Table Of Contents
Cisco ASA 5500 Series Release Notes Version 7.0(5)
Contents
Introduction
System Requirements
Memory Requirements
Determining the Software Version
Upgrading to a New Software Release
New Features
Important Notes
Important Notes in Release 7.0
FIPS 140-2
Hostname and Domain Name Limitation
WebVPN ACLS and DNS Hostname
Proxy Server and ASA
Mismatch PFS
ACS Radius Authorization Server
Readme Document for the Conduits and Outbound List Conversion Tool 1.2
User Upgrade Guide
Features not Supported in Version 7.0
MIB Supported
Downgrade to Previous Version
Caveats
Open Caveats - Release 7.0(5)
Resolved Caveats - Release 7.0(5)
Related Documentation
Software Configuration Tips on the Cisco TAC Home Page
Obtaining Documentation and Submitting a Service Request
Cisco ASA 5500 Series Release Notes Version 7.0(5)
April 2006
Contents
This document includes the following sections:
•
Introduction
•System Requirements
•New Features
•Important Notes
•Caveats
•Related Documentation
•Obtaining Documentation and Submitting a Service Request
Introduction
The Cisco ASA 5500 series security appliance delivers unprecedented levels of defense against threats to the network with deeper web inspection and flow specific analysis, improved secure connectivity through end-point security posture validation and voice and video over VPN support. It also provides enhanced support for intelligent information networks through improved network integration, resiliency, and scalability. This release introduces significant enhancements to all major functional areas, including: firewalling and inspection services, VPN services, network integration, high-availability services, and management/monitoring.
For more information on all the new features, see New Features.
Additionally, the Cisco ASA 5500 series security appliance software supports Adaptive Security Device Manager. ASDM is a browser-based, Java applet used to configure and monitor the software on the security appliances. ASDM is loaded from the security appliance, then used to configure, monitor, and manage the device.
System Requirements
The sections that follow list the system requirements for operating a Cisco ASA 5500 series security appliance. This section includes the following topics:
•Memory Requirements
•Determining the Software Version
•Upgrading to a New Software Release
Memory Requirements
Table 1 lists the DRAM memory requirements for the Cisco ASA 5500 series security appliance.
Table 1 DRAM Memory Requirements
ASA Model
|
DRAM Memory
|
ASA 5510
|
256 MB
|
ASA 5520
|
512 MB
|
ASA 5540
|
1 GB
|
All Cisco ASA 5500 series security appliances require a minimum of 64 MB of internal CompactFlash.
Determining the Software Version
Use the show version command to verify the software version of your Cisco ASA 5500 series security appliance.
Upgrading to a New Software Release
If you have a Cisco.com (CDC) login, you can obtain software from the following website:
http://www.cisco.com/cisco/software/navigator.html
New Features
Released: April 14, 2006
Table 2 lists the new features for ASA and PIX Version 7.0(5)/ASDM Version 5.0(5).
Table 2 New Features for ASA and PIX Version 7.0(5)/ASDM Version 5.0(5)
Feature
|
Description
|
Application Inspection Features
|
Command to Control DNS Guard
|
You can now control the DNS guard function. In releases prior to 7.0(5), the DNS guard functions are always enabled regardless of the configuration of DNS inspection:
•Stateful tracking of the DNS response with DNS request to match the ID
•Tearing down the DNS connection when all pending requests are responded
This command is effective only on interfaces with DNS inspection disabled (no inspect dns). When DNS inspection is enabled, the DNS guard function is always performed.
We introduced the following command: dns guard.
|
Enhanced IPSEC Inspection
|
The ability to open specific pinholes for ESP flows based on existence of an IKE flow is provided by the enhanced IPSec inspect feature. This feature can be configured within the MPF infrastructure along with other inspects. The idle-timeout on the resulting ESP flows is statically set at 10 minutes. There is no maximum limit on number of ESP flows that can be allowed.
We introduced the following command: inspect ipsec-pass-thru.
|
Firewall Features
|
Command to Disable RST for Denied TCP Packets
|
When a TCP packet is denied, the adaptive security appliance always sends a reset when the packet is going from a high security to a low security interface. The service resetinbound command is used to enable or disable sending resets when a TCP packet is denied when going from a low security to a high security interface. The service resetinbound command is introduced to control sending RESETs when a packet is denied when going from a high security to a low security interface. The existing service resetinbound command is enhanced to take an additional interface option.
We introduced the following commands: service resetoutbound, service resetinbound.
|
Platform Features
|
Increased Connections and VLANs
|
The maximum connections and VLANs is increased to the following numbers.
• ASA5510 base license conns 32000->50000 vlans 0->10
• ASA5510 plus license conns 64000->130000 vlans 10->25
• ASA5520 conns 130000->280000 vlans 25->100
• ASA5540 conns 280000->400000 vlans 100->200
|
Management Features
|
Password Increased in Local Database
|
Username and enable password length limits increased from 16 to 32 in the LOCAL database.
|
Enhanced show interface and show traffic Commands
|
The traffic statistics displayed in both the show interface and show traffic commands now support 1 minute rate and 5 minute rate for input, output and drop. The rate is calculated as the delta between the last two sampling points. For a 1 minute rate and a 5 minute rate, a 1 minute timer and a 5 minute timer are run constantly for the rates respectively. An example of the new display follows:
1 minute input rate 128 pkts/sec, 15600 bytes/sec
1 minute output rate 118 pkts/sec, 13646 bytes/sec
1 minute drop rate 12 pkts/sec
5 minute input rate 112 pkts/sec, 13504 bytes/sec
5 minute output rate 101 pkts/sec, 12104 bytes/sec
5 minute drop rate 4 pkts/sec
|
Important Notes
Important Notes in Release 7.0
This section lists important notes related to release 7.0(5).
FIPS 140-2
The Cisco ASA 5500 series security appliance is on the FIPS 140-2 Pre-Validation List.
Hostname and Domain Name Limitation
When using ASDM, the hostname and domain names combined should not be more than 63 characters long. If the hostname and domain names combined is more than 63 characters, you will get an error message.
WebVPN ACLS and DNS Hostname
When a deny webtype URL ACL (DNS-based) is defined, but the DNS-based URL is not reachable, a "DNS Error" popup is displayed on the browser. The ACL hitcounter is also not incremented.
If the URL ACL is defined by an IP instead of DNS name, then the traffic flow hitting the ACL will be recorded in the hitcounter and a "Connection Error" is displayed on the browser.
Proxy Server and ASA
If WebVPN is configured to use an HTTP(S)-proxy server to service all requests for browsing HTTP and/or HTTPS sites, the client/browser may expect the following behavior:
1. If the ASA cannot communicate with the HTTPS or HTTPS proxy server, a "connection error" is displayed on the client browser.
2. If the HTTP(S) proxy cannot resolve or reach the requested URL, it should send an appropriate error to the ASA, which in turn will display it to the client browser.
Only when the HTTP(S) proxy server notifies the ASA of the inaccessible URL, can the ASA notify the error to the client browser.
Mismatch PFS
The PFS setting on the VPN client and the security appliance must match.
ACS Radius Authorization Server
When certificate authentication is used in conjuction with Radius authorization, the ACS server sends a bogus Group=CISCOACS:0003b9c6/5a940131/username and is displayed in the vpn-session database.
Readme Document for the Conduits and Outbound List Conversion Tool 1.2
The Cisco ASA 5500 series security appliance Outbound/Conduit Conversion tool assists in converting configurations with outbound or conduit commands to similar configurations using ACLs. ACL-based configurations provide uniformity and leverage the powerful ACL feature set. ACL based configurations provide the following benefit:
•ACE Insertion capability - System configuration and management is greatly simplified by the ACE insertion capability that allows users to add, delete or modify individual ACEs.
User Upgrade Guide
•For a list of deprecated features, and user upgrade information, go to the following URL:
http://www.cisco.com/en/US/docs/security/asa/asa70/vpn3000_upgrade/upgrade/guide/migr_vpn.html
Features not Supported in Version 7.0
The following features are not supported in Version 7.0(5):
•PPPoE
•L2TP over IPSec
•PPTP
MIB Supported
For information on MIB Support, go to:
http://www.cisco.com/public/sw-center/netmgmt/cmtk/mibs.shtml
Downgrade to Previous Version
To downgrade to a previous version of the operating system software (software image), use the downgrade command in privileged EXEC mode. For more information and a complete description of the command syntax, see the Cisco Security Appliance Command Reference.
Caveats
The following sections describe the caveats for the 7.0(5) release.
For your convenience in locating caveats in Cisco's Bug Toolkit, the caveat titles listed in this section are drawn directly from the Bug Toolkit database. These caveat titles are not intended to be read as complete sentences because the title field length is limited. In the caveat titles, some truncation of wording or punctuation may be necessary to provide the most complete and concise description. The only modifications made to these titles are as follows:
•Commands are in boldface type.
•Product names and acronyms may be standardized.
•Spelling errors and typos may be corrected.
Note If you are a registered cisco.com user, view Bug Toolkit on cisco.com at the following website:
http://tools.cisco.com/Support/BugToolKit/
To become a registered cisco.com user, go to the following website:
http://tools.cisco.com/RPF/register/register.do
Open Caveats - Release 7.0(5)
Table 3 Open Caveats
ID Number
|
Software Release 7.0(5)
|
Corrected
|
Caveat Title
|
CSCei47678
|
No
|
SNMP packet size standards in RFC3417 not fully supported.
|
CSCek21836
|
No
|
SIP: BYE embryonic connection timestamp not updated.
|
CSCsc36891
|
No
|
Higher CPU utilization for url filtering in recent releases.
|
CSCsc37965
|
No
|
IP-directed broadcasts no longer allowed through device.
|
CSCsc68575
|
No
|
CPU usage is higher for given traffic throughput in recent releases.
|
CSCsc97602
|
No
|
Traceback is sometimes observed in tmatch compile thread.
|
CSCsd00086
|
No
|
ASDM connection may cause packet loss
|
CSCsd08170
|
No
|
UDP 500 not removed from pat port pool when crypto map is applied
|
CSCsd59936
|
No
|
Registering to the RP for PIM fails if fragmented in more then 12 packs
|
CSCsd69625
|
No
|
EZVPN:IOS C876 Client can't connect to ASA using digi certs and noXauth
|
CSCsd75865
|
No
|
VPN address pool overlap may cause packet drop.
|
CSCsd78428
|
No
|
Traceback may occur in Checkheaps on standby unit
|
CSCsd79596
|
No
|
H245 connection going idle although traffic on RTP stream and H225.
|
CSCsd82355
|
No
|
Malformed syslog packets may be generated.
|
CSCsd82714
|
No
|
RTSP fails with Windows media player
|
CSCsd84394
|
No
|
IPSec: Invalid block submitted to outbound packet processing
|
CSCsd85345
|
No
|
Traceback may occur in fover_parse on 7.0.4
|
CSCsd89503
|
No
|
Traceback during failover in routing module
|
CSCsd93207
|
No
|
Show failover indicates different uptimes on devices in failover pair
|
CSCsd93380
|
No
|
Packets for VPN-l2l peer get dropped instead of encrypted
|
Resolved Caveats - Release 7.0(5)
Table 4 Resolved Caveats
ID Number
|
Software Release 7.0(5)
|
Corrected
|
Caveat Title
|
CSCeh46345
|
Yes
|
Dynamic L2L could pass clear text traffic when tunnel terminates
|
CSCeh60845
|
Yes
|
Logginig queue incorrectly registers 8192 256-byte blocks
|
CSCeh70043
|
Yes
|
DOC: sh asp drop needs further clarification in doc
|
CSCeh90617
|
Yes
|
Recompiling ACLs can cause packet drops on low-end platforms
|
CSCei43588
|
Yes
|
traceback when trying to match a packet to acl with deny
|
CSCek21835
|
Yes
|
Higher metric OSPF external route is selected
|
CSCek21837
|
Yes
|
PDM with Command Authorization requires the write command for Read-Only
|
CSCek21838
|
Yes
|
SIP: fail to open a conn for Record route in NOTIFY
|
CSCek21843
|
Yes
|
SIP: Not translate c= address if first m= has port 0 in SDP body.
|
CSCek21849
|
Yes
|
Backspace sent in cut-through proxy authentication
|
CSCek26572
|
Yes
|
tftp fixup does not allow error message from client
|
CSCsc02485
|
Yes
|
Session Cmd: sendind 036xr to exit session to ssm causes Traceback
|
CSCsc03061
|
Yes
|
CLI should generate Warning if kerberos-relm is not in all uppercase
|
CSCsc07614
|
Yes
|
Minimum unit poll time causes trouble for failover with 4GE card
|
CSCsc08188
|
Yes
|
5540 crash during 1000+ tunnel, multi-encapsulation system testing
|
CSCsc12094
|
Yes
|
AAA fallback authentication does not work with reactivation-mode timed
|
CSCsc15434
|
Yes
|
Assertion violation w/icmp traffic and icmp inspection
|
CSCsc16041
|
Yes
|
'clear local host' results in memory leak
|
CSCsc16507
|
Yes
|
url-server: cannot remove despite having removed url-block cmd
|
CSCsc18444
|
Yes
|
Tunnel-group for specific peer not created upgrading to 7.0 w/ certs
|
CSCsc18911
|
Yes
|
ASA does not remove OSPF route for global PAT entry after deleting
|
CSCsc20102
|
Yes
|
webfo: traceback during bulk sync in vpnfol_thread_sync
|
CSCsc26331
|
Yes
|
PKI: CR should not be used to terminate certificate console input
|
CSCsc27972
|
Yes
|
Traceback when changing crypto maps when Answer-Only in lower sequence
|
CSCsc31762
|
Yes
|
Fixup RTSP does not re-write the SET Parameter to the NATed IP address
|
CSCsc31788
|
Yes
|
Failover Primary access-list delete problem crashes secondary
|
CSCsc33385
|
Yes
|
GTP - pdp context creation failed - GSN tunnel limit exceeded
|
CSCsc34022
|
Yes
|
ASA requires improved failover testing method
|
CSCsc36332
|
Yes
|
Crash with show running-config all when priority class configured
|
CSCsc36898
|
Yes
|
FIPS: POST Bypass test failure
|
CSCsc37492
|
Yes
|
ASA: snmp-server host is not working in some circumstances
|
CSCsc39334
|
Yes
|
Crash due to check-retransmission from the tcp-map
|
CSCsc39559
|
Yes
|
APPFW:Obfuscated characters causing alert with firefox browser
|
CSCsc42204
|
Yes
|
Syslog ID 111005 no longer being logged when user exits config mode
|
CSCsc44566
|
Yes
|
Traceback in Dispatch Unit - pm_rcv_cb_ids
|
CSCsc44591
|
Yes
|
Traceback in ARP Thread - arp_sendbp in mulicontext mode
|
CSCsc46976
|
Yes
|
SIP: crash when failed to pre-allocate early rtp
|
CSCsc48330
|
Yes
|
OpenSSL Security Advisory: Potential SSL 2.0 Rollback
|
CSCsc48463
|
Yes
|
Traceback on ASA 5510 in Thread Name: vpnfo_thread_msg
|
CSCsc49830
|
Yes
|
IKE daemon crashes after upgrading
|
CSCsc49873
|
Yes
|
VPN-filter not applied without for remote VPN clients without xauth
|
CSCsc56552
|
Yes
|
Adding user context causes traceback on Standby unit
|
CSCsc57901
|
Yes
|
Memory leak when the standby unit fails to parse IKE messages
|
CSCsc57935
|
Yes
|
ASA FO should give warning when there is OS version difference
|
CSCsc58416
|
Yes
|
ASA crash in Dispatch Unit thread
|
CSCsc59298
|
Yes
|
VPN: IPSec errors are reported when trying to fragment compressed pkts
|
CSCsc60506
|
Yes
|
Large banner from RADIUS is causing traceback
|
CSCsc67347
|
Yes
|
VPN locks up under throughput stress
|
CSCsc73580
|
Yes
|
traceback in logger_save after clear config logging
|
CSCsc73942
|
Yes
|
TCP RST is dropped when there is outstanding data that is not acked
|
CSCsc77884
|
Yes
|
GTP: should check spare bits in header
|
CSCsc78817
|
Yes
|
ASA crashes in FWTask() during clear config all
|
CSCsc78900
|
Yes
|
Reload with Thread Name: Dispatch Unit at tcp_check_packet
|
CSCsc81668
|
Yes
|
https://<ip>/config does not have the same privilege level as 'write'
|
CSCsc83854
|
Yes
|
ASA endlessly sends Radius Access-Requests when requesting a BIG dACL
|
CSCsc84291
|
Yes
|
When using SSL the warning message is not returned back
|
CSCsc86217
|
Yes
|
Voice Proxy Function does not preserve DSCP bits.
|
CSCsc90944
|
Yes
|
ASA sends malformed https proxy authentication page.
|
CSCsc92575
|
Yes
|
Upgrade Activation Key reduces permitted interfaces
|
CSCsc97846
|
Yes
|
CPU utilization increase when adding more logging hosts.
|
CSCsc97905
|
Yes
|
traceback when running codenomicon snmp suite. eip 0x00ebf294
|
CSCsc98336
|
Yes
|
Large group-policy names cause crash if used with IPSec
|
CSCsc99263
|
Yes
|
GTPv1: Subsequent Create Req to modify PDP context IEs are not processed
|
CSCsc99339
|
Yes
|
traceback when running ospf codenomicon suite.eip 0x00ef5f7c
|
CSCsc99364
|
Yes
|
SSL Certs from Verisign Managed PKI do not install
|
CSCsd00051
|
Yes
|
SNMP polling may cause packet loss
|
CSCsd00175
|
Yes
|
ASA5510 drops FIN/ACK packets resulting in half open FTP sessions
|
CSCsd01096
|
Yes
|
Primary active crash and both primary and secondary are non-active
|
CSCsd01722
|
Yes
|
ASA 7.0 logging message 419001 always sent in message lists
|
CSCsd02938
|
Yes
|
ASA doesn't reconnect if websense server goes down
|
CSCsd03391
|
Yes
|
TCP Intercept doesn't negate CPU impact when SYN flood from adjacent net
|
CSCsd04700
|
Yes
|
match port option for setting connection time-outs does not work
|
CSCsd08060
|
Yes
|
Memory corruption caused by session DB when events are out of sync..
|
CSCsd10138
|
Yes
|
Crash in Checkheaps thread when enabling LAN2LAN vpn
|
CSCsd11179
|
Yes
|
SNMP polling of resource MIBS may cause packet loss
|
CSCsd11511
|
Yes
|
Crash due to memory corruption in sanity check of the Checkheaps thread
|
CSCsd11908
|
Yes
|
Traceback in logger_save thread
|
CSCsd13334
|
Yes
|
ASA, Memory Leaking tunnel-group authorization-dn-attributes
|
CSCsd13938
|
Yes
|
Traceback and Assertion in "fover_dev.c", line 513
|
CSCsd16751
|
Yes
|
GTP: wrong service-policy used when connection is re-used
|
CSCsd22910
|
Yes
|
users with passwords longer than 11 chars can no longer authenticate
|
CSCsd25553
|
Yes
|
ASA crashes when VPN client tries to make connection to inside interface
|
CSCsd28581
|
Yes
|
ASA failover : Secondary crashes with Thread Name: IKE Daemon
|
CSCsd31068
|
Yes
|
platform image read as ascii if uploaded by asdm to flash:
|
CSCsd34070
|
Yes
|
H.245 inspection skipped when malformed GKRCS packet
|
CSCsd36030
|
Yes
|
in multiple policy-maps, packets should match the first map,not the last
|
CSCsd37075
|
Yes
|
DSH API should check for 0 handle
|
CSCsd38929
|
Yes
|
SSL Verisign imported certificate fails when establishing SSL session
|
CSCsd39029
|
Yes
|
Traceback with Thread Name: Dispatch Unit
|
CSCsd44349
|
Yes
|
PIM codenomicon suite crashes box - eip 0x010811f3
|
CSCsd45099
|
Yes
|
logging debug-trace should not prevent debugs from printing to console
|
CSCsd46111
|
Yes
|
Traceback when using sh xlate via telnet over VPN tunnel
|
CSCsd46922
|
Yes
|
High CPU usage when configuring/compiling ACL's
|
CSCsd48512
|
Yes
|
Duplicate ASP crypto table entry causes firewall to not encrypt traffic
|
CSCsd51884
|
Yes
|
Restore debug icmp trace functionallity - showing nat translation
|
CSCsd58620
|
Yes
|
H.323: Memory Leak Under Load
|
CSCsd58848
|
Yes
|
Memory allocated for connections not freed
|
CSCsd63673
|
Yes
|
ASA with dhcprelay doesnt reply with unicast DHCP offer
|
CSCsd64394
|
Yes
|
Deny syslog not generated for denied URLs trafic
|
CSCsd64912
|
Yes
|
url-server: tcp connections fail when tcp stack users are exhausted
|
CSCsd64920
|
Yes
|
url-server: url lookup requests are not retried when using tcp
|
CSCsd65209
|
Yes
|
url-block block: http response buffering feature does not work
|
CSCsd65215
|
Yes
|
Capture access-list shows only 1 hit count for outbound traffic
|
CSCsd67647
|
Yes
|
Traceback in obj-f1/tcp:_q_copydata+26 on copying image to ftp server
|
CSCsd70242
|
Yes
|
Some syslogs are incorrectly logged to an event list, when not specified
|
CSCsd70812
|
Yes
|
HA: Traffic Stall after config syncing running Act/Act fover
|
CSCsd72617
|
Yes
|
Dispatch Unit Crash when HTTP inspect enabled...ASA 7.1.2, 7.0.4-11
|
CSCsd72951
|
Yes
|
Traceback: Thread Name: IKE Daemon (Old pc 0x00507433 ebp 0x03bdc498)
|
CSCsd74964
|
Yes
|
SNP Inspect Http drops messages other than GET
|
CSCsd75794
|
Yes
|
MFW:R applfw crash on codenomicon http suite, test 39614 or 39615
|
CSCsd76384
|
Yes
|
dhcpc fails when management-access is configured
|
CSCsd77018
|
Yes
|
Traceback in obj-f1/snp_fp_main:_snp_fp_fragment+260
|
CSCsd77155
|
Yes
|
All out of order packets dropped by tcp normalizer
|
CSCsd78595
|
Yes
|
Global buffer drop output under show service-policy
|
CSCsd79775
|
Yes
|
ASA VPN: all packets for a l2l peer get dropped instead of encrypted
|
CSCsd81496
|
Yes
|
crash when websense service is restarted while requests are pending
|
CSCsd82114
|
Yes
|
Change of log options on the ACE doesn't take immediate effect
|
CSCsd83007
|
Yes
|
Need ability to disable dns guard in 7.0
|
CSCsd83863
|
Yes
|
Reload with Thread Name: Dispatch Unit
|
CSCsd85007
|
Yes
|
Dispatch unit crash at snp_fp_fragment with SSM card enabled
|
CSCsd85451
|
Yes
|
SAs not created when crypto map group and isakmp policy group are differ
|
CSCsd86841
|
Yes
|
F1 crash immediately after sending ping traffic thru GTP tunnel
|
CSCsd87779
|
Yes
|
fips self test power on never completes
|
Related Documentation
For additional information on the Cisco ASA 5500 series security appliance, refer to the following URL on Cisco.com:
http://www.cisco.com/en/US/products/ps6120/tsd_products_support_series_home.html
Software Configuration Tips on the Cisco TAC Home Page
The Cisco Technical Assistance Center has many helpful pages. If you have a CDC account you can visit the following websites for assistance:
TAC Troubleshooting, Sample Configurations, Hardware Info, Software Installations and more:
http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/
Obtaining Documentation and Submitting a Service Request
For information on obtaining documentation, submitting a service request, and gathering additional information, see the monthly What's New in Cisco Product Documentation, which also lists all new and revised Cisco technical documentation, at:
http://www.cisco.com/en/US/docs/general/whatsnew/whatsnew.html
Subscribe to the What's New in Cisco Product Documentation as a Really Simple Syndication (RSS) feed and set content to be delivered directly to your desktop using a reader application. The RSS feeds are a free service and Cisco currently supports RSS version 2.0.
Feedback
