cancel
Showing results for 
Search instead for 
Did you mean: 
cancel

ASA v9.0.1 and ASDM v7.0.1 released

3076
Views
5
Helpful
0
Comments

 

 

Introduction

This document discuss about the new release for ASA v9.0.1 and ASDM v7.0.1 release.

 

Important points to remember

Important points to consider before an upgrade to 9.0:

 

ASA and ASDM Compatibility

 

ASA OS

ASDM

ASA Model:

  

ASA 5505

ASA 5510, 5520, 5540

ASA 5550

ASA 5580

ASA 5512-X, 5515-X,   5525-X, 5545-X, 5555-X

ASA 5585-X

ASASM

ASA 1000V

 

ASA 9.0(1)

ASDM 7.0(1).

YES

YES

YES

YES

YES

YES

YES

No

 

 

 

Limitations and Restrictions

 

•Clientless SSL VPN with a self-signed certificate on the ASA—When the ASA uses a self-signed certificate or an un-trusted certificate, Firefox 4 and later and Safari are unable to add security exceptions when browsing using an IPv6 address HTTPS URL (FQDN URL is OK): the "Confirm Security Exception" button is disabled. See: https://bugzilla.mozilla.org/show_bug.cgi?id=633001. This caveat affects all SSL connections originating from Firefox or Safari to the ASA (including clientless SSL VPN connections, and ASDM connections). To avoid this caveat, configure a proper certificate for the ASA that is issued by a trusted certificate authority. For Internet Explorer 9 and later, use compatibility mode.

 

•Citrix Mobile Receiver and accessing Virtual Desktop Infrastructure (VDI):

 

–CSD is not supported.

 

–HTTP redirect is not supported.

 

–Using Citrix Receiver mobile clients to access web interface of Citrix servers is not supported.

 

–Certificate or smart card authentication is not supported as a means of auto sign-on.

 

–You must install XML service and configure on XenApp and XenDesktop servers.

 

–Make sure the ports 443, 1494, 2598, and 80 are open on any intermediate firewalls between the ASA and the XenApp/XenDesktop server.

 

–The password-expire-in-days notification on tunnel group that is used by VDI is not supported.

 

•When configuring for IKEv2, for security reasons you should use groups 21, 20, 19, 24, 14, and 5. We do not recommend Diffie Hellman Group1 or Group2. For example, use

 

crypto ikev2 policy 10

 

group 21 20 19 24 14 5

 

 

Important Notes

 

•Downgrading issues—Upgrading to Version 9.0 includes ACL migration (see the "ACL Migration in Version 9.0" section). Therefore, you cannot downgrade from 9.0 with a migrated configuration. Be sure to make a backup copy of your configuration before you upgrade so you can downgrade using the old configuration if required.

 

•Per-session PAT disabled when upgrading— Starting in Version 9.0, by default, all TCP PAT traffic and all UDP DNS traffic use per-session PAT (see the xlate per-session command in the command reference). If you upgrade to Version 9.0 from an earlier release, to maintain the existing functionality of multi-session PAT, the per-session PAT feature is disabled during configuration migration. The ASA adds the following deny rules:

 

 

 

xlate per-session deny tcp any4 any4

 

xlate per-session deny tcp any4 any6

 

xlate per-session deny tcp any6 any4

 

xlate per-session deny tcp any6 any6

 

xlate per-session deny udp any4 any4 eq domain

 

xlate per-session deny udp any4 any6 eq domain

 

xlate per-session deny udp any6 any4 eq domain

 

xlate per-session deny udp any6 any6 eq domain

 

To enable per-session PAT after you upgrade, enter:

 

clear configure xlate

 

The above deny rules are cleared so that only the default permit rules are still in place, thus enabling per-session PAT.

 

•No Payload Encryption for export—You can purchase some models with No Payload Encryption. For export to some countries, payload encryption cannot be enabled on the Cisco ASA 5500 series. The ASA software senses a No Payload Encryption model, and disables the following features:

 

–Unified Communications

 

–VPN

 

You can still install the Strong Encryption (3DES/AES) license for use with management connections and encrypted route messages for OSPFv3. For example, you can use ASDM HTTPS/SSL, SSHv2, Telnet and SNMPv3. You can also download the dynamic database for the Botnet Traffic Filer (which uses SSL) and redirect traffic to Cloud Web Security.

 

References:

This document was generated from the following discussion: <span>ASA v9.0.1 and ASDM v7.0.1 released</span>