Beginning with the 6.3 release, the Firepower software supports FTD multi-instance capability. With this support, administrators can create and run multiple independent instances of the FTD software on the same hardware appliance. For now, this multi-instance feature is supported only on 4100 and 9300 devices. Each FTD instance has dedicated hardware resources allocated to it, which guarantees the performance of an instance. In addition to meeting the traffic processing isolation requirements, multi-instance ensures that the management plane for each instance is fully independent of the other instances. In the first phase, it is preferable to manage all the instances on the same hardware from the same FMC. The Multi-instance Internals With FXOS, you can create two types of FTD multi-instances: Native instances consume all the existing hardware. Container Instances use only the hardware and resources allocated by the administrator. Each container has its own dedicated CPU, RAM, and HDD, which are not shared between other instances. Hardware-specific features like flow offload, crypto hardware, and so on do not work in the container instance.  With 6.4, you can create one instance that can be used for TLS HW specific operations, and share physical network interfaces with multiple logical FTDs. The number of instances is dependent on the available hardware.  The Factors that Limit the Creation of Instances Supervisor module resources contribute to limiting the number of maximum container instances. All traffic to security modules comes through the hardware switch available on the supervisor. The following hardware resources on the supervisor contribute to limiting the number of maximum instances that can be created: Switch forwarding path entries available on the hardware switch Nonshared logical interface assigned to an instance requires a physical interface to create a path between the two The number of switch forwarding path entries becomes more important if interfaces are shared between instances. When interfaces are shared between instances, inter-instance traffic flows through the shared interfaces via the hardware switch on the supervisor. For this, the supervisor needs to program a path between every pair of instances using every pair of shared interfaces between them. This exponentially increases the consumption of switch forwarding path entries and thus limits the number of instances that can be created. Ingress VLAN group entry counts Besides, the ingress VLAN group entry count restricts the maximum number of VLAN subinterfaces that can be created on the supervisor. This may restrict the number of instances that can be created. The VLAN group entry table tracks ingress VLAN IDs on the subinterfaces configured on a physical interface on the supervisor. The maximum number is 500 entries, and there is at least one entry from this table consumed for every VLAN subinterface created. The other factors that limit the creations of instances are: Distribution of hardware resources available on the security module Disk space Size of an instance—resource profile Benefits of Multi-instance Solutions Hardware-level traffic processing isolation Hardware-level fault isolation Independent software version management Independent upgrades and restarts Full management isolation Full feature parity between the container and native instances For more information on multi-instance, see Cisco Firepower Threat Defense Multi-Instance Capability on Cisco Firepower 4100 and 9300 Series Appliances White Paper. - Abhishek  ... View more

ASA Multi-Context virtualizes single hardware and transforms it into multiple small firewalls which can help the enterprise to segment their networks efficiently and manage effectively. Similarly, service providers leverage this to provide firewall services to various customers in a cost-effective manner. Cisco FTD Multi-instance attempts to meet the new requirements of the customers seeking next-generation firewall capabilities. Customers moving from ASA Multi context deployment to FTD Multi-instance deployment may find it challenging. This blog describes the tools required for migration and resources available for accelerating the migration process. To understand the migration process, let us consider an example of migrating one ASA context to an FTD. Different challenges arise when merging multiple ASA context; for example, some of the challenges include merging policies and configurations. This article does not cover on merging multiple ASA context and clustering aspects. The following figure depicts a typical migration process: As a first step, you must prepare a thorough plan that includes sizing, interface allocations, and so on. Consider the following questions during migration: What are the gaps between ASA and FTD solution? Review the ASA configuration and understand the features which are not supported by FTD and then evaluate the critical unsupported features and plan steps to mitigate them. In ASA multi-context to FTD multi-instance migration, the primary gap is scaling. Therefore, if you cannot map a context with an instance, then merge multiple contexts in a single instance. Also, plan for migrating the license as well, as ASA and FTD cannot use the same license. How do you size your instances? It is essential to size FTD instances; that is, you must determine the required resource profile and how interfaces must be associated. The resource allocation in Firepower chassis is based on core, which is much simpler compared to multi-context resource allocation. You can create different resource profiles based on the number of concurrent connection allocations. Each instance requires one “instance” license along with usual feature licenses, therefore, consider additional license requirements as well. What about licenses? FTD uses Smart licensing, and therefore, you must migrate the ASA PAK licenses to smart licenses. Typically, the license migration must be performed after migrating ASA to FTD. Cisco Smart Software Manager allows you to convert the ASA PAK license to smart licenses. For more information on smart license conversion, see How to Convert a Classic License or PAK to a Smart License. How to configure the management interface for the instances? There are several ways to decide the allocation of the management interface for your instance. It is recommended to create a port channel with two interfaces and share along with all instances. Do you need an event interface? If you expect a considerable event load on the deployment, you can consider a separate event interface instead of leveraging the management interface. This consideration isolates event traffic from the management traffic and thereby enhances the performance of FMC by improving the time taken to apply the policy to FTDs. However, to ensure a fault-tolerant channel, you must create a port channel which reserves another two 10 Gig interfaces and reduces the number of interfaces available for data. How to do data interface sharing? The most critical being the data interface and with limited ports, you must consider various aspects such as fault tolerance, instance sharing to cascade instances, and so on. You must create port channels to provide a fault tolerant channel. For a cascade multi-context configuration, that is, when the outbound traffic from one context becomes inbound traffic for another context, you must use ‘Data-sharing’ interfaces. See the Shared Interface Best Practices for best practices for the shared interface. You must consider the tools required for migrating the configuration and the configuration that needs to be migrated manually. You can leverage the Cisco Firepower Migration tool to migrate ASA firewall rules, NAT rules, static route and critical interface configuration to FTD, which covers a significant volume of the ASA configuration. The remaining configuration must be migrated manually. There are other third-party vendor tools for migration, but this article focuses only on Cisco Firepower Migration Tool. Additionally, you must plan tests to be performed at various stages for a successful migration with minimal network disruption. You must plan the activities to monitor the new deployment and have a rollback plan handy if the migration fails. The following diagram shows how different context configuration of ASA multi-context maps to FTD multi-instance solution: Once the migration plan is in place, the next phase includes the execution phase where you prepare for migration and then perform the actual switch over to the newly migrated device during the change window. At a high level, this phase includes the following major steps shown below: After setting up the chassis and configuration interfaces, the next steps are executed based on the context. You can create all instances at once and register them in FMC. It is recommended to replace the context with FTD instance one at a time except for the cases where you have cascaded the contexts. The following section describes this procedure: Setup Chassis. Deploy FTD 4100/9300 in your network and connect interfaces. Power on the appliance. Follow the instructions provided in the Cisco Firepower 4100 Getting Started Guide or Cisco Firepower 9300 Getting Started Guide to complete the procedure. Configure Interfaces and Resource Profiles on Chassis Manager. Create all port channels. Define management and event interfaces. Create sub and shared interfaces to leverage the big channel with multiple instances or where instance cascading is required. This configuration is similar to the interface configuration in a system context in the ASA Multi-Context. Create FTD instances on Chassis Manager and allocate necessary resources. Create an FTD instance based on the context. Select Resource profile. Assign interfaces which match the interfaces allocated to the context. Use the data-sharing interface where cascade instances are required. Make sure to assign the same number of interfaces which have been allocated to context. You can complete all chassis manager activities for all ASA user contexts by repeating step 3. Register all the instances in FMC. Maintain the device display name like your context names for easy mapping. Migrate configuration to an instance. The actual configuration conversion starts from this step onwards. We can use the Firepower Migration tool to migrate most of the configuration with little manual intervention. For more information, see Cisco Firepower Migration Tool. If you are using the tool for the first time, we recommend you go through the configuration guides. Some configurations cannot be migrated by the tool and therefore, must be migrated manually. It is assumed that you have identified all critical gaps in the planning phase. Launch the Firepower Migration tool and login. Select the source ASA or upload the show tech support. The tool provides you with an option to select the context you want to migrate. In this window, you will not see the system context as it maps to the chassis manager configuration, which you have already done. Select the instance as shown in the following figure: An FTD instance with a suffix ‘Container’ appears. Select the instance corresponding to context. In the subsequent step, you must map the interfaces: If there are insufficient interfaces, you cannot proceed from this step. However, you can complete this step by adding the missing interfaces to the target FTD in FMC and clicking the Refresh button. If you are adding interface through chassis manager, then add the required interfaces and save the instance. Go to FMC and synchronize the interface on that instance and save the changes. Refresh the screen on the Firepower Migration tool to get those interfaces for mapping. Now the tool converts ASA firewall rules, NAT rules, static routes, and basic interface configuration. Also, the tool generates a premigration report which provides configurations that support and does not support migration. Verify the result with your analysis done during the planning stage. Use this report to refer during the manual migration of the configurations. Review them in the tool and tune as required. After completing the review, migrate the firewall rules, NAT, static route, and interfaces from the Firepower Migration tool by pushing the configuration to FMC. Download the post-migration report. Use this report along with the pre-migration report to understand the configurations which are not migrated from the supported configurations, i.e. firewall rules, NAT rules, static route, and interface. Login to FMC and manually configure the ASA configurations which are not migrated by the tool. Review and Tune. Pre and Post-migration report from the “Firepower Migration Tool” is very critical. You should thoroughly review and ensure all essential configuration is migrated. Make sure to consider the disabled rules either by tuning the enabled rules appropriately or by inserting new rules to match the posture of FTD with ASA w.r.t allowing legitimate traffic and blocking illegitimate traffic. You can tune the interface IP configuration if you don’t want to use the ASA IP addresses. Deploy to the device. Deploy the configuration to FTD device and review the configuration on the device as a standalone. Perform necessary tests on the FTD device before you connect it to the network to replace ASA. Drop in Network. While dropping in the network with cascaded contexts, you must drop in all FTD instances corresponding to the cascaded ASA’s contexts. If you are planning to use the same IP address as your ASA contexts, then bring down ASA interfaces and clear ARP caches on surrounding switch infrastructure. Otherwise, update routing configuration in surrounding infrastructure which points to FTD interface’s IP addresses instead of the ASA interface’s IP addresses. Test Once the FTD instances are in the traffic path, perform the necessary tests as planned during the planning phase. Monitor or rollback If the test pass, you could migrate the next context to FTD instance. If the test fails, rollback to context and return to the planning phase. Once you complete the migration, start migrating your license as well. I hope you had a tremendous migrating experience! - Vikas Sharma ... View more

Network security is critical in today’s fast-growing infrastructure. To protect the data and provide next-generation firewall capabilities, Firepower has emerged to combat the growing threats and provide end-to-end data security with its robust firewalling capabilities. However, with the high-end security and data processing by any firewall, there is a latency, and that is unacceptable in scenarios where every microsecond counts or in situations where there is a high burst of data flowing through. For example, low latency is critical in data centers that run the database servers doing bandwidth intensive procedures such as backup to a different datacenter segment. To ensure that the big data flows that get through Firepower are processed quickly, the Flow Offload feature was introduced. This feature ensures that the flow that is trusted by the Firepower data path doesn’t need any processing by the x86. It is offloaded to the smart NIC hardware, which is lightning fast. Just to share the numbers, when the flow is offloaded, we can have a scintillating 21G TCP throughput and 40-G UDP throughputs.  A test demonstrates that we can transfer 64 bytes of UDP packets with just 2.9 microseconds of delay. The flow offload on Firepower 9300s and 4100s generally would trigger with the prefilter allowing the fast path for the given traffic. However, with the introduction of Dynamic Flow Offload in Firepower Threat Defense 6.3 release, SNORT dynamically decides to offload given traffic. The dynamic offloading is done under the following conditions: When the flows match an access control policy's trust rule action When there are flows that are trusted by the Intelligent Application Bypass (IAB) policy either explicitly or due to exceeding flow bypass thresholds When the flows that match file or intrusion policies qualify for flow offload. This results in the x86 pushing the flow to the smart NIC The Flow offload feature is enabled by default, and it can be disabled manually using SFCLI:  > configure flow-offload dynamic whitelist disable This feature is supported in high availability mode (active/standby) pair and clustering mode wherein the symmetric flows (forward and backward flows hitting the connection owner directly) can be offloaded easily to the smart NIC. Some of Cisco's competitors follow a similar behavior, which is purely at the cost of security. Their focus is primarily centered on to fast switch the traffic through the hardware. With Firepower, when the flow is offloaded to the hardware smart NIC, Firepower is intelligent enough to offer a certain level of security by performing TCP sequence randomization, rewrite of header fielder of IP Addresses and NAT/PAT. This intelligence makes Firepower a winner over its competitions. After a flow is offloaded, packets within the flow may also be returned to the Firepower Threat Defense device for further processing under the following conditions: When the packets from a particular flow include TCP options other than the timestamp When packets from the flow are fragmented or are subjected to Equal-Cost Multi-Path (ECMP) routing When the ingress packets move from one interface to another This innovation and improvisation are a savior when dealing with thick fat flows and is readily accepted by the customers globally on the field. Cheers! - Hemant Madan     ... View more

CSM 4.19 We recently announced the release of ASA 9.12.1 containing a rich feature set targeting our customers to help solve their higher throughput needs with the support for new SM-40,48 modules for the FPR9300 platforms along with support for 4115, 4125, 4145 for the FPR4100 platforms. The release also focused on our service provider customers by bridging the gap with features such as CGNAT interim logging for port block allocation and updated GTPv1 to RLS10. This release also introduces the integration of ASA with Umbrella. What’s New This release includes the following new features and enhancements: Support for ASA 9.12 (1) version Support for CGNAT enhancements— The CGNAT interim logging feature allows you to configure a timer interval to generate syslog for all the active port blocks allocated at that point in time. You can configure in the Policies> NAT > Global Options page. This feature is supported on Cluster and Failover topologies of ASA 9.12(1) and higher devices. Support for Umbrella connector global enhancements— In Cisco Security Manager 4.18, the Umbrella Connector Global Configuration page was introduced under Device Administration. In Cisco Security Manager 4.19, further enhancements are made—configuring umbrella IPv4 resolver, the umbrella IPv6 resolver, and configuring local domain bypass regex value. OSPF key chain support—Beginning with version 4.19, Cisco Security Manager supports the OSPF key chain authentication. This authentication feature allows you to configure key chain authentication for OSPF virtual link and OSPF interface. In Cisco Security Manager, you can add the key chain in the policy object manager and configure it in OSPF authentication page for ASA 9.12(1) or higher devices. Support security requirements over IPv6—Earlier, IPv6 support was not available for NTP server. Beginning with Cisco Security Manager 4.19, IPv6 support is provided. Deprecation of DH Group 1—Cisco Security Manager supports numerous DH group algorithms in various policies. DH groups determine the strength of the key used in the key exchange process. DH Group1 is no longer considered to be secured against threats prevailing in current networking world. Hence, beginning from CSM 4.19, DH group1 support is removed for ASA 9.12(1) or higher devices. Removal of trustpool import default bundle—In order to comply with PSB requirement, Trustpool Import Default Bundle option is removed from trusted pool policy (under Remote Access VPN) for ASA 9.12(1) or higher devices. Provision for management access sessions on ASA devices—Beginning with 4.19, Cisco Security Manager allows you to configure enforcement of limits for the maximum number of admin sessions across all connection types and usernames. The quota is also provisioned for maximum number of concurrent sessions per username as well as per protocol limits on ASA 9.12(1) devices or higher. The configured session concurrence limits is enforced prior to authenticating the incoming administrative session. Support to capture control packets on cluster interface—Beginning with 4.19, Cisco Security Manager allows capture of control packets on cluster interface of ASA devices. This new static interface option allows you to capture cluster control plane packets. This information is useful to troubleshoot issues on cluster especially in multi-context mode. Resolved and Open Bugs For information on fixes for various problems, see Resolved caveats—Release 4.19. Related Documents For additional information on CSM, see Release Notes. ASDM 7.12.1 Cisco's Adaptive Security Device Manager (ASDM) is the GUI tool used to manage the Cisco ASA security appliances. This section contains the new features, bugs fixed and open, and related documentation for ASDM 7.12.1 release. What’s New This release includes the following new features and enhancements: Feature Description Platform Features Support for ASA and FTD on separate modules of the same Firepower 9300 You can now deploy ASA and FTD logical devices on the same Firepower 9300. Requires FXOS 2.6.1. No modified screens. Firewall Features GTPv1 release 10.12 support. The system now supports GTPv1 release 10.12. Previously, the system supported release 6.1. The new support includes recognition of 25 additional GTPv1 messages and 66 information elements. In addition, there is a behavior change. Now, any unknown message IDs are allowed. Previously, unknown messages were dropped and logged. No modified screens. Cisco Umbrella Enhancements. You can now identify local domain names that should bypass Cisco Umbrella. DNS requests for these domains go directly to the DNS servers without Umbrella processing. You can also identify which Umbrella servers to use for resolving DNS requests. Finally, you can define the Umbrella inspection policy to fail open, so that DNS requests are not blocked if the Umbrella server is unavailable. New/Modified screens: Configuration > Firewall > Objects > Umbrella, Configuration > Firewall > Objects > Inspect Maps> DNS. The object group search threshold is now disabled by default. If you enabled object group search, the feature was subject to a threshold to help prevent performance degradation. That threshold is now disabled by default. You can enable it by using the object-group-search threshold command. We changed the following screen: Configuration > Access Rules > Advanced. Interim logging for NAT port block allocation. When you enable port block allocation for NAT, the system generates syslog messages during port block creation and deletion. If you enable interim logging, the system generates message 305017 at the interval you specify. The messages report all active port blocks allocated at that time, including the protocol (ICMP, TCP, UDP) and source and destination interface and IP address, and the port block. New/Modified screen: Configuration > Firewall > Advanced > PAT Port Block Allocation. VPN Features New condition option for debug aaa . The condition option was added to the debug aaa command. You can use this option to filter VPN debugging based on group name, user name, or peer IP address. No modified screens. Support for RSA SHA-1 in IKEv2 You can now generate a signature using the RSA SHA-1 hashing algorithm for IKEv2. New/Modified screens: View the default SSL configuration for both DES and 3DES encryption licenses as well as available ciphers You can now view the default SSL configuration with and without the 3DES encryption license. In addition, you can view all the ciphers supported on the device. New/Modified commands: show ssl information No modified screens. Add subdomains to webVPN HSTS Allows domain owners to submit what domains should be included in the HSTS preload list for web browsers. New/Modified screens: Configuration > Remote Access VPN > Clientless SSL VPN Access > Advanced > Proxies > Enable HSTS Subdomains field High Availability and Scalability Features Per-site gratuitous ARP for clustering The ASA now generates gratuitous ARP (GARP) packets to keep the switching infrastructure up to date: the highest priority member at each site periodically generates GARP traffic for the global MAC/IP addresses. When using per-site MAC and IP addresses, packets sourced from the cluster use a site-specific MAC address and IP address, while packets received by the cluster use a global MAC address and IP address. If traffic is not generated from the global MAC address periodically, you could experience a MAC address timeout on your switches for the global MAC address. After a timeout, traffic destined for the global MAC address will be flooded across the entire switching infrastructure, which can cause performance and security concerns. GARP is enabled by default when you set the site ID for each unit and the site MAC address for each Spanned EtherChannel. New/Modified screens: Configuration > Device Management > High Availability and Scalability > ASA Cluster > Cluster Configuration > Site Periodic GARP field Routing Features OSPF Keychain support for authentication OSPF authenticates the neighbor and route updates using MD5 keys. In ASA, the keys that are used to generate the MD5 digest had no lifetime associated with it. Thus, user intervention was required to change the keys periodically. To overcome this limitation, OSPFv2 supports MD5 authentication with rotating keys. Based on the accept and send lifetimes of Keys in KeyChain, OSPF authenticates, accepts or rejects keys and forms adjacency. New/Modified screens: Configuration > Device Setup > Key Chain Configuration > Device Setup > Routing > OSPF > Setup > Authentication Configuration > Device Setup > Routing > OSPF > Setup > Virtual Link Certificate Features Local CA configurable FQDN for enrollment URL To make the FQDN of the enrollment URL configurable instead of using the ASA's configured FQDN, a new CLI option is introduced. This new option is added to the smtp mode of crypto ca server . New/Modified commands: fqdn Administrative, Monitoring, and Troubleshooting Features enable password change now required on a login The default enable password is blank. When you try to access privileged EXEC mode on the ASA, you are now required to change the password to a value of 3 characters or longer. You cannot keep it blank. The no enable password command is no longer supported. At the CLI, you can access privileged EXEC mode using the enable command, the login command (with a user at privilege level 2+), or an SSH or Telnet session when you enable aaa authorization exec auto-enable . All of these methods require you to set the enable password. This password change requirement is not enforced for ASDM logins. In ASDM, by default, you can log in without a username and with the enable password. No modified screens. Configurable limitation of admin sessions You can configure the maximum number of aggregate, per user, and per-protocol administrative sessions. Formerly, you could configure only the aggregate number of sessions. This feature does not affect console sessions. Note that in multiple context mode, you cannot configure the number of HTTPS sessions, where the maximum is fixed at five sessions. The quota management-session command is also no longer accepted in the system configuration and is instead available in the context configuration. The maximum aggregate sessions is now 15; if you configured 0 (unlimited) or 16+, then when you upgrade, the value is changed to 15. New/Modified screens: Configuration > Device Management > Management Access > Management Session Quota Notifications for administrative privilege level changes When you authenticate for enable access (aaa authentication enable console ) or allow privileged EXEC access directly (aaa authorization exec auto-enable ), then the ASA now notifies users if their assigned access level has changed since their last login. New/Modified screens: Status bar > Login History icon NTP support on IPv6 You can now specify an IPv6 address for the NTP server. New/Modified screens: Configuration > Device Setup > System Time > NTP > Add button > Add NTP Server Configuration dialog box SSH stronger security See the following SSH security improvements: SSH version 1 is no longer supported; only version 2 is supported. Diffie-Hellman Group 14 SHA256 key exchange support. This setting is now the default. The former default was Group 1 SHA1. HMAC-SHA256 integrity cipher support. The default is now the high security set of ciphers (hmac-sha1 and hmac-sha2-256). The former default was the medium set. New/Modified screens: Configuration > Device Management > Management Access > ASDM/HTTPS/Telnet/SSH Configuration > Device Management > Advanced > SSH Ciphers Allow non-browser-based HTTPS clients to access the ASA You can allow non-browser-based HTTPS clients to access HTTPS services on the ASA. By default, ASDM, CSM, and REST API are allowed. New/Modified screens. Configuration > Device Management > Management Access > HTTP Non-Browser Client Support Capture control plane packets only on the cluster control link You can now capture control plane packets only on the cluster control link (and no data plane packets). This option is useful in the system in multiple context mode where you cannot match traffic using an ACL. New/Modified screens: Wizards > Packet Capture Wizard > Cluster Option debug conn command The debug conn command was added to provide two history mechanisms that record connection processing. The first history list is a per-thread list that records the operations of the thread. The second history list is a list that records the operations into the conn-group. When a connection is enabled, processing events such as a connection lock, unlock, and delete are recorded into the two history lists. When a problem occurs, these two lists can be used to look back at the processing to determine the incorrect logic. New/Modified commands: debug conn show tech-support includes additional output The output of the show tech-support is enhanced to display the output of the following: show ipv6 interface show aaa-server show fragment New/Modified commands: show tech-support ASDM support to enable and disable the results for free memory and used memory statistics during SNMP walk operations To avoid overutilization of CPU resources, you can enable and disable the query of free memory and used memory statistics collected through SNMP walk operations. New or modified screen: Configuration > Device Management > Management Access > SNMP Configurable graph update interval for the ASDM Home pane for the System in multiple-context mode For the System in multiple context mode, you can now set the amount of time between updates for the graphs on the Home pane. New/Modified screens: Tools > Preferences > Graph User time interval in System Context Resolved and Open Bugs For information on fixes for various problems, see Resolved Bugs in Version 7.12(1). Related Documents For additional information on the ASA, see  Navigating the Cisco ASA Series Documentation . - Authored by Kaushik Swaminathan ... View more

With the 6.4 release, the Firepower Management Center (FMC) supports the Open API standards for the API specification. The Open API Specification site quotes the following about Open API standards – “The OpenAPI Specification (OAS) defines a standard, programming language-agnostic interface description for REST APIs, which allows both humans and computers to discover and understand the capabilities of a service without requiring access to source code, additional documentation, or inspection of network traffic.” The FMC Open API support adds new capabilities that make integration with the FMC much easier and simpler. This blog contains information on accessing the new API Explorer page, navigating the explorer pages for supported API operations, specific examples for applicable operations, executing or trying out an operation, information on the API model and downloading the specification, and information on various open source tools for the API client development. The Open API Specification (OAS) brings in powerful new capabilities in the way you consume the APIs. Let’s delve further to see how you can access these APIs in FMC. The original URL “https://<<your-server>>/api/api-explorer” takes you to the new API explorer screen that leverages the Open API standards. The new FMC API Explorer screen uses the Swagger UI to render this page. Let’s have a quick look at the various options on this page. Download Spec: This is a direct link to download the Open API specification for the whole of FMC. It also thoroughly describes all the supported API operations. Legacy Explorer: This links to the legacy API explorer interface page, which has all API information in the older format. Logout: A link to log out from the page. REST URLs and Supported Methods: This is an information section that provides references and quick links for more resources. Domains: A domain selector that allows you to choose the domain on which you want to perform your API calls. API Resource Section: This section provides complete details on the supported APIs and a convenient way of trying them out. Let’s now delve deep into the API resource section that contains all the information on supported operations and their models. The page consists of a list of top-level sections – Devices, Policy Assignments, Device HA Pairs, and so on. The section is divided based on the top-level area under which the API resources are available. For example, the Devices section contains all APIs related to device operations; the Policy Assignments section has APIs that can assign policies to different targets, and so on. Clicking a top-level section header displays the list of operations and URLs that are supported under it. Clicking further on the corresponding URL opens the specific REST API with more details. As an example, let’s explore the GET /api/fmc_config/v1/domain/{domainUUID}/object/hosts/{objectID} REST API call in detail using the API explorer. The host is essentially a host network object which is contained within the Objects section. Clicking on the GET operation in the Object sections opens more details around it. The GET page includes a short description of the GET object, a Try it out button to try out the GET operation on the FMC, and the query and path parameters that are required to try out this operation successfully. Let’s scroll down a bit further to see more details from the Responses section. The Responses section contains some useful information like the supported examples for the operation, the response code (200 in this case), and the Model link beside the Example Value that provides more details about the Model itself. Note: Any applicable Cisco provided example content irrespective of the type of HTTP operation – GET, PUT, POST or DELETE is always mentioned in the responses section of the operation in question. Let’s now explore the model link. Choosing the Model link displays a comprehensive model description of the model attributes used in this operation. The second-level models like Metadata can be expanded for more details. To try out an actual operation, click the Try it out button. Fill in the relevant data and click the Execute button, which displays the results in the responses section. For example, the domainUUID is automatically populated based on the Domain that is selected in the top of the page. Note: All operations are always performed on the actual server data on the FMC from where the API Explorer is launched. Finally, let’s have a quick glimpse at the open API specification itself. As mentioned at the beginning of this overview, you can use the Download Spec to download the Open API specification for the whole of FMC. It thoroughly describes all the supported API operations to ease the API client development. The FMC API supports the Open API standards version 2.0. There is also a bunch of open source tools available to ease the process of developing API clients to integrate with the FMC API using the Open API specification. Here’s a short list of some of the open source projects that can be of some help (listed in no specific order): Swagger Code Gen : This can be used to auto-generate documentation, and API clients in different languages by using the Open API specification file. Bravado : This is a Python client library for API that supports Open API version 2.0. OpenAPI Generator : This generates clients, servers, and documentation from OpenAPI 2.0/3.x specifications. Go-Swagger : This can be used for Go-based client generation. Note: The tools mentioned here are not specifically evaluated or endorsed for use with the FMC Open API specification. It is the responsibility of the consumer to evaluate specific tools based on their individual need. Hope you found this blog useful and that it helped you to explore the possibilities with FMC Open API support. Cheers - Vijaya Raghavan S V ... View more

Cisco announces the availability of Firepower 6.4.0. You can download the Firepower 6.4.0 software from the Software Download page and view the release notes at Cisco Firepower Release Notes, Version 6.4.0. In addition to the new features (summarized in the table below), the Firepower 6.4.0 release includes these significant enhancements to user experience: Improved FTDv Getting Started Guides for VMware and KVM that merge FDM and FMC management modes. For more information, see Cisco Firepower Threat Defense Virtual for VMware Getting Started Guide and Cisco Firepower Threat Defense Virtual for KVM Getting Started Guide . Improved Firepower 4100 and 9300 Getting Started Guides that merge FXOS, FTD, and ASA. For more information, see Cisco Firepower 4100 Getting Started Guide and Cisco Firepower 9300 Getting Started Guide . New Cisco Firepower App for Splunk User Guide . Cisco Firepower App for Splunk presents security and network event information sent to Splunk from Firepower Management Center running version 6.0 or later.   New Features in FMC/Firepower Version 6.4.0 The following table lists the new features available in Firepower Version 6.4 when configured using a Firepower Management Center.   Feature Description Hardware and Virtual Hardware FMCv on Azure We introduced Firepower Management Center Virtual on Microsoft Azure. ASA and FTD on the same Firepower 9300 You can now deploy ASA and FTD logical devices on the same Firepower 9300, which requires FXOS 2.6.1. For more information, see Cisco Firepower 4100/9300 FXOS Release Notes, 2.6(1) and Release Notes for the Cisco ASA Series, 9.12(x). Firepower Threat Defense Routing Rotating (keychain) authentication for OSPFv2 routing You can now use rotating (keychain) authentication when configuring OSPFv2 routing. New/modified screens: Objects > Object Management > Key Chain object Devices > Device Management > edit device > Routing tab > OSPF settings > Interface tab > add/edit interface > Authentication option Devices > Device Management > edit device > Routing tab > OSPF settings > Area tab > add/edit area > Virtual Link sub-tab > add/edit virtual link > Authentication option Supported platforms: FTD Firepower Threat Defense Encryption and VPN RA VPN: Duo as first factor in two-factor authentication You can now use a Duo proxy server (which also acts as a RADIUS server) as the first factor in RA VPN two-factor authentication. For details from Duo, see: Cisco Firepower Threat Defense (FTD) VPN with AnyConnect. Supported platforms: FTD RA VPN: Secondary authentication Secondary authentication, also called double authentication, adds an additional layer of security to RA VPN connections by using two different authentication servers. With secondary authentication enabled, AnyConnect VPN users must provide two sets of credentials to log in to the VPN gateway. RA VPN supports secondary authentication for the AAA Only and Client Certificate and AAA authentication methods. New/modified screens: Devices > VPN > Remote Access > add/edit configuration > Connection Profile > AAA area Supported platforms: FTD Site-to-site VPN: Dynamic IP addresses for extranet endpoints You can now configure site to site VPNs to use a dynamic IP address for extranet endpoints. In hub-and-spoke deployments, you can use a hub as an extranet endpoint. New/modified screens: Devices > VPN > Site To Site > add/edit FTD VPN topology > Endpoints tab > add endpoint > IP Address option Supported platforms: FTD Site-to-site VPN: Dynamic crypto maps for point-to-point topologies You can now use dynamic crypto maps in point-to-point as well as in hub-and-spoke VPN topologies. Dynamic crypto maps are still not supported for full mesh topologies. You specify the crypto map type when you configure a topology. Make sure you also specify a dynamic IP address for one of the peers in the topology. New/modified screens: Devices > VPN > Site To Site > add/edit FTD VPN topology > IPsec tab > Crypto Map Type option Supported platforms: FTD TLS crypto acceleration SSL hardware acceleration has been renamed TLS crypto acceleration. Depending on the device, TLS crypto acceleration might be performed in software or in hardware. The Version 6.4 upgrade process automatically enables acceleration on all eligible devices, even if you previously disabled the feature manually. In most cases you cannot configure this feature; it is automatically enabled and you cannot disable it. However, if you are using the multi-instance capability of the Firepower 4100/9300 chassis, you can enable TLS crypto acceleration for one container instance per module/security engine. Acceleration is disabled for other container instances, but enabled for native instances. New FXOS CLI commands for the Firepower 4100/9300 chassis: show hwCrypto enable config hwCrypto enable New FTD CLI commands: show crypto accelerator status (replaces system support ssl-hw-status ) Removed FTD CLI commands: system support ssl-hw-accel enable system support ssl-hw-accel disable system support ssl-hw-status Supported platforms: Firepower 2100 series, Firepower 4100/9300 chassis Events, Logging, and Analysis Improvements to syslog messages for file and malware events Fully-qualified file and malware event data can now be sent from managed devices via syslog. New/modified screens: Policies > Access Control > Access Control > add/edit policy > Logging tab > File and Malware Settings area Supported platforms: Any Search intrusion events by CVE ID You can now search for intrusion events generated as a result of a particular CVE exploit. New/modified screens: Analysis > Search Supported platforms: FMC IntrusionPolicy field is now included in syslog Intrusion event syslog messages now specify the intrusion policy that triggered the event. Supported platforms: Any Cisco Threat Response (CTR) integration Cisco Threat Response is a new Cisco offering that you will be able to integrate with Firepower Threat Defense deployments. CTR's powerful analysis tools will allow you to integrate Firepower event data with data from other sources for a unified view of threats on your network. Note  CTR will not be available until after Firepower 6.4 releases. Until then, configuring CTR integration in the web interface has no effect. New/modified screens: System > Integration > Cloud Services Supported platforms: FTD Splunk integration Splunk users can use a new, separate Splunk app, Cisco Firepower App for Splunk, to analyze events. Available functionality is affected by your Firepower version. Supported platforms: FMC Administration FTDv on VMware defaults to vmxnet3 interfaces FTDv on VMware now defaults to vmxnet3 interfaces when you create a virtual device. Previously, the default was e1000. The vmxnet3 device drivers and network processing are integrated with the ESXi hypervisor, so they use fewer resources and offer better network performance. Note  If you are using e1000 interfaces, we strongly recommend you switch. For more information, refer to the instructions on adding and configuring VMware interfaces in the Cisco Firepower Threat Defense Virtual for VMware Quick Start Guide. Supported platforms: FTDv on VMware Ability to disable Duplicate Address Detection (DAD) on management interfaces When you enable IPv6, you can disable DAD. You might want to disable DAD because using DAD opens up the possibility of denial of service attacks. If you disable this setting, you need check manually that this interface is not using an already-assigned address. New/modified screens: System > Configuration > Management Interfaces > Interfaces area > edit interface > IPv6 DADcheck box Supported platforms: FMC, 7000 and 8000 Series Ability to disable ICMPv6 Echo Reply and Destination Unreachable messages on management interfaces When you enable IPv6, you can now disable ICMPv6 Echo Reply and Destination Unreachable messages. You might want to disable these packets to guard against potential denial of service attacks. Disabling Echo Reply packets means you cannot use IPv6 ping to the device management interfaces for testing purposes. New/modified screens: System > Configuration > Management Interfaces > ICMPv6 New/modified commands: configure network ipv6 destination-unreachable configure network ipv6 echo-reply Supported platforms: FMC (web interface only), managed devices (CLI only) Support for the Service-Type attribute for FTDusers defined on the RADIUS server For RADIUS authentication of FTD CLI users, you used to have to predefine the usernames in the RADIUS external authentication object and manually make sure that the list matched usernames defined on the RADIUS server. You can now define CLI users on the RADIUS server using the Service-Type attribute and also define both Basic and Config user roles. To use this method, be sure to leave the shell access filter blank in the external authentication object. New/modified screens: System > Users > External Authentication tab > add/edit external authentication object > Shell Access Filter Supported platforms: FTD Signed SRU, VDB, and GeoDB updates So that Firepower can verify that you are using the correct update files, Version 6.4+ uses signedupdates for intrusion rules (SRU), the vulnerability database (VDB), and the geolocation database (GeoDB). For more information, see Security Enhancement: Signed SRU, VDB, and GeoDB Updates. Supported platforms: Any Scheduled remote backups of managed devices You can now use the FMC to schedule remote backups of certain managed devices. Previously, only 7000 and 8000 series devices supported scheduled backups, and you had to use the device's local GUI. New/modified screens: System > Tools > Scheduling > add/edit task > choose Job Type: Backup > choose a Backup Type Supported platforms: FTD physical platforms, FTDv for VMware, 7000/8000 series Exceptions: No support for FTD clustered devices or container instances Monitoring and Troubleshooting URL Filtering Monitor improvements You can now configure time thresholds for URL Filtering Monitor alerts. New/modified screens: System > Health > Policy > add/edit policy > URL Filtering Monitor Supported platforms: Any Hit counts for access control and prefilter rules You can now access hit counts for access control and prefilter rules on your FTD devices. New/modified screens: Policies > Access Control > Access Control > add/edit policy > Analyze Hit Counts Policies > Access Control > Prefilter > add/edit policy > Analyze Hit Counts New commands: show rule hits clear rule hits cluster exec show rule hits cluster exec clear rule hits show cluster rule hits Modified commands: show failover now contains object static counts related to syncing hit counts between HA peers Supported platforms: FTD Connection-based troubleshooting Connection-based troubleshooting or debugging provides uniform debugging across modules to collect appropriate logs for a specific connection. It also supports level-based debugging up to 7 levels and enables uniform log collection mechanism for lina and Snort logs. New/modified commands: clear packet debug debug packet start debug packet stop show packet debugs Supported platforms: FTD Firepower Management Center REST API New REST API capabilities Added REST API objects to support Version 6.4 features: cloudeventsconfigs: Manage Cisco Threat Response integration. ftddevicecluster: Manage chassis clustering. hitcounts: Manage hit count statistics for access control and prefilter rules. keychain: Manage key chain objects used for rotating authentication when configuring OSPFv2 routing. loggingsettings: Manage logging settings for access control policies Supported platforms: FMC API Explorer based on OAS Version 6.4 uses a new API Explorer, based on the OpenAPI Specification (OAS). As part of the OAS, you now use CodeGen to generate sample code. You can still access the legacy API Explorer if you prefer. Supported platforms: FMC Performance Snort restart improvements Before Version 6.4, during Snort restarts, the system dropped encrypted connections that matched a 'Do not decrypt' SSL rule or default policy action. Now, routed/transparent traffic passes without inspection instead of dropping, as long as you did not disable large flow offload or Snort preserve-connection. Supported platforms: Firepower 4100/9300 Faster access control The Version 6.4 upgrade process enables egress optimization on eligible devices, which enhances access control performance. For more information, see the Cisco Firepower Threat Defense Command Reference. We strongly recommend you leave this feature enabled. If you have questions, contact Cisco TAC. Supported platforms: FTD Faster SNMP event logging Performance improvements when sending intrusion and connection events to an external SNMP trap server. Supported platforms: Any Faster deploy Improvements to appliance communications and deploy framework. Supported platforms: FTD Faster upgrade Improvements to the event database. Supported platforms: Any   New Features in Firepower Device Manager/FTD Version 6.4.0   The following table lists the new features available in FTD 6.4.0 when configured using Firepower Device Manager. Feature Description Hardware bypass for the ISA 3000. You can now configure hardware bypass for the ISA 3000 on the Device > Interfaces page. In release 6.3, you needed to configure hardware bypass using FlexConfig. If you are using FlexConfig, please redo the configuring on the Interfaces page and remove the hardware bypass commands from FlexConfig. However, the portion of the FlexConfig devoted to disabling TCP sequence number randomization is still recommended. Ability to reboot and shut down the system from FDM. You can now issue the reboot and shutdown commands through the CLI Console in FDM. Previously, you needed to open a separate SSH session to the device to reboot or shut down the system. You must have Administrator privileges to use these commands. External Authentication and Authorization using RADIUS for FTD CLI Users. You can use an external RADIUS server to authenticate and authorize users logging into the FTD CLI. You can give external users config (administrator) or basic (read-only) access. We added the SSH configuration to the AAA Configuration tab on the Device > System Settings > Management Access page. Support for network range objects and nested network group objects. You can now create network objects that specify a range of IPv4 or IPv6 addresses, and network group objects that include other network groups (that is, nested groups). We modified the network object and network group object Add/Edit dialog boxes to include these features, and modified the various security policies to allow the use of these objects, contingent on whether address specifications of that type make sense within the context of the policy. Full-text search options for objects and rules. You can do a full-text search on objects and rules. By searching a policy or object list that has a large number of items, you can find all items that include your search string anywhere within the rule or object. We added a search box to all policies that have rules, and to all pages on the Objects list. In addition, you can use the filter=fts~ search-string option on GET calls for supported objects in the API to retrieve items based on a full-text search. Obtaining a list of supported API versions for an FDM-managed FTD device. You can use the GET /api/versions (ApiVersions) method to get a list of the API versions that are supported on a device. You can use your API client to communicate and configure the device using commands and syntax valid for any of the supported versions. FTD REST API version 3 (v3). The FTD REST API for software version 6.4 has been incremented to version 3. You must replace v1/v2 in the API URLs with v3. The v3 API includes many new resources that cover all features added in software version 6.4. Please re-evaluate all existing calls, as changes might have been mode to the resource models you are using. To open the API Explorer, where you can view the resources, change the end of the Firepower Device Manager URL to /#/api-explorer after logging in. Hit counts for access control rules. You can now view hit counts for access control rules. The hit counts indicate how often connections matched the rule. We updated the access control policy to include hit count information. In the FTD API, we added the HitCounts resource and the includeHitCounts and filter=fetchZeroHitCounts options to the GET Access Policy Rules resource. Site-to-Site VPN enhancements for dynamic addressing and certificate authentication. You can now configure site-to-site VPN connections to use certificates instead of preshared keys to authenticate the peers. You can also configure connections where the remote peer has an unknown (dynamic) IP address. We added options to the Site-to-Site VPN wizard and the IKEv1 policy object. Support for RADIUS servers and Change of Authorization in remote access VPN. You can now use RADIUS servers for authenticating, authorizing, and accounting remote access VPN (RA VPN) users. You can also configure Change of Authentication (CoA), also known as dynamic authorization, to alter a user’s authorization after authentication when you use a Cisco ISE RADIUS server. We added attributes to the RADIUS server and server group objects, and made it possible to select a RADIUS server group within an RA VPN connection profile. Multiple connection profiles and group policies for remote access VPN. You can configure more than one connection profile, and create group policies to use with the profiles. We changed the Device > Remote Access VPN page to have separate pages for connection profiles and group policies, and updated the RA VPN Connection wizard to allow the selection of group policies. Some items that were previously configured in the wizard are now configured in the group policy. Support for certificate-based, second authentication source, and two-factor authentication in remote access VPN. You can use certificates for user authentication, and configure secondary authentication sources so that users must authenticate twice before establishing a connection. You can also configure two-factor authentication using RSA tokens or Duo passcodes as the second factor. We updated the RA VPN Connection wizard to support the configuration of these additional options. Support for IP address pools with multiple address ranges, and DHCP address pools, for remote access VPN. You can now configure address pools that have more than one address range by selecting multiple network objects that specify subnets. In addition, you can configure address pools in a DHCP server and use the server to provide addresses to RA VPN clients. If you use RADIUS for authorization, you can alternatively configure the address pools in the RADIUS server. We updated the RA VPN Connection wizard to support the configuration of these additional options. You can optionally configure the address pool in the group policy instead of the connection profile. Active Directory realm enhancements. You can now include up to 10 redundant Active Directory (AD) servers in a single realm. You can also create multiple realms and delete realms that you no longer need. In addition, the limit for downloading users in a realm is increased to 50,000 from the 2,000 limit in previous releases. We updated the Objects > Identity Sources page to support multiple realms and servers. You can select the realm in the user criteria of access control and SSL decryption rules, to apply the rule to all users within the realm. You can also select the realm in identity rules and RA VPN connection profiles. Redundancy support for ISE servers. When you configure Cisco Identity Services Engine (ISE) as an identity source for passive authentication, you can now configure a secondary ISE server if you have an ISE high availability setup. We added an attribute for the secondary server to the ISE identity object. File/malware events sent to external syslog servers. You can now configure an external syslog server to receive file/malware events, which are generated by file policies configured on access control rules. File events use message ID 430004, malware events are 430005. We added the File/Malware syslog server options to the Device > System Settings > Logging Settingspage. Logging to the internal buffer and support for custom event log filters. You can now configure the internal buffer as a destination for system logging. In addition, you can create event log filters to customize which messages are generated for the syslog server and internal buffer logging destinations. We added the Event Log Filter object to the Objects page, and the ability to use the object on the Device > System Settings > Logging Settings page. The internal buffer options were also added to the Logging Settings page. Certificate for the Firepower Device Manager Web Server. You can now configure the certificate that is used for HTTPS connections to the Firepower Device Manager configuration interface. By uploading a certificate your web browsers already trust, you can avoid the Untrusted Authority message you get when using the default internal certificate. We added the Device > System Settings > Management Access > Management Web Server page. Cisco Threat Response support. You can configure the system to send intrusion events to the Cisco Threat Response cloud-based application. You can use Cisco Threat Response to analyze intrusions. We added Cisco Threat Response to the Device > System Settings > Cloud Services page. ... View more

According to the Verizon 2018 Data Breach Investigations Report, 81% of hacking-related incidents leverage stolen or weak passwords. When your workforce requires access to business-critical information residing on your corporate network and cloud, a VPN connectivity with the highest level of security is a mandate. If an attacker steals employee’s VPN credentials and gains access to your network, they can masquerade as employees, obtain sensitive information, and disrupt business operations. Duo Multifactor Authentication (MFA) adds another layer of defense and makes breaches from stolen credentials a thing of the past. Duo’s MFA provides secure remote access to internal corporate applications using Cisco’s AnyConnect VPN on Adaptive Security Appliance (ASA) or Firepower Threat Defense (FTD). Duo’s multi-factor authentication is easy to use and deploy, and it offers the convenience of several authentication methods based on your specific use case such as Duo Push, which is the most secure and user-friendly. Duo is now natively integrated with Cisco AnyConnect and Next-Generation Firewall (NGFW). Here are five reasons why you should secure your VPN with Duo MFA to ensure trusted access: Protect against credential theft Achieve regulatory compliance Enable consistent access security for on-premises and cloud apps Gain visibility into all devices Enforce granular access security policies For more information, see a short video on CISCO + Duo Better Together and 5 Reasons to Protect your VPN with MFA . ... View more

Take advantage of Firepower’s most powerful, and well documented context-rich APIs to allow the exchange of network and endpoint security events, data, and host information. With these APIs, you can automate repetitive tasks for consistency and to avoid user errors, do configuration management automation, and automate mass deployments that need faster rollout of changes with a higher degree of consistency. The DevNet Firepower page contains all the resources such as videos, documentation, and learnings labs to get you started with programming and to get the most out of your Firepower environment. The DevNet Firepower page is categorized as follows: The Firepower Management Center (FMC) APIs allow the exchange of network and endpoint security events, data, and host information. The FMC APIs include: eStreamer The Cisco Event Streamer (also known as eStreamer) allows you to stream Firepower System events to external client applications. You can stream host, discovery, correlation, compliance white list, intrusion, user activity, file, malware, and connection data from a Management Center. For more information, see the eStreamer Integration Guide for 6.3.0 . Database Access The Firepower System database access feature allows you to query intrusion, discovery, user activity, correlation, connection, vulnerability, and application and URL statistics database tables on a Cisco Firepower Management Center, using a third-party client that supports JDBC SSL connections. For more information, see the Database Access Guide for 6.3.0 . Host Input The Firepower Management Center Host Input API provides a tool for importing data from other sources on your network to augment the monitored host information. For more information, see the Host Input API Guide for 6.0 . Remediation The Firepower System Remediation API allows you to create remediations that your Firepower Management Center can automatically launch when conditions on your network violate the associated correlation policy. For more information, see the Firepower System Remediation API Guide for 6.0 . REST The REST API is an application programming interface (API), based on “RESTful” principles, which you can quickly enable on any Firepower Management Center running version 6.1 or higher, and use with a REST client. You can use the REST APIs over HTTPS, and the REST API uses JavaScript Object Notation (JSON) format to represent objects. For more information, see the Firepower Management Center REST API Quick Start Guide for 6.3.0 . The Firepower Threat Defense (FTD) REST APIs help you to automate configuration management and execution of operational tasks on FTD devices. You can use the FTD REST APIs over HTTPS to interact with an FTD device through a client program. The REST API uses JavaScript Object Notation (JSON) format to represent objects. For more information, see the Cisco Firepower Threat Defense REST API Guide. The FXOS Firepower Chassis Manager REST APIs includes both Platform and Firepower Chassis Services RESTful APIs. With these APIs, you can configure and monitor the platform and Firepower Chassis Services. These APIs are solely for Platform services provided by Firepower eXtensible OS. For more information, see the Cisco Firepower Chassis Manager REST API Reference . Cisco Defense Orchestrator (CDO) is a cloud-based, multi-device manager that provides a simple, consistent, and highly secure way of managing security policies on all your ASA devices. Want to delve deep? Visit the Firepower programming knowledge hub at https://developer.cisco.com/firepower/. And, for detailed documentation on the programming guides, visit https://www.cisco.com/c/en/us/support/security/defense-center/products-programming-reference-guides-list.html. ... View more

Cisco announces the availability of ASA 9.12(1). New Features in this Release Feature Description Platform Features Support for ASA and  FTD  on separate modules of the same Firepower 9300 You can now deploy ASA and  FTD  logical devices on the same Firepower 9300. Requires FXOS 2.6.1. No modified commands. Firewall Features GTPv1 release 10.12 support. The system now supports GTPv1 release 10.12. Previously, the system supported release 6.1. The new support includes recognition of 25 additional GTPv1 messages and 66 information elements. In addition, there is a behavior change. Now, any unknown message IDs are allowed. Previously, unknown messages were dropped and logged. No modified commands. Cisco Umbrella Enhancements. You can now identify local domain names that should bypass Cisco Umbrella. DNS requests for these domains go directly to the DNS servers without Umbrella processing. You can also identify which Umbrella servers to use for resolving DNS requests. Finally, you can define the Umbrella inspection policy to fail open, so that DNS requests are not blocked if the Umbrella server is unavailable. New/Modified commands:  local-domain-bypass  ,  resolver  ,  umbrella fail-open . The object group search threshold is now disabled by default. If you enabled object group search, the feature was subject to a threshold to help prevent performance degradation. That threshold is now disabled by default. You can enable it by using the  object-group-search threshold  command. New/Modified command:  object-group-search threshold . Interim logging for NAT port block allocation. When you enable port block allocation for NAT, the system generates syslog messages during port block creation and deletion. If you enable interim logging, the system generates message 305017 at the interval you specify. The messages report all active port blocks allocated at that time, including the protocol (ICMP, TCP, UDP) and source and destination interface and IP address, and the port block. New/Modified command:  xlate block-allocation pba-interim-logging  seconds. VPN Features New  condition  option for  debug aaa  . The  condition  option was added to the  debug aaa  command. You can use this option to filter VPN debugging based on group name, user name, or peer IP address. New/Modified commands:  debug aaa condition Support for RSA SHA-1 in IKEv2 You can now generate a signature using the RSA SHA-1 hashing algorithm for IKEv2. New/Modified commands:  rsa-sig-sha1 View the default SSL configuration for both DES and 3DES encryption licenses as well as available ciphers You can now view the default SSL configuration with and without the 3DES encryption license. In addition, you can view all the ciphers supported on the device. New/Modified commands:  show ssl information Add subdomains to webVPN HSTS Allows domain owners to submit what domains should be included in the HSTS preload list for web browsers. New/Modified commands:  hostname(config-webvpn) includesubdomains High Availability and Scalability Features Per-site gratuitous ARP for clustering The ASA now generates gratuitous ARP (GARP) packets to keep the switching infrastructure up to date: the highest priority member at each site periodically generates GARP traffic for the global MAC/IP addresses. When using per-site MAC and IP addresses, packets sourced from the cluster use a site-specific MAC address and IP address, while packets received by the cluster use a global MAC address and IP address. If traffic is not generated from the global MAC address periodically, you could experience a MAC address timeout on your switches for the global MAC address. After a timeout, traffic destined for the global MAC address will be flooded across the entire switching infrastructure, which can cause performance and security concerns. GARP is enabled by default when you set the site ID for each unit and the site MAC address for each Spanned EtherChannel. New/Modified commands:  site-periodic-garp interval Routing Features OSPF Keychain support for authentication OSPF authenticates the neighbor and route updates using MD5 keys. In ASA, the keys that are used to generate the MD5 digest had no lifetime associated with it. Thus, user intervention was required to change the keys periodically. To overcome this limitation, OSPFv2 supports MD5 authentication with rotating keys. Based on the accept and send lifetimes of Keys in KeyChain, OSPF authenticates, accepts or rejects keys and forms adjacency. New/Modified commands:  accept-lifetime ,  area virtual-link authentication ,  cryptographic-algorithm ,  key ,  key chain ,  key-string ,  ospf authentication ,  send-lifetime Certificate Features Local CA configurable FQDN for enrollment URL To make the FQDN of the enrollment URL configurable instead of using the ASA's configured FQDN, a new CLI option is introduced. This new option is added to the  smpt  mode of  crypto ca server . New/Modified commands:  fqdn Administrative, Monitoring, and Troubleshooting Features enable  password change now required on a login The default  enable  password is blank. When you try to access privileged EXEC mode on the ASA, you are now required to change the password to a value of 3 characters or longer. You cannot keep it blank. The  no enable password  command is no longer supported. At the CLI, you can access privileged EXEC mode using the  enable  command, the  login  command (with a user at privilege level 2+), or an SSH or Telnet session when you enable  aaa authorization exec auto-enable . All of these methods require you to set the enable password. This password change requirement is not enforced for ASDM logins. In ASDM, by default you can log in without a username and with the  enable  password. New/Modified commands:  enable password Configurable limitation of admin sessions You can configure the maximum number of aggregate, per user, and per-protocol administrative sessions. Formerly, you could configure only the aggregate number of sessions. This feature does not affect console sessions. Note that in multiple context mode, you cannot configure the number of HTTPS sessions, where the maximum is fixed at 5 sessions. The  quota management-session  command is also no longer accepted in the system configuration, and is instead available in the context configuration. The maximum aggregate sessions is now 15; if you configured 0 (unlimited) or 16+, then when you upgrade, the value is changed to 15. New/Modified commands:  quota management-session ,  show quota management-session Notifications for administrative privilege level changes When you authenticate for enable access ( aaa authentication enable console  )  or allow privileged EXEC access directly ( aaa authorization exec auto-enable  ), then the ASA now notifies users if their assigned access level has changed since their last login. New/Modified commands:  show aaa login-history NTP support on IPv6 You can now specify an IPv6 address for the NTP server. New/Modified commands:  ntp server SSH stronger security See the following SSH security improvements: · SSH version 1 is no longer supported; only version 2 is supported. · Diffie-Hellman Group 14 SHA256 key exchange support. This setting is now the default. The former default was Group 1 SHA1. · HMAC-SHA256 integrity cipher support. The default is now the high security set of ciphers (hmac-sha1 and hmac-sha2-256). The former default was the medium set. New/Modified commands:  ssh cipher integrity ,  ssh key-exchange group dh-group14-sha256 ,  ssh version Allow non-browser-based HTTPS clients to access the ASA You can allow non-browser-based HTTPS clients to access HTTPS services on the ASA. By default, ASDM, CSM, and REST API are allowed. New/Modified commands:  http server basic-auth-client Capture control plane packets only on the cluster control link You can now capture control plane packets only on the cluster control link (and no data plane packets). This option is useful in the system in multiple context mode where you cannot match traffic using an ACL. New/Modified commands:  capture interface cluster cp-cluster debug conn  command The  debug conn  command was added to provide two history mechanisms that record connection processing. The first history list is a per-thread list that records the operations of the thread. The second history list is a list that records the operations into the conn-group. When a connection is enabled, processing events such as a connection lock, unlock, and delete are recorded into the two history lists. When a problem occurs, these two lists can be used to look back at the processing to determine the incorrect logic. New/Modified commands:  debug conn show tech-support  includes additional output The output of the  show tech-support  is enhanced to display the output of the following: ·  show ipv6 interface ·  show aaa-server ·  show fragment New/Modified commands:  show tech-support Support to enable and disable the results for free memory and used memory statistics during SNMP walk operations To avoid overutilization of CPU resources, you can enable and disable the query of free memory and used memory statistics collected through SNMP walk operations. We did not modify any commands.   Resolved and Open Bugs For information on fixes for various problems, see Resolved Bugs in Version 9.12(1). There are no open bugs at the time of publishing this blog. Related Documents For additional information on the ASA, see Navigating the Cisco ASA Series Documentation.           ... View more

Cisco announces the availability of Firepower 4100/9300 FXOS 2.6(1). New Features in this Release Support for ASA 9.12(1). Support for Radware DefensePro 8.13.01.09-3. You can now install a mix of different security module types on the same Firepower 9300. Support for this feature requires ASA 9.12(1) or later. Note: To use clustering with your Firepower 9300, all security modules installed on the chassis must be of the same type. For the FTD bootstrap configuration, you can now set the NAT ID for the FMC in the Firepower Chassis Manager. Previously, you could only set the NAT ID within the FXOS CLI or FTD CLI. Normally, you need both IP addresses (along with a registration key) for both routing purposes and for authentication—the FMC specifies the device IP address, and the device specifies the FMC IP address. However, if you only know one of the IP addresses, which is the minimum requirement for routing purposes, then you must also specify a unique NAT ID on both sides of the connection to establish trust for the initial communication and to look up the correct registration key. The FMC and device use the registration key and NAT ID (instead of IP addresses) to authenticate and authorize for initial registration. New/modified screens: Logical Devices > Add Device > Settings > Firepower Management Center NAT ID field You can now configure the key used for encrypting sensitive data during configuration export. You must set the encryption key before you can export a configuration. Make sure that the same encryption key is set on the system when importing that configuration. You can now generate and download technical support log files from Firepower Chassis Manager. You now have the option to enable or disable LLDP. You can now use a new Low Touch Provisioning method to perform first time setup over the Management port. Resolved and Open Bugs   For information on fixes for various problems, see Resolved Bugs in FXOS 2.6.1.131. For a list of open bugs, see Open Bugs in FXOS 2.6.1.131. Related Documents For additional information on the Firepower 9300 or 4100 series security appliance and FXOS, see Navigating the Cisco Firepower 4100/9300 FXOS Documentation. To view the latest release notes, see Cisco Firepower 4100/9300 FXOS Release Notes, 2.6(1). ... View more

As one of the largest security companies in the world, we take great pride in building solutions that many thousands of organizations trust to secure their networks. Small businesses and large enterprises alike rely on Cisco firewalls to keep their organizations running. With our latest release, Firepower Threat Defense (FTD) 6.3, our team is delivering value and bringing new possibilities to Firepower customers of all sizes.   Interested in knowing more, visit Joel Ferman’s  blog on Improve network and security operations with Firepower multi-instance and Cisco Threat Response. ... View more