules are plugged in and running at the same time.

Network module for the Secure Firewall 4200

10.0.0

The FPR4K-XNM-6X1SXF for the Secure Firewall 4200 is a 6-port 1-Gbps SFP hardware bypass network module that operates in SX multimode. This network module has built-in SFP transceivers.

High availability/scalability

More container instances (21) on the Secure Firewall 4225 in multi-instance mode

10.0.0

The Secure Firewall 4225 in multi-instance mode now supports 21 container instances. The previous limit was 14.

Cluster redirect: flow offload support for the Secure Firewall 4200 asymmetric cluster traffic

10.0.0

For asymmetric flows, cluster redirect lets the forwarding node offload flows to hardware. This feature is enabled by default but can be configured using FlexConfig.

When traffic for an existing flow is sent to a different node, then that traffic is redirected to the owner node over the cluster control link. Because asymmetric flows can create a lot of traffic on the cluster control link, letting the forwarder offload these flows can improve performance.

Added/modified commands: flow-offload cluster-redirect (FlexConfig), show conn , show flow-offload flow , show flow-offload info

IPsec flow offload for traffic on the cluster control link on the Secure Firewall 4200 in distributed site-to-site VPN mode

10.0.0

For asymmetric flows, cluster redirect lets the forwarding node offload flows to hardware. This feature is enabled by default but can be configured using FlexConfig.

Added/modified commands: flow-offload cluster-redirect (FlexConfig), show conn , show flow-offload flow , show flow-offload info

Identity

Identity-based dynamic access control

7.3.0 (AD realm)

7.4.0 (Azure AD realm)

Handle traffic based on real-time user posture and risk by correlating identity and device context (from Cisco ISE or pxGrid Cloud) with Cisco Identity Intelligence (from Microsoft Entra ID or Cisco Duo).

pxGrid Cloud identity source

7.3.0 (AD realm)

7.4.0 (Azure AD realm)

The Cisco Identity Services Engine (Cisco ISE) pxGrid Cloud Identity Source enables you to use subscription and user data from a Cisco ISE server or cluster Cisco ISE in access control rules.

Logging and analysis features

Send security events to Splunk or other SIEM via syslog

10.0.0

A new Splunk integration wizard (Integrations > Splunk) and updated logging options in access control make it easier to send security events to Splunk (or any other SIEM via syslog)..

Generate and send protocol-aware (enriched) inspector logs via syslog

10.0.0

You can generate protocol-aware (enriched) inspector logs for traffic that you specify. Send these logs via syslog to Splunk or to any syslog server configured as an alert.

To use this feature, enable advanced logging in your access control policy's advanced settings. Then, use access control rules to pinpoint the traffic where you want advanced logs. In those rules, enable the protocols you want to inspect.

To receive alerts when there are communication issues between devices and the syslog server, enable the Snort 3 Statistics module in the device health policy.

Packet data included with intrusion events sent to Cisco Security Cloud

10.0.0

Packet data is now included with intrusion events sent to Cisco Security Cloud.

Model migration

Migrate Firepower 4100/9300 to Secure Firewall 3100, 4200, and 6100

Any (source) 7.4.1 (target)

Migrate to the Secure Firewall 3100, 4200, and 6100 from:

Firepower 4112, 4115, 4125, 4145
Firepower 9300: SM-40, SM-48, SM-56

Migrate Firepower 1010 to Secure Firewall 200 and 1200

Any (source) 7.6.0 (target)

Migrate the Firepower 1010 and 1010E to the Secure Firewall 200 and 1200.

Performance and resiliency

Block depletion autorecovery for clusters

10.0.0

The firewall block depletion fault manager introduced in Version 7.7.0 now supports clustered devices. Fault monitoring is automatically enabled on new and upgraded devices. To disable, use FlexConfig.

Other performance and resiliency improvements

Feature dependent

We made performance and resiliency improvements to:

Deploying configuration changes
Event logging to external servers such as syslog or Cisco Security Cloud, for the Secure Firewall 4200 and 6100
Install and upgrade
High availability for Firewall Threat Defense
Snort ML
Zero-touch provisioning

Public and private cloud

Firewall Threat Defense Virtual for Microsoft Hyper-V

10.0.0

Firewall Threat Defense Virtual now supports Microsoft Hyper-V.

Larger default disk size and the ability to resize the disk post-deployment

10.0.0

Firewall Threat Defense Virtual supports dynamic disk expansion on all virtual platforms. This capability optimizes disk utilization on high-capacity systems (for example, systems with 64 vCPUs and 128 GB RAM), ensuring that large core dump files do not trigger disk-space alerts. The default disk size has also changed.

Unlimited performance tier (FTDvU) for VMware and KVM

10.0.0

Firewall Threat Defense Virtual for VMware and KVM now support an unlimited performance tier (FTDvU). This tier does not rate limit and the RA VPN session limit depends on the allocated resources:

20,000 sessions with 32 vCPU and 64 GB RAM
32,000 sessions with 64 vCPU and 128 GB RAM

Azure MANA NIC support

10.0.0

Firewall Threat Defense Virtual for Microsoft Azure now supports MANA NIC hardware, which is optimized for enhanced networking performance.

Supported instances: Standard_D8s_v5, Standard_D16s_v5

Nutanix AOS 6.8 support

10.0.0

Firewall Management Center Virtual and Firewall Threat Defense Virtual for Nutanix now support Nutanix AOS 6.8. This includes Virtual Private Cloud (VPC) support, whose flexible and cloud-like network segmentation and isolation allows you to effectively design and scale secure multi-tenant architectures.

OpenStack Caracal support

10.0.0

Firewall Management Center Virtual and Firewall Threat Defense Virtual for OpenStack now support the Caracal release.

OCI Ampere Compute instances

10.0.0

Firewall Threat Defense Virtual for OCI now supports Flex instances powered by an Ampere ARM-based processor. ARM architecture provides high performance with lower power consumption, enabling cost-efficient scaling.

Supported instances: VM.Standard.A1.Flex, VM.Standard.A2.Flex

Secure Boot and UEFI firmware support

10.0.0

Upgrade impact. You cannot revert from Version 10+ to Version 7.7 or earlier.

Firewall Threat Defense Virtual is now compatible with UEFI-based virtual machines. This modern firmware interface replaces legacy BIOS, improves boot performance, and provides enhanced hardware/VM compatibility.

Secure Boot ensures that only signed and trusted bootloaders, kernel modules, and drivers are executed when the VM starts. It improves the virtual appliances security.

These changes mean that you cannot revert virtual firewalls from Version 10+ to Version 7.7 and earlier. After upgrade, we also recommend you migrate configurations to freshly deployed Version 10+ instances and decommission the old ones.

Routing

Use PBR to handle traffic based on custom application patterns.

10.0.0

You can now use policy based routing to handle traffic using custom application patterns (basic supported from Version 7.7.0). Create an advanced custom application detector by uploading a Lua file with your detection pattern. Then, use the detector in an extended ACL in your PBR policy.

See: Policy Based Routing

IPv6 router advertisements assign RDNSS/DNSSL

10.0.0

You can now configure recursive DNS server (RDNSS) and DNS search list (DNSSL) options to provide DNS servers and domains to SLAAC clients using router advertisements.

New/modified screens: Devices > Device Management > Interfaces > Add/Edit Interfaces > IPv6 > Settings

New/modified commands: show ipv6 nd detail , show ipv6 nd ra dns-search-list , show ipv6 nd ra dns server , show ipv6 nd summary

Threat detection and application identification

Encrypted visibility engine (EVE) improvements

10.0.0 (widgets)

Any (all others)

Encrypted visibility engine (EVE) improvements include:

Configuration moved from the access control policy advanced settings to the main access control policy page (in the More drop-down list).
New monitor and protect modes. The monitor mode allows you to see verdicts without blocking.
Five-level threat confidence scale now only two levels: high and very high.
EVE is now automatically used for application detection when you enable EVE.
EVE exceptions are now objects, and are automatically shared across all access control policies.
Security-related connection events now include those for connections with malware processes detected by EVE at higher threat confidence levels.
New EVE widgets on the Summary Dashboard provide information on targeted resources, as well as on connections blocked over time. Note that new dashboard widgets only show data for Version 10+ devices.

Default ports in application-based access control rules

Any with Snort 3

For access control rules, a new Application Default option on the Applications tab lets you limit the rule to the application's default ports. You can also specify that the application be identified on Any port, which is the system's previous behavior.

Note that any specification on the Ports tab overrides these options. You can use the Ports tab to limit the rule to one, multiple, or a range of ports.

Dynamic objects and security group tags in DNS rules

10.0.0

You can configure DNS rules in the DNS policy to use dynamic objects or security group tags (SGT). If you are using these types of objects in access control rules already, you can now extend their use to your DNS policy.

We added the Dynamic Attributes tab to the add/edit DNS rule dialog box.

HTTP command line injection attack detection with Snort ML

10.0.0

Snort ML now detects HTTP command line injection attacks.

The snort_ml inspector is currently disabled in all default policies except maximum detection. The intrusion rule that generates an event when the snort_ml detects an attack (GID:411 SID:1) is also currently disabled in all default policies except maximum detection.

Portscan detection for clusters

10.0.0

You can configure threat detection at the cluster level. For nodes in a cluster, detection and prevention happen at the cluster level. Portscans can be detected when they happen across nodes or in an individual node. Shunned hosts are shunned on all devices in the cluster. Shuns are released at the same time on all nodes. Statistics are available at the cluster level.

Troubleshooting and serviceability

MTU ping test on cluster node join provides more information by trying smaller MTUs

Any

When a node joins the cluster, it checks MTU compatibility by sending a ping to the control node with a packet size matching the cluster control link MTU. If the ping fails, it tries the MTU divided by 2 and keeps dividing by 2 until an MTU ping is successful. A notification is generated so you can fix the MTU to a working value and try again. We recommend increasing the switch MTU size to the recommended value, but if you can't change the switch configuration, a working value for the cluster control link will let you form the cluster.

New/modified commands: show cluster history

Improved cluster control link health check with high CPU

Any

When a cluster node CPU usage is high, the health check will be suspended, and the node will not be marked as unhealthy. This feature is enabled by default when the CPU usage reaches 90% but can be configured using FlexConfig.

New/modified FlexConfig commands: cpu-healthcheck-threshold

Ensure temporarily unavailable nodes can rejoin an oversubscribed cluster

10.0.0

Prioritizing critical control traffic increases resiliency in high availability and clustered deployments, especially when forming high availability or rejoining a cluster during times of heavy load.

New/modified commands: show asp priority-polling , show cluster info trace , show failover trace

Deployment restrictions: Not supported with container instances

Platform restrictions: Supported with Secure Firewall 3100, 4200, and 6100 only

Use the packet tracer to modify PCAPs

10.0.0

You can now use the packet tracer to modify the source and destination IP address, source and destination port, and VLAN ID of a PCAP. In transparent mode, you can also modify the destination MAC address. You can then run a trace with the modified PCAP.

Generate a kernel dump on demand, or automatically on crash

10.0.0

You can now use the CLI to configure most hardware devices to generate a Linux kernel dump on crash. After you enable this feature, the device must reboot for it to take effect. Using the force keyword reboots the device and generates a kernel dump immediately. Or, manually reboot the device later. The upgrade automatically enables this feature.

New CLI command: system support kernel-crash-dump

Platform restrictions: Supported on all hardware devices except the Secure Firewall 200 and ISA 3000.

Recovery-config mode support for NAT and other interface commands

10.0.0

Recovery-config mode now supports NAT and related object and object-group commands.

It also supports the following interface commands:

duplex
fec
negotiate-auto
speed

These interface commands, in addition to shutdown, are not supported in recovery-config mode on the cluster control link or failover link.

New/modified diagnostic CLI (system support diagnostic-cli ) command: configure recovery-config

Platform restrictions: Not supported with the Firepower 4100/9300, ISA 3000, or virtual firewall. Not supported for the Secure Firewall 3100/4200 in multi-instance mode.

Minimal system logging

10.0.0

You can now configure minimal (notice and above) system logging. For most devices, the default is full logging. For the new Secure Firewall 220, the default is minimal logging.

New/modified CLI commands: system support logging-show , system support logging-full , system support logging-minimal

Upgrade

New device and chassis upgrade wizard

Any

A new, streamlined upgrade wizard makes it easier to select and prepare devices for upgrade, and to identify issues preventing upgrade.

Note that the Firewall Threat Defense wizard takes advantage of a new prepare-only option for unattended mode. This means that while the wizard copies packages and checks readiness, you may see messages about unattended mode running even if you did not explicitly start it.

Prepare-only and skip-checks options for unattended Firewall Threat Defense upgrade

Any

With unattended Firewall Threat Defense upgrades:

Prepare for upgrade only—copy packages and check readiness, but do not perform the actual upgrade.
Skip readiness checks for devices that already passed.

These new options are available when you start unattended mode.

New options for downloading upgrade packages

Any

You can now:

Prevent devices from downloading upgrade packages from the internet. That is, you can now require that devices get upgrade packages from the Cloud-Delivered Firewall Management Center or an internal server, even if the devices have internet access.
Specify how long devices retry failed downloads from an internal server or the internet. This setting does not apply to transfers between the Cloud-Delivered Firewall Management Center and device.

New/modified screens: Administration > Product Upgrades > Global upgrade settings

Usability

Redesigned menus for the Cloud-Delivered Firewall Management Center

Any

We redesigned the Cloud-Delivered Firewall Management Center menus to be more intuitive and consistent with the Cisco Security Cloud user interface. A main, single-column menu provides a subset of your most used items, while all items are visible in expanded mode. You can customize which items to include on the main menu to suit your priorities. Preferences are per user.

Existing and renamed top-level menus include:

Overview is now Insights & Reports
Analysis is now Events & Logs
Policies, Devices, and Objects are the same
Integration is now Integrations
System is now Administration and appears in the left navigation

New top-level menus include:

Secure Connections
Troubleshooting

Some submenus were moved to new main menu locations.

Device Management page enhancements

Any

A redesigned user interface has been launched for the Device Management page, offering better usability and enhanced performance.

Key improvements include:

Advanced Search: Find devices more easily using multiple device-related criteria for more precise results.
Device Status Banner: Quickly view the number of devices in Normal, Error, and Offline states, displayed with a color-coded legend for easy identification.
Performance Enhancements: Enjoy faster page loading time and pagination that supports up to 1,000 devices per page.
Streamlined Device Actions: Perform device actions and bulk operations more efficiently through an intuitive side panel.
Centralized Troubleshooting: Access diagnostic tools such as Packet Tracer and Packet Capture from a single, convenient troubleshooting panel.

Note

This enhanced interface is currently in a preliminary phase. You can switch back to the legacy UI to access any features that are not yet available in the new interface.

Updated screens: Go to Devices > Device Management and enable the New Device Management UI toggle button.

VPN

ACME-based TLS certificate management for remote access VPN

10.0.0

You can now use an ACME certificate to authenticate a managed device as an RA VPN gateway.

New/modified screens: Objects > PKI > Cert Enrollment > Add Cert Enrollment > Enrollment Type > ACME

New/modified commands: crypto ca trustpoint

Site-to-site VPN tunnels over IPsec VTIs preserve SGT metadata

10.0.0

Cisco TrustSec uses security group tags (SGTs) to control access and enforce traffic on a network. This option enables SGT propagation over SVTIs and DVTIs of route-based and SD-WAN VPN topologies. To enable SGT propagation on a specific SVTI or DVTI, configure it in individual devices.

New/modified screens:

Secure Connections > Site-to-Site VPN & SD-WAN > SD-WAN Topology > Advanced Settings
Secure Connections > Site-to-Site VPN & SD-WAN > Route-based VPN > Advanced > Tunnel

Site-to-site VPN hub support for ECMP load balancing with dynamic VTIs

10.0.0

You can now enable Equal Cost Multi-Path (ECMP) on the dynamic VTIs of hub devices. All virtual access interfaces on the hub connecting to the same spoke are grouped into an ECMP zone.

New/modified screens:

Secure Connections > Site-to-Site VPN & SD-WAN > SD-WAN Topology > Add Hub
Secure Connections > Site-to-Site VPN & SD-WAN > Route-based VPN > Hub

Site-to-site VPN support for BFD-based failover

10.0.0

You can now enable the BFD routing protocol on the SVTIs and DVTIs of route-based and SD-WAN VPN topologies.

New/modified screens:

Secure Connections > Site-to-Site VPN & SD-WAN > SD-WAN Topology > Advanced Settings
Secure Connections > Site-to-Site VPN & SD-WAN > Route-based VPN > Advanced > Tunnel

Distributed site-to-site VPN with clustering for the Secure Firewall 4200

10.0.0

A cluster on the Secure Firewall 4200 supports site-to-site VPN in distributed mode. Distributed mode provides the ability to have many site-to-site IPsec IKEv2 VPN connections distributed across members of a cluster, not just on the control node (as in centralized mode). This significantly scales VPN support beyond centralized VPN capabilities and provides high availability.

Added/modified commands: cluster redistribute vpn-sessiondb , show cluster vpn-sessiondb , cluster vpn-mode , show cluster resource usage , show vpn-sessiondb , show conn detail , show crypto ikev2 stats

Zero trust access

ACME trustpoint as identity certificate for zero trust access

10.0.0

You can choose an ACME certificate for authenticating a managed device as a SAML SP for a zero-trust application policy. ACME certificates automate the lifecycle management of SSL and TLS certificates, including their auto-renewal.

New/modified screens: Objects > PKI > Cert Enrollment > ACME

New/modified commands: crypto ca trustpoint

IPv6 support for zero trust access

10.0.0

Clientless ZTNA now provides secure access to applications connected over IPv6 networks.

Limitations: IPv6 source NAT for applications is only for homogeneous scenarios such as NAT66 and NAT44. NAT64 and NAT46 are not supported.

New/modified screens: Policies > Zero Trust Application > Clientless Policy > Add Application

New/modified CLIs: show running-config zero-trust

Deprecated features

End of support: Firewall Threat Defense Version 7.0.x

10.0.0

Cloud-Delivered Firewall Management Center stopped managing Firewall Threat Defense devices, Version 7.0.x, as of December 15, 2025. For more information, see frequently asked question.

Deprecated: Enable a DHCP server on the firewall management interface

10.0.0

We deprecated these firewall CLI commands:

configure network ipv4 dhcp-server-enable
configure network ipv4 dhcp-server-disable
show network-dhcp-server

See: Cisco Secure Firewall Threat Defense Command Reference

Deprecated: Secure Network Analytics manager-only deployments

Any

You can no longer configure a Secure Network Analytics manager-only deployment to store events. Note that manager-only deployments are deprecated in Secure Network Analytics Version 7.5.1.

Although existing manager-only integrations continue to work, we recommend you switch to a single-node data store deployment with the latest supported version of Secure Network Analytics. This allows you to take advantage of new features, resolved issues, and performance improvements.

End of support: VMware vSphere/VMware ESXi 6.5, 6.7, and 7.0

Any

. Upgrade VMware before you upgrade the software.

We discontinued support for virtual deployments on VMware vSphere/VMware ESXi 6.5, 6.7, and 7.0. Upgrade your hosting environment to Version 8.0 before you upgrade any virtual appliance.

Version restrictions: Versions 7.3.x and 7.4.0–7.4.1 are not qualified on VMware 8.0. If you run any of these versions, upgrade to VMware 8.0 first. Move to the next step as soon as possible. For best results, perform a multi-step upgrade: first the virtual appliance to 7.4.2–7.7.x, then VMware, then the virtual appliances again.

Deprecated: Monitor device revert in the Message Center

Any

You can no longer monitor device revert from the Message Center. Instead, use the Device Management page (Devices > Device Management). On the Upgrade tab, click View Details next to the device you are reverting.

Deprecated: Selected walkthroughs

Any

Some walkthroughs are no longer available. For a list of supported walkthroughs by version, see Walkthroughs in Secure Firewall Management Center.

November 20, 2025

Table 24. Features in Version 20251025
Feature	Minimum Threat Defense	Details
Device Management
Maximum Firewall Threat Defense Devices Supported.	Any	This release enhances device-management capabilities, supporting up to 1,500 standalone devices, 750 high-availability pairs, or 1,500 cluster nodes. The increased device count improves scalability for complex network environments.

August 14, 2025

Table 25. Features in Version 20250725
Feature	Minimum Threat Defense	Details
Zero Trust Access
Universal Zero Trust Network Access (universal ZTNA).	7.7.10	Universal Zero Trust Network Access (universal ZTNA) is a comprehensive solution that provides secure access to internal network resources based on user identity, trust, and posture. It ensures that access to one application does not implicitly grant access to the entire network, as with remote access VPN. New/modified screens: Policies > Zero Trust Application Requires Cisco Secure Access and Security Cloud Control. Deployment restrictions: Not supported with clustered devices, container instances, or transparent mode. Supported platforms: Secure Firewall 1150, 3100, 4100, 4200, and Firewall Threat Defense Virtual. See Managing Firewall Threat Defense with Cloud-Delivered Firewall Management Center in Security Cloud Control
Administration
Backup of Threat Defense devices.	Any	The Cloud-Delivered Firewall Management Center now retains only the five most recent Threat Defense device backups. All the older backups are deleted automatically. See About Backup and Restore
Migration
Multi-instance Threat Defense device migration.	7.6	You can now migrate multi-instance Threat Defense devices that are part of a chassis, such as the Secure Firewall 3100/4200, to the Cloud-Delivered Firewall Management Center using the Migrate FTD to cdFMC feature in Security Cloud Control. See Supported Features
Migrate select Firepower 4100/9300 models to Secure Firewall 3100/4200.	The source devices must be Version 7.2.x and later. The target devices must be Version 7.4.1 and later.	You can now easily migrate configurations to the Secure Firewall 3100/4200 from these devices: Firepower 4110, 4120, 4140, 4150 Firepower 9300: SM-24, SM-36, SM-44 See Threat Defense Model Migration
Multi-instance mode conversion in the Cloud-Delivered Firewall Management Center for the Secure Firewall 3100/4200.	7.6.0	You can now register an application-mode device to the Cloud-Delivered Firewall Management Center and then convert it to multi-instance mode without having to use the CLI. New/modified screens: Devices > Device Management, then for a device, click More () > Convert to Multi-Instance Devices > Device Management, then select multiple devices and choose Select Bulk Action > Convert to Multi-Instance See: Convert a Device to Multi-Instance Mode

Open issues

This table lists the currently open issues for Cloud-Delivered Firewall Management Center. As they are resolved, issues move out of this table.

Table 26. Open Issues is Cloud-Delivered Firewall Management Center
ID	Headline
CSCwo13425	Bulk download 400K SXP mappings from ISE takes 80 minutes on FMC4800 with 1500 FTD setup
CSCwv04853	FMC REST API: POST /api/fmc_platform/v1/license/smartlicenses returns HTTP 500 due to Java DecimalFormat JSON serialization failure
CSCwv27763	hmdaemon exited alerts in cdFMC

Release Notes for Cloud-Delivered Firewall Management Center

Bias-Free Language

Book Title