This document discuss about the new release for ASA v9.0.1 and ASDM v7.0.1 release.
Important points to remember
Important points to consider before an upgrade to 9.0:
ASA and ASDM Compatibility
ASA 5510, 5520, 5540
ASA 5512-X, 5515-X, 5525-X, 5545-X, 5555-X
Limitations and Restrictions
•Clientless SSL VPN with a self-signed certificate on the ASA—When the ASA uses a self-signed certificate or an un-trusted certificate, Firefox 4 and later and Safari are unable to add security exceptions when browsing using an IPv6 address HTTPS URL (FQDN URL is OK): the "Confirm Security Exception" button is disabled. See: https://bugzilla.mozilla.org/show_bug.cgi?id=633001. This caveat affects all SSL connections originating from Firefox or Safari to the ASA (including clientless SSL VPN connections, and ASDM connections). To avoid this caveat, configure a proper certificate for the ASA that is issued by a trusted certificate authority. For Internet Explorer 9 and later, use compatibility mode.
•Citrix Mobile Receiver and accessing Virtual Desktop Infrastructure (VDI):
–CSD is not supported.
–HTTP redirect is not supported.
–Using Citrix Receiver mobile clients to access web interface of Citrix servers is not supported.
–Certificate or smart card authentication is not supported as a means of auto sign-on.
–You must install XML service and configure on XenApp and XenDesktop servers.
–Make sure the ports 443, 1494, 2598, and 80 are open on any intermediate firewalls between the ASA and the XenApp/XenDesktop server.
–The password-expire-in-days notification on tunnel group that is used by VDI is not supported.
•When configuring for IKEv2, for security reasons you should use groups 21, 20, 19, 24, 14, and 5. We do not recommend Diffie Hellman Group1 or Group2. For example, use
crypto ikev2 policy 10
group 21 20 19 24 14 5
•Downgrading issues—Upgrading to Version 9.0 includes ACL migration (see the "ACL Migration in Version 9.0" section). Therefore, you cannot downgrade from 9.0 with a migrated configuration. Be sure to make a backup copy of your configuration before you upgrade so you can downgrade using the old configuration if required.
•Per-session PAT disabled when upgrading— Starting in Version 9.0, by default, all TCP PAT traffic and all UDP DNS traffic use per-session PAT (see the xlate per-session command in the command reference). If you upgrade to Version 9.0 from an earlier release, to maintain the existing functionality of multi-session PAT, the per-session PAT feature is disabled during configuration migration. The ASA adds the following deny rules:
xlate per-session deny tcp any4 any4
xlate per-session deny tcp any4 any6
xlate per-session deny tcp any6 any4
xlate per-session deny tcp any6 any6
xlate per-session deny udp any4 any4 eq domain
xlate per-session deny udp any4 any6 eq domain
xlate per-session deny udp any6 any4 eq domain
xlate per-session deny udp any6 any6 eq domain
To enable per-session PAT after you upgrade, enter:
clear configure xlate
The above deny rules are cleared so that only the default permit rules are still in place, thus enabling per-session PAT.
•No Payload Encryption for export—You can purchase some models with No Payload Encryption. For export to some countries, payload encryption cannot be enabled on the Cisco ASA 5500 series. The ASA software senses a No Payload Encryption model, and disables the following features:
You can still install the Strong Encryption (3DES/AES) license for use with management connections and encrypted route messages for OSPFv3. For example, you can use ASDM HTTPS/SSL, SSHv2, Telnet and SNMPv3. You can also download the dynamic database for the Botnet Traffic Filer (which uses SSL) and redirect traffic to Cloud Web Security.
We use very long randomized URLs for our vendor AnyConnect connections. Generally, these are all connected on desktop devices, however we have a vendor now testing on android mobile devices. The Android version currently on Google Play (v4.10.00...
Hello, I'm currently meet an issue with a VPN IKEv2. Actually I have 2 local subnets (10.10.0.0/16 & 192.168.90.0/24) that want to reach a remote subnet (10.20.0.0/16). Here my access-list:access-list ACL_REMOTE line 1 extended permit ...
We are running FirePower 6.6 and have recently been seeing a lot of bad detections around the "built in" GoDaddy definition. As GoDaddy is tagged as webmail, these not-really-GoDaddy sites are being blocked by our "block webmail" apps policy. S...
I have a firewall 4100 . I need to set them up as FTD to work with my FMC I set up it up as below, but I can ssh but can not https to it. Do you know why? If you have a good link for setting up this firewall to FTD, pleas share. Switch Fabr...
I work in an environment using Cisco Stealthwatch. We have a cybersecurity team that is doing an audit on our systems where they are scanning the network for vulnerabilities and other problems. I have to provide my management team with the out...