Table Of Contents
Release Notes for Cisco Router and Security Device Manager Version 2.2
Supported Network Modules, WICs, Port Adapters, and Service Adapters
Web Browser Versions and Java Runtime Environment Versions
New Features Supported in SDM Version 2.2
Cisco 1700 Routers Running ITS/CCME and Cisco IOS Release 12.2(13)T
Downloading SDM from Cisco.com and Installing It on the Router
Upgrading to a New SDM Release
Restrictions for Cisco 7204VXR, 7206VXR, and 7301 Routers
SDM IPS User Guide Discontinued for SDM 2.2
SDM May Lose Connection to Network Access Device
SDM on PC May Not Launch under Windows XP with Service Pack 2
Popup Blockers Disable SDM Online Help
Routers Shipped with SDM Do Not Execute the Standard Cisco IOS Startup Sequence
Unable to Perform "squeeze flash:" Operation
Security Alert Dialog May Remain After SDM Launches
Cisco Product Security Overview
Reporting Security Problems in Cisco Products
Obtaining Technical Assistance
Cisco Technical Support Website
Definitions of Service Request Severity
Obtaining Additional Publications and Information
Release Notes for Cisco Router and Security Device Manager Version 2.2
April 5, 2006
These release notes support Cisco Router and Security Device Manager version 2.2. They should be used with the documents listed in the "Related Documentation" section. These release notes are updated as needed.
Contents
This document contains the following sections:
•
Cisco Product Security Overview
•
•
Introduction
Cisco Router and Security Device Manager (SDM) is a web-based configuration tool that allows you to configure LAN and WAN interfaces, routing, Network Admission Control (NAC), Network Address Translation (NAT), firewalls, Intrusion Prevention System (IPS), Virtual Private Networks (VPNs), and other features on the router. SDM version 2.1 and later can be installed on a PC, or in router flash, disk, or slot memory. Earlier versions of SDM cannot be installed on PCs, but can be installed in router flash, disk, or slot memory. If you have a router listed in the "Hardware Supported" section, SDM may be preinstalled in router memory, or may be shipped on a CD with the router.
System Requirements
This section contains SDM system requirements.
Memory Requirements
A minimum of 5.2 MB of free router memory is required to support Cisco SDM files. 2 MB of router memory is required to support Cisco SDM Express files. The Wireless Management application requires an additional 2 MB.
Cisco SDM installed on a PC requires 5.2 MB of memory.
Table 2 lists the files that are included with Cisco SDM, Cisco SDM Express, and the Wireless Management application.
Hardware Supported
This section lists the hardware that SDM supports.
Note
SDM is supported on the following Cisco SB100 series routers.
•
•
•
SDM is supported on the following Cisco 800 series routers:
•
•
•
•
•
•
•
•
•
SDM is supported on the following Cisco 1700 series routers:
•
•
•
•
•
•
•
•
•
SDM is supported on the following Cisco 1800 series routers:
•
•
•
•
•
•
SDM is supported on the following Cisco 2600 series routers:
•
•
•
•
•
•
•
SDM is supported on the following 2800 series routers:
•
•
•
•
SDM is supported on the following Cisco 3600 series routers:
•
•
•
•
•
SDM is supported on the following Cisco 3700 series routers:
•
•
SDM is supported on the following Cisco 3800 series routers:
•
•
SDM is supported on the following Cisco 7000 series routers:
•
•
•
Supported Network Modules, WICs, Port Adapters, and Service Adapters
SDM supports configuration on the following network modules:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
SDM supports only Ethernet configuration on the following network modules:
•
•
•
•
•
•
•
•
•
•
SDM supports the following EtherSwitch Service Modules:
•
•
•
•
SDM supports the following WAN interface cards:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
SDM supports the following high-speed wan interface cards (HWICs):
•
•
•
•
•
•
•
•
•
•
•
SDM supports the following advanced integration modules (AIMs):
•
•
•
•
•
•
•
•
•
SDM supports the following port adapters on Cisco 7000 routers:
•
•
•
•
SDM supports the following service adapters on Cisco 7000 routers:
•
•
•
SDM also supports the MOD-1700VPN.
PC System Requirements
SDM is designed to run on a personal computer that has a Pentium III or faster processor.
Software Supported
This section describes SDM software requirements.
Cisco IOS Images
SDM is compatible with the Cisco IOS images listed in Table 1.
Note
Determining the Cisco IOS Software Version
To determine the Release of Cisco IOS software currently running on your Cisco router, log in to the router and enter the show version EXEC command. The following sample output from the show version command indicates the version number on the second output line:
router> show versionCisco Internetwork Operating System SoftwareIOS (tm) C1700 Software (c1700-k8sv3y7-mz) Version 12.2(13)ZHWeb Browser Versions and Java Runtime Environment Versions
SDM can be used with the following browsers:
•
•
•
SDM requires Sun Java Runtime Environment (JRE). The following versions are supported:
•
•
Although the SDM application requires JRE to run, the Cisco SDM Express application included with SDM can run under the native Java Virtual Machine in the supported browsers, as well as with JRE.
PC Operating System Versions
SDM can be run on a PC running any of the following operating systems:
•
•
•
•
•
Note
SDM version 2.2 is available only in English. SDM version 2.1.2 is available in six additional languages: Japanese, Simplified Chinese, French, German, Spanish and Italian. SDM version 2.1.2 supports full SDM functionality released prior to SDM 2.2. New functionality introduced in SDM 2.2 is currently under development for these languages and will be available shortly. If you want to use SDM version 2.1.2 in one of these languages, your PC must run one of the following operating systems:
•
•
Refer to the Release Notes for Cisco Router and Security Device Manager Version 2.1.2 for more information. See Related Documentation to learn how to obtain these release notes.
New and Changed Information
This section contains information that is new or that has changed since the previous release.
New Features Supported in SDM Version 2.2
This release of SDM supports the following new features:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
SDM Files
This section describes the files used in SDM version 2.2.
Table 2 describes the files that SDM and SDM applications use.
Installation Notes
This section contains important information regarding installation and upgrades to SDM.
Cisco 1700 Routers Running ITS/CCME and Cisco IOS Release 12.2(13)T
If you are installing SDM on a router that already has the Internet Telephony Service (ITS) or Cisco Call Manager Express (CCME) application installed in flash memory, you may exceed the number of files allowed in flash memory by installing SDM. Cisco 1700 routers using a Cisco IOS Release 12.2(13)T image cannot have more than 32 files in flash memory.
Before installing SDM, you must delete any unneeded files from flash memory. If no files can be deleted, do not install SDM on the router.
Downloading SDM from Cisco.com and Installing It on the Router
If SDM is not currently installed on the router, the document Downloading and Installing Cisco Router and Security Device Manager (SDM) explains how to download SDM from Cisco.com and install it on the router. To obtain this document, go to the following URL:
Upgrading to a New SDM Release
If a version of SDM later than version 1.0 is already installed on the router, you should use the SDM automatic update feature to install the latest files on the router. SDM automatically checks Cisco.com for more recent versions of SDM, downloads them to your PC, removes the old SDM files from memory, runs the squeeze flash: command if necessary, and copies the latest files to the router. The update feature is available from the Tools menu. Choose Tools > Update SDM > Update from CCO.
If you are currently using SDM version 1.0, you must download the file SDM-Vnn.zip at the following URL:
http://www.cisco.com/cgi-bin/tablebuild.pl/sdm
The document Downloading and Installing Cisco Router and Security Device Manager (SDM) explains how to install SDM and all related files on the router. This document is available at the following URL:
Click Install and Upgrade in the Technical Documentation and Tools box, and then click Install and Upgrade Guides.
Uninstalling SDM Files
If you want to remove SDM from flash memory or from a router disk file system, you can do so by logging onto the router and completing the following steps in EXEC mode:
Step 1
If the router has a flash file system, use the following command:
router# cd flash:If the router has a disk file system, use the following command:
router# cd diskNReplace N with the actual number of the disk. Use the slot keyword instead of the disk keyword if necessary.
Step 2
router# delete sdm.tarDelete filename [sdm.tar]?Delete flash:sdm.tar? [confirm]Press Return to confirm the deletion.
Step 3
Step 4
router# squeeze flash:It is not necessary to use the squeeze flash: command on DOS-based file systems.
SDM version 2.1 or later can be installed on your PC. To remove SDM from your PC, complete the following steps:
Step 1
Step 2
Step 3
Restrictions and Limitations
This section describes restrictions and limitations that may apply to SDM.
SDM Minimum Screen Resolution
SDM requires a screen resolution of at least 1024 x 768.
Restrictions for Cisco 7204VXR, 7206VXR, and 7301 Routers
The following restrictions apply to SDM running on Cisco 7204VXR, 7206VXR, and 7301 Routers:
•
•
•
•
Important Notes
This section contains important information for SDM.
SDM IPS User Guide Discontinued for SDM 2.2
The SDM IPS application has been merged with SDM version 2.2. Instructions for using IPS are included in the Cisco Router and Security Device Manager Version 2.2 User's Guide. No SDM IPS User's Guide has been published for this release.
SDM May Lose Connection to Network Access Device
This note concerns the NAC feature.
If the PC used to invoke SDM returns a posture state (Healthy, Infected, Checkup, Quarantine, or Unknown) and if the group policy on the ACS server attached to the posture token assigned to the PC has a redirect URL configured, the connection between SDM and the router acting as the Network Access Device (NAD) may be lost. The same problem can occur if an exception list entry attached to a policy with a redirect URL is configured with the IP address or MAC address of the PC.
If you try to reinvoke SDM from this PC, you will not be able to do so because the browser will be redirected to the location specified in the redirect URL.
There are two workarounds for this problem:
•
•
For more information, refer to the links in the SDM NAC online help pages.
SDM on PC May Not Launch under Windows XP with Service Pack 2
When SDM is installed on a PC running Windows XP with Service Pack 2, Internet Explorer may display HTML source code when you attempt to launch SDM. To fix this problem, go to Tools > Internet Options > Advanced. Then scroll to the Security section, check Allow active content to run in files on my computer, and click Apply. Then relaunch SDM.
Popup Blockers Disable SDM Online Help
If you have enabled popup blockers in the browser you use to run SDM, SDM online help will not appear when you click the help button. To prevent this from happening, you must disable the popup blocker when you run SDM. Popup blockers may be enabled in search engine toolbars, or may be standalone applications integrated with the web browser.
Microsoft Windows XP with Service Pack 2 blocks popups by default. In order to turn off popup blocking in Internet Explorer, go to Tools > Pop-up Blocker > Turn Off Pop-up Blocker.
If you have not installed and enabled pop up blockers, go to Tools >Internet Options > Privacy, and uncheck the Block popups checkbox.
Disable Proxy Settings
SDM will not start when run under Internet Explorer with proxy settings enabled. To correct this problem, choose Internet Options from the Tools menu, click the Connections tab, and then click the LAN settings button. In the LAN Settings window, disable the proxy settings.
Routers Shipped with SDM Do Not Execute the Standard Cisco IOS Startup Sequence
Because a default configuration file is provided on a router shipped with SDM, the router will not execute the standard Cisco IOS startup sequence. If you are expecting to use the Cisco IOS setup utility, a TFTP/BOOTP configuration download, or other features available through the standard Cisco IOS startup, you will need to erase the configuration file.
To erase the existing configuration and take advantage of the Cisco IOS startup sequence, perform the following steps. This will leave SDM on the router if you later decide you want to use it, but you will need to configure the router manually before you can begin using SDM. Please refer to the router quick start guide and to the SDM FAQ (available at http://www.cisco.com/go/sdm) for information about the minimum configuration required for using SDM.
Step 1
Step 2
Step 3
Step 4
yourname> enablePassword: ciscoyourname#Step 5
yourname# erase startup-configStep 6
Step 7
yourname# reloadStep 8
After the router completes the reload operation, it enters into the standard Cisco IOS startup sequence. You can use the startup sequence to give the router a configuration manually, or to copy a configuration file from the network. If you later decide you want to use SDM to change an existing configuration, refer to the instructions on starting SDM included in the quick start guide for the router.
Unable to Perform "squeeze flash:" Operation
If the router is using a Cisco IOS image earlier than release 12.3T, or release 12.2(13)ZH, it may be necessary to use the squeeze flash: command to reclaim flash memory after repeated use of SDM. If this becomes necessary, SDM will inform you that the squeeze flash: command must be used, and will execute the command upon your confirmation.
However, the squeeze flash: command will not work if an erase flash: command has never been executed on the router. If this is the case you will receive an "Unable to perform `squeeze flash'" warning message, and you will need to run the erase flash: command to enable the use of the squeeze flash: command.
Executing the erase flash: command removes SDM and the Cisco IOS image from the router flash memory, and you will lose your connection to the router. Complete the following steps to save files in flash memory, execute erase flash:, and copy the files back so you can reconnect to SDM.
Step 1
Step 2
Step 3
Step 4
Step 5
copy flash: filename tftp://tftp-server-address/filename
For example:
Router# copy flash: sdm.tar tftp://10.10.10.3/sdm.tarTable 2 lists the files SDM uses.
Tip
a.
http://www.cisco.com/kobayashi/sw-center
b.
c.
http://www.cisco.com/cgi-bin/tablebuild.pl/sdm
d.
e.
Step 6
Router> enablePassword:Router#Step 7
Step 8
copy tftp://tftp-server-address/filename flash:
Example:
Router# copy tftp://10.10.10.3/SDM.tar flash:
Note
Step 9
Now that an erase flash: operation has been performed on the router, you will be able to execute the squeeze flash: command when necessary.
Security Alert Dialog May Remain After SDM Launches
When SDM is launched using HTTPS, a security alert dialog box that informs you of possible security problems and asks you if you want to proceed with program launch may appear. This can happen if the router does not have the following global configuration command in the running configuration:
ip http timeout-policy idle 600 life 86400 requests 10000Caveats
Caveats describe unexpected behavior in SDM. Severity 1 caveats are the most serious caveats, severity 2 caveats are less serious, and severity 3 caveats are the least serious of these three severity levels.
Open Caveats—Release 2.2
This section lists caveats that are open in release 2.2.
•
When you upgrade from SDM version 2.2.a to 2.2.1, SDM displays a warning popup that indicates that you are attempting to downgrade SDM to an earlier version. This message is seen when upgrading from SDM 2.2a to any language edition of SDM 2.2.1.
Workaround: Click Yes in the warning popup window to indicate that you want to proceed with the update.
•
When SDM is run on the PC, the Load File from PC function available from the File Management window may not work properly.
Workaround: With a TFTP server application on the PC, copy files to the router using the copy tftp flash command.
•
The SDM_HIGH security policy may not block Instant Messaging (IM) applications. The application security feature blocks IM applications using the server deny name command. New servers may become available, and if they do, IM applications may connect to them.
Workaround: Complete the following steps:
a.
b.
router# config trouter(config)# appfw policy-name SDM_HIGHrouter(cfg-appfw-policy)# application im yahoorouter(cfg-appfw-policy-ymsgr)# server deny name newserver.yahoo.comrouter(cfg-appfw-policy-ymsgr)# exitrouter(cfg-appfw-policy)# exit•
Due to IOS caveat CSCei75121, extra spaces introduced into the running configuration output may prevent SDM from accurately reading the running configuration. This occurs when RSA key pairs are manually entered.
Workaround: Go to View > Running Config to display the running configuration.
•
When the applications security policy blocks some Point-to-Point (P2P) applications, but permits others, blocked applications may be able to download files.
Workaround: Instead of permitting some P2P applications and blocking others, exclude the applications that you want to permit from the application security policy by unchecking the box next to the application name.
•
Because of a problem with the Cisco IOS NBAR feature, some Point-to-Point applications are able to download files even when application security is configured to block them. When the Cisco IOS NBAR feature is used to block Point-to-Point applications, only those applications and protocols supported by the NBAR feature will be successfully blocked.
Workaround: None
•
Because of a problem with Cisco IOS (CSCin92327), a connection between an Easy VPN Remote client and an Easy VPN Server may timeout before the user has time to enter the credentials.
Workaround: None
•
Due to a JVM bug (http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=4110094) SDM IPS may crash when large Signature Definition Files (SDF) are imported. When SDM is used to import large SDFs such as virtualsensor.xml or IOS-S178.zip, SDM crashes when dismissing the Import Signature dialog. This problem does not always occur.
Workaround: Set the java heap size to -Xmx256m and try to import the file again. If you need to use SDM to perform a critical operation, complete that operation before reattempting to import the file.
•
The SDM IPS import dialog may not appear when you attempt to import a large SDF, such as virtualsensor.xml more than 5 times. A java out-of-memory error occurs and the Import Signature dialog does not appear.
Workaround: Set the java heap size to -Xmx256m , restart SDM, and try to import the file again.
•
When using SDM IPS, if you go to IPS Global Settings > Edit and change the size of the SDEE event store, and then refresh or reinvoke SDM IPS, SDM shows the default size of the SDEE event store (200) instead of the value that you configured.
Workaround: None
•
VPN status in the Monitor windows do not show IPSec security association (SA) parameters for DMVPN when CLI status commands report that the crypto tunnels are up and traffic is passing through. The DMVPN tunnel is shown as established in the IKE SA tab.
Workaround: Use the CLI to view DMVPN status.
•
This problem is encountered on routers running Cisco IOS image c3825-advsecurityk9-mz.123-10.2. If an ATM interface is configured on routers running this image, WAN troubleshooting may display inconsistent results. PVC connections may be shown as UP when they are DOWN.
Workaround: None.
•
When both SDM and IPS are open, an open dialog box requiring an OK or Cancel in one application will prevent the user from working in the other application.
Workaround: Complete the work in the dialog box and click OK, or click Cancel to close the dialog box before switching to the other application.
•
If multiple instances of SDM are run under Netscape version 7.1 using the Java Virtual Machine (JVM) or the Java plug-in, and the user shuts down one instance of SDM, then all other open instances of SDM on that PC are shut down.
This problem occurs because Netscape version 7.1 uses only one instance of the JVM or the Java plug-in, even when multiple instances of Netscape are launched. As a result, when one instance of SDM is shut down, Netscape shuts down the JVM or the Java plug-in, and all other instances of SDM are also shut down.
Workaround: If SDM is run under Netscape version 7.1, open only one instance of SDM . Using Internet Explorer is advised when multiple instances of SDM must be opened, such as when the user must configure multiple routers at the same time.
•
When the crypto identity ca command is used, the Loopback0 interface is shown as having no configured IP address in the Edit Interfaces and Connections window when an IP address has been configured.
Workaround: Disregard the IP address information in the Interfaces and Connections window. If you need to view the IP address, choose the interface and click the Edit button.
•
This problem is caused by the Cisco IOS caveat CSCef46305. After an Easy VPN Remote connection has been brought up after a successful user authentication (Xauth), the remote peer may not be listed in the Easy VPN Remote Edit screen if SDM is refreshed or reinvoked. If this problem occurs, Easy VPN Remote troubleshooting might not behave as expected for this connection.
This problem will occur only when the Easy VPN server sends Xauth challenges to the Easy VPN remote at the same time that the Easy VPN remote is trying to establish a tunnel with the VPN server.
Workaround: None.
•
When an Easy VPN Server is configured using Digital Certificates for authentication, and an Easy VPN Remote connection is configured on another router, the client statistics for the Easy VPN server are all shown as 0 in the VPN Status window.
Workaround: To view client statistics, choose Tools > Telnet. Log in to the router, and issue the show crypto session command.
•
When adding a new signature to the ATOMIC.ICMP engine, you may see the error message "[Enum(xxx)-StorageKey-ATOMIC.ICMP] the value AaBb is not a valid value."
Workaround: In the Add Signature window, go to the parameter StorageKey, and click the green square to enable editing for this parameter. the green square icon will change to a red diamond icon. Choosing any value from the drop down box will fix this problem.
•
This problem is caused by the Cisco IOS caveat CSCef64124. When the user unchecks the Save Xauth username and password on the router check box in the Edit Easy VPN Remote dialog box and clicks OK, the command is delivered to the router, but SDM shows the check box as checked, and the corresponding command is still shown in the running configuration if SDM is refreshed.
This occurs when the user wants to remove the saved Xauth username and password in Easy VPN Remote.
•
If an Easy VPN Remote configuration has connections to more than one Easy VPN server configured, VPN troubleshooting deactivating may report troubleshooting results for only one VPN server or give incorrect recommendations. This issue is seen only in some Cisco IOS images.
Workaround: None.
•
Invoking SDM with a user associated with SDM_Monitor view adds a PKI trust point and an Easy VPN profile. This behavior does not affect the running configuration.
Workaround: Invoke SDM with a user associated with a different CLI view, or with a user of privilege level 15.
•
SDM filenames are case sensitive. If the SDM files are copied from the PC hard disk to a flash card, File Explorer changes the names to uppercase. When this happens, SDM cannot be invoked from this flash card.
Workaround: Before removing the flash card from the PC, restore the filenames to lowercase.
•
When the router is running a Cisco IOS image that does not support the show pppoe session command, WAN troubleshooting may not report any reasons for failure or recommended actions for PPPoE connections that are found to be down.
Workaround: None.
•
If a firewall is configured for an interface which already has a Management Access policy associated with it, choosing Replace in the Merge/Replace dialog box might prevent access to certain networks.
This occurs because choosing Replace causes the policy access control entries (ACEs) to be disassociated from the interface but not from the vty or HTTP line.
Workaround: When running Firewall wizard on an interface configured with Management Access policy, choose Merge option instead of Replace and proceed.
•
VPN troubleshooting may report a possible Maximum Transmission Unit (MTU) problem in the passthrough network when the tunnel is up. If the VPN interface is a dialer interface configured on an asynchronous interface, this problem may not always exist, and the displayed recommended action will have no effect.
Workaround: Ignore this message and the corresponding recommendation.
•
Due to a problem with Cisco IOS, if a custom protocol is mapped to a port and the same custom protocol is specified for matching under a classmap, and then the mapping of the custom protocol is deleted from the configuration , Cisco IOS does not give any warning message that the user should first delete the match protocol custom-01 commands that make use of the custom protocol mapping.
Workaround: Do the following:
–
–
–
•
Guest
