FTD may not match correct Access Control rule following a deploy to multiple devices

Available Languages

Download Options

PDF (274.5 KB)
View with Adobe Reader on a variety of devices

Updated:December 9, 2019

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Dear Cisco Customer,

Cisco engineering has identified the following software issue with the release that you have selected that might affect your use of this software. Please review the Software Advisory notice here to determine if the issue applies to your environment.

Affected Software and Replacement Solution for CSCvr52109

Software Type

Software Affected

Software Solution

FMC Software

Version:

6.4.0.6 and 6.5.0.1

Version:

6.4.0.7

6.5.0.2

6.4.0.7-2 Hotfix (for 6.4.0.6)

6.5.0.2-2 Hotfix (for 6.5.0.1)

Reason for Advisory:

This software advisory addresses one software issue.

CSCvr52109

FTD may not match correct Access Control rule following a deploy to multiple devices

Affected Platforms:

FMC 6.4.0.6 or 6.5.0.1

Symptom:

Deployed FTD configurations might not include all access control rules.

Conditions:

·         2 or more FTDs are registered with the same FMC. Note: An HA pair or cluster counts as a single device in this case.

·         The FTDs share 2 or more routed security zones, for example InsideRouted and OutsideRouted.

·         An Access Control policy applies to the shared security zones.

When you deploy the Access Control policy to the FTDs at the same time, some access rules will not be applied to all of the FTDs.

Workaround:

Deploy to each device individually.

NOTE: Do not uninstall 6.5.0.1 to work around this issue; the uninstall will fail due to CSCvs33868.