Introduction
This document discuss about the new release for ASA v9.0.1 and ASDM v7.0.1 release.
Important points to remember
Important points to consider before an upgrade to 9.0:
ASA and ASDM Compatibility
ASA OS | ASDM | ASA Model: | ||||||||
ASA 5505 | ASA 5510, 5520, 5540 | ASA 5550 | ASA 5580 | ASA 5512-X, 5515-X, 5525-X, 5545-X, 5555-X | ASA 5585-X | ASASM | ASA 1000V | |||
ASA 9.0(1) | ASDM 7.0(1). | YES | YES | YES | YES | YES | YES | YES | No |
Limitations and Restrictions
•Clientless SSL VPN with a self-signed certificate on the ASA—When the ASA uses a self-signed certificate or an un-trusted certificate, Firefox 4 and later and Safari are unable to add security exceptions when browsing using an IPv6 address HTTPS URL (FQDN URL is OK): the "Confirm Security Exception" button is disabled. See: https://bugzilla.mozilla.org/show_bug.cgi?id=633001. This caveat affects all SSL connections originating from Firefox or Safari to the ASA (including clientless SSL VPN connections, and ASDM connections). To avoid this caveat, configure a proper certificate for the ASA that is issued by a trusted certificate authority. For Internet Explorer 9 and later, use compatibility mode.
•Citrix Mobile Receiver and accessing Virtual Desktop Infrastructure (VDI):
–CSD is not supported.
–HTTP redirect is not supported.
–Using Citrix Receiver mobile clients to access web interface of Citrix servers is not supported.
–Certificate or smart card authentication is not supported as a means of auto sign-on.
–You must install XML service and configure on XenApp and XenDesktop servers.
–Make sure the ports 443, 1494, 2598, and 80 are open on any intermediate firewalls between the ASA and the XenApp/XenDesktop server.
–The password-expire-in-days notification on tunnel group that is used by VDI is not supported.
•When configuring for IKEv2, for security reasons you should use groups 21, 20, 19, 24, 14, and 5. We do not recommend Diffie Hellman Group1 or Group2. For example, use
crypto ikev2 policy 10
group 21 20 19 24 14 5
Important Notes
•Downgrading issues—Upgrading to Version 9.0 includes ACL migration (see the "ACL Migration in Version 9.0" section). Therefore, you cannot downgrade from 9.0 with a migrated configuration. Be sure to make a backup copy of your configuration before you upgrade so you can downgrade using the old configuration if required.
•Per-session PAT disabled when upgrading— Starting in Version 9.0, by default, all TCP PAT traffic and all UDP DNS traffic use per-session PAT (see the xlate per-session command in the command reference). If you upgrade to Version 9.0 from an earlier release, to maintain the existing functionality of multi-session PAT, the per-session PAT feature is disabled during configuration migration. The ASA adds the following deny rules:
xlate per-session deny tcp any4 any4
xlate per-session deny tcp any4 any6
xlate per-session deny tcp any6 any4
xlate per-session deny tcp any6 any6
xlate per-session deny udp any4 any4 eq domain
xlate per-session deny udp any4 any6 eq domain
xlate per-session deny udp any6 any4 eq domain
xlate per-session deny udp any6 any6 eq domain
To enable per-session PAT after you upgrade, enter:
clear configure xlate
The above deny rules are cleared so that only the default permit rules are still in place, thus enabling per-session PAT.
•No Payload Encryption for export—You can purchase some models with No Payload Encryption. For export to some countries, payload encryption cannot be enabled on the Cisco ASA 5500 series. The ASA software senses a No Payload Encryption model, and disables the following features:
–Unified Communications
–VPN
You can still install the Strong Encryption (3DES/AES) license for use with management connections and encrypted route messages for OSPFv3. For example, you can use ASDM HTTPS/SSL, SSHv2, Telnet and SNMPv3. You can also download the dynamic database for the Botnet Traffic Filer (which uses SSL) and redirect traffic to Cloud Web Security.
References:
This document was generated from the following discussion: <span>ASA v9.0.1 and ASDM v7.0.1 released</span>