Network security is critical in today’s fast-growing infrastructure. To protect the data and provide next-generation firewall capabilities, Firepower has emerged to combat the growing threats and provide end-to-end data security with its robust firewalling capabilities. However, with the high-end security and data processing by any firewall, there is a latency, and that is unacceptable in scenarios where every microsecond counts or in situations where there is a high burst of data flowing through. For example, low latency is critical in data centers that run the database servers doing bandwidth intensive procedures such as backup to a different datacenter segment. To ensure that the big data flows that get through Firepower are processed quickly, the Flow Offload feature was introduced. This feature ensures that the flow that is trusted by the Firepower data path doesn’t need any processing by the x86. It is offloaded to the smart NIC hardware, which is lightning fast. Just to share the numbers, when the flow is offloaded, we can have a scintillating 21G TCP throughput and 40-G UDP throughputs.  A test demonstrates that we can transfer 64 bytes of UDP packets with just 2.9 microseconds of delay. The flow offload on Firepower 9300s and 4100s generally would trigger with the prefilter allowing the fast path for the given traffic. However, with the introduction of Dynamic Flow Offload in Firepower Threat Defense 6.3 release, SNORT dynamically decides to offload given traffic. The dynamic offloading is done under the following conditions: When the flows match an access control policy's trust rule action When there are flows that are trusted by the Intelligent Application Bypass (IAB) policy either explicitly or due to exceeding flow bypass thresholds When the flows that match file or intrusion policies qualify for flow offload. This results in the x86 pushing the flow to the smart NIC The Flow offload feature is enabled by default, and it can be disabled manually using SFCLI:  > configure flow-offload dynamic whitelist disable This feature is supported in high availability mode (active/standby) pair and clustering mode wherein the symmetric flows (forward and backward flows hitting the connection owner directly) can be offloaded easily to the smart NIC. Some of Cisco's competitors follow a similar behavior, which is purely at the cost of security. Their focus is primarily centered on to fast switch the traffic through the hardware. With Firepower, when the flow is offloaded to the hardware smart NIC, Firepower is intelligent enough to offer a certain level of security by performing TCP sequence randomization, rewrite of header fielder of IP Addresses and NAT/PAT. This intelligence makes Firepower a winner over its competitions. After a flow is offloaded, packets within the flow may also be returned to the Firepower Threat Defense device for further processing under the following conditions: When the packets from a particular flow include TCP options other than the timestamp When packets from the flow are fragmented or are subjected to Equal-Cost Multi-Path (ECMP) routing When the ingress packets move from one interface to another This innovation and improvisation are a savior when dealing with thick fat flows and is readily accepted by the customers globally on the field. Cheers! - Hemant Madan     ... View more

CSM 4.19 We recently announced the release of ASA 9.12.1 containing a rich feature set targeting our customers to help solve their higher throughput needs with the support for new SM-40,48 modules for the FPR9300 platforms along with support for 4115, 4125, 4145 for the FPR4100 platforms. The release also focused on our service provider customers by bridging the gap with features such as CGNAT interim logging for port block allocation and updated GTPv1 to RLS10. This release also introduces the integration of ASA with Umbrella. What’s New This release includes the following new features and enhancements: Support for ASA 9.12 (1) version Support for CGNAT enhancements— The CGNAT interim logging feature allows you to configure a timer interval to generate syslog for all the active port blocks allocated at that point in time. You can configure in the Policies> NAT > Global Options page. This feature is supported on Cluster and Failover topologies of ASA 9.12(1) and higher devices. Support for Umbrella connector global enhancements— In Cisco Security Manager 4.18, the Umbrella Connector Global Configuration page was introduced under Device Administration. In Cisco Security Manager 4.19, further enhancements are made—configuring umbrella IPv4 resolver, the umbrella IPv6 resolver, and configuring local domain bypass regex value. OSPF key chain support—Beginning with version 4.19, Cisco Security Manager supports the OSPF key chain authentication. This authentication feature allows you to configure key chain authentication for OSPF virtual link and OSPF interface. In Cisco Security Manager, you can add the key chain in the policy object manager and configure it in OSPF authentication page for ASA 9.12(1) or higher devices. Support security requirements over IPv6—Earlier, IPv6 support was not available for NTP server. Beginning with Cisco Security Manager 4.19, IPv6 support is provided. Deprecation of DH Group 1—Cisco Security Manager supports numerous DH group algorithms in various policies. DH groups determine the strength of the key used in the key exchange process. DH Group1 is no longer considered to be secured against threats prevailing in current networking world. Hence, beginning from CSM 4.19, DH group1 support is removed for ASA 9.12(1) or higher devices. Removal of trustpool import default bundle—In order to comply with PSB requirement, Trustpool Import Default Bundle option is removed from trusted pool policy (under Remote Access VPN) for ASA 9.12(1) or higher devices. Provision for management access sessions on ASA devices—Beginning with 4.19, Cisco Security Manager allows you to configure enforcement of limits for the maximum number of admin sessions across all connection types and usernames. The quota is also provisioned for maximum number of concurrent sessions per username as well as per protocol limits on ASA 9.12(1) devices or higher. The configured session concurrence limits is enforced prior to authenticating the incoming administrative session. Support to capture control packets on cluster interface—Beginning with 4.19, Cisco Security Manager allows capture of control packets on cluster interface of ASA devices. This new static interface option allows you to capture cluster control plane packets. This information is useful to troubleshoot issues on cluster especially in multi-context mode. Resolved and Open Bugs For information on fixes for various problems, see Resolved caveats—Release 4.19. Related Documents For additional information on CSM, see Release Notes. ASDM 7.12.1 Cisco's Adaptive Security Device Manager (ASDM) is the GUI tool used to manage the Cisco ASA security appliances. This section contains the new features, bugs fixed and open, and related documentation for ASDM 7.12.1 release. What’s New This release includes the following new features and enhancements: Feature Description Platform Features Support for ASA and FTD on separate modules of the same Firepower 9300 You can now deploy ASA and FTD logical devices on the same Firepower 9300. Requires FXOS 2.6.1. No modified screens. Firewall Features GTPv1 release 10.12 support. The system now supports GTPv1 release 10.12. Previously, the system supported release 6.1. The new support includes recognition of 25 additional GTPv1 messages and 66 information elements. In addition, there is a behavior change. Now, any unknown message IDs are allowed. Previously, unknown messages were dropped and logged. No modified screens. Cisco Umbrella Enhancements. You can now identify local domain names that should bypass Cisco Umbrella. DNS requests for these domains go directly to the DNS servers without Umbrella processing. You can also identify which Umbrella servers to use for resolving DNS requests. Finally, you can define the Umbrella inspection policy to fail open, so that DNS requests are not blocked if the Umbrella server is unavailable. New/Modified screens: Configuration > Firewall > Objects > Umbrella, Configuration > Firewall > Objects > Inspect Maps> DNS. The object group search threshold is now disabled by default. If you enabled object group search, the feature was subject to a threshold to help prevent performance degradation. That threshold is now disabled by default. You can enable it by using the object-group-search threshold command. We changed the following screen: Configuration > Access Rules > Advanced. Interim logging for NAT port block allocation. When you enable port block allocation for NAT, the system generates syslog messages during port block creation and deletion. If you enable interim logging, the system generates message 305017 at the interval you specify. The messages report all active port blocks allocated at that time, including the protocol (ICMP, TCP, UDP) and source and destination interface and IP address, and the port block. New/Modified screen: Configuration > Firewall > Advanced > PAT Port Block Allocation. VPN Features New condition option for debug aaa . The condition option was added to the debug aaa command. You can use this option to filter VPN debugging based on group name, user name, or peer IP address. No modified screens. Support for RSA SHA-1 in IKEv2 You can now generate a signature using the RSA SHA-1 hashing algorithm for IKEv2. New/Modified screens: View the default SSL configuration for both DES and 3DES encryption licenses as well as available ciphers You can now view the default SSL configuration with and without the 3DES encryption license. In addition, you can view all the ciphers supported on the device. New/Modified commands: show ssl information No modified screens. Add subdomains to webVPN HSTS Allows domain owners to submit what domains should be included in the HSTS preload list for web browsers. New/Modified screens: Configuration > Remote Access VPN > Clientless SSL VPN Access > Advanced > Proxies > Enable HSTS Subdomains field High Availability and Scalability Features Per-site gratuitous ARP for clustering The ASA now generates gratuitous ARP (GARP) packets to keep the switching infrastructure up to date: the highest priority member at each site periodically generates GARP traffic for the global MAC/IP addresses. When using per-site MAC and IP addresses, packets sourced from the cluster use a site-specific MAC address and IP address, while packets received by the cluster use a global MAC address and IP address. If traffic is not generated from the global MAC address periodically, you could experience a MAC address timeout on your switches for the global MAC address. After a timeout, traffic destined for the global MAC address will be flooded across the entire switching infrastructure, which can cause performance and security concerns. GARP is enabled by default when you set the site ID for each unit and the site MAC address for each Spanned EtherChannel. New/Modified screens: Configuration > Device Management > High Availability and Scalability > ASA Cluster > Cluster Configuration > Site Periodic GARP field Routing Features OSPF Keychain support for authentication OSPF authenticates the neighbor and route updates using MD5 keys. In ASA, the keys that are used to generate the MD5 digest had no lifetime associated with it. Thus, user intervention was required to change the keys periodically. To overcome this limitation, OSPFv2 supports MD5 authentication with rotating keys. Based on the accept and send lifetimes of Keys in KeyChain, OSPF authenticates, accepts or rejects keys and forms adjacency. New/Modified screens: Configuration > Device Setup > Key Chain Configuration > Device Setup > Routing > OSPF > Setup > Authentication Configuration > Device Setup > Routing > OSPF > Setup > Virtual Link Certificate Features Local CA configurable FQDN for enrollment URL To make the FQDN of the enrollment URL configurable instead of using the ASA's configured FQDN, a new CLI option is introduced. This new option is added to the smtp mode of crypto ca server . New/Modified commands: fqdn Administrative, Monitoring, and Troubleshooting Features enable password change now required on a login The default enable password is blank. When you try to access privileged EXEC mode on the ASA, you are now required to change the password to a value of 3 characters or longer. You cannot keep it blank. The no enable password command is no longer supported. At the CLI, you can access privileged EXEC mode using the enable command, the login command (with a user at privilege level 2+), or an SSH or Telnet session when you enable aaa authorization exec auto-enable . All of these methods require you to set the enable password. This password change requirement is not enforced for ASDM logins. In ASDM, by default, you can log in without a username and with the enable password. No modified screens. Configurable limitation of admin sessions You can configure the maximum number of aggregate, per user, and per-protocol administrative sessions. Formerly, you could configure only the aggregate number of sessions. This feature does not affect console sessions. Note that in multiple context mode, you cannot configure the number of HTTPS sessions, where the maximum is fixed at five sessions. The quota management-session command is also no longer accepted in the system configuration and is instead available in the context configuration. The maximum aggregate sessions is now 15; if you configured 0 (unlimited) or 16+, then when you upgrade, the value is changed to 15. New/Modified screens: Configuration > Device Management > Management Access > Management Session Quota Notifications for administrative privilege level changes When you authenticate for enable access (aaa authentication enable console ) or allow privileged EXEC access directly (aaa authorization exec auto-enable ), then the ASA now notifies users if their assigned access level has changed since their last login. New/Modified screens: Status bar > Login History icon NTP support on IPv6 You can now specify an IPv6 address for the NTP server. New/Modified screens: Configuration > Device Setup > System Time > NTP > Add button > Add NTP Server Configuration dialog box SSH stronger security See the following SSH security improvements: SSH version 1 is no longer supported; only version 2 is supported. Diffie-Hellman Group 14 SHA256 key exchange support. This setting is now the default. The former default was Group 1 SHA1. HMAC-SHA256 integrity cipher support. The default is now the high security set of ciphers (hmac-sha1 and hmac-sha2-256). The former default was the medium set. New/Modified screens: Configuration > Device Management > Management Access > ASDM/HTTPS/Telnet/SSH Configuration > Device Management > Advanced > SSH Ciphers Allow non-browser-based HTTPS clients to access the ASA You can allow non-browser-based HTTPS clients to access HTTPS services on the ASA. By default, ASDM, CSM, and REST API are allowed. New/Modified screens. Configuration > Device Management > Management Access > HTTP Non-Browser Client Support Capture control plane packets only on the cluster control link You can now capture control plane packets only on the cluster control link (and no data plane packets). This option is useful in the system in multiple context mode where you cannot match traffic using an ACL. New/Modified screens: Wizards > Packet Capture Wizard > Cluster Option debug conn command The debug conn command was added to provide two history mechanisms that record connection processing. The first history list is a per-thread list that records the operations of the thread. The second history list is a list that records the operations into the conn-group. When a connection is enabled, processing events such as a connection lock, unlock, and delete are recorded into the two history lists. When a problem occurs, these two lists can be used to look back at the processing to determine the incorrect logic. New/Modified commands: debug conn show tech-support includes additional output The output of the show tech-support is enhanced to display the output of the following: show ipv6 interface show aaa-server show fragment New/Modified commands: show tech-support ASDM support to enable and disable the results for free memory and used memory statistics during SNMP walk operations To avoid overutilization of CPU resources, you can enable and disable the query of free memory and used memory statistics collected through SNMP walk operations. New or modified screen: Configuration > Device Management > Management Access > SNMP Configurable graph update interval for the ASDM Home pane for the System in multiple-context mode For the System in multiple context mode, you can now set the amount of time between updates for the graphs on the Home pane. New/Modified screens: Tools > Preferences > Graph User time interval in System Context Resolved and Open Bugs For information on fixes for various problems, see Resolved Bugs in Version 7.12(1). Related Documents For additional information on the ASA, see  Navigating the Cisco ASA Series Documentation . - Authored by Kaushik Swaminathan ... View more

With the 6.4 release, the Firepower Management Center (FMC) supports the Open API standards for the API specification. The Open API Specification site quotes the following about Open API standards – “The OpenAPI Specification (OAS) defines a standard, programming language-agnostic interface description for REST APIs, which allows both humans and computers to discover and understand the capabilities of a service without requiring access to source code, additional documentation, or inspection of network traffic.” The FMC Open API support adds new capabilities that make integration with the FMC much easier and simpler. This blog contains information on accessing the new API Explorer page, navigating the explorer pages for supported API operations, specific examples for applicable operations, executing or trying out an operation, information on the API model and downloading the specification, and information on various open source tools for the API client development. The Open API Specification (OAS) brings in powerful new capabilities in the way you consume the APIs. Let’s delve further to see how you can access these APIs in FMC. The original URL “https://<<your-server>>/api/api-explorer” takes you to the new API explorer screen that leverages the Open API standards. The new FMC API Explorer screen uses the Swagger UI to render this page. Let’s have a quick look at the various options on this page. Download Spec: This is a direct link to download the Open API specification for the whole of FMC. It also thoroughly describes all the supported API operations. Legacy Explorer: This links to the legacy API explorer interface page, which has all API information in the older format. Logout: A link to log out from the page. REST URLs and Supported Methods: This is an information section that provides references and quick links for more resources. Domains: A domain selector that allows you to choose the domain on which you want to perform your API calls. API Resource Section: This section provides complete details on the supported APIs and a convenient way of trying them out. Let’s now delve deep into the API resource section that contains all the information on supported operations and their models. The page consists of a list of top-level sections – Devices, Policy Assignments, Device HA Pairs, and so on. The section is divided based on the top-level area under which the API resources are available. For example, the Devices section contains all APIs related to device operations; the Policy Assignments section has APIs that can assign policies to different targets, and so on. Clicking a top-level section header displays the list of operations and URLs that are supported under it. Clicking further on the corresponding URL opens the specific REST API with more details. As an example, let’s explore the GET /api/fmc_config/v1/domain/{domainUUID}/object/hosts/{objectID} REST API call in detail using the API explorer. The host is essentially a host network object which is contained within the Objects section. Clicking on the GET operation in the Object sections opens more details around it. The GET page includes a short description of the GET object, a Try it out button to try out the GET operation on the FMC, and the query and path parameters that are required to try out this operation successfully. Let’s scroll down a bit further to see more details from the Responses section. The Responses section contains some useful information like the supported examples for the operation, the response code (200 in this case), and the Model link beside the Example Value that provides more details about the Model itself. Note: Any applicable Cisco provided example content irrespective of the type of HTTP operation – GET, PUT, POST or DELETE is always mentioned in the responses section of the operation in question. Let’s now explore the model link. Choosing the Model link displays a comprehensive model description of the model attributes used in this operation. The second-level models like Metadata can be expanded for more details. To try out an actual operation, click the Try it out button. Fill in the relevant data and click the Execute button, which displays the results in the responses section. For example, the domainUUID is automatically populated based on the Domain that is selected in the top of the page. Note: All operations are always performed on the actual server data on the FMC from where the API Explorer is launched. Finally, let’s have a quick glimpse at the open API specification itself. As mentioned at the beginning of this overview, you can use the Download Spec to download the Open API specification for the whole of FMC. It thoroughly describes all the supported API operations to ease the API client development. The FMC API supports the Open API standards version 2.0. There is also a bunch of open source tools available to ease the process of developing API clients to integrate with the FMC API using the Open API specification. Here’s a short list of some of the open source projects that can be of some help (listed in no specific order): Swagger Code Gen : This can be used to auto-generate documentation, and API clients in different languages by using the Open API specification file. Bravado : This is a Python client library for API that supports Open API version 2.0. OpenAPI Generator : This generates clients, servers, and documentation from OpenAPI 2.0/3.x specifications. Go-Swagger : This can be used for Go-based client generation. Note: The tools mentioned here are not specifically evaluated or endorsed for use with the FMC Open API specification. It is the responsibility of the consumer to evaluate specific tools based on their individual need. Hope you found this blog useful and that it helped you to explore the possibilities with FMC Open API support. Cheers - Vijaya Raghavan S V ... View more

Cisco announces the availability of Firepower 6.4.0. You can download the Firepower 6.4.0 software from the Software Download page and view the release notes at Cisco Firepower Release Notes, Version 6.4.0. In addition to the new features (summarized in the table below), the Firepower 6.4.0 release includes these significant enhancements to user experience: Improved FTDv Getting Started Guides for VMware and KVM that merge FDM and FMC management modes. For more information, see Cisco Firepower Threat Defense Virtual for VMware Getting Started Guide and Cisco Firepower Threat Defense Virtual for KVM Getting Started Guide . Improved Firepower 4100 and 9300 Getting Started Guides that merge FXOS, FTD, and ASA. For more information, see Cisco Firepower 4100 Getting Started Guide and Cisco Firepower 9300 Getting Started Guide . New Cisco Firepower App for Splunk User Guide . Cisco Firepower App for Splunk presents security and network event information sent to Splunk from Firepower Management Center running version 6.0 or later.   New Features in FMC/Firepower Version 6.4.0 The following table lists the new features available in Firepower Version 6.4 when configured using a Firepower Management Center.   Feature Description Hardware and Virtual Hardware FMCv on Azure We introduced Firepower Management Center Virtual on Microsoft Azure. ASA and FTD on the same Firepower 9300 You can now deploy ASA and FTD logical devices on the same Firepower 9300, which requires FXOS 2.6.1. For more information, see Cisco Firepower 4100/9300 FXOS Release Notes, 2.6(1) and Release Notes for the Cisco ASA Series, 9.12(x). Firepower Threat Defense Routing Rotating (keychain) authentication for OSPFv2 routing You can now use rotating (keychain) authentication when configuring OSPFv2 routing. New/modified screens: Objects > Object Management > Key Chain object Devices > Device Management > edit device > Routing tab > OSPF settings > Interface tab > add/edit interface > Authentication option Devices > Device Management > edit device > Routing tab > OSPF settings > Area tab > add/edit area > Virtual Link sub-tab > add/edit virtual link > Authentication option Supported platforms: FTD Firepower Threat Defense Encryption and VPN RA VPN: Duo as first factor in two-factor authentication You can now use a Duo proxy server (which also acts as a RADIUS server) as the first factor in RA VPN two-factor authentication. For details from Duo, see: Cisco Firepower Threat Defense (FTD) VPN with AnyConnect. Supported platforms: FTD RA VPN: Secondary authentication Secondary authentication, also called double authentication, adds an additional layer of security to RA VPN connections by using two different authentication servers. With secondary authentication enabled, AnyConnect VPN users must provide two sets of credentials to log in to the VPN gateway. RA VPN supports secondary authentication for the AAA Only and Client Certificate and AAA authentication methods. New/modified screens: Devices > VPN > Remote Access > add/edit configuration > Connection Profile > AAA area Supported platforms: FTD Site-to-site VPN: Dynamic IP addresses for extranet endpoints You can now configure site to site VPNs to use a dynamic IP address for extranet endpoints. In hub-and-spoke deployments, you can use a hub as an extranet endpoint. New/modified screens: Devices > VPN > Site To Site > add/edit FTD VPN topology > Endpoints tab > add endpoint > IP Address option Supported platforms: FTD Site-to-site VPN: Dynamic crypto maps for point-to-point topologies You can now use dynamic crypto maps in point-to-point as well as in hub-and-spoke VPN topologies. Dynamic crypto maps are still not supported for full mesh topologies. You specify the crypto map type when you configure a topology. Make sure you also specify a dynamic IP address for one of the peers in the topology. New/modified screens: Devices > VPN > Site To Site > add/edit FTD VPN topology > IPsec tab > Crypto Map Type option Supported platforms: FTD TLS crypto acceleration SSL hardware acceleration has been renamed TLS crypto acceleration. Depending on the device, TLS crypto acceleration might be performed in software or in hardware. The Version 6.4 upgrade process automatically enables acceleration on all eligible devices, even if you previously disabled the feature manually. In most cases you cannot configure this feature; it is automatically enabled and you cannot disable it. However, if you are using the multi-instance capability of the Firepower 4100/9300 chassis, you can enable TLS crypto acceleration for one container instance per module/security engine. Acceleration is disabled for other container instances, but enabled for native instances. New FXOS CLI commands for the Firepower 4100/9300 chassis: show hwCrypto enable config hwCrypto enable New FTD CLI commands: show crypto accelerator status (replaces system support ssl-hw-status ) Removed FTD CLI commands: system support ssl-hw-accel enable system support ssl-hw-accel disable system support ssl-hw-status Supported platforms: Firepower 2100 series, Firepower 4100/9300 chassis Events, Logging, and Analysis Improvements to syslog messages for file and malware events Fully-qualified file and malware event data can now be sent from managed devices via syslog. New/modified screens: Policies > Access Control > Access Control > add/edit policy > Logging tab > File and Malware Settings area Supported platforms: Any Search intrusion events by CVE ID You can now search for intrusion events generated as a result of a particular CVE exploit. New/modified screens: Analysis > Search Supported platforms: FMC IntrusionPolicy field is now included in syslog Intrusion event syslog messages now specify the intrusion policy that triggered the event. Supported platforms: Any Cisco Threat Response (CTR) integration Cisco Threat Response is a new Cisco offering that you will be able to integrate with Firepower Threat Defense deployments. CTR's powerful analysis tools will allow you to integrate Firepower event data with data from other sources for a unified view of threats on your network. Note  CTR will not be available until after Firepower 6.4 releases. Until then, configuring CTR integration in the web interface has no effect. New/modified screens: System > Integration > Cloud Services Supported platforms: FTD Splunk integration Splunk users can use a new, separate Splunk app, Cisco Firepower App for Splunk, to analyze events. Available functionality is affected by your Firepower version. Supported platforms: FMC Administration FTDv on VMware defaults to vmxnet3 interfaces FTDv on VMware now defaults to vmxnet3 interfaces when you create a virtual device. Previously, the default was e1000. The vmxnet3 device drivers and network processing are integrated with the ESXi hypervisor, so they use fewer resources and offer better network performance. Note  If you are using e1000 interfaces, we strongly recommend you switch. For more information, refer to the instructions on adding and configuring VMware interfaces in the Cisco Firepower Threat Defense Virtual for VMware Quick Start Guide. Supported platforms: FTDv on VMware Ability to disable Duplicate Address Detection (DAD) on management interfaces When you enable IPv6, you can disable DAD. You might want to disable DAD because using DAD opens up the possibility of denial of service attacks. If you disable this setting, you need check manually that this interface is not using an already-assigned address. New/modified screens: System > Configuration > Management Interfaces > Interfaces area > edit interface > IPv6 DADcheck box Supported platforms: FMC, 7000 and 8000 Series Ability to disable ICMPv6 Echo Reply and Destination Unreachable messages on management interfaces When you enable IPv6, you can now disable ICMPv6 Echo Reply and Destination Unreachable messages. You might want to disable these packets to guard against potential denial of service attacks. Disabling Echo Reply packets means you cannot use IPv6 ping to the device management interfaces for testing purposes. New/modified screens: System > Configuration > Management Interfaces > ICMPv6 New/modified commands: configure network ipv6 destination-unreachable configure network ipv6 echo-reply Supported platforms: FMC (web interface only), managed devices (CLI only) Support for the Service-Type attribute for FTDusers defined on the RADIUS server For RADIUS authentication of FTD CLI users, you used to have to predefine the usernames in the RADIUS external authentication object and manually make sure that the list matched usernames defined on the RADIUS server. You can now define CLI users on the RADIUS server using the Service-Type attribute and also define both Basic and Config user roles. To use this method, be sure to leave the shell access filter blank in the external authentication object. New/modified screens: System > Users > External Authentication tab > add/edit external authentication object > Shell Access Filter Supported platforms: FTD Signed SRU, VDB, and GeoDB updates So that Firepower can verify that you are using the correct update files, Version 6.4+ uses signedupdates for intrusion rules (SRU), the vulnerability database (VDB), and the geolocation database (GeoDB). For more information, see Security Enhancement: Signed SRU, VDB, and GeoDB Updates. Supported platforms: Any Scheduled remote backups of managed devices You can now use the FMC to schedule remote backups of certain managed devices. Previously, only 7000 and 8000 series devices supported scheduled backups, and you had to use the device's local GUI. New/modified screens: System > Tools > Scheduling > add/edit task > choose Job Type: Backup > choose a Backup Type Supported platforms: FTD physical platforms, FTDv for VMware, 7000/8000 series Exceptions: No support for FTD clustered devices or container instances Monitoring and Troubleshooting URL Filtering Monitor improvements You can now configure time thresholds for URL Filtering Monitor alerts. New/modified screens: System > Health > Policy > add/edit policy > URL Filtering Monitor Supported platforms: Any Hit counts for access control and prefilter rules You can now access hit counts for access control and prefilter rules on your FTD devices. New/modified screens: Policies > Access Control > Access Control > add/edit policy > Analyze Hit Counts Policies > Access Control > Prefilter > add/edit policy > Analyze Hit Counts New commands: show rule hits clear rule hits cluster exec show rule hits cluster exec clear rule hits show cluster rule hits Modified commands: show failover now contains object static counts related to syncing hit counts between HA peers Supported platforms: FTD Connection-based troubleshooting Connection-based troubleshooting or debugging provides uniform debugging across modules to collect appropriate logs for a specific connection. It also supports level-based debugging up to 7 levels and enables uniform log collection mechanism for lina and Snort logs. New/modified commands: clear packet debug debug packet start debug packet stop show packet debugs Supported platforms: FTD Firepower Management Center REST API New REST API capabilities Added REST API objects to support Version 6.4 features: cloudeventsconfigs: Manage Cisco Threat Response integration. ftddevicecluster: Manage chassis clustering. hitcounts: Manage hit count statistics for access control and prefilter rules. keychain: Manage key chain objects used for rotating authentication when configuring OSPFv2 routing. loggingsettings: Manage logging settings for access control policies Supported platforms: FMC API Explorer based on OAS Version 6.4 uses a new API Explorer, based on the OpenAPI Specification (OAS). As part of the OAS, you now use CodeGen to generate sample code. You can still access the legacy API Explorer if you prefer. Supported platforms: FMC Performance Snort restart improvements Before Version 6.4, during Snort restarts, the system dropped encrypted connections that matched a 'Do not decrypt' SSL rule or default policy action. Now, routed/transparent traffic passes without inspection instead of dropping, as long as you did not disable large flow offload or Snort preserve-connection. Supported platforms: Firepower 4100/9300 Faster access control The Version 6.4 upgrade process enables egress optimization on eligible devices, which enhances access control performance. For more information, see the Cisco Firepower Threat Defense Command Reference. We strongly recommend you leave this feature enabled. If you have questions, contact Cisco TAC. Supported platforms: FTD Faster SNMP event logging Performance improvements when sending intrusion and connection events to an external SNMP trap server. Supported platforms: Any Faster deploy Improvements to appliance communications and deploy framework. Supported platforms: FTD Faster upgrade Improvements to the event database. Supported platforms: Any   New Features in Firepower Device Manager/FTD Version 6.4.0   The following table lists the new features available in FTD 6.4.0 when configured using Firepower Device Manager. Feature Description Hardware bypass for the ISA 3000. You can now configure hardware bypass for the ISA 3000 on the Device > Interfaces page. In release 6.3, you needed to configure hardware bypass using FlexConfig. If you are using FlexConfig, please redo the configuring on the Interfaces page and remove the hardware bypass commands from FlexConfig. However, the portion of the FlexConfig devoted to disabling TCP sequence number randomization is still recommended. Ability to reboot and shut down the system from FDM. You can now issue the reboot and shutdown commands through the CLI Console in FDM. Previously, you needed to open a separate SSH session to the device to reboot or shut down the system. You must have Administrator privileges to use these commands. External Authentication and Authorization using RADIUS for FTD CLI Users. You can use an external RADIUS server to authenticate and authorize users logging into the FTD CLI. You can give external users config (administrator) or basic (read-only) access. We added the SSH configuration to the AAA Configuration tab on the Device > System Settings > Management Access page. Support for network range objects and nested network group objects. You can now create network objects that specify a range of IPv4 or IPv6 addresses, and network group objects that include other network groups (that is, nested groups). We modified the network object and network group object Add/Edit dialog boxes to include these features, and modified the various security policies to allow the use of these objects, contingent on whether address specifications of that type make sense within the context of the policy. Full-text search options for objects and rules. You can do a full-text search on objects and rules. By searching a policy or object list that has a large number of items, you can find all items that include your search string anywhere within the rule or object. We added a search box to all policies that have rules, and to all pages on the Objects list. In addition, you can use the filter=fts~ search-string option on GET calls for supported objects in the API to retrieve items based on a full-text search. Obtaining a list of supported API versions for an FDM-managed FTD device. You can use the GET /api/versions (ApiVersions) method to get a list of the API versions that are supported on a device. You can use your API client to communicate and configure the device using commands and syntax valid for any of the supported versions. FTD REST API version 3 (v3). The FTD REST API for software version 6.4 has been incremented to version 3. You must replace v1/v2 in the API URLs with v3. The v3 API includes many new resources that cover all features added in software version 6.4. Please re-evaluate all existing calls, as changes might have been mode to the resource models you are using. To open the API Explorer, where you can view the resources, change the end of the Firepower Device Manager URL to /#/api-explorer after logging in. Hit counts for access control rules. You can now view hit counts for access control rules. The hit counts indicate how often connections matched the rule. We updated the access control policy to include hit count information. In the FTD API, we added the HitCounts resource and the includeHitCounts and filter=fetchZeroHitCounts options to the GET Access Policy Rules resource. Site-to-Site VPN enhancements for dynamic addressing and certificate authentication. You can now configure site-to-site VPN connections to use certificates instead of preshared keys to authenticate the peers. You can also configure connections where the remote peer has an unknown (dynamic) IP address. We added options to the Site-to-Site VPN wizard and the IKEv1 policy object. Support for RADIUS servers and Change of Authorization in remote access VPN. You can now use RADIUS servers for authenticating, authorizing, and accounting remote access VPN (RA VPN) users. You can also configure Change of Authentication (CoA), also known as dynamic authorization, to alter a user’s authorization after authentication when you use a Cisco ISE RADIUS server. We added attributes to the RADIUS server and server group objects, and made it possible to select a RADIUS server group within an RA VPN connection profile. Multiple connection profiles and group policies for remote access VPN. You can configure more than one connection profile, and create group policies to use with the profiles. We changed the Device > Remote Access VPN page to have separate pages for connection profiles and group policies, and updated the RA VPN Connection wizard to allow the selection of group policies. Some items that were previously configured in the wizard are now configured in the group policy. Support for certificate-based, second authentication source, and two-factor authentication in remote access VPN. You can use certificates for user authentication, and configure secondary authentication sources so that users must authenticate twice before establishing a connection. You can also configure two-factor authentication using RSA tokens or Duo passcodes as the second factor. We updated the RA VPN Connection wizard to support the configuration of these additional options. Support for IP address pools with multiple address ranges, and DHCP address pools, for remote access VPN. You can now configure address pools that have more than one address range by selecting multiple network objects that specify subnets. In addition, you can configure address pools in a DHCP server and use the server to provide addresses to RA VPN clients. If you use RADIUS for authorization, you can alternatively configure the address pools in the RADIUS server. We updated the RA VPN Connection wizard to support the configuration of these additional options. You can optionally configure the address pool in the group policy instead of the connection profile. Active Directory realm enhancements. You can now include up to 10 redundant Active Directory (AD) servers in a single realm. You can also create multiple realms and delete realms that you no longer need. In addition, the limit for downloading users in a realm is increased to 50,000 from the 2,000 limit in previous releases. We updated the Objects > Identity Sources page to support multiple realms and servers. You can select the realm in the user criteria of access control and SSL decryption rules, to apply the rule to all users within the realm. You can also select the realm in identity rules and RA VPN connection profiles. Redundancy support for ISE servers. When you configure Cisco Identity Services Engine (ISE) as an identity source for passive authentication, you can now configure a secondary ISE server if you have an ISE high availability setup. We added an attribute for the secondary server to the ISE identity object. File/malware events sent to external syslog servers. You can now configure an external syslog server to receive file/malware events, which are generated by file policies configured on access control rules. File events use message ID 430004, malware events are 430005. We added the File/Malware syslog server options to the Device > System Settings > Logging Settingspage. Logging to the internal buffer and support for custom event log filters. You can now configure the internal buffer as a destination for system logging. In addition, you can create event log filters to customize which messages are generated for the syslog server and internal buffer logging destinations. We added the Event Log Filter object to the Objects page, and the ability to use the object on the Device > System Settings > Logging Settings page. The internal buffer options were also added to the Logging Settings page. Certificate for the Firepower Device Manager Web Server. You can now configure the certificate that is used for HTTPS connections to the Firepower Device Manager configuration interface. By uploading a certificate your web browsers already trust, you can avoid the Untrusted Authority message you get when using the default internal certificate. We added the Device > System Settings > Management Access > Management Web Server page. Cisco Threat Response support. You can configure the system to send intrusion events to the Cisco Threat Response cloud-based application. You can use Cisco Threat Response to analyze intrusions. We added Cisco Threat Response to the Device > System Settings > Cloud Services page. ... View more

According to the Verizon 2018 Data Breach Investigations Report, 81% of hacking-related incidents leverage stolen or weak passwords. When your workforce requires access to business-critical information residing on your corporate network and cloud, a VPN connectivity with the highest level of security is a mandate. If an attacker steals employee’s VPN credentials and gains access to your network, they can masquerade as employees, obtain sensitive information, and disrupt business operations. Duo Multifactor Authentication (MFA) adds another layer of defense and makes breaches from stolen credentials a thing of the past. Duo’s MFA provides secure remote access to internal corporate applications using Cisco’s AnyConnect VPN on Adaptive Security Appliance (ASA) or Firepower Threat Defense (FTD). Duo’s multi-factor authentication is easy to use and deploy, and it offers the convenience of several authentication methods based on your specific use case such as Duo Push, which is the most secure and user-friendly. Duo is now natively integrated with Cisco AnyConnect and Next-Generation Firewall (NGWF). Here are five reasons why you should secure your VPN with Duo MFA to ensure trusted access: Protect against credential theft Achieve regulatory compliance Enable consistent access security for on-premises and cloud apps Gain visibility into all devices Enforce granular access security policies For more information, see a short video on CISCO + Duo Better Together and 5 Reasons to Protect your VPN with MFA . ... View more

Take advantage of Firepower’s most powerful, and well documented context-rich APIs to allow the exchange of network and endpoint security events, data, and host information. With these APIs, you can automate repetitive tasks for consistency and to avoid user errors, do configuration management automation, and automate mass deployments that need faster rollout of changes with a higher degree of consistency. The DevNet Firepower page contains all the resources such as videos, documentation, and learnings labs to get you started with programming and to get the most out of your Firepower environment. The DevNet Firepower page is categorized as follows: The Firepower Management Center (FMC) APIs allow the exchange of network and endpoint security events, data, and host information. The FMC APIs include: eStreamer The Cisco Event Streamer (also known as eStreamer) allows you to stream Firepower System events to external client applications. You can stream host, discovery, correlation, compliance white list, intrusion, user activity, file, malware, and connection data from a Management Center. For more information, see the eStreamer Integration Guide for 6.3.0 . Database Access The Firepower System database access feature allows you to query intrusion, discovery, user activity, correlation, connection, vulnerability, and application and URL statistics database tables on a Cisco Firepower Management Center, using a third-party client that supports JDBC SSL connections. For more information, see the Database Access Guide for 6.3.0 . Host Input The Firepower Management Center Host Input API provides a tool for importing data from other sources on your network to augment the monitored host information. For more information, see the Host Input API Guide for 6.0 . Remediation The Firepower System Remediation API allows you to create remediations that your Firepower Management Center can automatically launch when conditions on your network violate the associated correlation policy. For more information, see the Firepower System Remediation API Guide for 6.0 . REST The REST API is an application programming interface (API), based on “RESTful” principles, which you can quickly enable on any Firepower Management Center running version 6.1 or higher, and use with a REST client. You can use the REST APIs over HTTPS, and the REST API uses JavaScript Object Notation (JSON) format to represent objects. For more information, see the Firepower Management Center REST API Quick Start Guide for 6.3.0 . The Firepower Threat Defense (FTD) REST APIs help you to automate configuration management and execution of operational tasks on FTD devices. You can use the FTD REST APIs over HTTPS to interact with an FTD device through a client program. The REST API uses JavaScript Object Notation (JSON) format to represent objects. For more information, see the Cisco Firepower Threat Defense REST API Guide. The FXOS Firepower Chassis Manager REST APIs includes both Platform and Firepower Chassis Services RESTful APIs. With these APIs, you can configure and monitor the platform and Firepower Chassis Services. These APIs are solely for Platform services provided by Firepower eXtensible OS. For more information, see the Cisco Firepower Chassis Manager REST API Reference . Cisco Defense Orchestrator (CDO) is a cloud-based, multi-device manager that provides a simple, consistent, and highly secure way of managing security policies on all your ASA devices. Want to delve deep? Visit the Firepower programming knowledge hub at https://developer.cisco.com/firepower/. And, for detailed documentation on the programming guides, visit https://www.cisco.com/c/en/us/support/security/defense-center/products-programming-reference-guides-list.html. ... View more

Cisco announces the availability of ASA 9.12(1). New Features in this Release Feature Description Platform Features Support for ASA and  FTD  on separate modules of the same Firepower 9300 You can now deploy ASA and  FTD  logical devices on the same Firepower 9300. Requires FXOS 2.6.1. No modified commands. Firewall Features GTPv1 release 10.12 support. The system now supports GTPv1 release 10.12. Previously, the system supported release 6.1. The new support includes recognition of 25 additional GTPv1 messages and 66 information elements. In addition, there is a behavior change. Now, any unknown message IDs are allowed. Previously, unknown messages were dropped and logged. No modified commands. Cisco Umbrella Enhancements. You can now identify local domain names that should bypass Cisco Umbrella. DNS requests for these domains go directly to the DNS servers without Umbrella processing. You can also identify which Umbrella servers to use for resolving DNS requests. Finally, you can define the Umbrella inspection policy to fail open, so that DNS requests are not blocked if the Umbrella server is unavailable. New/Modified commands:  local-domain-bypass  ,  resolver  ,  umbrella fail-open . The object group search threshold is now disabled by default. If you enabled object group search, the feature was subject to a threshold to help prevent performance degradation. That threshold is now disabled by default. You can enable it by using the  object-group-search threshold  command. New/Modified command:  object-group-search threshold . Interim logging for NAT port block allocation. When you enable port block allocation for NAT, the system generates syslog messages during port block creation and deletion. If you enable interim logging, the system generates message 305017 at the interval you specify. The messages report all active port blocks allocated at that time, including the protocol (ICMP, TCP, UDP) and source and destination interface and IP address, and the port block. New/Modified command:  xlate block-allocation pba-interim-logging  seconds. VPN Features New  condition  option for  debug aaa  . The  condition  option was added to the  debug aaa  command. You can use this option to filter VPN debugging based on group name, user name, or peer IP address. New/Modified commands:  debug aaa condition Support for RSA SHA-1 in IKEv2 You can now generate a signature using the RSA SHA-1 hashing algorithm for IKEv2. New/Modified commands:  rsa-sig-sha1 View the default SSL configuration for both DES and 3DES encryption licenses as well as available ciphers You can now view the default SSL configuration with and without the 3DES encryption license. In addition, you can view all the ciphers supported on the device. New/Modified commands:  show ssl information Add subdomains to webVPN HSTS Allows domain owners to submit what domains should be included in the HSTS preload list for web browsers. New/Modified commands:  hostname(config-webvpn) includesubdomains High Availability and Scalability Features Per-site gratuitous ARP for clustering The ASA now generates gratuitous ARP (GARP) packets to keep the switching infrastructure up to date: the highest priority member at each site periodically generates GARP traffic for the global MAC/IP addresses. When using per-site MAC and IP addresses, packets sourced from the cluster use a site-specific MAC address and IP address, while packets received by the cluster use a global MAC address and IP address. If traffic is not generated from the global MAC address periodically, you could experience a MAC address timeout on your switches for the global MAC address. After a timeout, traffic destined for the global MAC address will be flooded across the entire switching infrastructure, which can cause performance and security concerns. GARP is enabled by default when you set the site ID for each unit and the site MAC address for each Spanned EtherChannel. New/Modified commands:  site-periodic-garp interval Routing Features OSPF Keychain support for authentication OSPF authenticates the neighbor and route updates using MD5 keys. In ASA, the keys that are used to generate the MD5 digest had no lifetime associated with it. Thus, user intervention was required to change the keys periodically. To overcome this limitation, OSPFv2 supports MD5 authentication with rotating keys. Based on the accept and send lifetimes of Keys in KeyChain, OSPF authenticates, accepts or rejects keys and forms adjacency. New/Modified commands:  accept-lifetime ,  area virtual-link authentication ,  cryptographic-algorithm ,  key ,  key chain ,  key-string ,  ospf authentication ,  send-lifetime Certificate Features Local CA configurable FQDN for enrollment URL To make the FQDN of the enrollment URL configurable instead of using the ASA's configured FQDN, a new CLI option is introduced. This new option is added to the  smpt  mode of  crypto ca server . New/Modified commands:  fqdn Administrative, Monitoring, and Troubleshooting Features enable  password change now required on a login The default  enable  password is blank. When you try to access privileged EXEC mode on the ASA, you are now required to change the password to a value of 3 characters or longer. You cannot keep it blank. The  no enable password  command is no longer supported. At the CLI, you can access privileged EXEC mode using the  enable  command, the  login  command (with a user at privilege level 2+), or an SSH or Telnet session when you enable  aaa authorization exec auto-enable . All of these methods require you to set the enable password. This password change requirement is not enforced for ASDM logins. In ASDM, by default you can log in without a username and with the  enable  password. New/Modified commands:  enable password Configurable limitation of admin sessions You can configure the maximum number of aggregate, per user, and per-protocol administrative sessions. Formerly, you could configure only the aggregate number of sessions. This feature does not affect console sessions. Note that in multiple context mode, you cannot configure the number of HTTPS sessions, where the maximum is fixed at 5 sessions. The  quota management-session  command is also no longer accepted in the system configuration, and is instead available in the context configuration. The maximum aggregate sessions is now 15; if you configured 0 (unlimited) or 16+, then when you upgrade, the value is changed to 15. New/Modified commands:  quota management-session ,  show quota management-session Notifications for administrative privilege level changes When you authenticate for enable access ( aaa authentication enable console  )  or allow privileged EXEC access directly ( aaa authorization exec auto-enable  ), then the ASA now notifies users if their assigned access level has changed since their last login. New/Modified commands:  show aaa login-history NTP support on IPv6 You can now specify an IPv6 address for the NTP server. New/Modified commands:  ntp server SSH stronger security See the following SSH security improvements: · SSH version 1 is no longer supported; only version 2 is supported. · Diffie-Hellman Group 14 SHA256 key exchange support. This setting is now the default. The former default was Group 1 SHA1. · HMAC-SHA256 integrity cipher support. The default is now the high security set of ciphers (hmac-sha1 and hmac-sha2-256). The former default was the medium set. New/Modified commands:  ssh cipher integrity ,  ssh key-exchange group dh-group14-sha256 ,  ssh version Allow non-browser-based HTTPS clients to access the ASA You can allow non-browser-based HTTPS clients to access HTTPS services on the ASA. By default, ASDM, CSM, and REST API are allowed. New/Modified commands:  http server basic-auth-client Capture control plane packets only on the cluster control link You can now capture control plane packets only on the cluster control link (and no data plane packets). This option is useful in the system in multiple context mode where you cannot match traffic using an ACL. New/Modified commands:  capture interface cluster cp-cluster debug conn  command The  debug conn  command was added to provide two history mechanisms that record connection processing. The first history list is a per-thread list that records the operations of the thread. The second history list is a list that records the operations into the conn-group. When a connection is enabled, processing events such as a connection lock, unlock, and delete are recorded into the two history lists. When a problem occurs, these two lists can be used to look back at the processing to determine the incorrect logic. New/Modified commands:  debug conn show tech-support  includes additional output The output of the  show tech-support  is enhanced to display the output of the following: ·  show ipv6 interface ·  show aaa-server ·  show fragment New/Modified commands:  show tech-support Support to enable and disable the results for free memory and used memory statistics during SNMP walk operations To avoid overutilization of CPU resources, you can enable and disable the query of free memory and used memory statistics collected through SNMP walk operations. We did not modify any commands.   Resolved and Open Bugs For information on fixes for various problems, see Resolved Bugs in Version 9.12(1). There are no open bugs at the time of publishing this blog. Related Documents For additional information on the ASA, see Navigating the Cisco ASA Series Documentation.           ... View more

Cisco announces the availability of Firepower 4100/9300 FXOS 2.6(1). New Features in this Release Support for ASA 9.12(1). Support for Radware DefensePro 8.13.01.09-3. You can now install a mix of different security module types on the same Firepower 9300. Support for this feature requires ASA 9.12(1) or later. Note: To use clustering with your Firepower 9300, all security modules installed on the chassis must be of the same type. For the FTD bootstrap configuration, you can now set the NAT ID for the FMC in the Firepower Chassis Manager. Previously, you could only set the NAT ID within the FXOS CLI or FTD CLI. Normally, you need both IP addresses (along with a registration key) for both routing purposes and for authentication—the FMC specifies the device IP address, and the device specifies the FMC IP address. However, if you only know one of the IP addresses, which is the minimum requirement for routing purposes, then you must also specify a unique NAT ID on both sides of the connection to establish trust for the initial communication and to look up the correct registration key. The FMC and device use the registration key and NAT ID (instead of IP addresses) to authenticate and authorize for initial registration. New/modified screens: Logical Devices > Add Device > Settings > Firepower Management Center NAT ID field You can now configure the key used for encrypting sensitive data during configuration export. You must set the encryption key before you can export a configuration. Make sure that the same encryption key is set on the system when importing that configuration. You can now generate and download technical support log files from Firepower Chassis Manager. You now have the option to enable or disable LLDP. You can now use a new Low Touch Provisioning method to perform first time setup over the Management port. Resolved and Open Bugs   For information on fixes for various problems, see Resolved Bugs in FXOS 2.6.1.131. For a list of open bugs, see Open Bugs in FXOS 2.6.1.131. Related Documents For additional information on the Firepower 9300 or 4100 series security appliance and FXOS, see Navigating the Cisco Firepower 4100/9300 FXOS Documentation. To view the latest release notes, see Cisco Firepower 4100/9300 FXOS Release Notes, 2.6(1). ... View more

As one of the largest security companies in the world, we take great pride in building solutions that many thousands of organizations trust to secure their networks. Small businesses and large enterprises alike rely on Cisco firewalls to keep their organizations running. With our latest release, Firepower Threat Defense (FTD) 6.3, our team is delivering value and bringing new possibilities to Firepower customers of all sizes.   Interested in knowing more, visit Joel Ferman’s  blog on Improve network and security operations with Firepower multi-instance and Cisco Threat Response. ... View more