Cisco Firepower 4100/9300 FXOS Release Notes, 1.1(4)
New Features in FXOS 1.1.4.179
New Features in FXOS 1.1.4.178
New Features in FXOS 1.1.4.175
New Features in FXOS 1.1.4.169
New Features in FXOS 1.1.4.140
New Features in FXOS 1.1.4.117
Upgrading a Standalone Firepower Security Appliance
Upgrading an ASA Failover Pair
Upgrading an Inter-chassis Cluster
Resolved Bugs in FXOS 1.1.4.179
Resolved Bugs in FXOS 1.1.4.178
Resolved Bugs in FXOS 1.1.4.175
Resolved Bugs in FXOS 1.1.4.169
Resolved Bugs in FXOS 1.1.4.140
Resolved Bugs in FXOS 1.1.4.117
Resolved Bugs in FXOS 1.1.4.95
Communications, Services, and Additional Information
First Published: March 20, 2016
Last Revised: August 18, 2017
This document contains release information for Cisco Firepower eXtensible Operating System 1.1(4).
Use this release note as a supplement with the other documents listed in the documentation roadmap:
http://www.cisco.com/go/firepower9300-docs
http://www.cisco.com/go/firepower4100-docs
Note: The online versions of the user documentation are occasionally updated after the initial release. As a result, the information contained in the documentation on Cisco.com supersedes any information contained in the context-sensitive help included with the product.
This document contains the following sections:
–New Features in FXOS 1.1.4.179
–New Features in FXOS 1.1.4.178
–New Features in FXOS 1.1.4.175
–New Features in FXOS 1.1.4.169
–New Features in FXOS 1.1.4.140
–New Features in FXOS 1.1.4.117
–New Features in FXOS 1.1.4.95
–Upgrading a Standalone Firepower Security Appliance
–Upgrading an ASA Failover Pair
–Upgrading an Inter-chassis Cluster
–Resolved Bugs in FXOS 1.1.4.179
–Resolved Bugs in FXOS 1.1.4.178
–Resolved Bugs in FXOS 1.1.4.175
–Resolved Bugs in FXOS 1.1.4.169
–Resolved Bugs in FXOS 1.1.4.140
–Resolved Bugs in FXOS 1.1.4.117
–Resolved Bugs in FXOS 1.1.4.95
The Cisco Firepower security appliance is a next-generation platform for network and content security solutions. The Firepower security appliance is part of the Cisco Application Centric Infrastructure (ACI) Security Solution and provides an agile, open, secure platform that is built for scalability, consistent control, and simplified management.
The Firepower security appliance provides the following features:
■Modular chassis-based security system—Provides high performance, flexible input/output configurations, and scalability.
■Firepower Chassis Manager—Graphical user interface provides a streamlined, visual representation of the current chassis status and allows for simplified configuration of chassis features.
■FXOS CLI—Provides command-based interface for configuring features, monitoring chassis status, and accessing advanced troubleshooting features.
■FXOS REST API—Allows users to programmatically configure and manage their chassis.
Cisco Firepower eXtensible Operating System 1.1.4.179 introduces the following new features in addition to the features included in earlier releases:
■Fixes for various problems (see Resolved Bugs in FXOS 1.1.4.179).
Cisco Firepower eXtensible Operating System 1.1.4.178 introduces the following new features in addition to the features included in earlier releases:
■Adds additional support for verifying security module adapters and provides CLI commands for viewing and updating the boot image for the adapter.
Note: After installing FXOS 1.1.4.178, you might receive a critical fault asking you to update the firmware for your security module adapters. For instructions, see Adapter Bootloader Upgrade.
■Fixes for various problems (see Resolved Bugs in FXOS 1.1.4.178).
Cisco Firepower eXtensible Operating System 1.1.4.175 introduces the following new features in addition to the features included in earlier releases:
■Fixes for various problems (see Resolved Bugs in FXOS 1.1.4.175).
Cisco Firepower eXtensible Operating System 1.1.4.169 introduces the following new features in addition to the features included in earlier releases:
■Fixes for various problems (see Resolved Bugs in FXOS 1.1.4.169).
Cisco Firepower eXtensible Operating System 1.1.4.140 introduces the following new features in addition to the features included in earlier releases:
■Support for DC power supply modules on Firepower 4100 Series security appliances.
■Increased maximum possible MTU value to 9216 for Jumbo Frame support on logical devices.
■Fixes for various problems (see Resolved Bugs in FXOS 1.1.4.140).
Cisco Firepower eXtensible Operating System 1.1.4.117 introduces the following new features in addition to the features included in earlier releases:
■Fixes for various problems (see Resolved Bugs in FXOS 1.1.4.117).
Cisco Firepower eXtensible Operating System 1.1.495 introduces the following new features:
■Fixes for various problems (see Resolved Bugs in FXOS 1.1.4.95).
■Support for Firepower Threat Defense 6.0.1.
■Service Chaining—The Firepower 9300 can support two services chained together on a single security module. In the current supported service chaining configuration, the Radware DefensePro (vDP) third-party application runs in front of the ASA firewall to protect customers and other applications from DDoS attacks. The Radware DefensePro application is not supported on the Firepower 4100 series security appliances, or with Firepower Threat Defense.
■You can now update the firmware on your Firepower security appliance using the CLI.
■You can now store configuration import/export settings in Firepower Chassis Manager so that they can be used for future import or export operations.
■Support for the Firepower 2-port 100G double-wide Network Module (FPR-DNM-2X100G) on the Firepower 9300 security appliance. For more information, see the Cisco Firepower 9300 Hardware Installation Guide ( http://www.cisco.com/c/en/us/td/docs/security/firepower/9300/hw/guide/b_install_guide_9300.html).
Note: Your Firepower 9300 security appliance must have Firmware package 1.0.10 or later installed before you can use the Firepower 100G Network Module. For instructions on how to verify your firmware package version and to upgrade the firmware if necessary, see the “Firmware Upgrade” topic in the Cisco FXOS CLI Configuration Guide, 1.1(4) or Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(4) ( http://www.cisco.com/go/firepower9300-config).
You can download software images for FXOS and supported applications from one of the following URLs:
■Firepower 9300 — https://software.cisco.com/download/type.html?mdfid=286287252
■Firepower 4100 — https://software.cisco.com/download/navigator.html?mdfid=286305164
For information about the applications that are supported on a specific version or FXOS, refer to the Cisco FXOS Compatibility guide at this URL:
http://www.cisco.com/c/en/us/td/docs/security/firepower/fxos/compatibility/fxos-compatibility.html
■Before you can use a Firepower 100G Network Module with your Firepower 9300 security appliance, the security appliance must have Firmware package 1.0.10 or later installed. For instructions on how to verify your firmware package version and to upgrade the firmware if necessary, see the “Firmware Upgrade” topic in the Cisco FXOS CLI Configuration Guide, 1.1(4) or Cisco FXOS Firepower Chassis Manager Configuration Guide, 1.1(4) ( http://www.cisco.com/go/firepower9300-config).
■If you are running FXOS 2.0(1) and have an ASA logical device that is running 9.6(2), the logical device will go offline if you downgrade FXOS to 1.1(4). To continue using your logical device, you must downgrade the ASA to 9.6(1) which will bring your logical device back online. You can then upgrade the ASA back to 9.6(2).
■If you are downgrading to FXOS 1.1(4) from a higher version and you have installed any network modules that are not supported on FXOS 1.1(4), you must uninstall those network modules before downgrading to FXOS 1.1(4).
■Zero downtime upgrade is not supported when upgrading your FXOS logical devices to ASA 9.6(1).
■Beginning with FXOS 1.1(3), the behavior for port-channels was changed. In FXOS 1.1(3) and later releases, when a port-channel is created, it is now configured as lacp cluster-detach by default and its status will show as down even if the physical link is up. The port-channel will be brought out of cluster-detach mode in the following situations:
–The port-channel's port-type is set to either cluster or mgmt
–The port-channel is added as a data port for a logical device that is part of a cluster and at least one security module has joined the cluster
If the port-channel is removed from the logical device or the logical device is deleted, the port-channel will revert to cluster-detach mode.
■To use ASDM and other strong encryption features such as VPN, after you deploy an ASA cluster you must enable the Strong Encryption (3DES) license on the master unit using the ASA CLI.
FXOS 1.1.4.178 and later adds additional testing to verify the security module adapters on your security appliance. After installing FXOS 1.1.4.178 or later, you might receive the following critical fault on your security appliance indicating that you should update the firmware for your security module adapter:
Critical F1715 2017-05-11T11:43:33.121 339561 Adapter 1 on Security Module 1 requires a critical firmware upgrade. Please see Adapter Bootloader Upgrade instructions in the FXOS Release Notes posted with this release.
If you receive the above message, use the following procedure to update the boot image for your adapter:
1. Connect to the FXOS CLI on your Firepower security appliance. For instructions, see the “Accessing the FXOS CLI” topic in the Cisco FXOS CLI Configuration Guide or the Cisco FXOS Firepower Chassis Manager Configuration Guide (see Related Documentation).
2. Enter the adapter mode for the adapter whose boot image you are updating:
3. Use the show image command to view the available adapter images and to verify that fxos-m83-8p40-cruzboot.4.0.1.62.bin is available to be installed:
--------------------------------------------- -------------------- -------
fxos-m83-8p40-cruzboot.4.0.1.62.bin Adapter Boot 4.0(1.62)
fxos-m83-8p40-vic.4.0.1.51.gbin Adapter 4.0(1.51)
4. Use the update boot-loader command to update the adapter boot image to version 4.0.1.62:
5. Use the show boot-update status command to monitor the update status:
6. Use the show version detail command to verify that the update was successful:
Note: Your show version detail output might differ from the following example. However, please verify that Bootloader-Update-Status is “Ready” and that Bootloader-Vers is 4.0(1.62).
You can access the Firepower Chassis Manager using the following browsers:
■Mozilla Firefox – Version 42 and later
■Google Chrome – Version 47 and later
Testing on FXOS 1.1(4) was performed using Mozilla Firefox version 42 and Google Chrome version 47. We anticipate that future versions of these browsers will also work. However, if you experience any browser-related issues, we suggest you revert to one of the tested versions.
Note: If you experience browser issues, try clearing your browser cache.
You can upgrade your Firepower 9300 security appliance to FXOS 1.1(4.179) if it is currently running any other FXOS 1.1(4) build. If you are running an earlier version of FXOS, refer to Upgrade Paths for FXOS/ASA for information on how to upgrade your system to FXOS 1.1(4.95). After upgrading to FXOS 1.1(4.95), you can then upgrade to FXOS 1.1(4.179).
|
||||||
|
|
|||||
|
|
|
■When upgrading the FXOS platform bundle software and application CSP images at the same time, do not upload the application CSP images to your security appliance until after you upgrade the FXOS platform bundle software.
■Zero downtime upgrade is not supported when upgrading your FXOS logical devices to ASA 9.6(1).
Refer to the upgrade instructions that apply for your device configuration:
■For instructions on how to upgrade a standalone Firepower security appliance, see Upgrading a Standalone Firepower Security Appliance.
■For instructions on how to upgrade two Firepower security appliances that are configured as an ASA Failover Pair, see Upgrading an ASA Failover Pair.
■For instructions on how to upgrade Firepower security appliances that are configured as an inter-chassis cluster, see Upgrading an Inter-chassis Cluster.
Perform the following steps to update your system to 1.1(4):
1. Download the required FXOS 1.1(4) image to your local machine (see Software Download).
2. Upload the FXOS 1.1(4) Platform Bundle image to your Firepower security appliance. For instructions, see the “Uploading an Image to the Firepower appliance” topic in the Cisco Firepower Chassis Manager Configuration Guide, 1.1(4) (see Related Documentation).
Note: Do not upload the application CSP images at this time. You should only upload the application CSP images after you have successfully upgraded the chassis using the Platform Bundle image.
3. Upgrade your Firepower security appliance using the FXOS 1.1(4) Platform Bundle image. For instructions, see the “Upgrading the Firepower eXtensible Operating System Platform Bundle” topic in the Cisco Firepower Chassis Manager Configuration Guide, 1.1(4) (see Related Documentation).
4. Upload the application CSP images to your Firepower security appliance. For instructions, see the “Uploading an Image to the Firepower appliance” topic in the Cisco Firepower Chassis Manager Configuration Guide, 1.1(4) Beta (see Related Documentation).
Your system has been successfully updated.
You can now update your existing ASA logical devices using the ASA image or you can use the ASA image when creating a new logical device.
You can configure a new Firepower Threat Defense logical device using the Firepower Threat Defense image. For instructions, see the “Deploy Firepower Threat Defense” section in the Cisco Firepower Threat Defense for Firepower 4100 Quick Start Guide or the Cisco Firepower Threat Defense for Firepower 9300 Quick Start Guide (see Related Documentation).
Note: If you want to install Firepower Threat Defense on a security module that currently has ASA installed, you must first delete the existing ASA logical device. For instructions, see the “Delete Existing Logical Devices and Application Configurations” topic in the Cisco Firepower Threat Defense for Firepower 4100 Quick Start Guide or the Cisco Firepower Threat Defense for Firepower 9300 Quick Start Guide (see Related Documentation).
1. Download the FXOS 1.1(4) images (see Software Download).
a. Connect to the ASA console on the Firepower security appliance that contains the primary ASA logical device. For instructions, see the “Connect to the Console of the Application or Decorator” topic in the Cisco Firepower Chassis Manager Configuration Guide (see Related Documentation).
c. Save the configuration on both the Firepower security appliance that contains the primary ASA logical device and the Firepower security appliance that contains the secondary ASA logical device:
3. Upgrade the Firepower eXtensible Operating System bundle on the Firepower security appliance that contains the secondary ASA logical device:
a. Upload the FXOS 1.1(4) Platform Bundle image to your Firepower security appliance. For instructions, see the “Uploading an Image to the Firepower appliance” topic in the Cisco Firepower Chassis Manager Configuration Guide (see Related Documentation).
NOTE : Do not upload the ASA image at this time. You should only upload the ASA image after you have successfully upgraded the chassis using the FXOS 1.1(4) Platform Bundle image.
b. Upgrade your Firepower security appliance using the FXOS 1.1(4) Platform Bundle image. For instructions, see the “Upgrading the Firepower eXtensible Operating System Platform Bundle” topic in the Cisco Firepower Chassis Manager Configuration Guide.
4. Wait for the chassis to reboot and upgrade successfully:
a. Use the show firmware monitor command under scope system to monitor the upgrade process.
b. After the upgrade process finishes, use the show app-instance command under scope ssa to verify that the ASA application has come “Online.”
5. Upgrade the ASA software on the secondary ASA logical device:
a. Upload the ASA image to your Firepower security appliance. For instructions, see the “Uploading an Image to the Firepower appliance” topic in the Cisco Firepower Chassis Manager Configuration Guide (see Related Documentation).
b. Upgrade the secondary ASA logical device using the ASA image. For instructions, see the “Updating the Image Version for a Logical Device” topic in the Cisco Firepower Chassis Manager Configuration Guide (see Related Documentation).
c. Wait for the upgrade process to finish. Use the show app-instance command under scope ssa to verify that the ASA application has come “online”.
a. Connect to the ASA console on the Firepower security appliance that contains the primary ASA logical device.
d. Verify that the unit is active:
7. Make the unit that you just upgraded the active unit so that traffic flows to the upgraded unit:
a. Connect to the ASA console on the Firepower security appliance that contains the secondary ASA logical device.
b. Enable failover and make active:
d. Verify that the unit is active :
a. Connect to the ASA console on the Firepower security appliance that contains the secondary ASA logical device (which is currently the active unit).
c. Save the configuration on both the Firepower security appliance that contains the primary ASA logical device and the Firepower security appliance that contains the secondary ASA logical device:
9. Upgrade the Firepower eXtensible Operating System bundle on the Firepower security appliance that contains the primary ASA logical device:
a. Upload the FXOS 1.1(4) Platform Bundle image to your Firepower security appliance. For instructions, see the “Uploading an Image to the Firepower appliance” topic in the Cisco Firepower Chassis Manager Configuration Guide (see Related Documentation).
NOTE : Do not upload the ASA image at this time. You should only upload the ASA image after you have successfully upgraded the chassis using the FXOS 1.1(4) Platform Bundle image.
b. Upgrade your Firepower security appliance using the FXOS 1.1(4) Platform Bundle image. For instructions, see the “Upgrading the Firepower eXtensible Operating System Platform Bundle” topic in the Cisco Firepower Chassis Manager Configuration Guide (see Related Documentation).
10. Wait for the chassis to reboot and upgrade successfully:
a. Use the show firmware monitor command under scope system to monitor the upgrade process.
b. After the upgrade process finishes, use the show app-instance command under scope ssa to verify that the ASA application has come “online.”
11. Upgrade the ASA software on the primary ASA logical device:
a. Upload the ASA image to your Firepower security appliance. For instructions, see the “Uploading an Image to the Firepower appliance” topic in the Cisco Firepower Chassis Manager Configuration Guide (see Related Documentation).
b. Upgrade the primary ASA logical device using the ASA image. For instructions, see the “Updating the Image Version for a Logical Device” topic in the Cisco Firepower Chassis Manager Configuration Guide (see Related Documentation).
c. Wait for the upgrade process to finish. Use the show app-instance command under scope ssa to verify that the ASA application has come “online”.
a. Connect to the ASA console on the Firepower security appliance that contains the secondary ASA logical device.
d. Verify that the unit is active:
13. Make the primary unit active :
a. Connect to the ASA console on the Firepower security appliance that contains the primary ASA logical device.
b. Enable failover and make active:
1. Connect to the FXOS CLI on Chassis #2 (this should be a chassis that does not have the Primary unit). For instructions, see the “Accessing the FXOS CLI” topic in the Cisco FXOS CLI Configuration Guide or the Cisco FXOS Firepower Chassis Manager Configuration Guide (see Related Documentation).
2. Verify that all installed security modules are online:
3. Verify that all installed security modules have the correct FXOS version and ASA version installed:
4. Verify that the cluster operational state is “In-Cluster” for all security modules installed in the chassis:
5. Verify that all installed security modules are shown as part of the cluster:
6. Verify that the Primary unit is not on this chassis.
1. Download the FXOS 1.1(4) image to your local machine (see Software Download).
2. Connect to the FXOS CLI on Chassis #2 (this should be a chassis that does not have the Primary unit). For instructions, see the “Accessing the FXOS CLI” topic in the Cisco FXOS CLI Configuration Guide or the Cisco FXOS Firepower Chassis Manager Configuration Guide (see Related Documentation).
3. For all security modules installed in Chassis #2, connect to the ASA console on each module and disable cluster:
4. Upgrade the Firepower eXtensible Operating System bundle on Chassis #2:
a. Upload the FXOS 1.1(4) Platform Bundle image to your Firepower security appliance. For instructions, see the “Uploading an Image to the Firepower appliance” topic in the Cisco Firepower Chassis Manager Configuration Guide (see Related Documentation).
b. Upgrade your Firepower security appliance using the FXOS 1.1(4) Platform Bundle image. For instructions, see the “Upgrading the Firepower eXtensible Operating System Platform Bundle” topic in the Cisco Firepower Chassis Manager Configuration Guide (see Related Documentation).
5. Wait for the chassis to reboot and upgrade successfully (approximately 15-20 minutes).
Use the show firmware monitor command under scope system to monitor the upgrade process. Every component should show “Upgrade-Status: Ready.”
ASA nodes will automatically rejoin the existing cluster after successful upgrade.
6. After the upgrade process finishes:
a. Use the show slot command under scope ssa to verify that every slot is “Online.”
b. Use the show app-instance command under scope ssa to verify that the ASA application has come “Online.”
c. Use the show app-instance command under scope ssa to verify that the cluster operational state is “In-Cluster” for all security modules installed in the chassis.
7. Upload the ASA image to Chassis #2. For instructions, see the “Uploading an Image to the Firepower appliance” topic in the Cisco Firepower Chassis Manager Configuration Guide (see Related Documentation).
8. For each security module on Chassis #2:
a. Upgrade the ASA logical device using the ASA image. For instructions, see the “Updating the Image Version for a Logical Device” topic in the Cisco Firepower Chassis Manager Configuration Guide (see Related Documentation).
b. Wait for the upgrade process to finish.
c. Use the show app-instance command under scope ssa to verify that the ASA application has come “online”.
d. Verify that the Cluster Operational Status for each security module is “in-cluster:”
9. Set one of the security modules on Chassis #2 as Primary:
10. Connect to the FXOS CLI on Chassis #1.
11. For all security modules in Chassis #1, connect to the ASA console on each module and disable cluster:
12. Upgrade the Firepower eXtensible Operating System bundle on Chassis #1:
a. Upload the FXOS 1.1(4) Platform Bundle image to your Firepower security appliance. For instructions, see the “Uploading an Image to the Firepower appliance” topic in the Cisco Firepower Chassis Manager Configuration Guide (see Related Documentation).
b. Upgrade your Firepower security appliance using the FXOS 1.1(4) Platform Bundle image. For instructions, see the “Upgrading the Firepower eXtensible Operating System Platform Bundle” topic in the Cisco Firepower Chassis Manager Configuration Guide (see Related Documentation).
13. Wait for the chassis to reboot and upgrade successfully (approximately 15-20 minutes).
Use the show firmware monitor command under scope system to monitor the upgrade process. Every component should show “Upgrade-Status: Ready.”
ASA nodes will automatically rejoin the existing cluster after successful upgrade.
14. After the upgrade process finishes:
a. Use the show slot command under scope ssa to verify that every slot is “Online.”
b. Use the show app-instance command under scope ssa to verify that the ASA application has come “Online.”
c. Use the show app-instance command under scope ssa to verify that the cluster operational state is “In-Cluster” for all security modules installed in the chassis.
15. Upload the ASA image to Chassis #1. For instructions, see the “Uploading an Image to the Firepower appliance” topic in the Cisco Firepower Chassis Manager Configuration Guide (see Related Documentation).
16. For each security module on Chassis #1:
a. Upgrade the ASA logical device using the ASA image. For instructions, see the “Updating the Image Version for a Logical Device” topic in the Cisco Firepower Chassis Manager Configuration Guide (see Related Documentation).
b. Wait for the upgrade process to finish.
c. Use the show app-instance command under scope ssa to verify that the ASA application has come “online”.
d. Verify that the Cluster Operational Status for each security module is “in-cluster:”
17. If there are any additional chassis included in the cluster, repeat steps Connect to the FXOS CLI on Chassis #1. through For each security module on Chassis #1: for those chassis.
The open and resolved bugs for this release are accessible through the Cisco Bug Search Tool. This web-based tool provides you with access to the Cisco bug tracking system, which maintains information about bugs and vulnerabilities in this product and other Cisco hardware and software products.
Note: You must have a Cisco.com account to log in and access the Cisco Bug Search Tool. If you do not have one, you can register for an account.
For more information about the Cisco Bug Search Tool, see the Bug Search Tool Help & FAQ.
Open bugs severity 3 and higher for Firepower eXtensible Operating System 1.1(4) are listed in the following table:
The following table lists the defects that were resolved in Firepower eXtensible Operating System 1.1.4.179:
The following table lists the defects that were resolved in Firepower eXtensible Operating System 1.1.4.178:
The following table lists the defects that were resolved in Firepower eXtensible Operating System 1.1.4.175:
The following table lists the defects that were resolved in Firepower eXtensible Operating System 1.1.4.169:
The following table lists the defects that were resolved in Firepower eXtensible Operating System 1.1.4.140:
The following table lists the defects that were resolved in Firepower eXtensible Operating System 1.1.4.117:
The following table lists the previously release-noted and customer-found defects that were resolved in Firepower eXtensible Operating System 1.1.4.95:
For additional information on the Firepower 9300 security appliance and the Firepower eXtensible Operating System, see Navigating the Cisco Firepower 9300 Documentation.
■To receive timely, relevant information from Cisco, sign up at Cisco Profile Manager.
■To get the business impact you’re looking for with the technologies that matter, visit Cisco Services.
■To submit a service request, visit Cisco Support.
■To discover and browse secure, validated enterprise-class apps, products, solutions and services, visit Cisco Marketplace.
■To obtain general networking, training, and certification titles, visit Cisco Press.
■To find warranty information for a specific product or product family, access Cisco Warranty Finder.
Cisco Bug Search Tool (BST) is a web-based tool that acts as a gateway to the Cisco bug tracking system that maintains a comprehensive list of defects and vulnerabilities in Cisco products and software. BST provides you with detailed defect information about your products and software.
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1721R)