Cisco PIX Device Manager

Table Of Contents

Release Notes for Cisco PDM Version 4.1(4) for Firewall Services Module

Introduction

PDM Software Overview

Switch and Router System Requirements

FWSM Requirements

Browser Requirements

Maximum Configuration File Size

PC and Workstation Requirements

Supported Platforms

Features Introduced in PDM Version 4.1

Important Notes

One-time Password

Caveats

Open Caveats—Version 4.1(4)

Resolved Caveats—Version 4.1(4)

Obtaining Documentation and Submitting a Service Request

Release Notes for Cisco PDM Version 4.1(4) for Firewall Services Module

---

November 2006

Introduction

Cisco PDM Version 4.1(4) is a web-based application used to configure and monitor the Firewall Services Module (FWSM) on a Catalyst 6500 series switch or Cisco 7600 series router. PDM Version 4.1(4) requires FWSM Release 2.3 or 2.2 and supports all of the configuration features in this release. For more information, see FWSM Technical Documentation and the FWSM FAQ (Frequently Asked Questions) sections on Cisco.com.

---

Note PDM Version 4.1(4) is a single image that supports FWSM Release 2.3 and 2.2. It does not support FWSM Release 1.x, FWSM Release 3.x or above, or the ASA or PIX platforms.

---

This document includes the following sections:

•Introduction

•Switch and Router System Requirements

•PC and Workstation Requirements

•Features Introduced in PDM Version 4.1

•Caveats

•Obtaining Documentation and Submitting a Service Request

PDM Software Overview

PDM Version 4.1(4) is a single image that provides secure administration of the FWSM. PDM is implemented as a signed Java applet, which downloads to your PC or workstation when you point your browser at the FWSM and does not require a plug-in or other software to be preinstalled. PDM manages FWSM Release 2.3 and 2.2 when it runs in single or multiple context modes.

PDM provides a graphical user interface to the FWSM to administer it without requiring knowledge of the command-line interface (CLI). PDM also maintains compatibility with the FWSM CLI and includes a tool for using the standard CLI commands within the PDM application. PDM lets you graph many aspects of the FWSM, as well as print or export graphs of the traffic through the FWSM and of system activity.

To help you use PDM, the application provides online help as well as a help table of contents, index, and glossary.

Switch and Router System Requirements

The switch and router models that are supported by the FWSM are as follows:

•Catalyst 6500 series switches with the following required components:

–Supervisor engine with Cisco IOS software or Catalyst operating system

–Multilayer Switch Feature Card (MSFC 2) with Cisco IOS software

•Cisco 7600 series routers, with the following required components:

–Supervisor engine with Cisco IOS software

–MSFC 2 with Cisco IOS software

For more information about supported supervisor engine and software versions and the supported Cisco IOS software, see the Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide Version 2.3.

---

Note The FWSM does not support a direct connection to a switch WAN port because WAN ports do not use static virtual local area networks (VLANs). However, the WAN port can connect to the MSFC, which can also connect to the FWSM.

---

For more information on switch or router requirements for FWSM, see the following website: http://www.cisco.com/en/US/products/hw/modules/ps2706/ps4452/tsd_products_support_model_home.html

The following sections list the system requirements for PDM Version 4.1(4) software.

FWSM Requirements

The FWSM must meet the following requirements to successfully install and run PDM:

•Minimum Software Versions—Verify that your FWSM meets the requirements listed in the Release Notes for the Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Software Release. You must have Release 2.3 or 2.2 installed on the FWSM before using PDM Version 4.1(4). For more information, see the Cisco PDM Installation and Configuration Guide for Firewall Services Module.

•Upgrading Software—When you install a new version of PDM, close all browser sessions before launching PDM. For information on upgrading your FWSM, see the following websites:

http://www.cisco.com/cisco/software/navigator.html?a=a&i=rpm

http://www.cisco.com/en/US/products/hw/modules/ps2706/ps4452/tsd_products_support_model_home.html

---

Caution If you are using Management Center for Firewalls, use PDM for monitoring only. All changes made using PDM will be overwritten the next time Management Center for Firewalls synchronizes with the FWSM.

---

Browser Requirements

The following are required to access one or more firewalls through PDM:

•Java Virtual Machine (JVM)—PDM 4.1(4) supports the native JVM on Microsoft Internet Explorer 6.0, Sun Java 1.4.2 or 5.0. PDM 4.1(4) also supports Sun Java 1.4.2 on Solaris or Red Hat Linux.

•HTTP 1.1—For Microsoft Internet Explorer, be sure to use HTTP 1.1 for both proxy and non-proxy connections. This can be changed in Tools > Internet Options > Advanced tab. Scroll down to the "HTTP 1.1 settings" section.

Maximum Configuration File Size

For optimum performance, we recommend a configuration file of no more than 500 KB when using PDM.

FWSM Firewall configuration files over 500 KB may interfere with the performance of PDM on your workstation in the following situations:

•While executing commands such as the write term command and the show running-config command

•Failover (the configuration synchronization time)

•When you click the Refresh button in PDM for the first time

PC and Workstation Requirements

PDM has different requirements depending on the platform from which it is accessed. PDM is not supported for use on computers equipped with the Macintosh operating system, or other versions of the Windows operating systems.

Supported Platforms

Table 1 lists the supported platforms for PDM Version 4.1(4).

Table 1 Supported Platforms for PDM Version 4.1(4)

	Operating System	Browser	Hardware
Windows	Windows 2000 (Service Pack 3 or higher) or Windows XP operating systems1 (English or Japanese versions)	Internet Explorer 6.0 with native JVM (VM 3809 or higher), Sun Java 1.4.2 or 5.0 Netscape 7.1 or 7.2 with Sun Java 1.4.2 or 5.0	Any Pentium III or Pentium-compatible processor running at 450 MHz or higher. At least 256 MB of RAM. We recommend 192 MB or more. A 1024 x 768 pixel display and at least High Color (16-bit).
SUN Solaris	Sun Solaris 8 or 9	Mozilla 1.7.3 with Sun Java 1.4.2	SPARC microprocessor. At least 256 MB of RAM. A 1024 x 768 pixel display and at least 256 colors. High Color (16-bit) recommended.
Linux	Red Hat Linux 9 or Red Hat Enterprise Linux WS version 3	Mozilla 1.7.3 with Sun Java 1.4.2	At least 128 MB of RAM. 256 MB recommended. A 1024 x 768 pixel display with at least 256 colors. High Color (16-bit) recommended.

1 PDM is not supported on Windows 3.1, 95, 98, ME or Windows NT 4.

---

Note When using Netscape on some Linux platforms, if you select an item under the Properties tab or the Monitoring tab, the entire PDM window shifts a few pixels to the left and up. This movement happens when you select a pane that contains a text field or a combo box.

---

Features Introduced in PDM Version 4.1

No new features have been introduced in PDM Version 4.1(4) since PDM Version 4.1(1). The purpose of this release is to resolve open caveats.

Important Notes

This section describes important notes for PDM software Version 4.1.

One-time Password

PDM does not support the one-time password (OTP) authentication mechanism.

Caveats

The following sections describe the caveats for PDM software Version 4.1(4).

For your convenience in locating caveats in the Cisco Bug Toolkit, the caveat titles listed in this section are taken directly from the Cisco Bug Toolkit database. These caveat titles are not intended to be read as complete sentences because the title field length is limited. In the caveat titles, some truncation of wording or punctuation may be necessary to provide the most complete and concise description. The only modifications made to these titles are as follows:

•Commands are in boldface type.

•Product names and acronyms may be standardized.

•Spelling errors and typos may be corrected.

---

Note To view additional caveat information, use Bug Navigator II on CCO. Bug Navigator II may be accessed at the following website:

http://tools.cisco.com/Support/BugToolKit/action.do?hdnAction=searchBugs

---

Open Caveats—Version 4.1(4)

The caveats in Table 2 are yet to be resolved in this version.

Table 2 Caveats Still Open in Version 4.1(4) 

ID Number	Caveat Title
CSCdx28710	PDM shows wrong interface on outbound deny ACL
CSCdx44905	Match access list uses subnet wider than ip local pool
CSCeg54076	Failover enabled popup incorrect or misleading
CSCeg54474	PDM gets stuck at 96% after removing context and doing a refresh
CSCeg57996	After deleting a resource class, security context still shows resource
CSCeg71623	PDM should not change config if logged in as a read-only user
CSCeh15426	MFW failover monitoring screen caches interfaces from other contexts
CSCeh50272	Network object groups are created even when identity statics are used
CSCeh54110	Traffic graphs confused if two contexts use same interface names
CSCeh59768	PDM takes longer time to add Hosts/Networks Groups
CSCeh78484	PDM cannot print Access-Rules
CSCsb93749	Destination address in the Access Rules table is incorrect when using NAT/PAT
CSCsc20328	Search by Field for filtering has wrong search choices
CSCsc65102	Wrong security rules when using static translation + same security traffic
CSCsc88018	PDM allows user to modify config even if the maximum user limit is reached
CSCsd10442	PDM Config refresh hangs while another session paused at -More- Prompt
CSCsd17010	PDM does not filter show arp output when using the include command
CSCsd98278	PDM hangs at 52% when loading with dynamic policy NAT in config
CSCse12882	PDM on FWSM stuck opening at 47% during loading
CSCse24811	Unable to add a network object group that is in use
CSCse47250	PDM locks at 52%
CSCsf33083	Adding an ACL is deleting the route

Resolved Caveats—Version 4.1(4)

The caveats in Table 3 are resolved in Version 4.1(4).

Table 3 Caveats Resolved in Version 4.1(4) 

ID Number	Caveat Title
CSCsb86840	Search by field on Action field in the rules table does not work properly
CSCsc27272	PDM locks if you attempt to do something that is not allowed by the command authorization
CSCsc74421	Unknown IP protocol error occurs when you create a new access rule
CSCsc95805	PDM unexpected null rules generated for access rules
CSCsd12031	PDM moves around the remarks when editing an ACE rule
CSCsd19901	Null rule does not get updated even after fix and refresh
CSCsd30253	PDM on FWSM is stuck open at 47% during loading
CSCsd33096	PDM is stuck at 47% during loading because of access list configurations
CSCsd84342	PDM does not allow you to add or edit a valid policy NAT
CSCse09377	PDM does not show details for access rule when FWSM is in transparent mode

Obtaining Documentation and Submitting a Service Request

For information on obtaining documentation, submitting a service request, and gathering additional information, see the monthly What's New in Cisco Product Documentation, which also lists all new and revised Cisco technical documentation, at:

http://www.cisco.com/en/US/docs/general/whatsnew/whatsnew.html

Subscribe to the What's New in Cisco Product Documentation as a Really Simple Syndication (RSS) feed and set content to be delivered directly to your desktop using a reader application. The RSS feeds are a free service and Cisco currently supports RSS version 2.0.

---

Copyright © 2006 Cisco Systems, Inc. All rights reserved.