Downloads |
 Feedback
|
Table Of Contents
Cisco ASDM Release Notes Version 6.0(2)
ASDM Client PC Operating System and Browser Requirements
Supported Platforms and Feature Licenses
Starting ASDM from the ASDM Launcher
Starting ASDM from a Web Browser
One-Time Password Not Supported
Effects of Unsupported Commands
Ignored and View-Only Commands
Interactive User Commands Not Supported in ASDM CLI Tool
Obtaining Documentation and Submitting a Service Request
Cisco ASDM Release Notes Version 6.0(2)
May 2008
This document contains release information for Cisco ASDM Version 6.0(2) on Cisco PIX 500 series and Cisco ASA 5500 adaptive series security appliances Version 8.0(2). It includes the following sections:
•
Supported Platforms and Feature Licenses
•
Introduction
Cisco Adaptive Security Device Manager (ASDM) delivers world-class security management and monitoring services for Cisco PIX 500 and ASA 5500 adaptive series security appliances through an intuitive, easy-to-use, web-based management interface. Bundled with supported security appliances, the device manager accelerates security appliance deployment with intelligent wizards, robust administration tools, and versatile monitoring services that complement the advanced security and networking features offered by Cisco PIX 500 and ASA 5500 adaptive series security appliance software Version8.0(2). Its secure, web-based design enables anytime, anywhere access to security appliances.
New Features
Released: June 18, 2007Table 1 lists the new features for ASA and PIX Version 8.0(2)/ASDM Version 6.0(2).
Note
Table 1 New Features for ASA and PIX Version 8.0(2)/ASDM Version 6.0(2)
Routing Features
EIGRP routing
The security appliance supports EIGRP or EIGRP stub routing.
Remote command execution in Failover pairs
You can execute commands on the peer unit in a failover pair without having to connect directly to the peer. This works for both Active/Standby and Active/Active failover.
CSM configuration rollback support
Adds support for the Cisco Security Manager configuration rollback feature in failover configurations.
Failover pair Auto Update support
You can use an Auto Update server to update the platform image and configuration in failover pairs.
Stateful Failover for SIP signaling
SIP media and signaling connections are replicated to the standby unit.
Redundant interfaces
A logical redundant interface pairs an active and a standby physical interface. When the active interface fails, the standby interface becomes active and starts passing traffic. You can configure a redundant interface to increase the security appliance reliability. This feature is separate from device-level failover, but you can configure redundant interfaces as well as failover if desired. You can configure up to eight redundant interface pairs.
Virtual IPS sensors with the AIP SSM
The AIP SSM running IPS software Version 6.0 and above can run multiple virtual sensors, which means you can configure multiple security policies on the AIP SSM. You can assign each context or single mode security appliance to one or more virtual sensors, or you can assign multiple security contexts to the same virtual sensor. See the IPS documentation for more information about virtual sensors, including the maximum number of sensors supported.
Password reset
You can reset the password on the SSM hardware module.
Combined certificate and username/password login
An administrator requires a username and password in addition to a certificate for login to SSL VPN connections.
Internal domain username/password
Provides a password for access to internal resources for users who log in with credentials other than a domain username and password, for example, with a one-time password. This is a password in addition to the one a user enters when logging in.
Generic LDAP support
This includes OpenLDAP and Novell LDAP. Expands LDAP support available for authentication and authorization.
Onscreen keyboard
The security appliance includes an onscreen keyboard option for the login page and subsequent authentication requests for internal resources. This provides additional protection against software-based keystroke loggers by requiring a user to use a mouse to click characters in an onscreen keyboard for authentication, rather than entering the characters on a physical keyboard.
SAML SSO verified with RSA Access Manager
The security appliance supports Security Assertion Markup Language (SAML) protocol for Single Sign On (SSO) with RSA Access Manager (Cleartrust and Federated Identity Manager).
NTLMv2
Version 8.0(2) adds support for NTLMv2 authentication for Windows-based clients.
Local certificate authority
Provides a certificate authority on the security appliance for use with SSL VPN connections, both browser- and client-based.
OCSP CRL
Provides OCSP revocation checking for SSL VPN.
Host Scan
As a condition for the completion of a Cisco AnyConnect or clientless SSL VPN connection, the remote computer scans for a greatly expanded collection of antivirus and antispyware applications, firewalls, operating systems, and associated updates. It also scans for any registry entries, filenames, and process names that you specify. It sends the scan results to the security appliance. The security appliance uses both the user login credentials and the computer scan results to assign a Dynamic Access Policy (DAP).
With an Advanced Endpoint Assessment License, you can enhance Host Scan by configuring an attempt to update noncompliant computers to meet version requirements.
Cisco can provide timely updates to the list of applications and versions that Host Scan supports in a package that is separate from Cisco Secure Desktop.
Simplified prelogin assessment and periodic checks
Cisco Secure Desktop now simplifies the configuration of prelogin and periodic checks to perform on remote Microsoft Windows computers. Cisco Secure Desktop lets you add, modify, remove, and place conditions on endpoint checking criteria using a simplified, graphical view of the checks. As you use this graphical view to configure sequences of checks, link them to branches, deny logins, and assign endpoint profiles, Cisco Secure Desktop Manager records the changes to an XML file. You can configure the security appliance to use returned results in combination with many other types of data, such as the connection type and multiple group settings, to generate and apply a DAP to the session.
Dynamic access policies (DAP)
VPN gateways operate in dynamic environments. Multiple variables can affect each VPN connection, for example, intranet configurations that frequently change, the various roles each user may inhabit within an organization, and logins from remote access sites with different configurations and levels of security. The task of authorizing users is much more complicated in a VPN environment than it is in a network with a static configuration.
Dynamic Access Policies (DAP) on the security appliance let you configure authorization that addresses these many variables. You create a dynamic access policy by setting a collection of access control attributes that you associate with a specific user tunnel or session. These attributes address issues of multiple group membership and endpoint security. That is, the security appliance grants access to a particular user for a particular session based on the policies you define. It generates a DAP at the time the user connects by selecting and/or aggregating attributes from one or more DAP records. It selects these DAP records based on the endpoint security information of the remote device and the AAA authorization information for the authenticated user. It then applies the DAP record to the user tunnel or session.
Administrator differentiation
Lets you differentiate regular remote access users and administrative users under the same database, either RADIUS or LDAP. You can create and restrict access to the console via various methods (TELNET and SSH, for example) to administrators only. It is based on the IETF RADIUS service-type attribute.
VLAN support for remote access VPN connections
Provides support for mapping (tagging) of client traffic at the group or user level. This feature is compatible with clientless as well as IPsec and SSL tunnel-based connections.
VPN load balancing for the ASA 5510
Extends load balancing support to ASA 5510 security appliances that have a Security Plus license.
Crypto conditional debug
Lets users debug an IPsec tunnel on the basis of predefined crypto conditions such as the peer IP address, connection-ID of a crypto engine, and security parameter index (SPI). By limiting debug messages to specific IPSec operations and reducing the amount of debug output, you can better troubleshoot the security appliance with a large number of tunnels.
Enhanced portal design
Version 8.0(2) includes an enhanced end user interface that is more cleanly organized and visually appealing.
Customization
Supports administrator-defined customization of all user-visible content.
Support for FTP
You can provide file access via FTP in additional to CIFS (Windows-based).
Plugin applets
Version 8.0(2) adds a framework for supporting TCP-based applications without requiring a pre-installed client application. Java applets let users access these applications from the browser-enabled SSL VPN portal. Initial support is for TELNET, SSH, RDP, and VNC.
Smart tunnels
A smart tunnel is a connection between an application and a remote site, using a browser-based SSL VPN session with the security appliance as the pathway. Version 8.0(2) lets you identify the applications to which you want to grant smart tunnel access, and lets you specify the path to the application and the SHA-1 hash of its checksum to check before granting it access. Lotus SameTime and Microsoft Outlook Express are examples of applications to which you might want to grant smart tunnel access.
The remote host originating the smart tunnel connection must be running Microsoft Windows Vista, Windows XP, or Windows 2000, and the browser must be enabled with Java, Microsoft ActiveX, or both.
RSS newsfeed
Administrators can populate the clientless portal with RSS newsfeed information, which lets company news or other information display on a user screen.
Personal bookmark support
Users can define their own bookmarks. These bookmarks are stored on a file server.
Transformation enhancements
Adds support for several complex forms of web content over clientless connections, including Adobe flash and Java WebStart.
IPv6
Allows access to IPv6 resources over a public IPv4 connection.
Web folders
Lets browser-based SSL VPN users connecting from Windows operating systems browse shared file systems and perform the following operations: view folders, view folder and file properties, create, move, copy, copy from the local host to the remote host, copy from the remote host to the local host, and delete. Internet Explorer indicates when a web folder is accessible. Accessing this folder launches another window, providing a view of the shared folder, on which users can perform web folder functions, assuming the properties of the folders and documents permit them.
Microsoft Sharepoint enhancement
Extends Web Access support for Microsoft Sharepoint, integrating Microsoft Office applications available on the machine with the browser to view, change, and save documents shared on a server. Version 8.0(2) supports Windows Sharepoint Services 2.0 in Windows Server 2003.
PAC support
Lets you specify the URL of a proxy autoconfiguration file (PAC) to download to the browser. Once downloaded, the PAC file uses a JavaScript function to identify a proxy for each URL.
Proxy exclusion list
Lets you configure a list of URLs to exclude from the HTTP requests the security appliance can send to an external proxy server.
SSL VPN tunnel support
The security appliance provides NAC posture validation of endpoints that establish AnyConnect VPN client sessions.
Support for audit services
You can configure the security appliance to pass the IP address of the client to an optional audit server if the client does not respond to a posture validation request. The audit server uses the host IP address to challenge the host directly to assess its health. For example, it might challenge the host to determine whether its virus checking software is active and up-to-date. After the audit server completes its interaction with the remote host, it passes a token to the posture validation server, indicating the health of the remote host. If the token indicates the remote host is healthy, the posture validation server sends a network access policy to the security appliance for application to the traffic on the tunnel.
Modular policy framework inspect class map
Traffic can match one of multiple match commands in an inspect class map; formerly, traffic had to match all match commands in a class map to match the class map.
AIC for encrypted streams and AIC Arch changes
Provides HTTP inspection into TLS, which allows AIC/MPF inspection in WebVPN HTTP and HTTPS streams.
TLS Proxy for SCCP and SIP2
Enables inspection of encrypted traffic. Implementations include SSL encrypted VoIP signaling, namely Skinny and SIP, interacting with the Cisco CallManager.
SIP enhancements for CCM
Improves interoperability with CCM 5.0 and 6.x with respect to signaling pinholes.
IPv6 support for SIP
The SIP inspection engine supports IPv6 addresses. IPv6 addresses can be used in URLs, in the Via header field, and SDP fields.
Full RTSP PAT support
Provides TCP fragment reassembly support, a scalable parsing routine on RTSP, and security enhancements that protect RTSP traffic.
Enhanced service object group
Lets you configure a service object group that contains a mix of TCP services, UDP services, ICMP-type services, and any protocol. It removes the need for a specific ICMP-type object group and protocol object group. The enhanced service object group also specifies both source and destination services. The access list CLI now supports this behavior.
Ability to rename access list
Lets you rename an access list.
Live access list hit counts
Includes the hit count for ACEs from multiple access lists. The hit count value represents how many times traffic hits a particular access rule.
Set connection limits for management traffic to the security appliance
For a Layer 3/4 management class map, you can specify the set connection command.
Threat detection
You can enable basic threat detection and scanning threat detection to monitor attacks such as DoS attacks and scanning attacks. For scanning attacks, you can automatically shun attacking hosts. You can also enable scan threat statistics to monitor both valid and invalid traffic for hosts, ports, protocols, and access lists.
Transparent firewall NAT support
You can configure NAT for a transparent firewall.
Secure logging
You can enable secure connections to the syslog server using SSL or TLS with TCP, and encrypted system log message content. Not supported on the PIX series security appliance.
Redesigned Interface
Reorganizes information to provide greater logical consistency and ease of navigation.
Expanded onscreen help
ASDM describes features and configuration options on screen, which reduces the need to consult other information sources.
Visual policy editor
The visual policy editor lets an administrator configure access control policies and posture checking.
Firewall Dashboard
From the home page, you can now track threats to your network by monitoring traffic that exceeds rate limits, as well as allowed and dropped traffic by host, access list, port, or protocol.
Accessibility Features
Features such as keyboard navigation, alternate text for graphics, and improved screen reader support have been added.
Complex Configuration Support
You can move between panes without applying changes, allowing you to enter multi-pane configurations before applying that configuration to the device.
Device List
ASDM maintains a list of recently accessed devices, allowing you to switch between devices and contexts.
SSL VPN configuration wizard
The new SSL VPN configuration wizard provides step-by-step guidance in configuring basic SSL VPN connections.
Startup Wizard Enhancement
The Startup Wizard now allows you to configure the adaptive security appliance to pass traffic to an installed CSC SSM.
ASDM Assistant Enhancements`
An assistant for configuring Secure Voice was added.
Packet Capture Wizard
The Packet Capture Wizard assists you in obtaining and downloading sniffer trace in PCAP format.
Service Policy Rule Wizard
Updated to support IPS Virtualization.
Certificate Management Enhancements
The certificate management GUI is reorganized and simplified.
1 Clientless SSL VPN features are not supported on the PIX security appliance.
2 TLS proxy is not supported on the PIX security appliance.
ASDM Client PC Operating System and Browser Requirements
Table 2 lists the supported and recommended PC operating systems and browsers for ASDM Version 6.0(2).
Table 2 Operating System and Browser Requirements
Microsoft Windows1
Windows Vista
Windows 2003 Server
Windows XP
Windows 2000 (Service Pack 4)
Internet Explorer 6.0 or 7.0 with Sun Java SE2 Plug-in 1.4.2, 5.0 (1.5.0), or 6.0
Firefox 1.5 or 2.0 with Java SE Plug-in 1.4.2, 5.0 (1.5.0), or 6.0
SSL Encryption Settings—All available encryption options are enabled for SSL in the browser preferences.
Note
Note
Apple MacIntosh
Apple MacIntosh OS X
Firefox 1.5 or 2.0 or Safari 2.0 with Java SE Plug-in 1.4.2, 5.0 (1.5.0), or 6.0
Linux
Red Hat Desktop, Red Hat Enterprise Linux WS version 4 running GNOME or KDE
Firefox 1.5 or 2.0 with Java SE Plug-in 1.4.2, 5.0 (1.5.0), or 6.0
1 ASDM is not supported on Windows 3.1, Windows 95, Windows 98, Windows ME, or Windows NT4.
2 Obtain Sun Java from http://www.java.com/en/download/manual.jsp.
Memory Errors in Firefox
Firefox may stop responding or give an out of memory error message Linux and Windows if multiple instances of ASDM are running. You can use the following steps to increase the Java memory and work around the behavior.
This section describes how to increase the memory for Java on the following platforms:
Java Plug-In for Windows
To change the memory settings of the Java Plug-in on Windows for Java Plug-in versions 1.4.2 and 1.5, perform the following steps:
Step 1
Step 2
Step 3
a.
b.
c.
d.
Step 4
a.
b.
c.
d.
e.
Java Plug-In on Linux
To change the settings of Java Plug-in version 1.4.2 or 1.5 on Linux, perform the following steps:
Step 1
Step 2
Note
Step 3
a.
b.
c.
Step 4
a.
b.
c.
d.
Supported Platforms and Feature Licenses
This software version supports the following platforms; see the associated tables for the feature support for each model:
•
•
•
•
•
•
•
•
Note
Table 3 ASA 5505 Adaptive Security Appliance License Features
Users, concurrent1
10
Optional Licenses:
10
Optional Licenses:
50
Unlimited
50
Unlimited
Security Contexts
No support
No support
VPN Sessions2
10 combined IPSec and WebVPN
25 combined IPSec and WebVPN
Max. IPSec Sessions
10
25
Max. WebVPN Sessions
2
Optional License: 10
2
Optional License: 10
VPN Load Balancing
No support
No support
TLS Proxy for SIP and Skinny Inspection
Supported
Supported
Failover
None
Active/Standby (no stateful failover)
GTP/GPRS
No support
No support
Maximum VLANs/Zones
3 (2 regular zones and 1 restricted zone that can only communicate with 1 other zone)
20
Maximum VLAN Trunks
No support
Unlimited
Concurrent Firewall Conns3
10 K
25 K
Max. Physical Interfaces
Unlimited, assigned to VLANs/zones
Unlimited, assigned to VLANs/zones
Encryption
Base (DES)
Optional license:
Strong (3DES/AES)Base (DES)
Optional license:
Strong (3DES/AES)Minimum RAM
256 MB
256 MB
1 In routed mode, hosts on the inside (Business and Home VLANs) count towards the limit only when they communicate with the outside (Internet VLAN). Internet hosts are not counted towards the limit. Hosts that initiate traffic between Business and Home are also not counted towards the limit. The interface associated with the default route is considered to be the Internet interface. If there is no default route, hosts on all interfaces are counted toward the limit. In transparent mode, the interface with the lowest number of hosts is counted towards the host limit. See the show local-host command to view the host limits.
2 Although the maximum IPSec and WebVPN sessions add up to more than the maximum VPN sessions, the combined sessions should not exceed the VPN session limit. If you exceed the maximum VPN sessions, you can overload the security appliance, so be sure to size your network appropriately.
3 The concurrent firewall connections are based on a traffic mix of 80% TCP and 20% UDP, with one host and one dynamic translation for every four connections.
Table 4 ASA 5510 Adaptive Security Appliance License Features
Users, concurrent
Unlimited
Unlimited
Security Contexts
No support
2
Optional Licenses:
5
VPN Sessions1
250 combined IPSec and WebVPN
250 combined IPSec and WebVPN
Max. IPSec Sessions
250
250
Max. WebVPN Sessions
2
Optional Licenses:
2
Optional Licenses:
10
25
50
100
250
10
25
50
100
250
VPN Load Balancing
No support
No support
TLS Proxy for SIP and Skinny Inspection
Supported
Supported
Failover
None
Active/Standby or Active/Active
GTP/GPRS
No support
No support
Max. VLANs
50
100
Concurrent Firewall Conns2
50 K
130 K
Max. Physical Interfaces
Unlimited
Unlimited
Encryption
Base (DES)
Optional license:
Strong (3DES/AES)Base (DES)
Optional license:
Strong (3DES/AES)Min. RAM
256 MB
256 MB
1 Although the maximum IPSec and WebVPN sessions add up to more than the maximum VPN sessions, the combined sessions should not exceed the VPN session limit. If you exceed the maximum VPN sessions, you can overload the security appliance, so be sure to size your network appropriately.
2 The concurrent firewall connections are based on a traffic mix of 80% TCP and 20% UDP, with 1 host and 1 dynamic translation for every 4 connections.
Table 5 ASA 5520 Adaptive Security Appliance License Features
Users, concurrent
Unlimited
Unlimited
Security Contexts
2
Optional Licenses:
5
10
20
VPN Sessions1
750 combined IPSec and WebVPN
Max. IPSec Sessions
750
Max. WebVPN Sessions
2
Optional Licenses:
10
25
50
100
250
500
750
VPN Load Balancing
Supported
TLS Proxy for SIP and Skinny Inspection
Supported
Failover
Active/Standby or Active/Active
GTP/GPRS
None
Optional license: Enabled
Max. VLANs
150
Concurrent Firewall Conns2
280 K
Max. Physical Interfaces
Unlimited
Encryption
Base (DES)
Optional license: Strong (3DES/AES)
Min. RAM
512 MB
1 Although the maximum IPSec and WebVPN sessions add up to more than the maximum VPN sessions, the combined sessions should not exceed the VPN session limit. If you exceed the maximum VPN sessions, you can overload the security appliance, so be sure to size your network appropriately.
2 The concurrent firewall connections are based on a traffic mix of 80% TCP and 20% UDP, with 1 host and 1 dynamic translation for every 4 connections.
Table 6 ASA 5540 Adaptive Security Appliance License Features
Users, concurrent
Unlimited
Unlimited
Security Contexts
2
Optional licenses:
5
10
20
50
VPN Sessions1
5000 combined IPSec and WebVPN
Max. IPSec Sessions
5000
Max. WebVPN Sessions
2
Optional Licenses:
10
25
50
100
250
500
750
1000
2500
VPN Load Balancing
Supported
TLS Proxy for SIP and Skinny Inspection
Supported
Failover
Active/Standby or Active/Active
GTP/GPRS
None
Optional license: Enabled
Max. VLANs
200
Concurrent Firewall Conns2
400 K
Max. Physical Interfaces
Unlimited
Encryption
Base (DES)
Optional license: Strong (3DES/AES)
Min. RAM
1 GB
1 Although the maximum IPSec and WebVPN sessions add up to more than the maximum VPN sessions, the combined sessions should not exceed the VPN session limit. If you exceed the maximum VPN sessions, you can overload the security appliance, so be sure to size your network appropriately.
2 The concurrent firewall connections are based on a traffic mix of 80% TCP and 20% UDP, with 1 host and 1 dynamic translation for every 4 connections.
Table 7 ASA 5550 Adaptive Security Appliance License Features
Users, concurrent
Unlimited
Security Contexts
2
Optional licenses:
5
10
20
50
VPN Sessions1
5000 combined IPSec and WebVPN
Max. IPSec Sessions
5000
Max. WebVPN Sessions
2
Optional Licenses:
10
25
50
100
250
500
750
1000
2500
5000
VPN Load Balancing
Supported
TLS Proxy for SIP and Skinny Inspection
Supported
Failover
Active/Standby or Active/Active
GTP/GPRS
None
Optional license: Enabled
Max. VLANs
250
Concurrent Firewall Conns2
650 K
Max. Physical Interfaces
Unlimited
Encryption
Base (DES)
Optional license: Strong (3DES/AES)
Min. RAM
4 GB
1 Although the maximum IPSec and WebVPN sessions add up to more than the maximum VPN sessions, the combined sessions should not exceed the VPN session limit. If you exceed the maximum VPN sessions, you can overload the security appliance, so be sure to size your network appropriately.
2 The concurrent firewall connections are based on a traffic mix of 80% TCP and 20% UDP, with 1 host and 1 dynamic translation for every 4 connections.
Table 8 PIX 515/515E Security Appliance License Features
Users, concurrent
Unlimited
Unlimited
Unlimited
Unlimited
Security Contexts
No support
2
Optional license: 5
2
Optional license: 5
2
Optional license: 5
IPSec Sessions
2000
2000
2000
2000
WebVPN Sessions
No support
No support
No support
No support
VPN Load Balancing
No support
No support
No support
No support
TLS Proxy for SIP and Skinny Inspection
No support
No support
No support
No support
Failover
No support
Active/Standby
Active/ActiveActive/Standby
Active/Standby
Active/ActiveGTP/GPRS
None
Optional license:
EnabledNone
Optional license:
EnabledNone
Optional license:
EnabledNone
Optional license:
EnabledMax. VLANs
10
25
25
25
Concurrent Firewall Conns2
48 K
130 K
130 K
130 K
Max. Physical Interfaces
3
6
6
6
Encryption
None
Optional licenses:
None
Optional licenses:
None
Optional licenses:
None
Optional licenses:
Base (DES)
Strong (3DES/
AES)Base (DES)
Strong (3DES/
AES)Base (DES)
Strong (3DES/
AES)Base (DES)
Strong (3DES/
AES)Min. RAM
64 MB
128 MB
128 MB
128 MB
1 This license can only be used in a failover pair with another unit with a UR license. Both units must be the same model.
2 The concurrent firewall connections are based on a traffic mix of 80% TCP and 20% UDP, with 1 host and 1 dynamic translation for every 4 connections.
Table 9 PIX 525 Security Appliance License Features
Users, concurrent
Unlimited
Unlimited
Unlimited
Unlimited
Security Contexts
No support
2
Optional licenses:
2
Optional licenses:
2
Optional licenses:
5
10
20
50
5
10
20
50
5
10
20
50
IPSec Sessions
2000
2000
2000
2000
WebVPN Sessions
No support
No support
No support
No support
VPN Load Balancing
No support
No support
No support
No support
TLS Proxy for SIP and Skinny Inspection
No support
No support
No support
No support
Failover
No support
Active/Standby
Active/ActiveActive/Standby
Active/Standby
Active/ActiveGTP/GPRS
None
Optional license:
EnabledNone
Optional license:
EnabledNone
Optional license:
EnabledNone
Optional license:
EnabledMax. VLANs
25
100
100
100
Concurrent Firewall Conns2
140 K
280 K
280 K
280 K
Max. Physical Interfaces
6
10
10
10
Encryption
None
Optional licenses:
None
Optional licenses:
None
Optional licenses:
None
Optional licenses:
Base (DES)
Strong (3DES/
AES)Base (DES)
Strong (3DES/
AES)Base (DES)
Strong (3DES/
AES)Base (DES)
Strong (3DES/
AES)Min. RAM
128 MB
256 MB
256 MB
256 MB
1 This license can only be used in a failover pair with another unit with a UR license. Both units must be the same model.
2 The concurrent firewall connections are based on a traffic mix of 80% TCP and 20% UDP, with 1 host and 1 dynamic translation for every 4 connections.
Table 10 PIX 535 Security Appliance License Features
Users, concurrent
Unlimited
Unlimited
Unlimited
Unlimited
Security Contexts
No support
2
Optional licenses:
2
Optional licenses:
2
Optional licenses:
5
10
20
50
5
10
20
50
5
10
20
50
IPSec Sessions
2000
2000
2000
2000
WebVPN Sessions
No support
No support
No support
No support
VPN Load Balancing
No support
No support
No support
No support
TLS Proxy for SIP and Skinny Inspection
No support
No support
No support
No support
Failover
No support
Active/Standby
Active/ActiveActive/Standby
Active/Standby
Active/ActiveGTP/GPRS
None
Optional license:
EnabledNone
Optional license:
EnabledNone
Optional license:
EnabledNone
Optional license:
EnabledMax. VLANs
50
150
150
150
Concurrent Firewall Conns2
250 K
500 K
500 K
500 K
Max. Physical Interfaces
8
14
14
14
Encryption
None
Optional licenses:
None
Optional licenses:
None
Optional licenses:
None
Optional licenses:
Base (DES)
Strong (3DES/
AES)Base (DES)
Strong (3DES/
AES)Base (DES)
Strong (3DES/
AES)Base (DES)
Strong (3DES/
AES)Min. RAM
512 MB
1024 MB
1024 MB
1024 MB
1 This license can only be used in a failover pair with another unit with a UR license. Both units must be the same model.
2 The concurrent firewall connections are based on a traffic mix of 80% TCP and 20% UDP, with 1 host and 1 dynamic translation for every 4 connections.
ASDM and SSM Compatibility
ASDM Version 6.0(2) supports the following SSMs and releases:
•
•
•
Upgrading ASDM
This section describes how to upgrade ASDM to a new ASDM release. If you have a Cisco.com login, you can obtain ASDM from the following website:
http://www.cisco.com/cisco/software/navigator.html
Note
If you have a previous release of ASDM on your security appliance and want to upgrade to the latest release, you can do so from within ASDM. We recommend that you upgrade the ASDM image before the platform image. ASDM is backwards compatible, so you can upgrade the platform image using the new ASDM; you cannot use an old ASDM with a new platform image.
To upgrade ASDM, perform the following steps:
Step 1
Step 2
Step 3
a.
b.
Step 4
Step 5
If your security appliance does not have enough memory to hold two ASDM images, overwrite the old image with the new one by specifying the same destination filename. You can rename the image after it was uploaded using the Tools > File Management tool.
If you have enough memory for both versions, you can specify a different name for the new version. If you need to revert to the old version, it is still in your Flash memory.
Step 6
When ASDM is finished uploading, the following message appears:
"ASDM Image is Uploaded to Flash Successfully."
Step 7
Step 8
Step 9
To reload the new image, reload the security appliance using the Tools > System Reload tool.
Getting Started with ASDM
This section describes how to connect to ASDM and start your configuration. If you are using the security appliance for the first time, your security appliance might include a default configuration. You can connect to a default IP address with ASDM so that you can immediately start to configure the security appliance from ASDM. If your platform does not support a default configuration, you can log in to the CLI and run the setup command to establish connectivity. See Before You Begin for more detailed information about networking.
This section includes the following topics:
•
•
•
Before You Begin
If your security appliance includes a factory default configuration, you can connect to the default management address of 192.168.1.1 with ASDM. On the ASA 5500 series adaptive security appliance, the interface to which you connect with ASDM is Management 0/0. For the PIX 500 series security appliance, the interface to which you connect with ASDM is Ethernet 1. To restore the default configuration, enter the configure factory-default command at the security appliance CLI.
Make sure the PC is on the same network as the security appliance. You can use DHCP on the client to obtain an IP address from the security appliance, or you can set the IP address to a 192.168.1.0/24 network address.
If your platform does not support the factory default configuration, or you want to add to an existing configuration to make it accessible for ASDM, access the security appliance CLI according to the Cisco Security Appliance Command Line Configuration Guide, and enter the setup command. The setup command prompts you for a minimal configuration to connect to the security appliance using ASDM.
Note
Downloading the ASDM Launcher
The ASDM Launcher is for Windows only. The ASDM Launcher is an improvement over running ASDM in a Java Applet. The ASDM Launcher avoids double authentication and certificate dialog boxes, launches faster, and caches previously-entered IP addresses and usernames.
To download the ASDM Launcher, perform the following steps:
Step 1
https://interface_ip_addressIn transparent firewall mode, enter the management IP address.
Note
Step 2
A page displays with the following buttons:
•
•
Step 3
The installer downloads to your PC.
Step 4
Starting ASDM from the ASDM Launcher
The ASDM Launcher is for Windows only.
To start ASDM from the ASDM Launcher, perform the following steps:
Step 1
Step 2
If there is a new version of ASDM on the security appliance, the ASDM Launcher automatically downloads it before starting ASDM.
Using ASDM in Demo Mode
ASDM Demo Mode is available as a separately installed application running under Windows. It makes use of the ASDM Launcher and pre-packaged configuration files to let you run ASDM without having a live device available. ASDM Demo Mode lets you:
•
•
•
ASDM Demo Mode provides simulated monitoring data, including real-time system log messages. The data shown is randomly generated, but the experience is identical to what you would see when connecting to a real device.
ASDM Demo Mode has the following limitations:
•
•
•
•
•
–
Save Running Configuration to Flash
Save Running Configuration to TFTP Server
Save Running Configuration to Standby Unit
Save Internal Log Buffer to Flash
Clear Internal Log Buffer
–
Command Line Interface
Ping
File Management
Update Image
File Transfer
Upload image from Local PC
System Reload
–
–
–
•
–
–
–
–
To run ASDM in Demo Mode, perform the following steps:
Step 1
a.
http://www.cisco.com/cisco/software/navigator.html
The filename is asdm-demo-version.msi.
b.
Step 2
Step 3
Step 4
Step 5
a.
The filename is asdm-version.bin.
b.
A file browser appears. Find the ASDM image file in the browser.
Step 6
You see a Demo Mode label in the title bar of the window.
Starting ASDM from a Web Browser
To start ASDM from a web browser, perform the following steps:
Step 1
https://interface_ip_addressIn transparent firewall mode, enter the management IP address.
Note
Step 2
A page displays with the following buttons:
•
•
Step 3
Step 4
Using the Startup Wizard
The Startup Wizard helps you easily configure a single mode security appliance or a context in multiple context mode.
To use the Startup Wizard to configure the basic setup of the security appliance, perform the following steps:
Step 1
•
•
a.
b.
c.
d.
e.
Step 2
Step 3
Step 4
Using the VPN Wizard
The VPN Wizard configures basic VPN access for LAN-to-LAN or remote client access. The VPN Wizard is available only for security appliances running in single context mode and routed (not transparent) firewall mode.
To use the VPN Wizard to configure VPN, perform the following steps:
Step 1
Step 2
Step 3
Printing from ASDM
Note
ASDM supports printing for the following features:
•
•
•
•
•
ASDM Limitations
This section describes ASDM limitations, and includes the following topics:
•
•
Unsupported Commands
ASDM does not support the complete command set of the CLI. In most cases, ASDM ignores unsupported commands, and they can remain in your configuration.
One-Time Password Not Supported
ASDM does not support the one-time password (OTP) authentication mechanism.
Effects of Unsupported Commands
•
•
•
Monitor-only mode allows access to the following functions:
–
–
To exit Monitor-only mode, use the CLI tool or access the security appliance console, and remove the alias command. You can use outside NAT instead of the alias command. See the Cisco Security Appliance Command Reference for more information.
Note
Ignored and View-Only Commands
The following table lists commands that ASDM supports in the configuration when you add them through the CLI, but that you cannot add or edit in ASDM. If ASDM ignores the command, it does not appear in the ASDM GUI at all. If the command is view-only, then it appears in the GUI, but you cannot edit it.
Other CLI Limitations
•
ip address inside 192.168.2.1 255.255.0.255Interactive User Commands Not Supported in ASDM CLI Tool
The ASDM CLI tool does not support interactive user commands. If you enter a CLI command that requires interactive confirmation, ASDM prompts you to enter "[yes/no]" but does not recognize your input. ASDM then times out waiting for your response.
For example:
1.
2.
ASDM generates the default 1024-bit RSA key.
3.
Instead of regenerating the RSA keys by overwriting the previous one, ASDM displays the following error:
Do you really want to replace them? [yes/no]:WARNING: You already have RSA ke0000000000000$A keyInput line must be less than 16 characters in length.%Please answer 'yes' or 'no'.Do you really want to replace them [yes/no]:%ERROR: Timed out waiting for a response.ERROR: Failed to create new RSA keys names <Default-RSA-key>Workaround:
•
•
crypto key generate rsa noconfirmUnsupported Characters
ASDM does not support any non-English characters or any other special characters. If you enter non-English characters in any text entry field, they become unrecognizable when you submit the entry, and you cannot delete or edit them.
If you are using a non-English keyboard or usually type in a language other than English, be careful not to enter non-English characters accidentally.
Workaround:
For workarounds, see CSCeh39437 under Caveats.
Caveats
The following sections describes the open caveats for Version 6.0(2).
Note
http://tools.cisco.com/Support/BugToolKit/l
To become a registered cisco.com user, go to the following website:
http://tools.cisco.com/RPF/register/register.do
Open Caveats - Version 6.0(2)
The following list shows caveats that are resolved for Version 6.0(2):
End-User License Agreement
For information on the end-user license agreement, go to:
https://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html
Related Documentation
For additional information on ASDM or its platforms, see the ASDM online Help or the following documentation found on Cisco.com:
•
•
•
•
•
•
•
•
•
•
•
Obtaining Documentation and Submitting a Service Request
For information on obtaining documentation, submitting a service request, and gathering additional information, see the monthly What's New in Cisco Product Documentation, which also lists all new and revised Cisco technical documentation, at:
http://www.cisco.com/en/US/docs/general/whatsnew/whatsnew.html
Subscribe to the What's New in Cisco Product Documentation as a Really Simple Syndication (RSS) feed and set content to be delivered directly to your desktop using a reader application. The RSS feeds are a free service and Cisco currently supports RSS version 2.0.
This document is to be used in conjunction with the documents listed in the "Related Documentation" section.
CCVP, the Cisco logo, and the Cisco Square Bridge logo are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn is a service mark of Cisco Systems, Inc.; and Access Registrar, Aironet, BPX, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Enterprise/Solver, EtherChannel, EtherFast, EtherSwitch, Fast Step, Follow Me Browsing, FormShare, GigaDrive, HomeLink, Internet Quotient, IOS, iPhone, IP/TV, iQ Expertise, the iQ logo, iQ Net Readiness Scorecard, iQuick Study, LightStream, Linksys, MeetingPlace, MGX, Networking Academy, Network Registrar, Packet, PIX, ProConnect, ScriptShare, SMARTnet, StackWise, The Fastest Way to Increase Your Internet Quotient, and TransPath are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.
All other trademarks mentioned in this document or Website are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0705R)
© 2007 Cisco Systems, Inc.
All rights reserved.
