 Feedback
|
Table Of Contents
Cisco PDM Release Notes for Firewall Services Module Version 4.0
Switch/Router System Requirements
Maximum Configuration File Size
Outbound Destination Interface ACL (Access Control List)
Stateful ICMP Inspection & NAT for ICMP Error Messages
OSPF (Single Firewall Mode Only)
DHCP Relay (Routed Firewall Only)
Specify Interface as Address in ACLs
Change Level for Syslog Messages
Sharing of Access Control Lists
Save All Running Configurations to Flash
Command-Line Interface Enhancements
Improved Performance and Scalability
CLI Commands not Fully Supported in FWSM
CLI Commands Ignored By PDM in FWSM
Unsupported Command Combinations
Resolved Caveats - Version 4.0
Obtaining Documentation and Submitting a Service Request
Cisco PDM Release Notes for Firewall Services Module Version 4.0
June 2004
Contents
This document includes the following sections:
•
Switch/Router System Requirements
•
Introduction
Cisco PDM Version 4.0 for FWSM Release 2.2 is a web-based application used to configure and monitor the Firewall Services Module (FWSM) on a Catalyst 6500 switch or Cisco 7600 router. PDM Version 4.0 requires FWSM Release 2.2(1) and supports all of the configuration features in this release. For more information see FWSM Technical Documentation and the FWSM FAQ (Frequently Asked Questions) sections on Cisco.com.
Note
PDM Software Overview
PDM Version 4.0 supports FWSM Release 2.2 on a Catalyst 6500 switch or Cisco 7600 router.
PDM Version 4.0 is a single image, which supports only FWSM Release 2.2, and is designed to provide secure administration of the firewall. PDM is implemented as a signed Java applet, which downloads to your PC or workstation when you point your browser at the firewall without requiring a plug-in or other software to be installed beforehand. PDM manages FWSM Release 2.2 when it runs in single or multiple context modes.
PDM provides a graphical user interface to the firewall to administer it without requiring knowledge of the command-line interface (CLI). Additionally, PDM maintains compatibility with the firewall CLI and includes a tool for using the standard CLI commands within the PDM application. PDM lets you graph many aspects of the firewall, as well as print or export graphs of traffic through the firewall and system activity.
To help you use PDM, online Help is provided throughout the application as well as a Help table of contents, index, and glossary.
Switch/Router System Requirements
The switch and router models that support the FWSM are:
•
–
–
•
–
–
For more information, see the Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide Version 2.2 for supported supervisor engine and software versions and the supported Cisco IOS software.
Note
For more information on switch or router requirements for FWSM, go to the following website: http://www.cisco.com/en/US/partner/products/hw/modules/ps2706/ps4452/tsd_products_support_model_home.html
The following sections list the system requirements for PDM Version 4.0 software.
FWSM Requirements
The FWSM must run software Release 2.2 and meet all browser requirements below to run PDM Version 4.0.
A firewall must meet the following requirements to successfully install and run PDM:
•
•
http://www.cisco.com/cisco/pub/software/portal/select.html
http://www.cisco.com/en/US/partner/products/hw/modules/ps2706/ps4452/tsd_products_support_model_home.html
Caution
Browser Requirements
The following are required to access one or more firewalls through PDM:
•
•
•
Maximum Configuration File Size
For optimum performance, we recommend a configuration file of no more than 500 KB when using PDM.
FWSM Firewall configuration files over 500 KB may interfere with the performance of PDM on your workstation in the following situations:
•
•
•
PC/Workstation Requirements
PDM has different requirements depending on the platform from which it is accessed. PDM is not supported for use on computers equipped with the Macintosh OS, or other versions of the Windows operating systems.
Configuration Recommendations
We recommend the following browser and JVM combinations for these operating systems:
Supported Platforms
Table 2 lists the supported and recommended platforms for PDM Version 4.0.
Note
Note
–
–
New and Changed Information
Security Contexts
The FWSM supports multiple instances of virtual firewalls, called security contexts. PDM users log on to a context, which appears as a single firewall. PDM admin users log on to the admin context and then change into the System execution space to create contexts and perform global system tasks.
Resource Management
By default, each security contexts has unlimited access to the resources of the FWSM. Using resource management, you can limit the use of firewall resources per context, including concurrent connections, connections per second, syslogs per second, max number of Telnet/SSH sessions per context, and other settings.
Transparent Firewall
The firewall service is transparently enabled on the ingress and egress of router VLAN-based Layer 2 interfaces. The FWSM acts like a bump in the wire, and is not a router hop. The FWSM connects the same network on its inside and outside ports, but each port must be on a different VLAN. The initial limit is two interfaces per transparent firewall context.
Policy NAT
The policy NAT feature provides the ability to translate a host to multiple identities based on access rules. This allows the same local IP address to be translated to different global addresses based on the destination network and translation rules.
Outbound Destination Interface ACL (Access Control List)
PDM uses the Access Rules panel to generate CLI ACLs that are normally applied to inbound (source interface) traffic. This extension allows ACLs to also be applied to outbound (destination interface) traffic.
Same Security Level
This extension allows multiple interfaces to have the same security level to better manage large numbers of virtual firewalls and VLAN interfaces.
Increased VLAN Support
The FWSM supports a maximum of 256 interfaces per context or in single context mode. In multiple context mode, the FWSM has an overall limit of 1000 VLAN interfaces across all contexts. You can share interfaces between contexts if your network requires it.
ACL Commit
This feature sets the FWSM CLI to a blocked condition until recompilation of ACLs is complete, to assure accurate reporting back to the PDM application.
Monitoring
New DHCP monitoring functions are present.
Stateful ICMP Inspection & NAT for ICMP Error Messages
ICMP and NAT enhancements are present for the virtual firewall.
SNMP
Ability to change UDP port on which traps are sent to the server, ability to specify traps to be sent by feature, and Cisco firewall MIB support.
Failover
Active/Standby system failover mode on a per-blade basis exists.You can configure the FWSM to monitor essential interfaces.
Connections
Control of maximum connections for interfaces is present.
VLAN
802.1Q VLAN support provides added flexibility in managing and provisioning the firewall. This feature enables the decoupling of IP interfaces from physical interfaces and supplies appropriate handling for IEEE 802.1Q tags.
OSPF (Single Firewall Mode Only)
Route propagation and greatly reduced route convergence times are two of the many benefits of OSPF. Intra-area, inter-area, and external routes are supported. The distribution of static routes to OSPF processes and route redistribution between OSPF processes are also included.
DHCP Relay (Routed Firewall Only)
Acting as a DHCP relay agent, the firewall can assist in dynamic configuration of IP hosts on any of its interfaces. It receives requests from hosts on a given interface and forwards them to a user-configured DHCP server on another interface.
Comments in ACLs
This feature lets you include comments in access lists to make the ACL easier to understand and scan.
Syslog by ACL
This feature lets you configure a specific ACL entry with a logging option. When such an option is configured, statistics for each flow that match the permit or deny conditions of the ACL entry are logged.
Specify Interface as Address in ACLs
If you are running the DHCP client on the firewall outside interface you will no longer have to adjust access lists every time the outside DHCP address gets changed by the ISP.
Java Plug-in 1.4
PDM Version 4.0 adds support for Java plug-in versions 1.4.1 and 1.4.2. You can download Java plug-ins from http://java.sun.com.
New Fixup Features
MGCP, ICMP Error, Sun RPC and NIS+, and Disable SIP UDP. If SIP UDP fixup is disabled, the firewall does not inspect any packets transmitted over SIP UDP port 5060, or translate the IP addresses or ports embedded in the payload of the packets. Disabling SIP UDP fixup also prevents valid non-SIP packets from being dropped by the firewall if they originate from or are destined to the SIP UDP port 5060.
Change Level for Syslog Messages
This feature lets you change the default logging level for a specific ACL entry with a logging option. When such an option is configured, statistics for each flow that matches the permit or deny conditions of the ACL entry are logged.
AAA Proxy Limit
You can limit the number of concurrent proxy connections allowed.
HTTPS/FTP Using Websense
This feature extends the existing Websense-based URL filtering to HTTPS and FTP.
DHCP Server on Any Interface
You can configure any interface as a DHCP server.
Management Feature Access
You can perform FWSM management functions, such as running PDM on an internal interface with a fixed IP address over an IPSec VPN tunnel.
Banner
The Banner panel lets you configure a message of the day, login, and session banners.
Improved Printing
Printing has been improved so that access lists can be printed and viewed more easily.
RME Syslog Compatibility
This feature provides the ability to log messages in Cisco EMBLEM format to a syslog server. This feature allows the RME (Resource Manager Essentials) syslog analyzer to parse FWSM messages sent to a syslog host.
PDM Home Page
The PDM home page lets you view, at a glance, important information about your firewall such as the status of your interfaces, the version you are running, licensing information, and performance.
Batch Mode When Sending CLIs
PDM is faster in the method it uses to send a series of CLI commands to the firewall. It allows all CLIs to be sent and configured, even if you end up losing the connection because of the changes you make.
AAA Fallback
By default, a AAA server failure would prevent you from authenticating and/or authorizing. This feature lets you optionally choose to use the LOCAL database on the FWSM for authentication and/or authorization in the event of a AAA server failure.
Certificates
You can configure a certificate server in the Certificates panel. You must still execute commands on the CLI to get the certificate.
PDM Enhancements
New Look-and-Feel
PDM Version 4.0 has a new look-and-feel including a home page, status bar, and flat buttons. The home page displays the device information, interface status, system resources, and traffic status.
Sharing of Access Control Lists
PDM now supports sharing of ACLs. This means if an access list is used in more than one place, such as one that is used by more than interface, PDM will support this configuration. Previously, it would limit you to the Monitoring tab.
When you attempt to change an access list that is being shared in the Access Rules table or other features that use access lists, it will prompt you to make a copy of the access list so that a change will not affect other parts of your configuration.
Rule Flow Diagram
In the Access Rules tab, Access Rules, Add/Edit Rule dialog, there is a new Rule Flow Diagram that indicates how the rule is applied. This appears in the Add/Edit Rule dialog for AAA Rules and Filter Rules as well.
Save All Running Configurations to Flash
As an administrator, you can click File > Save All Running Configurations to Flash. This saves the running configuration of each context to flash memory.
Startup Wizard
This adds a Startup Wizard that covers the basic configuration. It can be used to set up a new context and to allow direct access to this context using PDM. Click Wizard > Startup Wizard to run this wizard. In addition, you can configure HTTPS, SSH, and Telnet access to the FWSM. In transparent firewall mode, you can configure the management IP.
Command-Line Interface Enhancements
This feature can be accessed by clicking Tools > Command Line Interface. It remembers the last issued CLIs. You can access common show commands from the drop-down list.
Improved Startup Time
PDM Version 4.0 loads faster because it caches the PDM applet. The first time you run PDM, it will cache the PDM image on your local hard drive. The next time you run PDM, it checks to see if the version matches. If so, it runs PDM from your cache as opposed to downloading the PDM image again. Otherwise, it downloads PDM from the FWSM. The cache is independent of the browser cache and the plug-in cache, so clearing these caches will not affect PDM. You can clear the PDM cache in PDM by clicking File > Clear PDM Cache. Clearing the PDM cache will only clear the cache for that browser and JVM. For example, when using both Internet Explorer and Netscape 7.1, if you clear the cache in Internet Explorer, it will not clear the cache used by Netscape 7.1.
Improved Performance and Scalability
PDM Version 4.0 applies changes much quicker than the previous release because it no longer rereads the configuration after every change. If another session made a change to the configuration, click the Refresh button to retrieve the latest configuration in your PDM session.
In addition, PDM supports up to a 500 KB configuration. This is simply a recommended limit and is not enforced in the software. Exceeding 500 KB may cause noticeable performance degradation in PDM.
Support for New Platforms
Support for Red Hat Enterprise Linux WS, version 3 and Red Hat Linux 9 was added. Support for Windows, Japanese OS (JOS) was added. PDM will still display in English but will run on JOS.
Important Notes
This section describes important notes for PDM software Version 4.0.
Fixups
Both fixup SIP over TCP and fixup SIP over UDP are supported in FWSM Release 1.1, but fixup SIP over UDP cannot be disabled in FWSM Release 1.1 or PDM Version 2.1. Fixup SIP over UDP can only be disabled in FWSM Release 2.2, PDM Version 4.0.
CLI Command Support
PDM Version 4.0 adds support to the firewall CLI command syntax. Refer to PDM online Help for more information on the supported CLI commands.
Fully Supported CLI Commands
PDM parses these commands when uploading or creating the FWSM configuration and grants you full access to all PDM user-interface tabs.
Exceptions are noted in the table and occur when PDM cannot parse certain combinations of command statements. Commands that PDM cannot parse stay in the configuration, their values cannot be changed with PDM, and they appear in the list of unparseable commands.
Table 3 lists the CLI commands that PDM fully supports. PDM parses these commands in the FWSM configuration and allows PDM to operate successfully.
CLI Commands not Fully Supported in FWSM
Table 4 lists commands that cannot be changed. PDM parses these commands in the firewall configuration and handles them transparently.
CLI Commands Ignored By PDM in FWSM
These CLI commands are displayed in the list of unparseable commands in PDM. However, PDM does not change or remove these commands from your configuration, and the presence of these commands does not limit your access to the user-interface tabs in PDM.
The following commands are otherwise ignored by PDM except that they are displayed in the list of unparseable commands:
•
For example:
access-list eng permit ip any server1 255.255.255.255access-list eng permit ip any server2 255.255.255.255access-list eng permit ip any server3 255.255.255.255access-list eng deny ip any any•
•
Note
PDM does not support discontinuous netmasks.
Unsupported Command Combinations
The following command combinations allow only monitoring and not configuration facilities:
•
access-list 101 permit tcp any anyaaa authentication include http inside 1.1.1.1 255.255.255.255 0.0.0.0 0.0.0.0 portalaaa accounting match 101 inside portalYou can fix this by changing aaa commands exclusively to either the match acl style or to the include/exclude style.
•
write
show pdm
show version
show curpriv
Multiple PDM Sessions
PDM allows multiple PCs or workstations to each have one browser session open with the same firewall. A single firewall unit can support up to concurrent 5 PDM sessions. However, only one session per browser per PC or workstation is supported for a particular firewall. Refer to PDM online Help for more information on multiple PDM sessions.
Caveats
The following sections describe the caveats for PDM software Version 4.0.
For your convenience in locating caveats in Cisco's Bug Toolkit, the caveat titles listed in this section are drawn directly from the Cisco Bug Toolkit database. These caveat titles are not intended to be read as complete sentences because the title field length is limited. In the caveat titles, some truncation of wording or punctuation may be necessary to provide the most complete and concise description. The only modifications made to these titles are as follows:
•
•
•
Note
https://tools.cisco.com/Support/BugToolKit/action.do
Open Caveats - Version 4.0
The caveats in Table 5 are yet to be resolved in this version.
Resolved Caveats - Version 4.0
The caveats in Table 6 are resolved in this version.
Obtaining Documentation and Submitting a Service Request
For information on obtaining documentation, submitting a service request, and gathering additional information, see the monthly What's New in Cisco Product Documentation, which also lists all new and revised Cisco technical documentation, at:
http://www.cisco.com/en/US/docs/general/whatsnew/whatsnew.html
Subscribe to the What's New in Cisco Product Documentation as a Really Simple Syndication (RSS) feed and set content to be delivered directly to your desktop using a reader application. The RSS feeds are a free service and Cisco currently supports RSS version 2.0.
