Release Notes

ManualsBrandsCisco Manualssecurity management softwareCisco Security Manager 4.0

Americas Headquarters:

Cisco Systems, Inc., 170 West Tasman Drive, San Jose, CA 95134-1706 USA

Release Notes for Cisco Security Manager 4.0

Published: June 17, 2010

Revised: October 6, 2010

These release notes are for use with the Cisco Security Manager (Security Manager), Release 4.0.

Release 4.0 is now available. Registered SMARTnet users can obtain release 4.0 from the Cisco support

website by going to http://www.cisco.com/go/csmanager and clicking Download Software in the

Support box.

This chapter contains the following topics:

• Introduction, page 1

• Supported Component Versions and Related Software, page 2

• What’s New, page 3

• Installation Notes, page 5

• Service Pack 1 Download and Installation Instructions, page 6

• Important Notes, page 7

• Caveats, page 8

• Where to Go Next, page 21

• Product Documentation, page 21

• Obtaining Documentation, Obtaining Support, and Security Guidelines, page 22

Introduction

Note Use this document in conjunction with the documents identified in Product Documentation, page 21.

The online versions of the user documentation are also occasionally updated after the initial release. As

a result, the information contained in the Cisco Security Manager end-user guides on Cisco.com

supersedes any information contained in the context-sensitive help included with the product. For more

information about specific changes, please see Where to Go Next, page 21.

Summary of content (22 pages)

PAGE 1
Release Notes for Cisco Security Manager 4.0 Published: June 17, 2010 Revised: October 6, 2010 These release notes are for use with the Cisco Security Manager (Security Manager), Release 4.0. Release 4.0 is now available. Registered SMARTnet users can obtain release 4.0 from the Cisco support website by going to http://www.cisco.com/go/csmanager and clicking Download Software in the Support box.
PAGE 2
Supported Component Versions and Related Software This document contains release note information for the following: • Cisco Security Manager 4.0 (Including Service Pack 1)—Cisco Security Manager (Security Manager) enables you to manage security policies on Cisco security devices.
PAGE 3
What’s New Table 1 Supported Versions for Components and Related Applications Application Support Releases Component Applications Cisco Security Manager 4.0 Auto Update Server 4.0 Performance Monitor 4.0 CiscoWorks Common Services 3.3 Resource Manager Essentials (RME) 4.3 Cisco Security Agent 5.2 Related Applications Cisco Security Monitoring, Analysis and Response System (CS-MARS) 6.0.5, 6.0.6 Cisco Secure Access Control Server (ACS) for Windows Note 4.1(3, 4), 4.
PAGE 4
What’s New – Object group search—Available as a firewall access control setting, object group search optimizes ACL performance without expanding object groups. However, you should use this only on memory constrained devices. You also cannot use the hit count tool if you configure object group search. • The release of ASA version 8.3 provides a simplified approach to configuring network address translation (NAT), as compared to earlier ASA versions and other devices.
PAGE 5
Installation Notes • Packet tracer allows you to troubleshoot active policies running on ASA and PIX firewall devices running 7.2.1 and higher that are not operating in transparent mode. • ASA 8.3 devices use the original, or real, IP address when evaluating traffic in firewall rules (such as access rules) rather than NAT-translated addresses. Ensure that you use the original address when configuring firewall rules for ASA 8.3 devices.
PAGE 6
Service Pack 1 Download and Installation Instructions We do not support installation of Security Manager on a server that is running any other web server or database server (for example, IIS or MS-SQL). Doing so might cause unexpected problems that may prevent you from logging into or using Cisco Security Manager. Before you can successfully upgrade to Security Manager 4.
PAGE 7
Important Notes Step 3 Click Security Manager (CSM) Software, expand the 4.0 folder under All Releases, and then click 4.0sp1. Step 4 Download the file fcs-csm-40-sp1-win-k9.exe. Step 5 To install the service pack, close all open applications, including the Cisco Security Manager Client. Step 6 Manually stop the Cisco Security Agent service from Start > Settings > Control Panel > Administrative Tools > Services. Step 7 Run the fcs-csm-40-sp1-win-k9.exe file that you previously downloaded.
PAGE 8
Caveats Manager so that the next deployment will correctly provision these commands. You can also rediscover the platform settings from the device; however, you will need to take necessary steps to save and restore any shared Security Manager policies that are assigned to the device. • A Cisco Services for IPS service license is required for the installation of signature updates on IPS 5.x+ appliances, Catalyst and ASA service modules, and router network modules.
PAGE 9
Caveats Open Caveats—Release 4.0 This section contains information about the problems known to exist in Cisco Security Manager 4.0.
PAGE 10
Caveats Table 3 CSM Client and Server Install Caveats (Continued) Reference Number Description CSCtf01120 CSM: Upgrade from 3.3.0 to 3.3.1 Does Not Update All Files CSCtf78013 CSM 3.3.1 client cannot launch due to MICE.
PAGE 11
Caveats Table 6 Cisco IPS and IOS IPS Devices Caveats (Continued) Reference Number Description CSCsh36604 IPS EAO: After editing a row, the ed. row is displayed as the last row CSCsh52484 IPS Licensing Date varies between sensor CLI and sensor CSCsh53265 On IPS Update page, checkbox for shared sig. policy can be incorrect CSCsh67506 Dynamic IP address IOS router imported by CNS cannot be discovered CSCsh77105 During deployment, signatures removed from current.
PAGE 12
Caveats Table 6 Cisco IPS and IOS IPS Devices Caveats (Continued) Reference Number Description CSCta93482 Deployment fails- shared sig policy with new custom sig to older version CSCtb16577 on applying sig pkg to the device, New sig(s) is not listed on sig page CSCtb40828 Signature deploy failed with “category ios_ips default” command CSCtb55176 Sensor update fails on applying sensor pkg manually with OOB change CSCtc57010 No validation for incorrect speed/duplex setting for 10G Interface CSC
PAGE 13
Caveats Table 7 Device Management, Discovery, and Deployment Caveats (Continued) Reference Number Description CSCth16062 shared credential policy does not modify the CSM used credentials Table 8 Event Viewer Caveats Reference Number Description CSCtd27974 Floating view minimized by default. CSCtd33930 Real-time event row selection not retaining CSCtd49651 Select all in custom filter with filter criteria not correct.
PAGE 14
Caveats Table 9 Firewall Services Caveats Reference Number Description CSCsc22934 ACL limitations for Layer 2 interfaces on IOS ISR devices CSCsh68101 Activity Report: Issues with access rules table change report CSCsh94210 Problems matching interface name when reusing AAA policy objects CSCsi18871 Inspect Map: PIX 7.1 gtp-map subcommand order is not preserved CSCsk33350 Discovery of PAM Mappings with Inspection Rules is incorrect CSCsk46057 Changes to csm.
PAGE 15
Caveats Table 9 Firewall Services Caveats (Continued) Reference Number Description CSCtg67869 DNS cli not generated for 2nd row onwards and double negation cli CSCtg73323 Add Singleton network object (host/network) takes more time than groups CSCtg84393 Fail to Removing un-reference object-groups leads to deployment fails CSCtg87338 CSM 3.3.1 SP1 wrong deployment of ACLs to ISR running 12.4(24)T code CSCtg89541 Discovery of asr-group in ASA 8.3.
PAGE 16
Caveats Table 11 VPN Device and Configuration Support Caveats (Continued) Reference Number Description CSCsh14709 Deployment fails on ASA 5505/PIX 6.3 Easy VPN remote client CSCsh79282 Cat6k-SPA GRE+Multicast - unsupported CSCso63006 IPSEC VPN import failed when crypto ACL contains intf in source/dest CSCsq66815 Side-effects due to missing Protected Network’s assignment usage info.
PAGE 17
Caveats Resolved Caveats—Release 4.0 The following customer found or previously release noted caveats have been resolved in this release. Reference Number Description CSCsi11419 Rollback sometimes fails with LAN Failover enabled CSCsm93970 Green field device Preview config does not show IPS pull down option CSCsq87565 certificate-to-connection-profile map policy does not support map name CSCsr46030 Copy Interface & VS policy from a 6.1(1)E2 to 6.
PAGE 18
Caveats Reference Number Description CSCtb81245 No Entry in Config Archive when deploy includes User Accounts Policy CSCtb81691 Deploy/discovery of IPS Appliances fail with “cannot identify user” error CSCtb97623 FWSM contexts not shown correctly in MCP CSCtb97789 View tab in “managing devices” in MCP not working CSCtc01735 IpsSensorUpdate policy locks device; device cannot be deleted CSCtc17882 Activity Validation causes MOP error on interface CSCtc29327 In 3.
PAGE 19
Caveats Reference Number Description CSCtd34189 CSM3.3.1: VACLPlugin throws exception/failure during config deployment CSCtd35839 CSM - IPS 7.x editHasNoEffect received after config change CSCtd43885 CSM not taking into account device override for PIX 6.
PAGE 20
Caveats Reference Number Description CSCtf30527 CSM: Import Script Case Sensitivity is Inconsistent CSCtf36203 Cannot import a PIX running 6.3 into MCP. CSCtf70104 SSL VPN Customization file size grow with every deployment in CSM CSCtf75961 DOC: CSM serial deployment knob for FWSM contexts needs documenting CSCtf94768 IPS license act validation takes a long time if sensor unreachable CSCtg02063 CSM 3.3.
PAGE 21
Where to Go Next Where to Go Next If you want to: Do this: Install Security Manager server or client software. See Installation Guide for Cisco Security Manager 4.0. Understand the basics. See the interactive JumpStart guide that opens automatically when you start Security Manager. Get up and running with the product quickly. See “Getting Started with Security Manager” in the online help, or see Chapter 1 of User Guide for Cisco Security Manager 4.0. Complete the product configuration.
PAGE 22
Obtaining Documentation, Obtaining Support, and Security Guidelines Obtaining Documentation, Obtaining Support, and Security Guidelines For information on obtaining documentation, obtaining support, providing documentation feedback, security guidelines, and also recommended aliases and general Cisco documents, see the monthly What’s New in Cisco Product Documentation, which also lists all new and revised Cisco technical documentation, at: Subscribe to the What’s New in Cisco Product Documentation as a Real