Cisco PIX Device Manager

Table Of Contents

Release Notes for Cisco PDM Version 4.1 for Firewall Services Module

Contents

Introduction

PDM Software Overview

Switch and Router System Requirements

FWSM Requirements

Browser Requirements

Maximum Configuration File Size

PC and Workstation Requirements

Supported Platforms

New and Changed Information

HTTPS Authentication Proxy

ACL Per User Override

Resource Manager for ACL Memory Pool

Resource Class for PDM Sessions

Suspend/Resume Failover Configuration Sync

Same Security Intra Interface

TFTP Fixup

Syslog Enhancements

Important Notes

One-time Password

Fixups

CLI Command Support

Fully Supported CLI Commands

CLI Commands Not Fully Supported in FWSM

CLI Commands Ignored in Multiple Mode when in System Mode

Miscellaneous CLI Command Operation Limitations

CLI Commands Ignored by PDM in FWSM

PDM Sessions

Caveats

Open Caveats - Version 4.1

Resolved Caveats - Version 4.1

Obtaining Documentation and Submitting a Service Request

Release Notes for Cisco PDM Version 4.1 for Firewall Services Module

---

December 2004

Contents

This publication includes the following sections:

•Introduction

•Switch and Router System Requirements

•PC and Workstation Requirements

•New and Changed Information

•Important Notes

•Caveats

•Obtaining Documentation and Submitting a Service Request

Introduction

Cisco PDM Version 4.1 is a web-based application used to configure and monitor the Firewall Services Module (FWSM) on a Catalyst 6500 series switch or Cisco 7600 series router. PDM Version 4.1 requires FWSM Release 2.3 or 2.2 and supports all of the configuration features in this release. For more information, see FWSM Technical Documentation and the FWSM FAQ (Frequently Asked Questions) sections on Cisco.com..

---

Note PDM Version 4.1 is a single image that supports FWSM Release 2.3 and 2.2. It does not support FWSM Release 1.1 or the PIX operating system.

---

PDM Software Overview

PDM Version 4.1 is a single image that provides secure administration of the FWSM. PDM is implemented as a signed Java applet, which downloads to your PC or workstation when you point your browser at the FWSM and does not require a plug-in or other software to be preinstalled. PDM manages FWSM Release 2.3 and 2.2 when it runs in single or multiple context modes.

PDM provides a graphical user interface to the FWSM to administer it without requiring knowledge of the command-line interface (CLI). PDM also maintains compatibility with the FWSM CLI and includes a tool for using the standard CLI commands within the PDM application. PDM allows you to graph many aspects of the FWSM, as well as print or export graphs of the traffic through the FWSM and of system activity.

To help you use PDM, the application provides online help as well as a help table of contents, index, and glossary.

Switch and Router System Requirements

The following switch and router models that are supported by the FWSM are:

•Catalyst 6500 series switches with the following required components:

–Supervisor engine with Cisco IOS software or Catalyst operating system

–Multilayer Switch Feature Card (MSFC 2) with Cisco IOS software

•Cisco 7600 series routers, with the following required components:

–Supervisor engine with Cisco IOS software

–MSFC 2 with Cisco IOS software

For more information about supported supervisor engine and software versions and the supported Cisco IOS software, refer to the Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide Version 2.3.

---

Note The FWSM does not support a direct connection to a switch WAN port because WAN ports do not use static virtual local area networks (VLANs). However, the WAN port can connect to the MSFC, which can also connect to the FWSM.

---

For more information on switch or router requirements for FWSM, go to the following website: http://www.cisco.com/en/US/products/hw/modules/ps2706/ps4452/tsd_products_support_model_home.html

The following sections list the system requirements for PDM Version 4.1 software.

FWSM Requirements

The FWSM must meet the following requirements to successfully install and run PDM:

•Minimum Software Versions-Verify that your FWSM meets the requirements listed in the Release Notes for the Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Software Release. You must have Release 2.3 or 2.2 installed on the FWSM before using PDM Version 4.1. For more information, refer to the Cisco PDM Installation and Configuration Guide for Firewall Services Module.

•Upgrading Software-When you install a new version of PDM, close all browser sessions before launching PDM. For information on upgrading your FWSM, see the following websites:

http://www.cisco.com/cisco/software/navigator.html?a=ahttp://www.cisco.com/public/sw-center/index.shtmli=rpm

http://www.cisco.com/en/US/products/hw/modules/ps2706/ps4452/tsd_products_support_model_home.html

---

Caution If you are using Management Center for Firewalls, use PDM for monitoring only. All changes made using PDM will be overwritten the next time Management Center for Firewalls synchronizes with the FWSM.

---

Browser Requirements

The following are required to access one or more firewalls through PDM:

•Java Virtual Machine (JVM)-PDM 4.1 supports native JVM on Microsoft Internet Explorer 6.0, Java Plug-in 1.4.2 or Java Plug-in 5.0. PDM 4.1 supports native JVM on Solaris Red Hat or Linux with Java Plug-in 1.4.2.

•HTTP 1.1-For Microsoft Internet Explorer, be sure to use HTTP 1.1 for both proxy and non-proxy connections. This can be changed in Tools > Internet Options > Advanced tab. Scroll down to the "HTTP 1.1 settings" section.

Maximum Configuration File Size

For optimum performance, we recommend a configuration file of no more than 500 KB when using PDM.

FWSM Firewall configuration files over 500 KB may interfere with the performance of PDM on your workstation in the following situations:

•While executing commands such as write term and show run

•Failover (the configuration synchronization time)

•During a PDM Refresh Operation or loading PDM for the first time

PC and Workstation Requirements

PDM has different requirements depending on the platform from which it is accessed. PDM is not supported for use on computers equipped with the Macintosh operating system, or other versions of the Windows operating systems.

Supported Platforms

Table 1 lists the supported and recommended platforms for PDM Version 4.1.

---

Note The Japanese version of Windows (JOS) is supported in the PDM Version 4.1 release.

---

Table 1 Supported and Recommended Platforms for PDM Version 4.1

	Operating System	Browser	Hardware
Windows	Windows 2000 (Service Pack 3 or higher) or Windows XP operating systems PDM is not supported on Windows 3.1, 95, 98, ME or Windows NT 4	Internet Explorer 6.0 with native JVM (VM 3809 or higher), Java Plug-in 1.4.2 or Java Plug-in 5.0 Netscape 7.1 or 7.2 with Java Plug-in 1.4.2 or Java Plug-in 5.0	Any Pentium III or Pentium-compatible processor running at 450 MHz or higher. At least 256 MB of RAM. We recommend 192 MB or more. A 1024 x 768 pixel display and at least High Color (16-bit).
SUN Solaris	Sun Solaris 8 or 9	Mozilla 1.7.3 with Java Plug-in 1.4.2	SPARC microprocessor. At least 256 MB of RAM. A 1024 x 768 pixel display and at least 256 colors. High Color (16-bit) recommended.
Linux	Red Hat Linux 9 or Red Hat Enterprise Linux WS version 3	Mozilla 1.7.3 with Java Plug-in 1.4.2	At least 128 MB of RAM. 256 MB recommended. A 1024 x 768 pixel display with at least 256 colors. High Color (16-bit) recommended.

---

Note When using Netscape on some Linux platforms, if you select an item under the Properties tab or the Monitoring tab, the entire PDM window shifts a few pixels to the left and up. This movement happens when you select a panel with a text box or a combo box in it.

---

New and Changed Information

The following sections provide new and changed information for this release.

HTTPS Authentication Proxy

This feature provides a secure mechanism for exchanging username and password information between an HTTP client and FWSM using HTTPS.

ACL Per User Override

This feature allows an external server to override the configuration of the access rules policy for that interface. This feature only applies to inbound ACLs.

Resource Manager for ACL Memory Pool

This feature allows you to manage resources for ACLs, including the ACL memory pool or ACL tree instances, which are used when compiling ACLs.

Resource Class for PDM Sessions

This feature allows you to specify the number of PDM sessions for a particular context.

Suspend/Resume Failover Configuration Sync

This feature provides the ability to disable failover synchronization from an active device to a standby device.

Same Security Intra Interface

This feature allows a packet to come in and go out on the same interface. A router might forward a packet to the FWSM so that it can apply the user's firewall policy on that packet.

TFTP Fixup

This feature inspects the TFTP protocol and dynamically creates a connection and xlate if necessary to permit file transfer between a TFTP client and server. This feature was included in FWSM 2.2.

Syslog Enhancements

These enhancements allow you to specify the amount of memory that can be allocated for the syslog messages per context and to optionally deny connections if the syslog queue is full.

Important Notes

This section describes important notes for PDM software Version 4.1.

One-time Password

PDM does not support the one-time password (OTP) authentication mechanism.

Fixups

Both fixup SIP over TCP and fixup SIP over UDP are supported in FWSM Release 1.1, but fixup SIP over UDP cannot be disabled in FWSM Release 1.1. Fixup SIP over UDP can only be disabled in FWSM Release 2.x.

CLI Command Support

This section indicates which CLIs PDM supports.

Fully Supported CLI Commands

PDM parses these commands when uploading or creating the FWSM configuration and gives you full access to all PDM user-interface tabs.

Table 2 lists the CLI commands that PDM fully supports. PDM parses these commands in the FWSM configuration and allows PDM to operate successfully.

Exceptions are noted in the table and occur when PDM cannot parse certain combinations of command statements. Commands that PDM cannot parse stay in the configuration, their values cannot be changed with PDM, and they appear in the list of unparseable commands.

Table 2 Fully Supported CLI Commands 

FWSM Commands
aaa command, include option
aaa command, match acl_name option
aaa-server
access-list and access-group
access-list compiled
access-list ethertype
arp
arp inspection
auth-prompt
class (in System mode)
context (in System mode)
dhcpd
domain-name
enable password
failover
failover lan and show failover lan detail
failover monitor-interface
failover polltime
failover polltime holdtime
filter
fixup protocol
fragment
global
hostname
http
icmp
igmp
interface
ip address
ip audit
ip local pool
ip verify reverse-path
isakmp identity [address | hostname]
logging
mroute
multicast
name
nameif
nat
nat [(if_name)] 0 access-list acl_name
ntp
object-group (network, service)
passwd
pdm
pdm group
pdm history
pdm location
pdm logging
privilege
remote-management
rip
route
router
rpc-server
same-security-traffic
service resetinbound
snmp-server
ssh
static (used for inbound PAT)
sysopt
telnet
tftp-server
timeout
udp
url-block
url-cache
url-server
user-name

CLI Commands Not Fully Supported in FWSM

Table 3 lists commands that cannot be changed. PDM parses these commands in the firewall configuration and handles them transparently.

Table 3 CLI Commands Not Fully Supported in FWSM

FWSM Commands	Result
ca authenticate	All VPN-related commands are ignored.
ca enroll	All VPN-related commands are ignored.
capture	Ignored
crypto	All VPN-related commands are ignored.
established	Ignored
floodguard	Ignored
ftp mode passive	Ignored
gdb enable	Ignored
object-group icmp-type	View-only
object-group network	Nested object groups are read-only
object-group protocol	View-only
object-group service	Nested object groups cannot be added
pager	Ignored
route-map	Ignored
sysopt connection zombie-timeout	Ignored
sysopt nodnsalias	Ignored
sysopt uauth allow-http-cache	Ignored
terminal	Ignored
virtual	Ignored
vpngroup	All VPN-related commands are ignored.

CLI Commands Ignored in Multiple Mode when in System Mode

Table 4 lists the CLI commands that are ignored when PDM 4.1 is operating in multiple mode and set to system mode.

Table 4 Ignored CLI Commands 

FWSM Commands
banner
enable password
ftp mode passive
logging
password
timeout
username
sysopt nodnsalias

Miscellaneous CLI Command Operation Limitations

Table 5 lists miscellaneous CLI command limitations in PDM 4.1.

Table 5 Miscellaneous CLI Command Limitations 

FWSM Commands	Result
access-list	Ignored if the access-list is not used anywhere in the configuration.
prefix-list	Ignored if it is not used in an OSPF area (CLI: area <area-id> filter-list prefix)
Discontinuous net masks such as 255.255.0.255. Example CLI: ip address inside 192.168.2.1 255.255.0.255	n/a
Use of aaa ... include and aaa ... match	Limited to monitor-only
No access to write, show pdm, show version, and show curpriv	PDM will not run.
Sharing of ACLs. Example CLI: access-group myACL in interface inside and access-group myACL in interface outside	PDM will display this as expected. However if you make a modification to an ACL that is being shared, PDM will prompt you to duplicate this ACL so that the ACL is no longer shared.

PDM does not support the one-time password (OTP) authentication mechanism.

CLI Commands Ignored by PDM in FWSM

These CLI commands are displayed in the list of unparseable commands in PDM. However, PDM does not change or remove these commands from your configuration, and the presence of these commands does not limit your access to the user-interface tabs in PDM. To see ignored commands, select Options > Show Commands Ignored by PDM on Firewall.

PDM Sessions

The FWSM can be configured to support up to five PDM sessions in single mode or five PDM sessions per context in multiple mode up to a total of 32 PDM sessions.

Caveats

The following sections describe the caveats for PDM software Version 4.1.

For your convenience in locating caveats in Cisco's Bug Toolkit, the caveat titles listed in this section are taken directly from the Cisco Bug Toolkit database. These caveat titles are not intended to be read as complete sentences because the title field length is limited. In the caveat titles, some truncation of wording or punctuation may be necessary to provide the most complete and concise description. The only modifications made to these titles are as follows:

•Commands are in boldface type.

•Product names and acronyms may be standardized.

•Spelling errors and typos may be corrected.

---

Note To view additional caveat information, use Bug Navigator II on CCO. Bug Navigator II may be accessed at the following website:

http://tools.cisco.com/Support/BugToolKit/action.do?hdnAction=searchBugs

---

Open Caveats - Version 4.1

The caveats in Table 6 are yet to be resolved in this version.

Table 6 Open Caveats 

ID Number	4.1
	Corrected	Caveat Title
CSCdx28710	No	PDM shows wrong interface on outbound deny ACL
CSCed71185	No	Cannot dismiss a dialog that appears over a status dialog.
CSCeg43510	No	Disable Secure http warning msg when tcp/0 configured in aaa rules
CSCeg54076	No	Failover enabled popup incorrect or misleading
CSCeg54474	No	PDM gets stuck at 96% after removing context and doing a refresh
CSCeg56569	No	Accessing online help in 2nd PDM session causes a JavaScript error
CSCeg57996	No	After deleting a resource class, security cntx still shows resource

Resolved Caveats - Version 4.1

The caveats in Table 7 are resolved in this version.

Table 7 Resolved Caveats 

ID Number	4.1
	Corrected	Caveat Title
CSCdv63733	Yes	Export: Export puts extra quotes around the titles when saving
CSCec74912	Yes	OSPF->Interface should list enabled interfaces only
CSCed37900	Yes	MFW Failover text incorrect in Config > Prop > Admin > Failover
CSCee31348	Yes	tftp-server inside interface 0 config throws warning msg
CSCee56043	Yes	Failover policy boxes need an extra character space
CSCee67920	Yes	caveat about authorization timeout on timeout screen needs changes
CSCee69148	Yes	Some text is clipped on Unix. Should use smaller font
CSCee73603	Yes	Display not correct for Management IP
CSCee75795	Yes	Subsequent help pages become inaccessible
CSCee77936	Yes	PDM should check for duplicate IPs
CSCee81372	Yes	Error popup for non-ip proto in adv pol static config screen
CSCee81774	Yes	TFW: Standby IP can not be removed.
CSCef10589	Yes	Protocol field of Config URL cannot be changed
CSCef18424	Yes	Clicking on first column header in a multilist to sort broken
CSCef34608	Yes	MultiList - selecting a row causes an IllegalArgException
CSCef44838	Yes	Null Rule for Object-groups and ACL created under Transparent mode.
CSCef50017	Yes	Minimize use of pdm location
CSCef53065	Yes	Changes in failover PIX does not display warning in PDM
CSCef57323	Yes	Add/Edit/Insert ICMP Rule: Any Address box resets ICMP Type
CSCef63620	Yes	Monitoring graph screens: need to switch Remove and Graph It btns
CSCef63885	Yes	Cannot easily get to online help from a dialog in Netscape 7.1
CSCef67464	Yes	Address cut off in new Add NAT Rule screen
CSCef67883	Yes	Add NAT Rule screen needs Manage Pools button
CSCef72242	Yes	System > Resource Class: use plural form
CSCef72638	Yes	MFM: System > Security Contexts apply enabled in linux
CSCef73509	Yes	Graphs: Export and Print buttons need...
CSCef77305	Yes	pdm stuck in loop loading config if FWSM interface down
CSCef77974	Yes	Cannot configure adv translation option in Policy NAT
CSCef78327	Yes	PDM hangs at 77% when using a discontiguous mask and policy NAT
CSCef83850	Yes	Access-list commit and clear xlate settings checked at startup
CSCef88725	Yes	Mozilla: Click some System Prop categories, Unapplied window appears
CSCef88728	Yes	PDM Add edit rule dialog box drop down menu is not working on UNIX
CSCef89002	Yes	PDM cannot configure or display filter with proxy-block correctly
CSCef89025	Yes	fixup dns description should specify UDP DNS response packet
CSCef89026	Yes	SNMP server configuration panel should be renamed
CSCef92909	Yes	Null Rule for object-group in outbound ACL on FWSM w/ same sec intf
CSCef92970	Yes	PDM is sending wrong password while sending commands to device
CSCef94978	Yes	If PDM logging is disabled, it incorrectly says System Properties
CSCef95004	Yes	Should not be able to set route metric to 255
CSCeg01043	Yes	Java exception when deleting identity nat rule
CSCeg02992	Yes	Incorporate Browser/OS checks and report to user before launch PDM
CSCeg16525	Yes	Need to init cap dialog box label of Add host/network.
CSCeg22010	Yes	Deleting a NAT 0 rule cause exception in java console
CSCeg25725	Yes	Policy NAT with translation to the same interface causes PDM to hang
CSCeg29316	Yes	ClassCast Exception when rules are deleted
CSCeg29391	Yes	NAT rules are not shown when same security level is configured
CSCeg29536	Yes	Disconnecting Telnet session makes reference to PDM session
CSCeg29548	Yes	service group should not send cmds for both www and http
CSCeg29593	Yes	Some routes not shown in Monitoring, Routing > Routes
CSCeg29680	Yes	exception if refreshing when no connection to the box
CSCeg29696	Yes	Java exception when deleting nat rule which is not bound to add pool
CSCeg29716	Yes	Java exception seen and can not del policy nat rules
CSCeg29794	Yes	Status bar stuck populating GUI modules when policy NAT exists
CSCeg29944	Yes	Add AAA account rule, PDM treats CLI prompt as error
CSCeg30245	Yes	global pol nat rule is shown as static pol nat rule, if both are conf
CSCeg30264	Yes	syslog server table acceptsc duplicate entries.
CSCeg30596	Yes	Switch filtering server type from PDM always gets error prompt
CSCeg30937	Yes	AAA Servers are not added in the order intended
CSCeg31977	Yes	CLI not generated OSPF->Interface->Properties tab
CSCeg31982	Yes	tftp-server inside interface 0 config throws warning msg
CSCeg31991	Yes	apply button not enabled after clearing metric value in ospf->redist
CSCeg32003	Yes	Clicking on first column header in a multilist to sort broken
CSCeg33316	Yes	allows addition of more than licensed number of contexts
CSCeg33470	Yes	Failover FWSM does not ask to send CLI to peer
CSCeg34261	Yes	OSPF Setup panel does not display OSPF process after reset
CSCeg40976	Yes	Refresh PDM ARP table entry will stop at 97% at panel bottom status
CSCeg40983	Yes	PDM shouldn't accept 0 as IP address for static ARP
CSCeg41070	Yes	PDM shouldn't accept subnet as IP address for static ARP
CSCeg41072	Yes	Clean up condition check for model family
CSCeg41076	Yes	SNMP: Table selection incorrect after adding a management station.
CSCeg41078	Yes	SNMP: Fields should be trimmed before validating
CSCeg41079	Yes	Should check if TCP Option mss < min mss before delivering to FWSM
CSCeg41080	Yes	ARP should be all caps - is not in Add Arp Static Config dialog
CSCeg43295	Yes	Fixed a missing static translation but Apply is still disabled
CSCeg44306	Yes	remove com.cisco.pdm.pdmdata.f.c in warning msg when user rm area
CSCeg44319	Yes	md5 key remains in Edit window even if a different ifx is selected
CSCeg44693	Yes	Monitoring: blocks used history table does not display full history
CSCeg44769	Yes	Changes to standby ip does not get applied to the FWSM
CSCeg46813	Yes	maximum-deny-flow range is incorrect in instructions
CSCeg47142	Yes	java exception on applying failover Advanced changes
CSCeg47552	Yes	TCP Options - timewait option is not supported
CSCeg48304	Yes	In context, config, access rule, row 2 display diff source host
CSCeg48323	Yes	pdm stuck in loading after adding OSPF area and networks
CSCeg48942	Yes	add/edit service groups allows only one type to be entered
CSCeg49156	Yes	Linux/Mozilla context and interface dropdowns are blank
CSCeg50348	Yes	Single mode-should allow 16 url-filter servers not 4
CSCeg50538	Yes	Home Page help displays Security Contexts page
CSCeg50656	Yes	DHCP server help discuss an invalid feature
CSCeg50914	Yes	Config w/3 nat 0 identity statements only shows 2
CSCeg52746	Yes	non-intuitive tab sequence for System > Security Context > Add/Edit
CSCeg53038	Yes	Failover interface IP not checked before send
CSCeg53152	Yes	Failover peer contact timeout too long
CSCeg53559	Yes	Null pointer exception from too many sessions in a context
CSCeg54207	Yes	PDM failover online help docs saturated in PIX ref
CSCeg54945	Yes	adding ARP static configuration to the management IP gives error mes
CSCeg55796	Yes	Configuration > Properties > Failover panel is cut off
CSCeg55989	Yes	Static with 0.0.0.0 cannot be deleted with the Delete button
CSCeg57046	Yes	Linux/JRE1.5: PDM not terminate properly
CSCeg57801	Yes	PDM failover missing Advanced button in single routed mode

Obtaining Documentation and Submitting a Service Request

For information on obtaining documentation, submitting a service request, and gathering additional information, see the monthly What's New in Cisco Product Documentation, which also lists all new and revised Cisco technical documentation, at:

http://www.cisco.com/en/US/docs/general/whatsnew/whatsnew.html

Subscribe to the What's New in Cisco Product Documentation as a Really Simple Syndication (RSS) feed and set content to be delivered directly to your desktop using a reader application. The RSS feeds are a free service and Cisco currently supports RSS version 2.0.

---

This document is to be used in conjunction with the appropriate documentation for your Cisco FWSM system.

CCSP, the Cisco Square Bridge logo, Follow Me Browsing, and StackWise are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn, and iQuick Study are service marks of Cisco Systems, Inc.; and Access Registrar, Aironet, ASIST, BPX, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Empowering the Internet Generation, Enterprise/Solver, EtherChannel, EtherFast, EtherSwitch, Fast Step, FormShare, GigaDrive, GigaStack, HomeLink, Internet Quotient, IOS, IP/TV, iQ Expertise, the iQ logo, iQ Net Readiness Scorecard, LightStream, Linksys, MeetingPlace, MGX, the Networkers logo, Networking Academy, Network Registrar, Packet, PIX, Post-Routing, Pre-Routing, ProConnect, RateMUX, ScriptShare, SlideCast, SMARTnet, StrataView Plus, SwitchProbe, TeleRouter, The Fastest Way to Increase Your Internet Quotient, TransPath, and VCO are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.

All other trademarks mentioned in this document or Website are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0411R)

Cisco PDM Release Notes for Firewall Services Module Version 4.1
Copyright © 2004 Cisco Systems, Inc.
All rights reserved.