Cisco announces the availability of ASA 9.10(1):
New features in this release:
|
Feature
|
Description
|
|
Platform Features
|
|
ASAv VHD custom images for Azure
|
You can now create your own custom ASAv images on Azure using a compressed VHD image available from Cisco. To deploy using a VHD image, you upload the VHD image to your Azure storage account. Then, you can create a managed image using the uploaded disk image and an Azure Resource Manager template. Azure templates are JSON files that contain resource descriptions and parameter definitions.
|
|
ISA 3000 support for FirePOWER module Version 6.3
|
The previous supported version was FirePOWER 5.4.
|
|
Firewall Features
|
|
Feature
|
Description
|
|
Cisco Umbrella support
|
You can configure the device to redirect DNS requests to Cisco Umbrella, so that your Enterprise Security policy defined in Cisco Umbrella can be applied to user connections. You can allow or block connections based on FQDN, or for suspicious FQDNs, you can redirect the user to the Cisco Umbrella intelligent proxy, which can perform URL filtering. The Umbrella configuration is part of the DNS inspection policy.
New/Modified commands: umbrella, umbrella-global, token, public-key, timeout edns, dnscrypt, show service-policy inspect dns detail
|
|
GTP inspection enhancements for MSISDN and Selection Mode filtering, anti-replay, and user spoofing protection
|
You can now configure GTP inspection to drop Create PDP Context messages based on Mobile Station International Subscriber Directory Number (MSISDN) or Selection Mode. You can also implement anti-replay and user spoofing protection.
New/Modified commands: anti-replay, gtp-u-header-check, match msisdn, match selection-mode
|
|
Default idle timeout for TCP state bypass
|
The default idle timeout for TCP state bypass connections is now 2 minutes instead of 1 hour.
|
|
Support for removing the logout button from the cut-through proxy login page
|
If you configure the cut-through proxy to obtain user identity information (the AAA authentication listener), you can now remove the logout button from the page. This is useful in case where users connect from behind a NAT device and cannot be distinguished by IP address. When one user logs out, it logs out all users of the IP address.
New/Modified commands: aaa authentication listener no-logout-button
Also in 9.8(3).
|
|
Trustsec SXP connection configurable delete hold down timer
|
The default SXP connection hold down timer is 120 seconds. You can now configure this timer, between 120 to 64000 seconds.
New/Modified commands: cts sxp delete-hold-down period, show cts sxp connection brief,
show cts sxp connections
Also in 9.8(3).
|
|
Support for offloading NAT'ed flows in transparent mode.
|
If you are using flow offload (the flow-offload enable and set connection advanced-options flow-offload commands), offloaded flows can now include flows that require NAT in transparent mode.
|
|
Support for transparent mode deployment for a Firepower 4100/9300 ASA logical device
|
You can now specify transparent or routed mode when you deploy the ASA on a Firepower 4100/9300.
New/Modified FXOS commands: enter bootstrap-key FIREWALL_MODE, set value routed, set value transparent
|
|
VPN Features
|
|
Feature
|
Description
|
|
Support for legacy SAML authentication
|
If you deploy an ASA with the fix for CSCvg65072, then the default SAML behavior is to use the embedded browser, which is not supported on AnyConnect 4.4 or 4.5. Therefore, to continue to use AnyConnect 4.4 or 4.5, you must enable the legacy external browser SAML authentication method. Because of security limitations, use this option only as part of a temporary plan to migrate to AnyConnect 4.6 (or later). This option will be deprecated in the near future.
New/Modified commands: saml external-browser
Also in 9.8(3).
|
|
DTLS 1.2 support for AnyConnect VPN remote access connections.
|
DTLS 1.2, as defined in RFC- 6347, is now supported for AnyConnect remote access in addition to the currently supported DTLS 1.0 (1.1 version number is not used for DTLS.) This applies to all ASA models except the 5506; and applies when the ASA is acting as a server only, not a client. DTLS 1.2 supports additional ciphers, as well as all current TLS/DTLS cyphers, and a larger cookie size.
New/Modified commands: show run ssl, show vpn-sessiondb detail anyconnectssl cipher,
ssl server-version
|
|
High Availability and Scalability Features
|
|
Cluster control link customizable IP Address for the Firepower 4100/9300
|
By default, the cluster control link uses the 127.2.0.0/16 network. You can now set the network when you deploy the cluster in FXOS. The chassis auto-generates the cluster control link interface IP address for each unit based on the chassis ID and slot ID: 127.2.chassis_id.slot_id. However, some networking deployments do not allow 127.2.0.0/16 traffic to pass. Therefore, you can now set a custom /16 subnet for the cluster control link in FXOS except for loopback (127.0.0.0/8) and multicast (224.0.0.0/4) addresses.
New/Modified FXOS commands: set cluster-control-link network
|
|
Parallel joining of cluster units per Firepower 9300 chassis
|
For the Firepower 9300, this feature ensures that the security modules in a chassis join the cluster simultaneously, so that traffic is evenly distributed between the modules. If a module joins very much in advance of other modules, it can receive more traffic than desired, because the other modules cannot yet share the load.
New/Modified commands: unit parallel-join
|
|
Cluster interface debounce time now applies to interfaces changing from a down state to an up state
|
When an interface status update occurs, the ASA waits the number of milliseconds specified in the health-check monitor-interface debounce-time command or the ASDM Configuration > Device Management > High Availability and Scalability > ASA Cluster screen before marking the interface as failed and the unit is removed from the cluster. This feature now applies to interfaces changing from a down state to an up state. For example, in the case of an EtherChannel that transitions from a down state to an up state (for example, the switch reloaded, or the switch enabled an EtherChannel), a longer debounce time can prevent the interface from appearing to be failed on a cluster unit just because another cluster unit was faster at bundling the ports.
We did not modify any commands.
|
|
Active/Backup High Availability for ASAv on Microsoft Azure Government Cloud
|
The stateless Active/Backup solution that allows for a failure of the active ASAv to trigger an automatic failover of the system to the backup ASAv in the Microsoft Azure public cloud is now available in the Azure Government Cloud.
New or modified command: failover cloud Monitoring > Properties > Failover > Status Monitoring > Properties > Failover > History
|
|
Interface Features
|
|
show interface ip brief and show ipv6 interface output enhancement to show the supervisor association for the Firepower 2100/4100/9300
|
For the Firepower 2100/4100/9300, the output of the command is enhanced to indicate the supervisor association status of the interfaces.
New/Modified commands: show interface ip brief, show ipv6 interface
|
|
The set lacp-mode command was changed to set port-channel-mode on the Firepower 2100
|
The set lacp-mode command was changed to set port-channel-mode to match the command usage in the Firepower 4100/9300.
New/Modified FXOS commands: set port-channel-mode
|
|
Administrative and Troubleshooting Features
|
|
Support for NTP Authentication on the Firepower 2100
|
You can now configure SHA1 NTP server authentication in FXOS.
New/Modified FXOS commands: enable ntp-authentication, set ntp-sha1-key-id, set ntp-sha1-key-string
New/Modified Firepower Chassis Manager screens:
Platform Settings > NTP
New/Modified options: NTP Server Authentication: Enable check box, Authentication Key field, Authentication Value field
|
|
Packet capture support for matching IPv6 traffic without using an ACL
|
If you use the match keyword for the capture command, the any keyword only matches IPv4 traffic. You can now specify any4 and any6 keywords to capture either IPv4 or IPv6 traffic. The any keyword continues to match only IPv4 traffic.
New/Modified commands: capture match
|
|
Support for public key authentication for SSH to FXOS on the Firepower 2100
|
You can set the SSH key so you can use public key authentication instead of/as well as password authentication.
New/Modified FXOS commands: set sshkey
|
|
Support for GRE and IPinIP encapsulation
|
When you do a packet capture on interface inside, the output of the command is enhanced to display the GRE and IPinIP encapsulation on ICMP, UDP, TCP, and others.
New/Modified commands: show capture
|
|
Support to enable memory threshold that restricts application cache allocations
|
You can restrict application cache allocations on reaching certain memory threshold so that there is a reservation of memory to maintain stability and manageability of the device.
New/Modified commands: memory threshold enable, show run memory threshold,clear conf memory threshold
|
|
Support for RFC 5424 logging timestamp
|
You can enable the logging timestamp as per RFC 5424 format. New/Modified command: logging timestamp
|
|
Support to display memory usage of TCB-IPS
|
Shows application level memory cache for TCB-IPS New/Modified command: show memory app-cache
|
Related Documents:
