Firepower System Release Notes, Version 6.1.0.3

Firepower Release Notes

Version: Version 6.1.0.3

First Published: April 26, 2017

Last Updated: January 30, 2019

These release notes are valid for the Firepower update.

Even if you are familiar with the update and reimage process, make sure you thoroughly read and understand these release notes, which describe supported platforms, and product and web browser compatibility. They also contain detailed information on prerequisites, warnings, and installation.

Warning: Devices configured for Threat Grid integration may be unable to pull reports from Threat Grid or submit files manually for analysis, per CSCvj07038. See Hotfix EM for more information..

Warning: Do not update to FXOS Version 2.3.1.56 if you are running an instance of Firepower Threat Defense that has been updated from Version 6.0.1.x of the Firepower System. Doing so may disable your Firepower Threat Defense application, which could interrupt traffic on your network. For more information, see CSCvh64138 in the Cisco Bug Search Tool.

Note: To access the full documentation for Firepower environments, see the documentation roadmap at https://www.cisco.com/c/en/us/td/docs/security/firepower/roadmap/firepower-roadmap.html.

For more information about the Version 6.1.0.3 update, see the following sections:

• Supported Platforms and Environments
• Management Capability
• Terminology and Documentation
• Compatibility
• Updating vs. Reimaging vs. Deploying
• Important Update Notes
• Update to Version 6.1.0.3
• Uninstall Version 6.1.0.3
• Resolved Issues
• Known Issues
• For Assistance

Supported Platforms and Environments

You can run Version 6.1.0.3 on the platforms and environments in the following table. See Compatibility for more information.

The table below includes supported environments at the time of publication. As new versions of the ASA software become available, compatibility may be added to Firepower 6.1.0.x versions. See the Firepower Compatibility Matrix for most up-to-date ASA or FXOS versions.

New Features and Functionality

This section of the release notes summarizes the new and updated features and functionality included in Version 6.1.0.3.

Updating vs. Reimaging vs. Deploying

In most cases, it is best to perform a traditional update from Version 6.0.1.X to Version 6.1.0.3 as described in Important Update Notes and Update to Version 6.1.0.3.

However, the following cases require you to reimage and/or deploy your appliance:

• If you are moving from ASA with FirePOWER Services to run Firepower Threat Defense, you must reimage your ASA device to deploy Firepower Threat Defense.
• If you have a Firepower Threat Defense device (physical or virtual) that was installed before Version 6.1.0, and you want to switch between managing it with a Firepower Management Center and managing it with the Firepower Device Manager, you must reimage the Firepower Threat Defense.

New installations of Version 6.1.0 and later do not require a reimage.

• If you are recreating a Firepower Threat Defense Virtual device in a different environment than before, you must redeploy the Firepower Threat Defense to the virtual platform.
• If you are unable or do not want to follow the required update path as described in Update Paths to Version 6.1.0.3, you must reimage and/or deploy your appliance.

See the installation and quick start guides linked from the documentation roadmap for more information about the reimage and deploy processes: https://www.cisco.com/c/en/us/td/docs/security/firepower/roadmap/firepower-roadmap.html.

Important Update Notes

Before you begin the update process to Version 6.1.0.3, you should familiarize yourself with the behavior during the update process, as well as with any compatibility issues or required pre- or post-update configuration changes.

Note: Do not reboot or shut down your appliance during the update until you see the login prompt. Appliances may appear inactive during the pre-checks; this is expected behavior and does not require you to reboot or shut down your appliance.

Note: Updating an ASA FirePOWER module to Version 6.1.0 or later fails when the ASA REST API is enabled. Prior to updating the Firepower version of the ASA FirePOWER module, execute the no rest-api agent CLI command to disable the ASA REST API. To reenable ASA REST API, execute the rest-api agent CLI command.

For more information, see the following sections:

• Update Paths to Version 6.1.0.3
• Update Interface Options
• Update Sequence Guidelines
• Pre-Update System Readiness Checks
• Pre-Update Configuration and Event Backups
• Traffic Flow and Inspection During the Update
• Additional Memory Requirements
• Time and Disk Space Requirements
• Post-Update Tasks

Traffic Flow and Inspection During the Update

When you update your sensing devices, traffic either drops throughout the update or traverses the network without inspection depending on how your devices are configured and deployed: routed or transparent, inline vs passive, bypass mode settings, and so on. We strongly recommend performing the update in a maintenance window or at a time when the interruptions will have the least impact on your deployment.

Note: When you update devices in a high availability pair, the system performs the update one device at a time to avoid traffic interruption.

This section discusses traffic behavior during the following update stages:

• The update itself, including related reboots
• FXOS updates on clustered Firepower Threat Defense, devices
• Configuration deployments after the update

Traffic Behavior During the Update

The following table describes how updates, including related device reboots, affect traffic flow for different deployments. Note that appliances do not perform switching, routing, NAT, and VPN during the update process, regardless of how you configure any inline sets.

Warning: Do not update to FXOS Version 2.3.1.56 if you are running an instance of Firepower Threat Defense that has been updated from Version 6.0.1.x of the Firepower System. Doing so may disable your Firepower Threat Defense application, which could interrupt traffic on your network. For more information, see CSCvh64138 in the Cisco Bug Search Tool.

 

Table 9 Update Traffic Behavior

Device	Deployment	Traffic Behavior
Firepower Threat Defense	inline with optional hardware bypass module; bypass enabled: (Bypass: Standby or Bypass-Force) or bypass disabled: (Bypass: Disabled)	dropped
Firepower Threat Defense Firepower Threat Defense Virtual	routed, transparent (including EtherChannel, redundant, subinterface)
	inline with no hardware bypass module
	inline in tap mode	egress packet immediately, copy not inspected
	passive	uninterrupted, not inspected
7000 and 8000 Series	inline with optional hardware bypass module, bypass enabled (Bypass Mode: Bypass)	passed without inspection Network traffic is interrupted briefly at two points: At the beginning of the update process, as link goes down and up (flaps) and the network card switches into hardware bypass. After the update finishes as link flaps and the network card switches out of bypass. Inspection resumes after the endpoints reconnect and reestablish link with the device interfaces. The hardware bypass option is not supported on nonbypass network modules on ASA with FirePOWER Services on Firepower 8000 Series devices, or SFP transceivers on Firepower 7000 Series.
	inline with optional hardware bypass module, bypass disabled (Bypass Mode: Non-Bypass)	dropped
7000 and 8000 Series NGIPSv	inline with no hardware bypass module	dropped
	inline in tap mode	egress packet immediately, copy not inspected
	passive	uninterrupted, not inspected
	routed, switched	dropped
ASA FirePOWER	routed or transparent, fail-open (Permit Traffic)	passed without inspection (requires at least the minimum supported ASA OS version; otherwise, traffic dropped)
	routed or transparent, fail-close (Close Traffic)	dropped

Caution : Rebooting the ASA FirePOWER module on an ASA 5585-X, including a reboot that occurs during a module upgrade, causes traffic to drop for up to thirty seconds on the interfaces on the ASA FirePOWER hardware module while the module reboots.

Traffic Behavior When Updating FXOS on Clustered Firepower Threat Defense Devices

Updating FXOS reboots the chassis, which drops traffic in a clustered environment until at least one module comes online, regardless of whether the cluster uses an optional hardware bypass (fail-to-wire) module or if bypass is enabled or disabled.

Traffic Behavior During Configuration Deployment

During the upgrade process, you deploy configurations either twice (standalone devices) or three times (devices managed by the Firepower Management Center). When you deploy, resource demands may result in a small number of packets dropping without inspection. In most cases, the deployment immediately after the upgrade restarts the Snort process. During subsequent deployments, the Snort process restarts only if, before deploying, you modify specific policy or device configurations that always restart the process when deployed.

The following table describes how different devices handle traffic during Snort process restarts.

 

Table 10 Restart Traffic Effects by Managed Device Model

Device Model	Interface Configuration	Restart Traffic Behavior
Firepower Threat Defense, Firepower Threat Defense Virtual, 7000 and 8000 Series, NGIPSv	inline, Failsafe enabled or disabled	passed without inspection A few packets might drop if Failsafe is disabled and Snort is busy but not down
	inline, tap mode	egress packet immediately, copy bypasses Snort
	passive	uninterrupted, not inspected
Firepower Threat Defense, Firepower Threat Defense Virtual	routed, transparent (including EtherChannel, redundant, subinterface)	dropped
7000 and 8000 Series	routed, switched, transparent	dropped
ASA FirePOWER	routed or transparent with fail-open (Permit Traffic)	passed without inspection
	routed or transparent with fail-close (Close Traffic)	dropped

Update to Version 6.1.0.3

Before you begin the update, you must thoroughly read and understand these release notes, especially Important Update Notes and Pre-Update System Readiness Checks.

If you are unsure whether you should perform a traditional Version 6.1.0.3 installation or a reimage to Version 6.1.0.3, see Updating vs. Reimaging vs. Deploying.

Caution : Updates can require large data transfers from the Firepower Management Center to managed devices. Before you begin, make sure your management network has sufficient bandwidth to successfully perform the transfer. See the Troubleshooting Tech Note at https://www.cisco.com/c/en/us/support/docs/security/ firepower-management-center/212043-Guidelines-for-Downloading-Data-from-the.html.

For more information about updating appliances to Version 6.1.0.3, see:

• Update Firepower Management Centers and Firepower Management Centers Virtual
• Update Firepower Threat Defense Devices using the Firepower Management Center
• Update 7000 and 8000 Series Devices, Firepower NGIPSv, and ASA FirePOWER modules
• Update Firepower Threat Defense Device with the Firepower Device Manager
• Update ASA FirePOWER Modules Managed via ASDM

Uninstall Version 6.1.0.3

For more information about uninstalling Version 6.1.0.3 from your appliances, see:

• Planning the Uninstallation
• Uninstall from 7000 and 8000 Series Managed Devices
• Uninstall from Firepower NGIPSv
• Uninstall from ASA FirePOWER Modules Managed by Firepower Management Centers
• Uninstall from Firepower Threat Defense Devices and Firepower Threat Defense Virtual Managed by Firepower Management Centers
• Uninstall from Firepower Management Centers
• Uninstall from ASA FirePOWER Modules Managed via ASDM
• Uninstall from Firepower Threat Defense Devices on Firepower Device Manager

Resolved Issues

If you have a Cisco account, you can view defects resolved in this release using the Cisco Bug Search Tool: https://tools.cisco.com/bugsearch/.

The following defects are resolved in Version 6.1.0.3:

• Security Issue A vulnerability in dynamic link libraries (DLL) system files for Open Source SNORT for Windows OS could allow an authenticated, local attacker to load malicious DDL files and execute arbitrary code, as described in CVE-2016-1417.
• Security Issue A vulnerability in TCP processing that allowed an unauthenticated, remote attacker to download files that should be blocked, as described in CVE-2016-9209.
• Security Issue A vulnerability that could allow an unauthenticated, remote attacker to maliciously bypass the appliance’s ability to block certain web content, as described in CVE-2017-3814.
• Security Issue A vulnerability in the detection engine reassembly of SSL packets could allow an unauthenticated, remote attacker to cause a denial of service condition due to the Snort process consuming a high level of the CPU, as described in CVE-2017-3885.
• Security Issue A vulnerability in the access control policy that allow an authenticated, remote attacker to cause an affected system to stop inspecting and processing packets, resulting in a denial of service, as described in CVE-2017-6625.
• Security Issue A vulnerability that allowed an unauthenticated, remote attacker to view sensitive information which should be restricted. (CSCvb52457)
• Autonegotiation automatically enabled after 5.4.x patch is applied. (CSCuy36266)
• SIP preprocessor is being disabled regardless of configuration. (CSCuy89897)
• Query Cisco CSI for Unknown URLs option being reset by ASA managed by ASDM. (CSCuz60614)
• Only 1500 Group Members are downloaded per group for an Active Directory Realm. (CSCva06227)
• URL marked PENDING_TYPE in cache stays as PENDING_TYPE. (CSCva47456)
• Access control policy report fails if category has span across 50 rules. (CSCva72899)
• Access control policy report differs from access control policy web interface. (CSCva78299)
• Trying to delete an identity realm that is in use breaks the identity realm. (CSCva98254)
• Excessive error messages from ADI for no DN for user, LQ_DN_UNAVAILABLE. (CSCvb06707)
• Security Intelligence category goes missing from security intelligence events after time. (CSCvb16465)
• Large flow introduces latency on all traffic in ASA with FirePOWER Services. (CSCvb30960)
• After Data purge user sessions stop being sent to Sensor. (CSCvb49240)
• Resolved SIP/RTP performance issues. (CSCvb61480)
• IPS rule filter in IPS policy does not deselect previous rule selection. (CSCvb58549)
• UI_archiver segfault for NULL message types. (CSCvb67568)
• Certain browsers load captive portal authentication page very slowly. (CSCvb80872)
• SNMP v3 password is incorrect and very large after changes to System Configuration. (CSCvc05643)
• Disable Clean List from File Policy Advanced Tab does not take effect. (CSCvc10200
• URL Filtering stopped working due to major version change in the BC database. (CSCvc17167)
• Client is not reset properly when malware is blocked first time on Firepower Threat Defense devices. (CSCvc38068)
• ASA FirePOWER module generates traceback and reloads or causes process not running. (CSCvc38425)
• Deleting remote storage backups via backup management fails to delete. (CSCvc46344)
• Files for user identity events are not being pruned. (CSCvc46386)
• Security Intelligence is reported out of date but Snort has been updated. (CSCvc47753)
• Enabling SSL Policy may result in detection engine exits. (CSCvc51173)
• Passive mode traffic decryption reports out of memory error. (CSCvc55195)
• OSPF routes from the neighbor is missing after upgrade from 6.1.0.1-53 to 6.1.0.2-28. (CSCvc58296)
• SSH access list configuration lost after reboot on Firepower Threat Defense. (CSCvc74345)
• Copying large access control policy, inserting moving more than 50 rules into category causes policy uneditable. (CSCvc74383)
• Unable to edit load Security Intelligence Tab in access control policy. (CSCvc80603)
• Firepower Threat Defense high availability: Deployment failed as high availability pair configuration synchronization is in progress. (CSCvc81801)
• FTP upload -Malware block miss and no file events on first attempt. (CSCvc82130)
• Context Explorer generates too-expensive queries when filtering on intrusion or file event fields. (CSCvc83023)
• Unable to deploy policy on Firepower Threat Defense devices due to wrong XML parsing. (CSCvc91839)
• ICMPv6 response not associated with request. (CSCvc91484)
• SCALE: sfestreamer_11 cores when many devices are registered. (CSCvc92724)
• Prefilter: Internal Error occurred when trying to edit policy after upgrading to 6.1.0.2-54. (CSCvc93448)
• Firepower does not support userPrincipalName attribute for login with ISE / Active authentication. (CSCvc93679)
• CTS traffic not propagating Firepower Threat Defense Inline mode. (CSCvc94586)
• Correlator timeout thread blocks event processing. (CSCvc98529)
• Snort segfault in GetTcpRebuiltPackets. (CSCvc99670)
• Performance impact because of duplicate primary macs in database. (CSCvd00017)
• With Safesearch configured but disabled, can lead to cores. (CSCvd01332)
• SSL Block action when RSA-PSS is used as signature hash algorithm. (CSCvd01805)
• Captive Portal NTLM needs to handle token received in POST in addition to GET. (CSCvd04922)
• Monitor Rules logged repeatedly when URL lookup is required. (CSCvd05469)
• Communication channel is blocked if recurring backup fails due to disk space on remote server. (CSCvd05788)
• Network Discovery: Invalid hosts added to hostmap. (CSCvd06393)
• Database settings for a fresh deployment were not saved. (CSCvd11997)
• Fail to create Firepower Threat Defense high availability due to previous failed attempt. (CSCvd14261)
• Snort HTTP gzip decompression does not work without content-length header. (CSCvd15007)
• Migration errors Firepower Management Center on does not mention the location of the log files to check. (CSCvd16149)
• Policy apply fails sometimes with old entries on interface config. (CSCvd20062)
• Context Explorer queries block event processing for many hours. (CSCvd22715)
• NAT policy created from the ASA-to-Firepower Threat Defense migration tool fails to deploy to the Firepower Threat Defense device. (CSCvd23419)
• Security intelligence Object saved in security intelligence tab does not work in a unique scenario. (CSCvd25433)
• SNMP lists same Hostname for all Firepower Threat Defense managed devices. (CSCvd26939)
• UIMP fails importing all users if any user in the import list has been deleted. (CSCvd27278)
• RCD should be disabled with scheduled policy deploy and remove the RCD checkbox from deploy dialog. (CSCvd29976)
• FTD crash at cli_xmlserver_thread while deploying access control policy. (CSCvd33044)
• Firepower: With SafeSearch on, users can't access multiple websites. (CSCvd34691)
• Snort is unable to map the filename if there are unsupported characters. (CSCvd37120)
• NSE interface initialization has not occurred, but still receiving packets. (CSCvd37902)
• ADI discards all but one IP address from a session notification. (CSCvd39490)
• Error during policy validation while navigating through access control policy. (CSCvd40583)
• Scheduler Queue Corruption leads to connectivity failures or failover problems after ASA Version 9.6(2). (CSCvd41052)
• SSL Trusted certificates not deployed to sensor in some cases. (CSCvd41054)
• Unwanted delta CLI config for the access list when a rule got added or deleted in access control policy. (CSCvd44450)
• PxGrid sent MAB and internal ISE DB info to /var/log/messages cause outage on Management Center. (CSCvd45766)
• Import fails due to conflict if variable differs only by case. (CSCvd53378)
• ASA FirePOWER module data plane down after reload of module. (CSCvd53884)
• Snort segfault while processing malware cache.(CSCvd55859)
• Unable to block bittorent traffic when download is resumed after moving to a new network. (CSCvd66343)
• Network range with a space after the dash removes current and subsequent access control rules. (CSCvd69506)
• Users are removed from groups after scheduled user/group download. (CSCvd71808)
• Snort core in alert action. (CSCvd74162)
• Unchecked host count growth after SFDataCorrelator reconfigure. (CSCvd76935)
• Resolved an issue where the Firepower Threat Defense device running Version 6.1.0.1 or Version 6.1.0.2 stopped passing traffic after 213 days of uptime and experienced a range of issues from limited connectivity to a traffic outage. (CSCvd78303)
• Report generation fails if the remote storage device is unmounted by another action. (CSCvd90101)

The following defects were resolved in Version 6.1.0.2:

• Security Issue Addressed a vulnerability in Transport Layer Security (TLS), as described in CVE-2011-3389.
• Security Issue Addressed a vulnerability issue that generated denial of service in the third party SSH, as described in CVE-2016-1907.
• Security Issue Addressed multiple vulnerabilities in the third party product Libxml2, as described in CVE-2016-2073, CVE-2016-444, and CVE-2016-4448.
• Security Issue Addressed a vulnerability that allowed remote attackers to exploit Firepower Management Center Virtual, as described in CVE-2016-2183.
• Security Issue Addressed a vulnerability where the system detected malicious files for the first time and incorrectly allowed the file to be downloaded, allowing unauthenticated, remote attackers to bypass malware detection rules, as described in CVE-2016-6396.
• Security Issue Addressed a vulnerability in the NTP third party product, as described in CVE-2016-7426, CVE-2016-7427, CVE-2016-7428, CVE-2016-7429, CVE-2016-7431, CVE-2016-7434, CVE-2016-7433, CVE-2016-9311, CVE-2016-9310, and CVE-2016-9312.
• Security Issue Resolved a vulnerability in dynamic link libraries (DLL) system files for Open Source SNORT for Windows. (CSCuz78239)
• Resolved an issue where, if you backed up the system through NFS, the system incorrectly reported the backup as successful even if the backup failed. (CSCuv03871)
• Resolved an issue where, if you deployed an SSL policy configured with a rule associated with an expired SSL certificate, the system used an incorrect SSL rule. (CSCux91934)
• Resolved an issue where, if you deployed an access control policy configured to Log at Beginning of Connection and Log at End of Connection containing the default Balanced Security and Connectivity network access policy, with an access control rule set to Allow, and a file policy set to Block Malware or Block with Reset, then you attempted to download a malicious file from a FTP server more than once, the system successfully downloaded the malicious file when it should not have. (CSCuy91156)
• If you execute the system support capture-traffic CLI command and attempt to use an IPv4 or IPv6 network address containing a slash ( /) or a dash ( -), the system incorrectly generates an Invalid user input error message. (CSCuz40408)
• Resolved an issue where the system incorrectly allowed you to configure sandbox file sizes larger than 10MB on the Files and Malware Settings section on the Advanced tab of the access control editor. (CSCuz46366)
• Resolved an issue where remote backups could not be locally restored. (CSCuz90632)
• Resolved an issue where, if you requested metadata older than Version 6.0.0 from a Firepower Management Center running Version 6.0.0 or later via eStreamer, the system incorrectly sent the userID field to the eStreamer client instead of the configured LDAP username. (CSCuz95008)
• Resolved an issue where, if you deployed a rule set with application or URL conditions, the system logged an incorrect access control rule for short sessions that were not identified as a known application. (CSCva07265)
• Resolved an issue where, if you registered more than 400 devices to a Firepower Management Center, the Health tab erroneously displayed alerts when the Monitor page (System > Health > Monitor) did not. (CSCva12703)
• Resolved an issue where Firepower Management Centers managing 100 or more devices experienced extensive device connectivity checks and overall latency. (CSCva23034)
• Resolved an issue where, if you deployed an intrusion rule containing an AppID web application condition and a managed device experienced a high volume of traffic containing an excessive amount of similar connection types that did not apply to the AppID application, the application detection process took more time than it normally should and caused latency for other traffic matches. (CSCva89328)
• Resolved an issue where, if you configured for multi-context mode on clustered ASA FirePOWER modules or a ASA FirePOWER module high availability pair and deployed one or more security zones from the Firepower Management Center, a module within the cluster or high availability pair may have lost all security zones and interfaces after restart. (CSCva89342)
• Resolved an issue where, if you updated the Firepower Management Center to Version 6.1.0 or later and edited the action of the default prefilter policy from Allow to Block all traffic, then deployed to a managed Firepower Threat Defense device running Version 6.0.x, the system incorrectly deployed the default action of the tunnel rules within the deployed prefilter policy to the Firepower Threat Defense device and the device incorrectly blocked tunnel traffic instead of allowing the traffic. Firepower Management Centers running Version 6.1.0.2 and later do not deploy tunnel rules to devices running Version 6.0.x. (CSCvb03905)
• Resolved an issue where, if you enabled automated intrusion rule updates for an ASA FirePOWER module managed by ASDM, and the device simultaneously deployed automated deployments, the device experienced issues. (CSCvb08840)
• Resolved an issue where, if you enabled URL Filtering from the CSI page (System > Integration > Cisco CSI), the system randomly disabled the option and URL-based access control rules did not match rules when they should have. (CSCvb16413)
• Resolved an issue where, in some cases, if you updated a system containing at least one security zone to Version 6.1.0 or later, the Interfaces page (Devices > Interfaces) might incorrectly displayed the security zone state as Unknown. (CSCvb24768)
• In rare cases, after you updated the Firepower Management Center to Version 6.10, the dynamic analysis page (AMP > AMP Management) would not load. (CSCvb24807)
• If you created a realm for Active Directory (AD) and Download users and groups and added a user from the downloaded group to an access control policy, then deploy to an ASA FirePOWER module, the system did not block the user when it should. (CSCvb26230)
• Resolved an issue where, if a Firepower Management Center running Version 6.1.0 or later managed a device running Version 6.0.1 or earlier, Quality of Service (QoS) events did not include interface statistics from the devices which caused issues queuing events. (CSCvb36847)
• If you deployed an access control policy containing an SSL policy containing a rule with the default action set to Decrypt - Resign for FTP Data, FTPS, and FTPS data application conditions, a file policy containing a rule with the default action set to Block Files and Reset on PDF file types, and an intrusion policy containing a rule with detection options configured to reset_both, intrusion and file detection did not work as expected and you could successfully download files that should have been blocked. (CSCvb38524)
• Resolved an issue where, if you updated the system from a version earlier than Version 6.1.0 to Version 6.1.0 and immediately exported the access control policy, then imported the policy, importing the access control policy failed. (CSCvb39435)
• Resolved an issue where the DHCP Relay agent did not start if you configured a RHCP Relay agent on a virtual router with more than 21 interfaces. (CSCvb40343)
• If updating the system failed and you attempted to update to a different version from the one that failed without resolving the original failure, the new install also failed and could cause the system to become unrecoverable. (CSCvb46146)
• Resolved an issue where the Firepower Management Center web interface became unusable if some Firepower Management Center processes exited without freeing semaphores. (CSCvb52344)
• Resolved an issue where, if you deployed an access control rule referencing a file policy with the default actions set to Block Malware, the session connection timed out instead of resetting, and traffic containing malware files passed and the malware was successfully downloaded. (CSCvb52625)
• Resolved an issue where, if you deployed the same platform settings policy to multiple stacked devices, the Platform Settings Listing page did not load correctly. (CSCvb53091, CSCvc10937)
• Resolved an issue where, if you configured DHCP relay on a system running Version 6.0.0 or later and updated the system to Version 6.1.0 and later, the Firepower Management Center did not display the DHCP information even though it correctly deployed the configuration. (CSCvb55593)
• Resolved an issue where, if you deployed to an ASA FirePOWER module managed by ASDM during an intrusion rule update installation, deploying future policy configurations failed. (CSCvb57747)
• Resolved an issue where generated risk reports contained spelling errors. (CSCvb65642)
• Resolved an issue where an optimization component attempted to connect to the wrong database and caused system issues, such as high CPU use and general performance degradation. (CSCvb63664, CSCvc05376, CSCvc49789)
• Resolved an issue where, if you exported more than one access control policy containing the same prefilter policy and imported the same access control policies, then edited the prefilter policies referenced in the imported access control policy, the system assigned a numerical suffix to the policy name and generated errors. (CSCvb63264)
• Resolved an issue where, in some cases, 7000 and 8000 Series device stacks experienced issues and required a reboot. (CSCvb66334)
• Resolved an issue where the system incorrectly populated N/A for labels within SSL widgets for generated events after you updated the system to Version 6.1.0. (CSCvb67848)
• Intrusion rule updates to 6.1.0 caused constant failover between ASA FirePOWER modules in a high availability pair. (CSCvb68226)
• Intermittently, if you created a realm and deployed an access control policy containing rules, then downloaded users and groups (including scheduled downloads), the user-to-group mapping could become incorrect, and access control rules using groups might not have matched when they should have. (CSCvb69906)
• If you enabled SMB File Inspection in a file policy and deployed to a device managed by the Firepower Management Center, the system generated Primary detection engine exited unexpectedly warning messages, and the system experienced issues. (CSCvb74873)
• If you deployed a DNS rule with a blacklist action containing a Security Intelligence DNS feed, the system did not send the Security Intelligence events to the external syslog if one was configured. (CSCvb75591)
• The system ignored security zone constraints on network discovery rules if the network discovery policy contained rules constrained by zones that included interfaces from multiple devices. This condition was present if the rules used single zones with interfaces from multiple devices (for example, Zone 1 included interfaces from Device 1 and Device 2) or multiple rules used different zones (for example if Rule 1 used Zone 1, which included interfaces from Device 1, and Rule 2 used Zone 2, which included interfaces from Device 2). (CSCvb78786)
• Resolved an issue where, if you added a syslog alert to an access control rule and deployed on an ASA FirePOWER module managed by ASDM, the device incorrectly generated excessive logging from prefilter policies. (CSCvb79079, CSCvb83172)
• Resolved an issue where a Firepower 7000 Series devices with static routes defined caused the device to require a software restart. (CSCvb81176)
• Resolved an issue where, if you updated a Firepower Threat Defense or 7000 and 8000 Series device to Version 6.1.0.1 and removed the device from the Firepower Management Center, then re-added the device and deployed, initial deployment of configuration changes failed and displayed an error. (CSCvb82371)
• Resolved an issue where corrupted database tables could cause the system to generate alerts about high disk usage. (CSCvb88976)
• Resolved an issue where, if you changed the type of interface on a Firepower 7000 Series devices from passive, inline, routed, or switched to another type of interface, the device incorrectly generated an Unsupported mode error. (CSCvb91730)
• If the system detected a user login from the user agent or configured LDAP server and you configured an associated email address on the Active Directory (AD) server, and the system detected another login attempt from the same user, user-to-host mappings did not transfer to the Firepower Management Center, and access control rules containing AD-based user conditions intended to identify traffic from those users did not match as expected. (CSCvb92474)
• Resolved an issue where, if you deployed an access control rule containing a URL category condition with the default action set to Block - Reset, an access control rule with the default action set to Allow, and an SSL rule with the default action set to Decrypt - Resign to an ASA FirePOWER module, loading HTTPS websites may have taken up to 30 seconds. (CSCvb92740)
• Resolved a rare issue where, another instance of Process Manager could be started while there was already an instance running, causing processes to both traffic outages and processes repeatedly stopping and starting. (CSCvb92968)
• In some cases, if you deployed an SSL policy containing an SSL rule with the action set to Do Not Decrypt placed above an SSL rule with the action set to Decrypt - Resign, the system incorrectly identified the sessions as undecryptable and matched against the wrong rule with an undecryptable action instead of the correct rule. (CSCvb94411)
• Resolved an issue where re-establishing high availability synchronization failed after successfully updating an Firepower Management Center high availability pair from Version 6.1.0 or later to Version 6.2.0 failed. (CSCvb96776)
• Resolved an issue where 7000 and 8000 Series devices with low memory did not recover and could result in a traffic outage. (CSCvb97742)
• Resolved an issue where, if you deployed an SSL policy with SSL inspection enabled, the system generated a The Detection Engine has exited 1 time(s) error message. (CSCvc03589)
• In rare cases, if you performed URL control and enabled Retry URL cache miss lookup in the access control policy, the system incorrectly generated multiple connection events for the same connection. (CSCvc08844)
• Resolved an issue where, if you created a prefilter policy with the ASA-to-Firepower Threat Defense migration tool, you could not delete multiple rules simultaneously and the system incorrectly misordered rule placement if you added a new rule to the prefilter policy (CSCvc09761, CSCvc12080)
• Resolved an issue where, if the name of an access control policy contained the ( &)character, deploying the policy failed. (CSCvc11916)
• Deploying to managed devices configured to user captive portal active authentication and the system processed jumbo packets, the system experienced traffic disruption and issues. (CSCvc12702, CSCvc12727, CSCvc55369)
• Resolved an issue where, if you connected a Firepower Management Center to an ISE server and enabled postured user sessions updates and the Firepower Management Center received a session from the ISE server containing an unknown operation or a missing operation, the network map experienced issues and the system experienced high CPU use. (CSCvc24316)
• Resolved an issue where, if a Firepower 8350 device or AMP8350 device produced an unusually large stream of messages on the serial port console or, if you enabled it, the Lights-out Management (LOM) console, the device became unresponsive. (CSCvc26880)
• Resolved an issue where eStreamer events incorrectly include the internal User ID instead of the LDAP hostnames. (CSCvc30591)
• Resolved an issue where, in some cases, if you enabled the use of a proxy on the Firepower Management Center and access the Internet, communication from the Firepower Management Center or any registered devices to the sandbox cloud failed. (CSCvc32479)
• Resolved an issue where constraining file events in the Context Explorer caused latency. (CSCvc33995)
• Resolved an issue where the system was not recovering from a disk write error caused by disk full even after the disk full issue was resolved, causing excessive logging. (CSCvc37923)
• Resolved an issue where, if you imported a policy containing two more objects with the same name but with a numerical suffix (object_1, object_2, etc), importing failed. (CSCvc37927)
• If you deployed an intrusion policy configured to log syslog or SNMP alerts for Security Intelligence events, event processing on the device became unstable. (CSCvc44292)
• Resolved an issue where the system did not extract URLs from reassembled HTTP requests and traffic did not match access control rules as expected. (CSCvc44398)
• Resolved an issue where you could not see more then 50 objects listed in custom network analysis policies (CSCvc48851)
• Resolved an issue where the snort processed experienced issues when processing RPC traffic behind a firewall. (CSCvc49641)
• Resolved an issue where ASA 5585-X-SSP-X devices running Version 6.1.0 or later experienced traffic disruption or high availability failover issues. (CSCvc50232)
• Resolved an issue where importing migrated ASA FirePOWER module configurations containing access lists with nameless networks or port values failed. (CSCvc52214)
• Resolved an issue where, if you edited port objects multiple times, the Available Ports list in the Port Exclusions tab of Network Discovery page (Policies > Network Discovery) did not load. (CSCvc53628)
• Resolved an issue where, when a Firepower Threat Defense high availability pair simultaneously rebooted, the pair continuously rebooted until the failover cable was removed. (CSCvc54134)
• Resolved an issue where, if you used the ASA-to-Firepower Threat Defense migration tool on an ASA FirePOWER module high availability environment that contained either a network object or network object group named with reserved words, such as ICMP, and restarted the device, did not correctly identify the configuration and deploying policy after the device restarted failed. (CSCvc57533)
• Resolved an issue where deploying an intrusion policy containing a custom rule timed out and the system generated an error message. (CSCvc58111)
• Resolved an issue where the ASA FirePOWER module configuration used the wrong interface IDs after a module rejoins a cluster configured for multi-context mode. (CSCvc64050)
• Resolved an issue where, if you executed the system support set-arc-mode throughput CLI command on an ASA 5545 or ASA 5555 device, the system experienced issues, such as latency in general performance or disruption in traffic. (CSCvc73128)
• Resolved an issue where default event table views may take excessive time to load if the query time range covers a large number of events. (CSCvc76394)
• Resolved an issue where deploying a policy with a policy identification number greater than 4096 failed. (CSCze89030)

The following defects were resolved in Version 6.1.0.1:

• Security Issue Addressed multiple vulnerabilities that generated denial of service in OpenSSL, as described in CVE-2010-5298, CVE-2013-4353, CVE-2014-3507, CVE-2014-3510, and CVE-2016-2182.
• Security Issue Addressed multiple vulnerability issues in the third party products OpenSSL and Linux, as described in CVE-2014-0160, CVE-2014-0076, CVE-2014-3508, CVE-2014-3509, CVE-2014-3511, CVE-2016-2183, and CVE-2016-5696.
• Security Issue Addressed a vulnerability in dynamic link libraries (DLL) system files that allowed allow an authenticated, local attacker to load DLL files and execute arbitrary code, as described in CVE-2016-1417.
• Security Issue Addressed a vulnerability within application user authentication that allowed an unauthenticated, remote attacker to access the Firepower Management Center interface, as described in CVE-2016-6394.
• Resolved a vulnerability where, if you applied a file policy with the default action set to Block Malware and enable Inspect HTTP Responses, the system assigned an incorrect SHA value to malware files and did not block the file when it should. (CSCvb20102)
• International characters in access control rule names or URL object names are no longer supported. (CSCux24338)
• Resolved an issue here, if you added a security zone on a Firepower Management Center running Version 5.4. or later and updated the system to Version 6.0 or later and deleted the security zone, the system generated an Object deletion restricted. Remove object from the following: Access control policies error even if the security zone was not referenced within a rule. (CSCuy68648)
• Resolved an issue where, if you created routed interfaces in the Interfaces tab of the Device Management page ( Devices > Device Management) and assign an IPv6 address that belongs to a different subnet to the routed interface configuration multiple times, deployment failed. (CSCuy89243)
• Resolved an issue where, if you enabled adaptive profiles in the Advanced tab of the access control policy editor page and repeatedly deployed configuration, the system did not prune expired information and experienced memory issues. (CSCuz03171)
• Resolved an issue where the system incorrectly terminated processes suspected of high memory usage on the ASA 5585-X device. (CSCuz09158)
• Resolved an issue where, if you executed the system support capture-traffic CLI command, the command rejected IPv6 host addresses. (CSCuz40373)
• Resolved an issue where, if you activated Automated Application Bypass (AAB) and deploy failed, the system experienced issues. (CSCuz52270)
• Resolved an issue where, if the system experienced an extreme amount of traffic and overloaded the queue, the system incorrectly displayed the same source and destination IP address for all logged messages. (CSCuz54235)
• Resolved an issue where, if you configured Lights-out Management (LOM) with an IP address, the system did not automatically configure the authentication type and you could not access the LOM interface via the IP address. (CSCuz66344)
• Resolved an issue where, if you booted an appliance in System Restore mode and clicked the Wiped Contents of Disk option on the Configurations Menu page, the system redirected you to the Configuration Menu page and did not wipe the disk. (CSCuz82594)
• Resolved an issue where, if you configured a clientless VPN connection on an ASA FirePOWER module and deployed an access control rule referencing at least one security zone, incoming clientless VPN traffic did not match the access control rule containing the security zone when it should. (CSCva02655, CSCva02659)
• If you create an access control policy or NAT policy referencing an object or object group that contains an invalid characters in the name, the system now generates an Unsupported object names are used in the policy for devices error message and does not save the policy. (CSCva05935, CSCvb29308)
• Resolved an issue where the system did not deploy the correct Regular Expression Limits default values within the access control policy when you deployed configuration. (CSCva54597)
• Resolved an issue where, if you enabled common criteria (CC) mode on an appliance for security certifications compliance and the syslog server certificate did not contain serverAuth, the system incorrectly passed connections to the syslog server when they should have failed. (CSCva67943)
• Resolved an issue where, if you deployed an SSL policy containing an SSL rule with the default action set to Do Not Decrypt and the ServerHello contained more than 14480 bytes, the system incorrectly dropped traffic that matched the rule set to Do Not Decrypt and the session failed. (CSCva78403)
• Improved the RPC decoder. (CSCva93408, CSCva93158)
• Resolved an issue where, if you updated the system from Version 6.0.1 to Version 6.0.1.2 or later, the Firepower Management Center user interface did not load. (CSCva96344)
• Resolved an issue where, if you configured the Firepower Management Center for multitenancy in a multidomain deployment and a user logged into the Firepower Management Center as a specific domain user, then attempted to edit an access control policy assigned to more than one device, the system generated an An internal error is preventing the system from validating this policy. If the policy is misconfigured, deploying configuration changes may fail or your changes may not work as expected. Contact TAC Support for assistance error. (CSCva96644)
• Resolved an issue where, if you created a new alert on the Alerts page ( Policy > Actions > Alerts) and edited the Relay Host option, then selected the deployed system policy and navigated between tabs, the system displayed the configurable items from the tab you previously viewed. (CSCvb04233)
• Resolved an issue where, if you deployed an SSL policy and traffic via an HTTP tunnel matched the SSL policy, the system dropped some traffic and experienced high CPU use and overall latency. (CSCvb05694)
• Resolved an issue where, if you edited latency-based performance setting values on the Advanced tab of the access control policy editor page and deployed to a registered Firepower Threat Defense device, the system did not save the correct latency rule values. (CSCvb11320)
• Resolved an issue where, if you created a network discovery policy configured to detect hosts and a correlation policy containing a rule set to trigger if discovery event occurs and the OS information for a host has changed, then added a condition for if OS name is unknown and added a remedaition Nmap scan, discovery events matching the rules did not generated corresponding Nmap scans. (CSCvb11642)
• Resolved an issue where, if the system experienced an issue processing the first session of SMTP traffic between a client and an SMTP server, the system did not correctly identify the subsequent SMTP sessions as SMTP for the client-server pair and displayed Unknown in the Application Protocol column of the Connection Events page ( Analysis > Connections > Events). (CSCvb11931)
• Resolved an issue where, if you enabled common criteria (CC) mode on an appliance for security certifications compliance and the syslog server certificate did not contain host name matching the name of the server, connections to the syslog server incorrectly passed when they should have failed. (CSCvb12453)
• Resolved an issue where, if you enabled Common Criteria (CC) mode on an appliance for security certifications compliance and the syslog server certificate and/or intermediate certificate(s) have been revoked, the system incorrectly established a TLS connection with the syslog server without checking the revocation status. (CSCvb12791)
• Private keys are no longer mandatory when importing certificates. (CSCvb13045)
• Resolved an issue where, if you configured captive portal active authentication with SSL decryption enabled, the system experienced issues. (CSCvb14386)
• Resolved an issue where Firepower Management Center high availability synchronization failed if the total size of the database files and logs totaled more than 4GB. (CSCvb19716)
• Resolved an issue where, if a Firepower Management Center in a high availability pair experienced connectivity issues with its managed devices, the primary Firepower Management Center incorrectly removed devices from its configuration. (CSCvb21705)
• Resolved an issue where Firepower devices issued extraneous health events. (CSCvb24405)
• Resolved an issue where, if you formed a Firepower 4100 Series or Firepower 9300 Appliance high availability pair with devices containing named interfaces and assigned a portchannel from the FXOS chassis manager, then edited the Interfaces tab of the high availability pair listed on the Device Management page ( Devices > Device Management) and saved, the system did not include the interfaces created for the high availability pair when it should and, in some cases, deployment failed. (CSCvb25963)
• Generated troubleshoot now includes captive portal information. (CSCvb26174)
• Resolved an issue where, if you enabled captive portal on a system and updated to Version 6.1.0, captive portal did not work. (CSCvb26266)
• Resolved an issue where, if you added more than 49 rules to a single NAT policy, you could only view the first page of rules listed on the NAT policy page and attempting to navigate to any other page generated an error message. (CSCvb32004)
• Resolved an issue where, if you removed a device from the Firepower Management Center, the Firepower Management Center did not consistently delete all of the device history. (CSCvb32168)
• Resolved an issue where, if you clicked Add Application Filter on the Applications Filters page ( Configuration >ASA FirePOWER Configuration > Object Management > Application Filters) of an ASA FirePOWER module managed by ASDM, the system did not launch the dialog window when it should. (CSCvb32873)
• Resolved an issue where, if you enabled captive portal authentication on a device configured with routed subinterfaces, an external user could access the Firepower Management Center interface via the IP address of port 443 or the IP address of port 22 via SSH. (CSCvb32918)
• Resolved an issue where, if you copied and edited an access control policy containing a rule comment with double quotes, the system generated a Error Moving Data: An internal error occurred and did not allow you to edit the copied policy. (CSCvb34959)
• Resolved an issue where, in some cases, if you updated a system from Version 6.1.0 to Version 6.1.0.x, the update failed. (CSCvb35499)
• Resolved an issue where, if you created a high availability pair and synchronization requests overload the Tasks tab in the Message Center, the system experienced disk space issues and intermittent login issues. (CSCvb35861)
• Resolved an issue where, if incoming HTTP, TCP, or SSH traffic did not contain an Security Group Tags (SGT) value in the header, traffic matched against the default access control policy instead of any other configured policy. (CSCvb36645)
• Resolved an issue where, if you created a pair of routed VLAN interfaces and used an NGIPSv device to inspect traffic between the interfaces, then enabled captive portal active authentication, captive portal did not work. (CSCvb36748)
• Resolved an issue where incoming HTTP and HTTPS traffic containing XFF fields caused system issues. (CSCvb39325)
• If you deployed an access control rule containing a Security Group Tag (SGT) condition and used packet-tracer to generate troubleshoot including a value for a SGT on an Firepower Threat Defense device, then executed another packet-tracer without an SGT value, the system incorrectly used the SGT value from the previous troubleshoot and applied the SGT value to incoming traffic when it should not. (CSCvb46270)
• Resolved an issue where, if you enabled the Safe Search option in an access control policy and deployed, the system incorrectly generated Primary Detection Engine Exiting health alerts. (CSCvb46555)
• Resolved an issue where, if you deployed an access control policy containing ISE-assigned Security Group Tags (SGTs) on a system running Version 6.0. or later and updated the system to Version 6.1.0, then deployed the policy containing the ISE SGT, deploy failed. (CSCvb46775)
• Resolved an issue where detecting HTTP traffic caused memory issues. (CSCvb47111)
• Improved general memory usage and reduced latency when processing high volumes of traffic against access control policies configured with URL filter conditions and user groups. (CSCvb50368)
• Resolved an issue where with Firepower Threat Defense device experienced system issues while creating secondary connection. (CSCvb50750)
• Resolved an issue where, if you deployed an access control policy containing rules with Safe Search enabled, some websites experienced latency when loading. (CSCvb52057, CSCvb63352)
• Improved logging performance for Firepower 4100 Series devices and Firepower 9300 Appliances. (CSCvb57755)
• Resolved an issue where, if a Firepower Management Center running Version 6.1.0 managed a device running a version earlier than Version 6.1.0, the system did not generate any new discovery events and removed the network map several days after the Firepower Management Center updated to Version 6.1.0. (CSCvb61156)
• Resolved an issue where the system logged extraneous policy information during deployment and, in some cases, deploying large policies failed. (CSCvb61836)
• Resolved an issue where, if you added a URL Filtering smart license to a Firepower 4100 Series device or a Firepower 9300 Appliances managed by either the Firepower Management Center or the Firepower Device Manager and deployed an access control rule containing a URL category condition, the system did not block traffic matching the access control rule when it should. (CSCvb63250)
• Resolved a rare issue where, if you deployed an access control policy with a rule containing an application or URL condition placed above a rule containing a source or destination network condition and a packet session ended before the system assigned an application or URL category, sessions that should have matched the second rule did not. (CSCvb65052)
• Resolved an issue where, if you deployed an access control policy containing an identity policy that referenced a realm or access control rules containing groups or users from the realm and you deleted the realm, the system incorrectly generated a System defined Objects cannot be Altered. Please use a different Object error and you could not edit the access control policy. (CSCvb65648)
• Resolved an issue where, if you updated the system to Version 6.1, intrusion emails alerts did not function correctly (CSCvb67792, CSCvb85231)
• Improved memory use when deploying configuration. (CSCvb69483)
• Resolved an issue where updating the system from Version 6.0.1 to Version 6.1.0 generated The detection engine, Primary Detection Engine, alerting process terminated unexpectedly 1 time(s). errors. (CSCvb70786)
• Resolved an issue where, if you created a portchannel interface on a Firepower 4100 Series or Firepower 9300 Appliance FXOS chassis manager and added a logical device before registering the appliance to a Firepower Management Center, disable the portchannel interface and deploy, then re enable the portchannel interface and deploy, the system incorrectly generated a Interfaces assigned to EtherChannel cannot be removed. Please remove the sub-interfaces from the EtherChannel or add its members. error message. (CSCvb71119)
• Resolved an issue where, if you deployed a primary and secondary pxGrid node in high availability mode and the primary ISE server failed over, the Firepower Management Center pxGrid failed over and the secondary pxGrid node failed to successfully connect to the secondary ISE server. (CSCvb73128)
• Resolved an issue where, in some cases, updating a system to Version 6.1.0 and deploying to a registered device generated a Deployment failed in policy and object collection. If problem persists after retrying, contact Cisco TAC. error message. (CSCvb88561, CSCvb01821)
• Resolved an issue where, if the system processed HTTP traffic containing XFF headers, the system experienced issues and generated erroneous detection engine health warnings. (CSCvb91613)
• Resolved an issue where the system displayed incorrect URL categories on the Connection Events page ( Analysis > Connections > Connection Events). (CSCvb93362)
• Resolved an issue where, in some cases, the web interface incorrectly reported timeouts for malware lookup actions. (CSCvb94393)

The following defects were resolved in Version 6.1.0:

• Security Issue Addressed multiple cross-site scripting (XSS) vulnerabilities, as described in CVE-2015-4270 and CVE-2016-1294.
• Security Issue Addressed multiple vulnerabilities within the third party OpenSSL, as described in CVE-2015-3193, CVE-2015-3194, CVE-2015-3195, CVE-2015-3196, CVE-2016-2105, CVE-2016-2106, CVE-2016-2107, CVE-2016-2108, CVE-2016-2109, and CVE-2016-2176.
• Security Issue Addressed multiple vulnerabilities within the third party Open SSH, as described in CVE-2015-5600, CVE-2015-6565, CVE-2016-0777, and CVE-2016-0778.
• Security Issue Addressed a vulnerability issue in the third party Java, as described in CVE-2015-6420.
• Security Issue Addressed an arbitrary HTTP header injection vulnerability allowing unauthenticated, remote attackers to exploit managed devices as described in CVE-2015-6564.
• Security Issue Addressed a vulnerability issue that generated denial of service in GNU utilities, as described in CVE-2015-7547.
• Security Issue Addressed multiple vulnerability issues that generated denial of service in NTP, XML, OpenSSL, and other third parties as described in CVE-2015-7691, CVE-2015-7692, CVE-2015-7701, CVE-2015-7702, CVE-2015-7704, CVE-2015-7705, CVE-2015-7848, CVE-2015-7850, and CVE-2015-7853.
• Security Issue Addressed a vulnerability that allowed internal users to bypass SSL rules with the rule action set to Decrypt-Resign, CVE-2016-6411.
• Security Issue Resolved an issue where, if you created an application protocol and you added the protocol to an access control rule, the system did not encode the application protocol name.
• Security Issue Resolved a vulnerability where a user without admin privileges could delete other users' scheduled tasks.
• Security Issue Resolved an issue where, if you clicked Generate Troubleshooting Files and selected All Data or System Configuration, Policy and Logs, the generated troubleshoot included sensitive data.
• The system now displays an HTTP response page for connections decrypted by the SSL policy, then blocked (or interactively blocked) either by access control rules or by the access control policy default action. In these cases, the system encrypts the response page and sends it at the end of the re encrypted SSL stream. However, the system does not display a response page for encrypted connections blocked by access control rules (or any other configuration). Access control rules evaluate encrypted connections if you did not configure an SSL policy, or your SSL policy passes encrypted traffic. For example, the system cannot decrypt HTTP/2 or SPDY sessions. If web traffic encrypted using one of these protocols reaches access control rule evaluation, the system does not display a response page if the session is blocked. (143836/CSCze94100)
• Resolved an issue where enabling Log at Beginning of Connection did not log the beginning of connection events generated from TCP fast-path network traffic. (121762/CSCze88553)
• Resolved an issue where, if you enabled cloud communications on an ASA FirePOWER module managed by ASDM and attempted to query or download URL files, the device ran out of memory and became unresponsive. (CSCur48363)
• Resolved an issue where, if you configured Open Shortest Path First (OSPF) in the Dynamic Routing tab of the Virtual router page ( Devices > Devices Management > Virtual routers > Dynamic Routing) and added an Area, then changed the value of the Cost column and deployed changes, the system did not update the OSPF. (CSCus31735)
• Resolved an issue where, if you deployed a network analysis policy (NAP) with Inline mode enabled, connection events generated from HTTPS video stream traffic displayed an incorrect total bytes value. (CSCus59142)
• Resolved an issue where the system did not correctly prime device names displayed on the Dashboard page. (CSCus71149)
• Resolved an issue where, if you registered a device to a pair of a Firepower Management Centers and applied an access control policy with URL rules and turned on URL cloud query, the managed device did not successfully request a URL lookup. (CSCus99059)
• Improved sftunnel logging. (CSCuu79387)
• Resolved an issue with flowbit auto-resolution that affected a small number of rules. (CSCuv55203)
• Resolved an issue where the system did not generate events for rules with the generator ID (GID) of 134 if the rule was configured to alert and latency-based performance settings were enabled in the access control policy. (CSCuv70840)
• Generated malware, IPS email, and syslog alerts now include source and destination IP address, downloaded file name, SHA, and URI values. (CSCuw18687)
• Resolved an issue where, if you deployed a route map, then removed all referenced objects within the map and redeployed, the second deployment failed. (CSCuw28056)
• Resolved an issue where, if you viewed All Events (Not Dropped) in the Intrusion Events table view page of a Firepower 7000 Series or Firepower 8000 Series device and sorted the table by up to six fields including Review By and Count and then generated a report, report generation failed. (CSCuw29993)
• Resolved an issue where, if you registered an ASA 5512-X, ASA 5515-X, ASA 5525-X, ASA 5545-X, ASA 5555-X, ASA 5585-X-SSP-10, ASA 5585-X-SSP-20, ASA 5585-X-SSP-40, or ASA 5585-X-SSP-60 device running FirePOWER services to a Firepower Management Center and enabled Clientless VPN tunnel group, then deployed an access control policy with the default action set to Allow all traffic, the system incorrectly dropped packets. (CSCuw38561)
• Resolved an issue where, if you deployed a network discovery policy and enabled host discovery, the system incorrectly detected hosts from networks not defined in the network discovery policy. (CSCuw51866)
• Resolved an issue where, if you deployed an access control rule set to Allow, an intrusion policy set to Drop when Inline for rule SID 31978, and a network analysis policy with inline normalization enabled, the system erroneously reported matched URI traffic containing unescaped spaces as dropped when the traffic was not. (CSCuw57831)
• Resolved an issue where some Firepower 8000 Series devices incorrectly changed the Ethernet type from 88a8 to 8100. (CSCuw57916)
• Resolved an issue where, if you enabled the use of a proxy on the Firepower Management Center and configured Smart licensing, the smart licensing registration attempted to connect directly to the Firepower Management Center instead of the proxy client. (CSCuw58574)
• Resolved an issue where, if you attempted to backup and restore a Firepower Management Center, backup failed. (CSCuw71197)
• Resolved an issue where, in some cases, the system generated extraneous messages and incorrectly filled up disk space. (CSCuw84304)
• Resolved an issue where, if you executed host input commands on a Firepower Management Center in a high availability configuration, the system failed to apply the host input commands to the secondary Firepower Management Center in the pair. (CSCuw98376)
• Resolved an issue where, in some cases, intrusion events did not display the correct source or destination IP address. (CSCux00385)
• Resolved an issue where a 7000 or 8000 series device in high availability environment configured with a virtual switch as an endpoint dropped communication if the high availability pair experienced a failover and the secondary device became the primary device. (CSCux11121)
• Resolved an issue where, if you reboot a managed NGIPSv device and added multiple vmxnet3 interfaces, the system incorrectly added the interfaces causing pre-existing interfaces to experience issues. (CSCux15018)
• Resolved an issue where, if you uninstall Version 5.4.1.4 from an ASA 5506-X, ASA 5506H-X, ASA 5506W-X, ASA 5508-X, or ASA 5516-X managed by ASDM to a previous version, the Vulnerability Database (VDB) incorrectly reverted to an older version when it should not have. (CSCux15318)
• Resolved an issue where, if you enabled Automatic Rule Update on a Firepower Management Center pair and installed a rule update, then applied policies, the Firepower Management Center incorrectly displayed the access control policy as out-of-date when it was not. (CSCux21111)
• Resolved an issue where, if you deployed an access control policy containing the default Balanced Security and Connectivity access control rule and an identity policy with captive portal enabled, the system incorrectly submitted traffic that should pass through the captive portal to the global whitelist and the captive portal page did not successfully load. (CSCux42313)
• Resolved an issue where, if you viewed the Firepower Management Center interface in Japanese, you could not change and save the Default Set from the Variable Set tab of the Object Management page ( Objects > Object Management). (CSCux55003)
• Resolved an issue where clicking the Copy button on the Reviewed Events page ( Analysis > Intrusion Reviewed Events) generated an Action Copy Failed... error message. (CSCux59910)
• Resolved an issue where, if you deleted an authentication certificate from a global domain or subdomain referenced in an identity policy and deployed, deployment failed. (CSCux68559)
• Resolved an issue where, if you registered a Firepower Threat Defense virtual device to a Firepower Management Center and unregistered the Firepower Threat Defense virtual device after deleting a domain, then registered the same Firepower Threat Defense virtual device to the same Firepower Management Center in the global domain, device registration failed and the system generated a Discovery failed due to access policy assignment failure. Retry device registration error in the Message Center. (CSCux72960)
• Resolved an issue where, if you deployed an SSL policy and enabled SSL decryption, the system experienced a disruption in traffic after a few hours of decrypting SSL traffic. (CSCux75036)
• Resolved an issue where, if you configured BGP Neighbor routing settings and set the Min hold time field or the Hold time field in the Timers tab of the Device Management page ( Devices > Device Management) with the integers between 0-2, the system generated a Hold time/Min hold time must be 0 or greater than 2 error message. (CSCux79162)
• Resolved an issue where deployment failed if you unregistered an ASA FirePOWER module from a Firepower Management Center and switched the device to an ASA FirePOWER module managed by ASDM, then attempted to save the access control policy containing web application conditions. (CSCux80311)
• The system no longer generates erroneous hardware health alert events. (CSCux82417)
• Improved the fail-to-wire function on Firepower 7110, 7115, 7120, 7125, and 7150 devices. (CSCux84120)
• Resolved an issue where, if you placed an ASA FirePOWER module managed by ASDM running Version 6.0 into multiple context mode, then filter events on the Connection tab of the Real Time Eventing page ( Monitoring > ASA FIrePOWER Monitoring > Real Time Eventing) for events based on the multiple context, the system did not display any events when it should have displayed all events matching the context name. (CSCux90148)
• Resolved a rare issue where, if you baselined a Firepower 7000 Series device at Version 5.4.0 and registered the device to a Firepower Management Center running Version 6.0, the system automatically unregistered the device after the device successfully registered to the Firepower Management Center. (CSCux92045)
• Resolved an issue where, if you created a Firepower Management Center high availability pair and restored a backup operation before the high availability pair was established, the system experienced severe issues. (CSCux92198)
• Resolved an issue where, if you create an access control rule containing the Uncategorized URL category in the Category tab, the rule matched against any URL condition rather than the configured Uncategorized URL category. (CSCux94309)
• Resolved an issue where, if you deployed an access control rule containing a passive security zone on a Firepower 7000 Series or Firepower 8000 Series device, the system incorrectly evaluated the direction of the traffic and did not matching the deployed access control rule. (CSCux96202)
• Improved update process from Version 5.4.1.2. (CSCuy00310)
• Resolved an issue where, if you deployed a file policy with local malware analysis enabled and right clicked a stored filed on the File Events page ( Analysis > Files) or the Captured Files page ( Analysis > Files > Captured Files) to View File Composition, the system incorrectly reported the MD5 value as 00000000000000000000000000000000 for every file stored by local malware analysis. (CSCuy01702)
• Resolved an issue where, if you configured LDAP authentication and restored a backup to a Firepower Management Center, then attempted to log in with LDAP external authentication credentials, authentication failed and the system generated an Unable to authorize access... message. (CSCuy01999)
• Resolved an issue where, in some cases, the system did not correctly enforce group-based access control rules. (CSCuy10652)
• Improved general tunnel decoding in routed environments. (CSCuy15661)
• Resolved an issue where the Firepower Management Center experienced a slow response time if you accessed the web interface via an IPv6 address with Internet Explorer Version 11. (CSCuy22566)
• Resolved an issue where, if you created a file rule set to Block Malware and a network analysis policy with Inline Normalization disabled, then disabled all access control rules referencing the file policy and deployed the access control policy, the system automatically enabled inline normalization when it should not. (CSCuy23822)
• Resolved an issue where, if you deployed a VPN on a Firepower 7000 Series or Firepower 8000 Series device where the VPN monitor generated health alerts in the Health tab of the Message Center and then you deleted the VPN, the system continued to generate health alerts for the VPN even though the configuration was deleted. (CSCuy25356)
• Resolved an issue where, if you modified a load balancing configuration with a CLI command and the successfully deployed configuration, the system did not retain the load balancing configuration. (CSCuy30534)
• Resolved an issue where, if you edited a base intrusion policy used by one or more child policies, the system did not mark the child policies as out-of-date when it should. (CSCuy32822)
• Resolved an issue where intrusion policies continuously and unsuccessfully attempted to sync a Firepower Management Center pair due to taking longer than a configured timeout. (CSCuy33982)
• Resolved an issue where, if you deployed an Open Shortest Path First (OSPF) on a Firepower Threat Defense high availability pair with an authentication password of more than nine characters, the Firepower Management Center did not restrict the authentication password for OSPF routing to nine characters when it should, and deployment failed. (CSCuy39850)
• Improved general HTTP header processes. (CSCuy42869, CSCuy43039, CSCuy44519, CSCuy44669)
• Resolved a rare issue where, if you enabled Inspect HTTP Responses as a Server-Level HTTP Normalization option, the system did not detect files containing 16,000 or more non-printable characters. (CSCuy43369)
• Improved passive FTP detection capabilities for specific FTP clients. (CSCuy43510)
• Resolved an issue where the system did not detect files if the client dropped packets. (CSCuy45196)
• Improved intrusion policy synchronization between two Firepower Management Centers in high availability configuration. (CSCuy49616)
• Improved general stability when deploying configuration. (CSCuy52294)
• Resolved an issue where, if you applied an intrusion rule set to Drop and Generate Events and enabled Sensitive Data Detection in the Advanced Settings tab of the intrusion Edit Policy page ( Policies > Intrusion > Intrusion Policy), then edited the Sensitive Data Detection page and checked Masks, the system did not correctly mask some sensitive data generated in intrusion events. (CSCuy56094)
• Resolved an issue where, if you created a variable set containing a group of multiple network objects the system incorrectly saved the variable set's default value as any. (CSCuy60748)
• Improved memory performance related to DNS traffic. (CSCuy61616)
• Resolved an issue where, if you configured an Open Shortest Path First (OSPF) on a registered device, the OSPF incorrectly reported all available interfaces as configured even if an interface was down. (CSCuy64096)
• Improved warning messages about SSL certificate verification failure. (CSCuy65151)
• Resolved an issue where, if you enabled URL cloud lookups and the system submitted a lookup request for a URL starting with www., and another lookup request for the same URL but without the www. prefix, the system generated an extraneous health alert message. (CSCuy86036)
• Resolved an issue where, in some cases, the Firepower Management Center did not display all the group mappings or user mappings based on groups. (CSCuy91826)
• Resolved an issue where, if you used eStreamer to stream event data, the system experienced high CPU usage. (CSCuy95836)
• Resolved an issue where, if you imported an SSL policy containing a network object group as a source or destination network and chose to import the network object group via the Import as new option, the system did not display the network object group value reference. (CSCuy95841)
• Resolved an issue where, if you deployed an access control policy containing a security intelligence object and enabled logging to system log, the system did not log events to the syslog when it should. (CSCuy97827)
• Resolved an issue where, if you configured the default time zone on the Time Zone Preference tab of the User Preferences page ( User > User Preferences) to Australia on a Firepower Management Center with a registered Firepower Threat Defense device, deploying to the Firepower Threat Defense device failed. (CSCuz00284)
• Resolved an issue where, if a scheduled intrusion rule update executed on a system with several registered devices and you deployed an intrusion policy after the intrusion rule update, deployment failed. (CSCuz01826)
• Resolved an issue where, if you attempted to deploy an access control policy containing a custom network group object in any variable, or saved a variable set containing a custom group network object, deployment failed and the system generated error messages respectively. (CSCuz03275)
• Resolved an issue where the system incorrectly identified Internet Control Message Protocol (ICMP) echo requests as SSL Client application protocol requests and blocked the ICMP echo requests. (CSCuz06203)
• Resolved an issue where, if you configured a realm for a STARTTLS server and deployed an SSL policy set to Decrypt-Resign traffic from SMTP servers with a file policy set to Block file attachments, the system did not block file attachments from the SMTP server when it should have. (CSCuz06368)
• Resolved an issue where, if you deployed a file policy with Archive Inspection enabled, the system generated extraneous messages in the syslog. (CSCuz13082)
• Generated malware events no longer contain extraneous linebreak characters. (CSCuz16055)
• If you did not add a smart license to the system configuration and initiated smart license evaluation mode, the system incorrectly generated evaluation period health alerts once the evaluation period expired and you could not disable the alerts. The system now generates evaluation period health alerts if you add a smart license to the system configuration and initiate smart license evaluation mode. (CSCuz19840)
• Resolved an issue where, if you deployed an access control policy with connection logging enabled and created a search from the Connection Events page ( Analysis > Connections > Connection Events) for a Traffic (KB) field value, the system returned incorrect results. (CSCuz22965)
• Resolved an issue where, if you created a correlation rule based on a malware event and included a filename containing a space as a condition, the system saved the correlation rule and you could not edit the rule after you saved it. (CSCuz23093)
• Resolved an issue where, if you added at least one license to a Firepower Management Center Virtual and updated to Version 6.0.0, the system changed the name of the pre-update licenses to Cisco Firepower Management Center for VMWare. If you updated a Firepower Management Center Virtual to Version 6.0.0 and attempted to add a new license, the system generated a Couldn't verify license error. (CSCuz25170)
• Resolved an issue where, if you deployed an SSL policy and the system experienced a high volume of traffic, the system dropped the SSL certificate fingerprint before logging occurred. (CSCuz30940)
• Resolved an issue where, if you enabled Inspect HTTP Responses and deployed configuration to a registered device running Firepower Threat Defense, the system was unable to detect some files and displayed incorrect SHA values. (CSCuz46938)
• Resolved an issue where the system did not block HTTPS traffic containing URLs blacklisted in Security Intelligence lists or feeds. (CSCuz50842)
• Resolved an issue where, if you deployed a network analysis rule containing a source or destination zone condition, the system incorrectly matched traffic against the default network analysis policy instead of the rule referencing the source or destination zone condition. (CSCuz60528)
• You can now enable the Connection Events table view to include the SSL Actual Action or SSL Expected Action columns. (CSCuz74234)
• Resolved an issue where, if you configured a realm for an LDAP or STARTTLS server with a port other the default port and saved, then edited the same directory again, the system incorrectly switches the port from the configure port to the default port. (CSCuz79383)
• Resolved an issue where the data in available widgets inconsistently truncated immediately after the username. (CSCuz80841)
• Resolved an issue where, if you deployed a file policy with Archive Inspection enabled for ARJ compressed files enabled during the inspection of traffic containing malformed ARJ compressed files, the system experienced issues such as geolocation database and URL database update failures. (CSCuz99094)
• Resolved an issue where, if you deployed access control rules to a managed device configured with a security zone, the system incorrectly deployed the access control rules out of order and incoming traffic triggered rules that would not have triggered in the desired configuration. (CSCuy99274)
• Resolved an issue where, if fragmented UDP packets with different VLAN tags traveled through the same inline set on a Firepower 7000 Series or Firepower 8000 Series device, the fragmented packets experienced a 10 second delay and the system dropped traffic. (CSCva03312)
• Resolved an issue where, if you updated an 5500-X series device while being registered to a Firepower Management Center, all Malware Cloud Lookup requests timed out. (CSCva00693)
• Resolved an issue where, in some cases, Firepower 7000 Series or Firepower 8000 Series devices configured with static routes experienced issues and used 100% of the CPU. (CSCva15195)
• Improved the Devices page load time. (CSCva23498)
• Improved memory usage on stacked Firepower 8000 Series devices. (CSCva39997, CSCva54894)
• Improved SSL inspection processes. (CSCva42950)

Known Issues

If you have a Cisco account, you can view known issues reported in this release using the Cisco Bug Search Tool: https://tools.cisco.com/bugsearch/.

The following defects are reported in Version 6.1.0.3:

• After upgrading to 6.0, you cannot remove tasks from the taskbar. (CSCuy17170)
• In Task Status page the task is stuck/spinning. (CSCuy50039)
• Flowbit auto-resolution not working properly. (CSCuy93365)
• Multi-Domain External Authentication Enabled at Global for Login. (CSCva77816)
• Detection engine,primary detection engine,alerting process health alert. (CSCvb00980)
• Suspected latency during shared memory lookup (with URL Retry enabled). (CSCvb24824)
• Cannot re-arrange order of Network Analysis Rules. (CSCvc16184)
• Firepower Management Center not providing options to restrict ICMP types for certain codes. (CSCvc24013)
• Policy deploy fails due to inconsistency in high availability primary Firepower Threat Defense device in the backend. (CSCvc37876)
• Altering logging settings like disabling syslog causes intrusion and file policies to become disabled. (CSCvc56921)
• Health monitor error: The cloud databases for these appliances are not synced. (CSCvc84721)
• Health monitoring for Firepower 8000 Series firmware needs to try again for communication failure. (CSCvd01405)
• Checking for conflicts in variable sets doesn't work on network groups. (CSCvd09003)
• Unable to use objects inside intrusion rules. (CSCvd32767)
• Unable to create an access control policy while registering a device on a Firepower Management Center upgrading to 6.1.0.3. (CSCvd37485)
• Firepower Management Center REST API Call timeouts. (CSCvd62103)
• Policy deploy with NAP fails when adaptive profiles or auto detect setting is disabled in NAP. (CSCvd62553
• Firepower Management Center high availability: LDAP authentication object on primary Firepower Management Center does not sync over secondary. (CSCvd67710)
• Intrusion policy commit is slow because prepare statement is called multiple times. (CSCvd72697)
• Handle rules.conf validation more efficiently for Firepower devices. (CSCvd74556)
• Error while switching domains from the Health Policy page. (CSCvd80045)
• XFF Rule does not match SPDY traffic. (CSCvd82111)
• Queries against temp merge tables may fail. (CSCvd82225)
• Upgrade fail at /600_schema/110_post_update_dbic.sh due to missing column in packet_log table. (CSCvd83569)
• Need ability to enable PPTP inspection. (CSCvd86594)
• Policy deploy hangs at 40% with the object names end with ( _). (CSCvd89890)
• Unable to delete third party vulnerabilities when the host count associated with them is > 100. (CSCvd91019)
• ICMP Any in destination or source ports are saved incorrectly, which can result in broken pre-filter policy. (CSCvd92322)
• SSL Block action when Extended Master Secret is used with SSL Policy Known Key Decrypt. (CSCvd93722)
• Intermittent failure in User Group lookup. (CSCvd94183)
• Nested network object set in network discovery rule is not deployed on the sensor. (CSCve02097)
• SMTP traffic prematurely reaching SafeSearch engine rule. (CSCve03600)
• Code Snippet shows while adding interface on route map. (CSCve11072)

The following defects were reported in previous versions:

• Prefiltering is supported on Firepower Threat Defense devices only. Prefilter policies deployed to Classic devices (the 7000 and 8000 Series, NGIPSv, and ASA FirePOWER) have no effect. Deploying a prefilter policy to a classic device generates an extraneous error indicating that only devices running Firepower Threat Defense Version 6.1.0 support prefilter policies. You can safely ignore the message that appears when you deploy to Classic devices.
• You cannot generate troubleshooting for the secondary Firepower Management Center in a high availability configuration from the primary Firepower Management Center. As a workaround, generate troubleshooting from the secondary Firepower Management Center. (CSCux46182)
• Firepower Management Center experiences an error while processing a particular user-to-host mapping, the device may incorrectly drop some user-to-host mappings. (CSCux61395)
• If you use Firefox to view multiple Firepower Management Center user interfaces with self-signed certificates, the Firepower Management Center login screen may take more than several minutes to load. If you experience an extended load time for the login screen, enter about:support in a Firefox web browser search bar and click the Refresh Firefox option, then view the Firepower Management Center interface with self-signed certificates in the same Firefox browser. See https://support.mozilla.org/en-US/kb/refresh-firefox-reset-add-ons-and-settings for more information. (CSCux72244)
• In some cases, if you update to Version 6.0 or later and deploy policies, the system generates cannot run validator error messages within /var logs. If you experience multiple error messages in /var logs, redeploy configuration. (CSCuy22361)
• If a Firepower Management Center generates a health alert for a registered ASA FirePOWER module, the generated alert does not include information about the available interfaces when it should. (CSCuy25731)
• If you update a system running Version 5.3.x to Version 5.4.0 or later, the system automatically sets the link mode to Autonegotiate even if the managed device does not support autonegotiation. As a workaround, manually set the link mode on the Device Management page ( Devices > Device Management) and save. (CSCuy28028)
• If you configure an email alert on the Alerts page (Policies > Actions > Alerts) for generated retrospective malware events, the system does not include all the required content in the generated email alert when it should. (CSCuy45255)
• If you update a Firepower Management Center from Version 5.4.x to Version 6.0 or later and create a new subdomain and deploy a network discovery policy, you cannot delete any objects or object groups referenced by the network discovery policy in the global domain. As a workaround, before adding any subdomains, remove rules from the global network discovery policy. (CSCuy51566)
• The REST API explorer does not prompt you to terminate the existing session before starting a new session when it should. (CSCuy98740)
• In some cases, the system incorrectly terminates processes suspected of high memory usage when this usage is not an error. These processes are automatically restarted. (CSCuz09158)
• If you create a system policy that contains external authentication on a Firepower Management Center running a version earlier than Version 6.0.0 and update the Firepower Management Center to Version 6.0.x or Version 6.1.0 and later, deploying the system policy fails and the system generates a INVALID OBJECT STORED error message. As a workaround, contact TAC Support. (CSCuz19786)
• In some cases, if you update a Firepower Management Center Virtual hosted AWS to Version 6.1.0 and experience a failure, the AWS platform may become unreachable. If you cannot reach the AWS after updating to Version 6.1.0, contact TAC Support (CSCuz23091)
• If you configure a Firepower Threat Defense device managed by Firepower Device Manager and deploy configuration, switch the device to be managed by a Firepower Management Center and deploy configuration, then switch the device to be managed by Firepower Device Manager, the device does not clear out the configuration deployed from the Firepower Management Center and generates errors. As a workaround, if you switch a Firepower Threat Defense device in such a manner, redeploy configuration after you've reestablished management by the Firepower Device Manager. (CSCuz44818)
• If you enable the Send Audit Log to Syslog option in the Audit tab of a managed device's Platform Settings page ( Devices > Platform Settings) and configure the Host field to an invalid hostname or do not have DNS configured to reach the hostname, then update the system, the update takes an excessive amount of time to complete or the update fails. As a workaround, use a valid hostname or IP address if you enable the Send Audit Log to Syslog option. (CSCuz44985)
• If you cannot reach the Firepower Management Center after editing reconciliations on the Change Reconciliation page ( System > Configuration > Change Reconciliation), the system successfully makes the changes and generates a report but the generated report does not track the changes made. (CSCuz48709)
• In some cases, the system experiences issues if the Automated application Bypass (AAB) is activated and deployment fails. As a workaround, restart the device and Increase the AAB timeout value, then redeploy policy. (CSCuz52270)
• If you apply an SSL policy containing application rule conditions for SMTPS, POP3S, and IMAPS traffic, the system may incorrectly display Unknown as the application protocol in the Connection Events page ( Analysis > Connections > Events). (CSCuz54417)
• In some cases, if you configure an inline set on a NetMod on a Firepower 8000 Series device and then move the NetMod to another interface port, then power on the device and deploy configuration, deployment fails. (CSCuz62308)
• If you update the system from Version 6.0.x to Version 6.1.0 or later and deploy, initial deployment may fail. As a workaround, redeploy configuration. If you continue to have issues, contact TAC support. (CSCuz70743)
• In rare cases, reimaging a Firepower Management Center or a Firepower Threat Defense device can cause an Out of Compliance (OOC) state with the Cisco License Authority. As a workaround, when reimaging a Firepower Management Center, first deregister the Firepower Management Center from the Cisco Smart Software Manager. Choose System > Licenses > Smart Licenses and click the deregister icon. When reimaging a Firepower Threat Defense device, first delete the device from its managing Firepower Management Center. Choose Devices > Device Management and click the trash can icon. When the reimage is complete, register the Firepower Management Center to the Cisco Smart Software Manager. For a Firepower Threat Defense device, add the device to its managing Firepower Management Center. (CSCuz91277)
• In some cases, if you deploy an intrusion policy to an inline deployment and intrusion rule threshold is triggered by traffic, the system correctly blocks traffic but generates connection events without the correct tag and appears to incorrectly allow traffic. (CSCva01799)
• In some cases, if you get locked out of a REST API session, the web browser generates an HTTP Error 401Unauthorized error message instead of an HTTP Error 403 Forbidden error message. (CSCva03571)
• In some cases, if you register an Firepower Threat Defense device to an Firepower Management Center and deploy an access control policy set to Block all traffic from the registration page, the device successfully registers to the Firepower Management Center but deployment fails. As a workaround, redeploy policies after the successful registration. (CSCva03933)
• In some cases, the syslog may report extraneous critical messages about the UECTunnel detection resource list. (CSCva06062)
• When the packet capture with tracer is configured on both ingress and egress interfaces at the same time for certain traffic, packet capture output shows the same ingress and egress interfaces. The packet traversal through the device works as expected. (CSCva11988)
• If you install the zero day configuration on a Firepower Threat Defense virtual, the device is not completely initialized the first time you log into the Firepower Threat Defense Virtual. The device completes initialization up to 30 seconds after the first login. (CSCva12971)
• If importing a large configuration takes longer than the configured session timeout value, the system logs out and the import job fails. As a workaround, edit the browser session timeout field on the Shell Timeout page ( System > Configuration > Shell Timeout) and configure a larger value to allow a successful import. (CSCva24670)
• In some cases, if you deploy a Firepower Threat Defense on Amazon Web Services (AWS) device from a Firepower Management Center for the first time, the End User License Agreement (EULA) page may erroneously appear on the first attempt to log into the Firepower Threat Defense on AWS. As a workaround, agree to the EULA and log into the virtual device. (CSCva26800)
• In some cases, if you create an intrusion rule and use an individual network object or a network object group as a source or destination IP, the system generates an Error – invalid Destination IPs message and does not create the intrusion rule. As a workaround, add an individual network object or a network object group to a variable and use the variable as a source or destination IP within an intrusion rule, then deploy. (CSCva29127)
• In some cases, Firepower Threat Defense on Amazon Web Services (AWS) does not configure a manager and, when registering to a Firepower Management Center, device registration fails. As a workaround, log into the Firepower Threat Defense on AWS via SSH and issue the configure manager CLI command on the Firepower Threat Defense, then register the device to the Firepower Management Center. (CSCva38712)
• In some cases, if you switch an ASA 5500-X series device from being managed by ASDM to being managed by a Firepower Management Center, registration to the Firepower Management Center fails and the system generates a Failed to Register error message in Tasks tab of the Message Center. As a workaround, re-register the device to the Firepower Management Center and redeploy configuration. (CSCva38806)
• In some cases, if you use a redundant interface within a Firepower Threat Defense high availability pair and then delete the redundant interface from the Interfaces tab of the Device Management page ( Devices > Device Management), deploy fails and the system generates a Removing the name of the interface will remove other sub-commands under interfaces, as well as the other command referencing the interface. Any network connected to this interface will be disconnected. error message. As a workaround, delete the redundant interface from both the Interfaces tab and the high availability pair prior to deploying. (CSCva40054)
• If you view the API explorer in a tab of a web browser window and close the tab, then view the API explorer in another tab of the same web browser window, the web browser uses cached login credentials when it should not. The cache is cleared if you close the web browser window. (CSCva40688)
• In rare cases, if an authoritative and non-authoritative logon for the same user or IP address arrive at the Firepower Management Center at approximately the same time, deployed access control rules may not work as expected. As a workaround, log out and log back in, then redeploy configuration. (CSCva43120)
• In rare cases, registering a smart license fails and the Tasks tab of the Message Center displays a Failed to register message even though the Smart Licenses Page ( System > Licenses > Smart Licenses) reports a successful product registration. (CSCva46755)
• In some cases, if you search for a registered device on the Smart Licenses page ( System > Licenses > Smart Licenses) via the Filter Devices search bar and edit device licenses, then save changes while the devices are filtered and search for a device again, the Smart Licenses page does not generate any available devices when it should. (CSCva47302)
• If you edit the custom logo in the Advanced tab of the Report Template editor page ( Overview > Reporting > Report Template), the logo previews are broken and the selected logo may incorrectly cover up data in the generated report. (CSCva48577)
• In some cases, if you deploy a file policy set to Block Malware and an SSL policy set to Decrypt -Known key to an ASA FirePOWER module, the system does not detect or log IPv6 traffic when it should. (CSCva48610)
• Version 6.1.0 does not support queries for the message keyword within records on the Audit page ( System > Monitoring > Audit) of a Firepower Management Center if you invoke a GET request via REST API. (CSCva48872)
• If you reference an object that does not exist within an access control rule and deploy, the object appears to be empty when the object should not appear. (CSCva48917)
• If you create an access control policy containing a health policy with Disk usage monitor enabled and add a URL Filtering license, then deploy to an ASA 5515-X device, the system incorrectly generates High unmanaged desk usage on /dev/shm health alerts. (CSCva30652)
• In some cases, if you create a custom role and check one or more smart license permissions, then log in as the user and view the Smart Licenses page ( System > Licenses > Smart Licenses), the system generates an Error 403: Forbidden message. (CSCva50429)
• If you switch from the device from being managed by a Firepower Management Center to being managed by ASDM, and if you configure a realm with Microsoft Active Directory (AD) credentials then the realm no longer successfully connects to the AD server. As a workaround, save and edit the realm, then retest the connection to the AD server. (CSCva50455)
• In some cases, VPN sessions on devices running Firepower Threat Defense experience latency and the web session times out before establishing a successful connection. (CSCva50614)
• If you create a realm containing an incorrect port using Microsoft Active Directory (AD) credentials, the system generates an extraneous ADI is not returning to ready state message. As a workaround, reconfigure the realm to use the correct port and save changes. (CSCva50669)
• If you have a device associated with the Firepower Management Center with a base license and Threat license or a base license, a Threat license, and a Malware license, then the licenceCaps field in the JSON response for the REST call GET /api/fmc_config/v1/domain/<domainUUID>/devices/devicerecords?expanded=true” does not display the base license. As a workaround, the REST call "GET /api/fmc_config/v1/domain/<domainUUID>/devices/devicerecords/<deviceUUID> can be used to determine the licenses associated with a device. (CSCva50700)
• If you use the REST API to create an access control rule with an object reference to SIURLList, the type for the reference is incorrectly set to SIURLFeed. (CSCva50886)
• If you attempt to create an access control rule with a POST request via REST API that includes invalid Id values for ISE attributes, the system incorrectly creates the access control rule when it should generate an error about the invalid values. (CSCva52523)
• If you create a recurring scheduled task configured to execute Every other day, the system incorrectly runs the task every day. As a workaround, manually check the Repeat on option. (CSCva60646)
• If you apply a file policy with logging to a device with Automatic Application Bypass (AAB) enabled, excessive logging may incorrectly trigger AAB. (CSCva62240)
• If you add or edit an interface on the Interfaces page ( Devices > Interfaces) of an Firepower Threat Defense device and click Add Prefix on the IPv6 tab of the Interfaces page, then set the Prefer LifeTime and Valid LifeTime values to Infinite and save, invoking a GET by ID or GET ALL with query expanded=true request via REST API fails. As a workaround, invoke a GET ALL request without any query parameters via REST API. (CSCva68420)
• If you assign an unassigned access policy to device groups using POST on policyassignments via REST API, the response lists the devices within the device group instead of the device groups the policy is assigned to. (CSCva82757)
• Firepower Threat Defense devices experience general performance degradation. (CSCva89333)
• If you create a network object on the Network page ( Object Management > Network) of an Firepower Management Center, then override the network object and invoke a GET request via REST API to query the override object, the system incorrectly sets the object's overrideable field to true in the return when the network override object cannot be overridden. (CSCva84245)
• In rare cases, if you attached an 10G SR module or 40G SR module connected a link partner to a Firepower 9300 Appliance port running Version 6.1.0 or later with FXOS version 2.0.1 and the SR module powers on while the Firepower 9300 Appliance switches from bypass mode to standby mode, the link goes down and up (flaps). (CSCva86402)
• If you create a new domain and include a space or an unsupported character in the domain name, the system generates default objects with the same name and does not save if you modify the default object. As a workaround, do not use names that include spaces or other unsupported characters when creating domains. (CSCva86631)
• If you click the Application tab when editing for creating an access control rule in the policy editor window, the system takes an excessive amount of time to load the page or may time out. (CSCva86595)In some cases, ISE connections established in Version 6.0 are broken after updating to Version 6.1.0. Version 6.1.0 is compliant with RFC6125-6.4.4, which states that certificate CNs should be ignored if there are SAN values specified. If the pxGrid server certificate in your ISE deployment is configured with a CN value and one or more SAN values, remove the CN value and add it as an additional SAN. (CSCva88329)
• The system incorrectly uses red Impact flag colors for all intrusion events instead of a variety of colors to display the severity of the event. (CSCva90055)
• If you deploy a Quality of Service (QoS) policy that rate limits application traffic, the system incorrectly displays an error about disabled adaptive profiling. You can safely ignore this warning. The QoS policy will correctly rate limit your traffic. (CSCva91785)
• If the HOME_NET variable includes more than 400 IP addresses, deploying fails. As a workaround, reduce the number of IP addresses in the default HOME_NET variable to a maximum of 400 IP address. (CSCva92910)
• You cannot form a Firepower Threat Defense high availability pair if a QoS policy is currently applied to the primary device. As a workaround, unassign the QoS policy and deploy configuration changes before you establish high availability. Once the high availability pair is successfully established, then you can then reassign the QoS policy to the new device pair. (CSCva93645)
• In some cases, if you configure the Firepower Management Center for multi-tenancy in a multidomain deployment and a user logs into the Firepower Management Center as a specific domain user, then attempts to edit an access control policy that is assigned to more than one managed device, the system generates a An internal error is preventing the system from validating this policy. If the policy is misconfigured, deploying configuration changes may fail or your changes may not work as expected. Contact TAC Support for assistance error. As a workaround, either edit the policy configuration with Filter by device to select a single device or log in a user of a global domain instead of a domain level and edit. (CSCva96644)
• If you update the Firepower Management Center to Version 6.1. or later and edit the action of the default prefilter policy from Allow to Block all traffic and deploy to a managed Firepower Threat Defense device running Version 6.0.x, the system incorrectly deploys the default action of the tunnel rules within the deployed prefilter policy to the Firepower Threat Defense device when they are not supported and the device may incorrectly allow tunnel traffic instead of blocking. (CSCvb03905)
• When you update clustered Firepower 9300 Firepower Appliances running Threat Defense, in rare cases, the system may show events logged before the update as occurring during the update. No event logging occurs during the update. (CSCvb03989)
• If you update the Firepower Management Center to Version 6.1, the system-provided initial health policy may not generate health alerts for the VPN Status module. As a workaround, edit the health policy (for example, turn the module off and then on again), save it, and reapply the policy. (CSCvb04288)
• If you update a Firepower Management Center to Version 6.1, the web interface appears to support running a readiness check to check the preparedness of the system for VDB updates. Running a readiness check for VDB updates is not supported. (CSCvb13949)
• If you create an access control rule or a URL object that contains non ASCII characters, the system does not warn you that non ASCII characters are not supported and traffic that should match the access control rule does not. Do not include non ASCII characters in access control rule or URL objects. (CSCvb14403)
• FTP servers do not support filenames or file paths containing non-English characters. If you use filenames or file paths with non-English characters on a configured FTP server and the server does not generate the filenames or file paths, change the filenames and file paths to English characters. (CSCvb22610)
• If you update a system running a version earlier than Version 6.0.0 that contains security zones with custom interface names to Version 6.0.1 and then update to Version 6.1.0 or later and you invoke a GET https://<hostname>/api/fmc_config/v1/domain/default/securityzones or a GET https://<hostname>/api/fmc_config/v1/domain/default/securityzones/<secZoneUUid> request via the REST API, the system may incorrectly generates an HTTP Error 500 Internal server error page. (CSCvb27562)
• If you create custom rules containing comments and initiate a database integrity check, the system generates erroneous warning messages during the database integrity check. (CSCvb28212)
• If you create a realm and enable NT LAN Manager (NTLM) for captive portal authentication within an SSL policy, then browse to a website and the SSL server does not recognize the server name in the generated certificate, the system incorrectly ends the connection. (CSCvb36313)
• If you deploy a file policy configured to Block file types and access or download files through the Cisco AnyConnect Secure Mobility Client where both client and server are located in outside security zone, the system does not block certain files depending on the selected file transfer protocol. (CSCvb37418, CSCvb37421)
• If you deploy a file policy to a device with an excessive amount of endpoints configured, the system experiences high CPU use and network latency. As a workaround, redeploy configuration. (CSCvb40344)
• If you add more than one management interface with incorrectly defined routes on a Firepower Management Center and register a device or if you edit the route to the management interfaces after registering a device, communication between the device and the Firepower Management Center may not use the expected IP address on the Firepower Management Center. As a workaround, edit the management interface IP address via the Registration page (System > Local > Registration). (CSCvb50979)
• If you create a new realm without Active Directory (AD) credentials and save, then edit the realm with new AD credentials and save, the system does not save the AD credentials. As a workaround, delete the realm and create a new realm with AD credentials. (CSCvb57936)
• Deleting a user from the Users page ( Analysis > Users > Users) generates a User(s) successfully deleted message even though the user is not deleted. As a workaround, use a search constraint to locate the user(s) you want to delete and delete the user from the search results page. (CSCvb63380)
• If a global user moves to a subdomain and add at least one tunnel zones to the default prefilter policy, then create an access control policy referencing the default prefilter policy and deploy, deploy fails and the system generates a I nvalid Domain Permissions error message. As a workaround, allow the user to access subdomain policies before editing the prefilter policy and deploying. (CSCvb63535)
• If you deploy a different access control policy to each registered device simultaneously and each access control policy contains a unique DNS policy referencing rules with unique blacklists or whitelists, the system displays the incorrect categories in generated security intelligence events. (CSCvb63720)
• If you configure a realm for an Active Directory (AD) server to download users and groups, then create a Firepower Management Center high availability pair and the downloads contain large amounts of users and groups, Firepower Management Center high availability registration fails. As a workaround, contact TAC Support. (CSCvb66591)
• If you start a session on a managed Firepower Threat Defense device and deploy configuration, network mapping may incorrectly identify the user as a user from a previous session. The incorrect identity may be used for identity-based policy enforcement and the system may display the wrong user in connection event logging. (CSCvb77191)
• If you execute the show interface CLI command on a Firepower 4100 Series or Firepower 9300 Appliances, the system does not generate input or output packets for portchannel10. (CSCvb81481)
• If you right click an event generated on the Analysis Connection Events page ( Analysis > Connections > Events) and click Blacklist IP, the system adds the IP address to the global blacklist but does not block packets from that IP address when it should. (CSCvb84812)
• If you add more than 50 rules to a NAT policy, the NAT policy page ( Devices > NAT) only displays the first 50 rules. (CSCvb89387, CSCvb89430)
• If you use Firepower Management Center Virtual on AWS to save a change to the MTU settings for Firepower Threat Defense Virtual on AWS, no message appears prompting you to restart Firepower Threat Defense Virtual. To allow the change to take affect, you must restart the virtual device. (CSCvb91307)
• If you create a realm for Active Directory (AD) and submit user information containing double quotes ( " ) character, the system displays user information incorrectly in the user interface. As a workaround, remove the double quotes character from the user information and save configuration. (CSCvb94004)
• If you import a local intrusion rule on the Rule Updates page (System > Updates > Rule Updates), then delete the rule and import the same rule again, the system no longer displays the imported rule. (CSCvb94538)
• Resolved an issue where, if you deployed a prefilter policy containing at least one tunnel rule or if you deployed a prefilter policy containing at least one port object to a Firepower Threat Defense device, the system did not successfully deploy all the access control rule or prefilter rules and, in some cases, traffic did not match against rules set to Allow or Block traffic when it should have. (CSCvb95281)
• When a Firepower Threat Defense high available device configured with interfaces fails over, the Firepower Management Center web interface still shows the new active device as Secondary Standby. (CSCvb99932)
• If you add a URL object to Security Intelligence tab of the access control policy editor, the system does not save the changes. (CSCvc00352)
• If you do not add any interfaces or security zones to a Firepower Threat Defense registered to a Firepower Management Center and deploy a shared NAT policy containing a NAT rule referencing a source and destination zone, the system saves and deploys the shared policy without validating the source and destination zones and the system does not generate a warning when it should. (CSCvc01094)
• When running the readiness check for the Version 6.1.0.1 update on a cluster of FXOS-based Firepower Threat Defense devices, only one device's status reports success when the readiness check completes. As long as you receive one success message, you can safely continue with the update even if the second device reports that the readiness check is still in progress. (CSCvc01221)
• If you attempt to disable a Firepower Threat Defense interface from the Interfaces page ( Devices > Interfaces) that is still referenced in a Firepower Threat Defense site-to-site VPN, the system generates a nondescript Invalid Logical Name used by the interface error. You must remove the interface from the site-to-site VPN topology prior to deleting the interface from the Interfaces page. (CSCvc02263)
• If you create a user role on the User Role tab of the Users page ( System > Users) and Create User, then delete the recently created user role, the system incorrectly allows you to delete the user role even if it is in use by another user and does not generate a warning. (CSCvc02787)
• If you exceed the maximum number of access control rules or intrusion policies supported by a target device, deployment may fail and then deploying a smaller access control policy afterwards also fails. This maximum depends on a number of factors, including the physical memory and the number of processors on the device. To optimize performance, simplify your policies. (CSCvc03688, CSCvc35667)
• If you deploy an intrusion policy with the Firepower Recommendation layer, edit the recommendations but discard the edits before saving, the system does not revert to the original Firepower Recommendation configuration when it should. (CSCvc04546)
• If you configure Lights-out Management (LOM) with a static IP address or DHCP but do not add any users, the Firepower Management Center may generate a Unable to clear Lights-out Management users error message when you attempt to restore a backup on a Firepower Management Center. (CSCvc05004)
• If you deploy a file policy configured to perform malware cloud lookup to an ASA with Firepower Threat Defense registered to a Firepower Management Center running Version 6.0.x and update the device to Version 6.1.0 or later, the malware lookup requests time out. As a workaround, delete the device from the Firepower Management Center and re-register the device, then deploy. (CSCvc06397)
• The application filter window on the Object Management page ( Object > Object Management) incorrectly displays Displaying 1-5 of 5 rows even if there are no records. (CSCvc06540)
• When you configure OSPFv3 authentication for a Firepower Threat Defense device with Encrypt Key and Encrypt Authentication Key enabled, a misleading error message appears. (CSCvc07593)
• You cannot disable the use of a proxy on the Firepower Management Center if you create a proxy and then save. Unchecking the Use Proxy Authentication box option on the Management Interfaces tab of the Configuration page ( System > Configuration) does not disable the option. (CSCvc07857)
• If you are performing URL control and your access control policy has the Retry URL cache miss lookup option enabled, the system may generate multiple connection events for the same connection. This occurs when a user is browsing the web, then idles for a while, then browses to a URL whose category and reputation are not in the device's cache. As a workaround, disable the Retry URL cache miss lookup option on the access control policy editor's Advanced tab. (CSCvc08844)
• When testing or using a connection to an SMB remote storage device for which you specified a particular Domain ( System > Configuration > Remote Storage Device), the Firepower Management Center records the password you provide in plain text in its internal logs. (CSCvc10894)
• The Firepower Management Center web interface allows users to click an icon that should not appear, given a particular combination of custom roles. If your custom user role has menu-based permissions to view access control policies but not other policies, the access control policy editor should not provide quick-link icons to view or edit those policies. Clicking one of these icons results in an error 403. (CSCvc11905)
• If you deployed to managed devices configured to user captive portal active authentication and the system processed jumbo packets, the system experienced traffic disruption and issues. (CSCvc12727, CSCvc12702, CSCvc55369)
• The following Firepower Threat Defense CLI commands do not function and instead produce an Invalid Input error message: show policy-list, s how ospf, and test sfr. (CSCvc13580)
• The Firepower Management Center intrusion policy editor page may continuously display a loading icon instead of filtering rules. As a workaround, click Threshold and All. (CSCvc15889)
• The system does not block sinkhole connections. Even if you configure a DNS policy to sinkhole matching connections, the system allows them to the next stage of access control. (CSCvc16679)
• When creating a realm for use with an identity rule using Kerberos client authentication, if you supply a username from a subdomain of the primary domain in the AD Join Username and AD Join Password fields, the join fails and the identity rule cannot enforce captive portal active authentication. (CSCvc16688)
• Even if you explicitly allow SSH traffic with access control using an application condition in an rule set to Allow, the system may block long-idling SSH connections if your access control policy's default action is set to Block. As a workaround, a use a port condition to allow SSH traffic or enable KeepAlive settings via the SSH server to prevent idling SSH connections. (CSCvc16820)
• In some cases, if you switch the peer roles in a Firepower Management Center high availability pair, health monitoring modules on the standby Firepower Management Center may temporarily stop functioning. Functionality restores within minutes. (CSCvc17348)
• If you create a Firepower Management Center high availability pair and register a Firepower Threat Defense and a Firepower 7000 Series device or a Firepower 8000 Series device, then Switch Peer Roles in the High Availability tab on the Integration page ( System > Integration), the system incorrectly displays a deploy task in progress for the Firepower 7000 Series device or a Firepower 8000 Series device when it should not. (CSCvc17479)
• If you create a Firepower Management Center high availability pair and register a Firepower Threat Defense and a Firepower 7000 Series device or a Firepower 8000 Series device, then deploy an access control policy with Adaptive Profiling enabled and S witch Peer Roles in the High Availability tab on the Integration page ( System > Integration), the system incorrectly generates a The snort attribute update daemon exited 5 time(s) error in the Monitor page ( System > Health > Monitor) of the secondary Firepower Management Center. (CSCvc18752)
• Importing an ASA configuration file via the migration tool in Version 6.1.0 generates a 500 Internal server error message. (CSCvc18928)
• If you create an object in the Port tab of the Object Management page ( Objects > Object Management) and check the Allow Overrides, then close the dialog box without saving and attempt to create a new port object, you cannot check the Allow Overrides checkbox. (CSCvc19798)
• If you create a file policy configured to identify malware through local malware analysis and set the default action to Block Malware with Reset, the system reports malware as blocked even though you can successfully download the malware files through FTP, SMTP, or SMB. (CSCvc20141)
• If two users with Deploy Configuration to Devices privileges log into the same device from two different systems and attempt to deploy the same access control policy, the system generates a Deployment failed due to another deployment in progress for this device. Retry deployment error for both users instead of deploying the first deploy request and generating the error for the second user. After generating the error, the system resolves itself and successfully deploys both configurations. (CSCvc26478)
• If you updated an ASA FirePOWER module managed by the Firepower Management Center to Version 6.1.0.1 and switch to be managed by ASDM, then install database updates (for the vulnerability database, intrusion rule, and geolocation database), the device incorrectly displays the updates successful when the intrusion rule and geolocation database updates failed. (CSCvc28485)
• If you deploy an SSL rule configured to constrain at least one user group and the system generates a Deployment failed. Correct configuration errors and redeploy. If deployment fails again, contact TAC. error message, clicking Show troubleshooting details generates incorrect information. As a workaround, use individual users in SSL rules instead of user groups. (CSCvc30486)
• If you configure SMB traffic file detection in the DCE/RPC preprocessor, the system does not detect all the SMB files when it should. (CSCvc31974)
• If you import the system policy on an ASA FirePOWER module managed by ASDM running Version 6.1.0.1, the import successfully completed but the Task Status page ( Monitoring > ASA Firepower Monitoring > Task Status) displays a corrupted link to download the report. (CSCvc32064)
• The system incorrectly displays Unknown as the application protocol for ICMP and TCP traffic in the connection events page (Analysis > Connections > Connection Events). (CSCvc37561)
• If you attempt to change the password of an admin user on a system that is not configured for Lights-out Management (LOM) and has no LOM users, changing the password may fail. (CSCvc43324)
• If you deploy an SSL policy to a registered device, the device may send erroneous Unable to translate SSL cipher suite 65535 messages to the syslog or the Simple Network Management Protocol (SNMP). You can ignore these error messages. (CSCvc46599)
• If you deploy a network analysis policy containing network analysis rules that reference network objects, you cannot search for the network objects through the network analysis policy editor. (CSCvc48768)
• If you compare two revisions of an intrusion policy containing a large number of rules, the generated policy comparison report incorrectly displays more changes than were actually made. (CSCvc50598)
• If you switch an ASA FirePOWER module to multi-context mode and a context name contains lag, such as flag, and deploy at least one access control rule containing security zones, traffic does not match against rules with security zones when it should. As a workaround, delete the existing context and copy the configuration to a context that does not have lag in the context name. (CSCvc53358)
• If you create a VPN connection with a reverse route that is same as the already present static route on a Firepower Threat Defense device, then restart the device, the static route breaks and you cannot successfully use the VPN connection. (CSCvc54069)
• If you use search constraints to filter intrusion events for ingress or egress interfaces, the system does not generate matches even if there are events that match. (CSCvc57785)
• If the primary peer temporarily loses connectivity with the standby peer, the Devices tab (Devices > Device Management) of the secondary Firepower Management Center does not display any registered devices. Note that the secondary Firepower Management Center resolves the issue and the Devices tab eventually displays registered devices. (CSCvc58454)
• If you deploy an access control policy containing an access rule with Original Client IP, logging enabled and an SSL rule with the default actions set to Decrypt - Resign, the system does not display the Action and Access control rule columns of some generated events in the Connection Events page (Analysis > Connections > Connection Events). (CSCvc74395)
• If you register a Firepower 7000 Series or Firepower 8000 Series device to a Firepower Management Center and add a domain, then click Global in the Available Devices window, the system moves all registered devices to the Selected Devices window and you cannot move or delete the devices. (CSCvc76018)
• If you use a valid IP address as the name of a network object on an Firepower Threat Defense managed by the Firepower Device Manager, deploying fails. As a workaround, either do not use an IP address as the logical name of a network object or add a prefix or suffix to the IP address. (CSCvc80439)
• Clicking the help icon on the intrusion policy editor page (Configuration > ASA FirePOWER Configuration > Policies > Intrusion Policy > Policy Editor) of an ASA FirePOWER module managed by ASDMincorrectly generates a 404: Page not found error. (CSCvc87106)
• If you enable the use of a proxy on the Management Interfaces page (System > Configuration > Management Interfaces), the system generates a Failed to apply the configuration error message. (CSCvc89426)
• Security Group Tags (SGT) traffic does not pass through Firepower Threat Defense devices configured for inline mode when it should. As a workaround, configure Firepower Threat Defense devices for routed mode. (CSCvc94586)
• If you backup the primary Firepower Management Center of a high availability pair and restore the backup on a new Firepower Management Center, then create a high availability pair with the secondary Firepower Management Center from the original high availability pair and switch the secondary Firepower Management Center to active mode and the primary Firepower Management Center to standby move, the system displays a system process are staring message and may not immediately synchornize when it should. (CSCvc97160)
• You cannot delete devices you have added to the Platform Settings policy on the Platform Settings page (Devices > Platform Settings). (CSCvc98169)
• If you backup the primary Firepower Management Center of a high availability pair containing classic licenses and break the high availability pair, then restore the backup on a new Firepower Management Center and create a high availability pair with the secondary Firepower Management Center from the original high availability pair, the secondary Firepower Management Center incorrectly displays the classic licenses as unlicensed. (CSCvc99194)
• If you register an Firepower Threat Defense device to a Firepower Management Center running Version 6.0.1.2 and never create a manual NAT environment through the NAT tab of the Device Management page (Devices > Device Management) and then update the Firepower Management Center to Version 6.1.0 or later, deploying the existing policy to the Firepower Threat Defense device running Version 6.0.1.2 fails and generates a Deployment failed due to failure in generating device configuration error message. As a workaround, copy the existing NAT policy and rename it, assign the Firepower Threat Defense device to the policy and deploy. (CSCvc99439)
• If you deploy an access control policy containing an access control rule configured to Allow a subdomain URL (site.example.com) placed before an access control rule configured to Block the domain URL (example.com) that references an SSL policy with decryption enabled, the system may inconsistently match traffic against the HTTPs certificate instead of the actual URL and navigating to the subdomain may get blocked when it should not. (CSCvc92934)Updating or restarting a security module of a Firepower 9300 Appliance may cause the device to drop traffic and disconnect any current sessions. (CSCvd02334)
• If a registered Firepower Threat Defense device experiences deployment failure due to configuration issues and an admin user clicks Show troubleshooting details on the Scheduling page (System > Scheduling), the Firepower Management Center web interface becomes unresponsive. (CSCvd02505)
• If you backup and restore the Firepower Management Center, the system incorrectly display access control policies as up-to-date when they are not. By default, all access control policies are out-of-date after restoring the Firepower Management Center. Deploy configuration before utilizing the Firepower Management Center and any registered devices. (CSCvd06662)
• Traffic Outage If you create an inline set in standby mode on a Firepower Threat Defense device’s FTW network module and update the Firepower version of the device, the FTW port is incorrectly disabled during the update process instead of failing into hardware bypass mode. (CSCvd04019)
• If you deploy an access control policy containing at least two access control rules referencing the same intrusion policy but with different variable sets from a Firepower Management Center running Version 6.1.0.2, deployment fails. As a workaround, if more than one access control rule references the same intrusion policy, the intrusion policy should have the same variable set for both rules. (CSCvd10943)

For Assistance

Thank you for choosing the Firepower.

For information on obtaining documentation, using the Cisco Bug Search Tool (BST), submitting a service request, and gathering additional information about Cisco ASA devices, see What’s New in Cisco Product Documentation at: http://www.cisco.com/en/US/docs/general/whatsnew/whatsnew.html.

Subscribe to What’s New in Cisco Product Documentation, which lists all new and revised Cisco technical documentation, as an RSS feed and deliver content directly to your desktop using a reader application. The RSS feeds are a free service.

If you have any questions about installing or running Version 6.1.0.3, contact Cisco Support:

• Visit the Cisco Support site at http://support.cisco.com/.
• Email Cisco Support at tac@cisco.com.
• Call Cisco Support at 1.408.526.7209 or 1.800.553.2447.

 Printed in the USA on recycled paper containing 10% postconsumer waste.

l