Table Of Contents
Release Notes for the Cisco PIX Firewall Version 5.2(5)
Cisco IOS Software Interoperability
Cisco Secure Policy Manager Interoperability
Cisco Secure VPN Client Interoperability
Cisco VPN 3000 Concentrator and Client Interoperability
PIX Firewall Manager Interoperability
Determining the Software Version
Upgrading to a New Software Release
New Information in Release 5.2(5)
New Information in Release 5.2(4)
New Information in Release 5.2(3)
New Information in Release 5.2(2)
New Hardware Features in Release 5.2(1)
Inside and Outside Port Restriction Change
New Software Features in Release 5.2
Certification Authority Servers—Baltimore and Microsoft
Cisco VPN 3000 Client (Formerly the Altiga VPN Client)
DHCP Server and Client Support
IP Fragmentation Syslog Messages
Unicast Reverse Path Forwarding
WebSense Filtering by Username and Group
New Command Options in Version 5.2
Command Changes in Version 5.2
Removed Messages in Version 5.2
Token-based Authentication for VPN Clients
Resolved Caveats - Release 5.2(5)
Resolved Caveats - Release 5.2(4)
Resolved Caveats - Release 5.2(3)
Resolved Caveats - Release 5.2(2)
Resolved Caveats - Release 5.2(1)
Obtaining Technical Assistance
Obtaining Additional Publications and Information
Release Notes for the Cisco PIX Firewall Version 5.2(5)
February 2001
Contents
This document includes the following sections:
•
Obtaining Technical Assistance
•
Introduction
The Cisco Secure PIX Firewall provides secure networking and NAT (Network Address Translation).
System Requirements
The sections that follow list the system requirements for operating a Cisco Secure PIX Firewall unit with version 6.0 software.
Memory Requirements
Note
The following table lists Flash memory requirements for this release:
Software Requirements
The following is required for version 5.2:
1.
2.
https://www.cisco.com/cgi-bin/Software/FormManager/formgenerator.pl?pid=221&fid=324
3.
4.
Cisco IOS Software Interoperability
If you use IKE Mode Config with the PIX Firewall, any routers on the IPSec connection must run Cisco IOS Release 12.0(6)T or later.
Cisco Secure Policy Manager Interoperability
Cisco Secure Policy Manager (Cisco Secure PM), version 2.1, provides policy-based management support for PIX Firewall units running version 4.2, 4.4, and 5.1 software images. Cisco Secure PM version 2.2 supports PIX Firewall version 5.2.
Refer to the documentation set for Cisco Secure PM at the following site:
http://www.cisco.com/en/US/products/sw/secursw/ps2120/prod_technical_documentation.html
Cisco Secure VPN Client Interoperability
PIX Firewall version 5.2 requires Cisco Secure VPN Client version 1.1. The Cisco Secure VPN Client can be used with Windows 95, Windows 98, and Windows NT version 4.0. The Cisco Secure VPN Client is not supported for use with Windows 2000.
Cisco VPN 3000 Concentrator and Client Interoperability
PIX Firewall version 5.2 requires Cisco VPN 3000 Client version 2.5 or later and Cisco VPN 3000 Concentrator version 2.5.2 or later. The Cisco VPN 3000 Client can be used with Windows 95, Windows 98, and Windows NT version 4.0. The Cisco VPN 3000 Client is not supported for use with Windows 2000.
PIX Firewall Manager Interoperability
You can use PIX Firewall version 5.2 with the PIX Firewall Manager version 4.3(2)f. Refer to the PIX Firewall Manager Release Notes, Version 4.3(2)f for more information. You can view this document online at the following site:
http://www.cisco.com/en/US/products/sw/secursw/ps2120/prod_release_note09186a008008c1d1.html
The PIX Firewall Manager (PFM) lets you manage PIX Firewall units; however, it does not let you configure any PIX Firewall features added after version 4.3(2).
The "Frequently Asked Questions" section in the PFM release notes provides useful troubleshooting information.
Determining the Software Version
Use the show version command to verify the software version of your PIX Firewall unit.
Upgrading to a New Software Release
If you have a cisco.com login, you can obtain software from the following site:
http://www.cisco.com/pcgi-bin/tablebuild.pl/pix
To register for a cisco.com login, go to the following site:
http://tools.cisco.com/RPF/register/register.do
New and Changed Information
New Information in Release 5.2(5)
Version 5.2(5) fixes caveat CSCds89077. The PIX Firewall now opens third party H.245 connections by inspecting the H.225 signaling messages to look for the specified H.245 address. The PIX Firewall then uses that address to open the H.245 connection.
New Information in Release 5.2(4)
Version 5.2(4) fixes caveat CSCds76768. If you configure the onboard Ethernet interfaces (ethernet0 and ethernet1) on a PIX 525 with a serial number of 44480380055 through 44480480044 to full-duplex, interface errors and throughput reductions may occur. If you configure the interfaces to half-duplex or to auto-sense, the speed and duplex function normally without error. Use the new eeprom command to fix the problem. The two variants of the eeprom command are the show eeprom command and eeprom update command.
The show eeprom command displays the current EEPROM setting, and the eeprom update command modifies the settings if necessary. If the eeprom command does update the EEPROM settings, we recommend you reboot the PIX Firewall.
Note
The eeprom command verifies the EEPROM register settings and updates them if they are not set to the recommended values. The eeprom command does not update the settings if they are correct and does not recommend a reboot unless the settings are changed.
The eeprom update command checks the contents of EEPROM registers 6 and 10 to ensure they contain the hexadecimal values 0x4701 and 0x40c0, respectively. If these registers contain different values, then all EEPROM register settings except the MAC address registers, which were not affected by the problem causing CSCds76768, are reset to the correct values.
Each register is 16 bits. The correct register values are as follows:
The syntax of the eeprom command is as follows:
show eeprom
Displays the current EEPROM register settings on the PIX 525.
update eeprom
Updates the EEPROM register settings if they do not match the recommended values.
The show eeprom command will display the current EEPROM register settings:
pix525# show eepromeeprom settings for ifc0:reg0: 0x5000reg1: 0xfe54reg2: 0x65f6reg3: 0x3reg5: 0x201reg6: 0x4702reg10: 0x40c0reg12: 0x8086eeprom settings for ifc1:reg0: 0x5000reg1: 0xfe54reg2: 0x66f6reg3: 0x3reg5: 0x201reg6: 0x4702reg10: 0x40c0reg12: 0x8086reg12: 0x8086If the command is run on a unit that is not a PIX 525, the following will be seen:
pix515# show eeprom This unit is not a PIX-525. Type help or '?' for a list of available commands.If the update needs to be run on the PIX 525, the eeprom update command returns the following:
pix525# eeprom updateeeprom settings on ifc0 are being reset to defaults:reg0: 0x5000reg1: 0xfe54reg2: 0x65f6reg3: 0x3reg5: 0x201reg6: 0x4701reg10: 0x40c0reg12: 0x8086eeprom settings on ifc1 are being reset to defaults:reg0: 0x5000reg1: 0xfe54reg2: 0x66f6reg3: 0x3reg5: 0x201reg6: 0x4701reg10: 0x40c0reg12: 0x8086*** WARNING! *** WARNING! *** WARNING! *** WARNING! ***The system should be restarted as soon as possible.*** WARNING! *** WARNING! *** WARNING! *** WARNING! ***If the update has been run successfully, the eeprom command output will look like this:
pix525# eeprom updateeeprom settings on ifc0 are already up to date:reg0: 0x5000reg1: 0xfe54reg2: 0x65f6reg3: 0x3reg5: 0x201reg6: 0x4701reg10: 0x40c0reg12: 0x808eeprom settings on ifc1 are already up to date:reg0: 0x5000reg1: 0xfe54reg2: 0x66f6reg3: 0x3reg5: 0x201reg6: 0x4701reg10: 0x40c0reg12: 0x80866New Information in Release 5.2(3)
Version 5.2(3) fixes caveat CSCds38708 only. If your configuration includes the fixup protocol smtp port_number command and either a conduit or access-list command statement permitting access to SMTP, you should install version 5.2(3) immediately to counter a vulnerability in the Mail Guard feature.
New Information in Release 5.2(2)
Version 5.2(2) fixes caveats CSCds30699 and CSCdr91002 only.
New Hardware Features in Release 5.2(1)
PIX 525
The new PIX 525 model has the fastest performance and highest capacity of any of the PIX Firewall series.
The PIX 525 provides the following features:
Note
Failover Serial Connection
The failover serial connection has been increased from 9600 baud to 117,760 baud (115K). The maximum supported length for the failover serial cable is 6 feet.
Note
Inside and Outside Port Restriction Change
With the 5.2 software release, there are no longer restrictions on having to use specific Ethernet ports as the inside and outside network ports. Any port, whether fixed or a PCI expansion port, and any interface type, FDDI, Token Ring, Fast Ethernet, or Gigabit Ethernet, can be assigned to be the inside or outside network port.
Use the following notes, restrictions, and instructions for configuring inside and outside network ports:
•
•
•
•
•
clear|no|show nameif hardware_if if_name security_levelThe following is an example of the default interface name information using the show nameif command:
nameif ethernet0 outside security0nameif ethernet1 inside security100nameif ethernet2 pix/intf2 security10nameif ethernet3 pix/intf3 security15nameif token-ring0 pix/intf4 security20nameif gb-ethernet0 pix/intf5 security25New Software Features in Release 5.2
The following features are new in version 5.2. Refer to the Cisco PIX Firewall Configuration Guide, Version 5.2 for information about each software feature. IPSec features are described in the new Cisco PIX Firewall IPSec User Guide, Version 5.2.
AAA access-list Support
The new match access_list_name option was added to the aaa command.
Broadcast Addresses
PIX Firewall no longer uses network addresses or broadcast addresses in static and global command statements when creating NAT xlate translations. Broadcast addresses are those addresses with the bit pattern of all ones, when the network mask is applied. Network addresses are those addresses with the bit pattern of all zeros, when the network mask is applied.
For example:
global 1 10.1.0.0-10.1.255.255 netmask 255.255.255.0With this command, the network addresses 10.1.0.0, 10.1.1.0, 10.1.2.0, and so forth through 10.1.255.0, are excluded. In addition, the broadcast addresses 10.1.0.255, 10.1.1.255, 10.1.2.255, and so forth through 10.1.255.255, are excluded.
Certification Authority Servers—Baltimore and Microsoft
In addition to supporting the Entrust and VeriSign certification authority (CA) servers, the PIX Firewall now also supports CA servers developed by Baltimore Technologies and Microsoft.
Cisco VPN 3000 Client (Formerly the Altiga VPN Client)
Remote access VPN users employing the Cisco VPN 3000 Client, version 2.5, can now securely access their private enterprise network through the PIX Firewall, version 5.2.
Note
Note
DHCP Server and Client Support
Failover Polling Time
The new failover poll seconds command lets you determine how long failover waits before sending special failover "hello" packets between the Primary and Standby units over all network interfaces and the failover cable. The default is 15 seconds. The minimum value is 3 seconds and the maximum is 15 seconds. Set to a lower value for Stateful Failover. With a faster poll time, PIX Firewall can detect failure and trigger failover faster. However, faster detection may cause unnecessary switchovers when the network is temporarily congested or a network card starts slowly.
FTP—Prevent Embedded Commands
The strict option to the fixup protocol ftp command prevents web browsers from sending embedded commands in FTP requests. Each FTP command must be acknowledged before a new command is allowed. Connections sending embedded commands are dropped. The strict option only lets an FTP server generate the 227 command and only lets an FTP client generate the PORT command. The 227 and PORT commands are checked to ensure they do not appear in an error string.
H.323 V2
H.323 is a suite of protocols defined by the International Telecommunication Union (ITU) for multimedia conferences over LANs. H.323 supports H.323 VoIP gateways and VoIP gatekeepers. H.323 version 2 adds the following functionality to the PIX Firewall:
•
•
ICMP Access Lists
Enable or disable pinging to an interface. With pinging disabled, the PIX Firewall cannot be detected on the network. The new icmp command implements this feature. This feature is also referred to as configurable proxy pinging.
IP Fragmentation Syslog Messages
Syslog messages PIX-4-209003, PIX-4-209004, and PIX-4-209005 have been added to disclose IP fragmentation attacks.
IDS Syslog Messages
Cisco Secure Intrusion Detection System (Cisco Secure IDS) is an IP-only feature that provides some level of flexibility for the user to customize the amount of traffic that needs to be audited and logged.
PAT Enhancements
The following PAT enhancements were added:
•
global [(int_name)] nat_id address | interface
The following example enables PAT using the IP address at the outside interface in global configuration mode:
ip address outside 192.150.49.1nat (inside) 1 0 0global (outside) 1 interfaceThe interface IP address used for PAT is the address associated with the interface when the xlate (translation slot) is created. This is important for configuring DHCP, allowing for the DHCP retrieved address to be used for PAT.
When PAT is enabled on an interface, there should be no loss of TCP, UDP, and ICMP services. These services allow for termination at the PIX Firewall unit's outside interface.
•
Mapping Different Internal Subnets to Different PAT Addresses
The following example maps hosts on the internal network 10.1.0.0/16 to global address 192.168.1.1 and hosts on the internal network10.1.1.1/16 to global address 209.165.200.225 in global configuration mode.
nat (inside) 1 10.1.0.0 255.255.255.0nat (inside) 2 10.1.1.1 255.255.255.0global (outside) 1 192.168.1.1 netmask 255.255.255.0global (outside) 2 209.165.200.225 netmask 255.255.255.224Backing Up PAT Addresses
The following example configures two port addresses for setting up PAT on hosts from the internal network 10.1.0.0/16 in global configuration mode.
nat (inside) 1 10.1.0.0 255.255.0.0global (outside) 1 209.165.200.225 netmask 255.255.255.224global (outside) 1 192.168.1.1 netmask 255.255.255.0With this configuration, address 192.168.1.1 will only be used when the port pool from address 209.165.200.225 is at maximum capacity.
ping Command Enhancement
The PIX Firewall ping command no longer requires an interface name. If an interface name is not specified, PIX Firewall checks the routing table to find the address you specify. You can specify an interface name to indicate through which interface the ICMP echo requests are sent.
Radius Authorization
PIX Firewall now allows a RADIUS server to send user group attributes to the PIX Firewall in the RADIUS authentication response message. Authorization is granted with the access-list command statement.
SIP Support
Session initiation protocol (SIP), as defined by the Internet Engineering Task Force (IETF), enables call handling sessions—particularly two-party audio conferences, or "calls." SIP works with Session Description Protocol (SDP) for call signaling. SDP specifies the ports for the media stream. Using SIP, the PIX Firewall can support any SIP Voice over IP (VoIP) gateways and VoIP proxy servers. SIP and SDP are defined in the following RFCs:
•
•
SSH
SSH (Secure Shell) is an application running on top of a reliable transport layer, such as TCP/IP that provides strong authentication and encryption capabilities. PIX Firewall supports the SSH remote shell functionality as provided in SSH version 1. SSH version 1 also works with Cisco IOS software devices. Up to five SSH clients are allowed simultaneous access to the PIX Firewall console.
Note
Note
Note
Obtaining an SSH Client
The following sites let you download an SSH v1.x client. Because SSH version 1.x and version 2 are entirely different protocols and not compatible, be sure you download a client that supports SSH v1.x.
•
http://hp.vector.co.jp/authors/VA002416/teraterm.html
Then add the SSH extension to Tera Term Pro, which is available at the following site:
http://www.zip.com.au/~roca/ttssh.html
•
http://www.openssh.com
•
http://www.lysator.liu.se/~jonasw/freeware/niftyssh/
TCP Intercept
The TCP Intercept feature improves the embryonic connection handling of the PIX Firewall. When the number of embryonic connections exceed the configured threshold, PIX Firewall intercepts and proxies new connections. Previous to version 5.2, PIX Firewall did not allow new connections after the embryonic connection threshold was exceeded.
This feature requires no change to the PIX Firewall command set, only that the embryonic connection limit on the static command now has a new behavior.
Unicast Reverse Path Forwarding
Unicast Reverse Path Forwarding requires that a source IP address is reachable via the receiving interface. This feature provides ingress and egress spoof filtering on the PIX Firewall. For more information, refer to RFC 2267. You can view this RFC at the following site:
http://www.cis.ohio-state.edu/htbin/rfc/rfc2267.html
WebSense Filtering by Username and Group
The WebSense Server works with the PIX Firewall to deny users from access to web sites based on the company security policy.
WebSense protocol version 4 enables group and username authentication between a host and a PIX Firewall. The PIX Firewall performs a username lookup, and then the WebSense server handles URL filtering and username logging.
WebSense protocol version 4 contains the following enhancements:
•
•
•
Command Changes
All new commands, options, and changes are described in the Cisco PIX Firewall Configuration Guide, Version 5.2.
New Commands in Version 5.2
The following commands are new in version 5.2:
•
•
•
•
•
•
•
New Command Options in Version 5.2
The following command options are new in version 5.2:
•
•
•
•
•
•
•
•
•
•
If a debug command does not use Trace Channel, each session operates independently, which means any commands started in the session only appear in the session. By default, a session not using Trace Channel has output disabled by default.
•
•
•
•
•
•
•
•
•
•
•
•
•
Command Changes in Version 5.2
•
•
•
filter url port|except local_ip local_mask foreign_ip foreign_mask [allow]
The port option was available in past versions but did not appear in the documentation.
•
•
%PIX-4-404101: ISAKMP: Failed to allocate address for client from pool poolname•
•
•
•
isakmp key ******** address ip_addr netmask mask•
•
•
•
isakmp key ******** address ip_addr netmask maskSyslog Message Changes
The sections that follow list changes to syslog messages in version 5.2. All messages are described in detail in Cisco PIX Firewall System Log Messages, Version 5.2.
New Messages in Version 5.2
The following syslog messages are new in version 5.2:
%PIX-2-106017: Deny IP due to Land Attack from IP_addr to IP_addr%PIX-1-106021: Deny num reverse path check from IP_addr to IP_addr on interface int_name%PIX-1-106022: Deny num connection spoof from IP_addr to IP_addr on interface int_name%PIX-6-109015: Authorization denied (acl=acl_ID) for user 'username' from src_addr/src_port to dest_addr/dest_port on interface int_name%PIX-3-109016: Downloaded authorization access-list acl_ID not found for user 'username'%PIX-4-209003: Fragment database limit of num exceeded: src = IP_addr, dest = IP_addr, proto = protocol, id = id%PIX-4-209004: Invalid IP fragment, size = num exceeds maximum size = size: src = IP_addr, dest = IP_addr, proto = protocol, id = id%PIX-4-209005: Discard IP fragment set with more than num elements: src = IP_addr, dest = IP_addr, proto = protocol, id = id%PIX-3-313001: Denied ICMP type=type, code=code from IP_addr on interface int_name%PIX-6-314001: Pre-allocate RTSP UDP backconnection for faddr faddr/fport to laddr laddr/lport%PIX-3-315001: Denied SSH session from IP_addr on interface int_name%PIX-6-315002: Permitted SSH session from IP_addr on interface int_name for user "user_id"%PIX-6-315003: SSH login session failed from IP_addr on (num attempts) on interface int_name by user "user_id"%PIX-3-315004: Fail to establish SSH session because PIX RSA host key retrieval failed.%PIX-6-315011: SSH session from IP_addr on interface int_name for user "user_id" terminated normally%PIX-6-315011: SSH session from IP_addr on interface int_name for user "user_id" disconnected by SSH server, reason: "text" (status_code_in_hex)%PIX-4-4000nn: IDS:sig_num sig_msg from IP_addr to IP_addr on interface int_name%PIX-4-404101: ISAKMP: Failed to allocate address for client from pool pool_idsha%PIX-4-405101: Unable to Pre-allocate H225 Call Signalling Connection for faddr faddr[/fport] to laddr laddr[/lport]%PIX-4-405102: Unable to Pre-allocate H245 Connection for faddr faddr[/fport] to laddr laddr[/lport]%PIX-6-604101: DHCP client interface int_name: Allocated ip = IP_addr, mask = mask, gw = IP_addr%PIX-6-604102: DHCP client interface int_name: address released%PIX-6-604103: DHCP daemon interface int_name: address granted MAC_addr (IP_addr)%PIX-6-604104: DHCP daemon interface int_name: address released MAC_addr (IP_addr)Removed Messages in Version 5.2
The following syslog messages were removed in version 5.2:
%PIX-2-106003: Connection denied src laddr dest faddr due to JAVA Applet on interface int_name.%PIX-3-201007: Unable to allocate new udp connections (faddr/fport-laddr/lport)%PIX-3-203001: ESP Error: No Key SPI hex SRC IP_addr DEST IP_addrDocumentation Changes
All IPSec configuration information is now in the Cisco PIX Firewall IPSec User Guide, Version 5.2. This guide is available both online and in the PIX Firewall accessory kit.
Installation Notes
Always configure a default route command statement to the outside interface in every configuration you create. This is especially important for use with IPSec.
Limitations and Restrictions
No new limitations or restrictions were added in version 5.2.
Important Notes
AAA
The inbound and outbound options to the aaa command apply only to the network interfaces in the first two slots of the PIX Firewall.
CRLs
When CRL checking is configured as mandatory, PIX Firewall takes about two minutes to poll the CRL from the VeriSign CA Server during ISAKMP negotiation. As a result, ISAKMP negotiation fails with the message "ISAKMP (0): Unknown error in cert validation, 0" and packets are lost until PIX Firewall receives the CRL. [CSCdr89880]
Cisco Secure VPN Client
•
•
The problem occurs when IKE Mode Config is configured and PIX Firewall runs out of addresses created by the ip local pool command and the next VPN Client tries to come in.
The behavior is as follows:
–
–
This caveat does not exist for the Cisco VPN 3000 Client version 2.5. [CSCdr48442]
Cisco VPN 3000 Client
The following restrictions apply to using PIX Firewall with the Cisco VPN 3000 Client:
•
•
•
•
•
•
•
•
For example, if you ping from the client and check the inbound and outbound SPIs, Cisco VPN 3000 Client can be seen to use the third (latest) SPI to send the ping, but PIX Firewall uses the second SPI, the one before the last, to respond to the ping. The result is that the ping responses return to the Cisco VPN 3000 Client, but are dropped. [CSCdr83223]
•
•
Cisco VPN 3000 Concentrator
The following restrictions apply to use with the Cisco VPN 3000 Concentrator series:
•
•
•
•
Failover
Refer to the "Failover" section in Chapter 3, "Advanced Configurations" in the Cisco PIX Firewall Configuration Guide, Version 5.2 for a new procedure for configuring failover.
The PIX Firewall DHCP client does not support failover configurations.
FDDI
FDDI interfaces are supported on the PIX 525 with the caveat that no other interface card can be used with FDDI cards. In addition, the Ethernet interfaces on the motherboard must be shut down using the shutdown option to the interface command.
On the PIX 520 and earlier models, when FDDI interface cards are used, no other interface card can be used on the unit.
The PIX 515 does not support use of any FDDI interface cards.
License Key Downgrade
If you downgrade your license key from a UR to an R, thereby restricting the number of supported interfaces, PIX Firewall removes all commands from your configuration that reference the unsupported interfaces. In addition, open caveat CSCdr52181 notes that PIX Firewall also removes all nat and static commands from the configuration.
SMTP
Multiple SMTP commands contained in a single packet are no longer permitted and are now dropped.
Token-based Authentication for VPN Clients
The PIX Firewall now supports token-based authentication systems through the use of the crypto map token authentication command. PIX Firewall supports the following token-based authentication systems and modes for use with the Cisco VPN 3000 Client:
•
–
–
•
–
–
•
–
The PIX Firewall supports the SDI RADIUS token-based authentication system using Next Token mode or New Pin mode for use with the Cisco Secure VPN Client, version 1.1.
Token based authentication has not been verified for the following vendors/products:
•
•
•
For more information about the crypto map token authentication command, see the crypto map command page in Chapter 12, "Command Reference" of the Cisco PIX Firewall IPSec User Guide, Version 5.2.
Caveats
Note
http://www.cisco.com/public/support/tac/tools_trouble.shtml
Open Caveats - Release 5.2
•
If you configure a network static where the network static is the same as a third party netmask and address, then an outbound H.323 connection fails. The following example clarifies this problem:
The interfaces in the example are as follows:
–
–
–
Example network static command statement:
static (inside,outside) 10.1.1.0 10.0.0.0
This command maps the inside host address of 10.0.0.5 to the outside global address of 10.1.1.5, and the inside host address 10.0.0.7 to the outside global address of 10.1.1.7.
If the PIX Firewall encounters a packet from 10.1.1.5 to 10.0.0.5 with the embedded IP address of 10.1.1.7, the PIX Firewall unit will not be able to determine if the embedded IP address belongs to the inside or outside network.
•
SSH and failover are not supported for use together in version 5.2. If used together, an RSA key created before failover will not appear on the Standby unit after failover occurs.
•
PIX Firewall is not able to create an IPSec tunnel with a 2048 RSA key using a PIX Firewall "Classic" model.
•
PIX Firewall fails to get certificates if downgraded from 5.2 when used with the Microsoft Certification Authority.
•
When IPSec traffic is not present between a PIX Firewall to a PIX Firewall, when the IPSec and ISA lifetimes expire, both IPSec and ISA SAs are deleted. When IPSec traffic is not present between a PIX Firewall and a Cisco VPN 3000 Concentrator, when the lifetimes expire, the SAs are not deleted and the units rekey.
•
H.323 call setup is not supported by failover.
•
The Cisco VPN 3000 Client on Windows 95 or Windows 98 does not take the WINS server address pushed to it from the PIX Firewall if an IP address is statically configured on the client. For static configurations, users must manually configure the adapters with WINS information. This works correctly on Cisco VPN 3000 Client on Windows NT. On Windows 95 or Windows 98, dynamic WINS support works with DHCP enabled adapters; that is, PPP or NIC adapters that get their information dynamically.
•
Always configure a default route command statement to the outside interface in every configuration you create. This is especially important for use with IPSec.
•
ICMP types 3, 4, 5, 11, 12, 13, 14, 15, 16, 17, and 18 fail with PAT.
•
During the PIX Firewall unit's enrollment request to a Baltimore CA server, the process fails. This failure occurs when using the ca enroll command to obtain CA-signed certificates for each of the two special-purpose RSA key pairs the PIX Firewall generated (using the ca generate rsa specialkey command). When the failure occurs, PIX Firewall displays the following error messages:
CRYPTO_PKI: status = 100: certificate is grantedCRYPTO_PKI: Error: Invalid format for BER encoding while##########In GetRecipientInfo: 315CRYPTO_PKI: status = 266: failed to open the envelopeThe certificate enrollment request failed!•
When CRL checking is configured as mandatory, PIX Firewall takes about two minutes to poll the CRL from the VeriSign CA Server during ISAKMP negotiation. As a result, ISAKMP negotiation fails with the message "ISAKMP (0): Unknown error in cert validation, 0" and packets are lost until PIX Firewall receives the CRL.
•
SSH permits up to 100 characters in a username and up to 50 characters in a password.
•
When PIX Firewall creates multiple IPSec SPIs (security parameter indexes), the Cisco VPN 3000 Client uses the latest SPI to send data, but PIX Firewall does not. PIX Firewall does not keep track of the SPIs in the order they were created. PIX Firewall uses the SPI with the highest lifetime, but the latest SPI ends up with less lifetime than the one before.
For example, if you ping from the client and check the inbound and outbound SPIs, Cisco VPN 3000 Client can be seen to use the third (latest) SPI to send the ping, but PIX Firewall uses the second SPI, the one before last, to respond to the ping. The result is that the ping responses return to the Cisco VPN 3000 Client, but are dropped.
•
In version 5.1 and prior versions, when you enabled the debug command, output messages displayed at an active terminal session, such as the console or a Telnet session.
In version 5.2 and future versions, PIX Firewall supports multiple console sessions, which means that debug command output messages can be sent to multiple sessions simultaneously, as long as the sessions are enabled. Each session is enabled or disabled independently and there is no effect on other sessions.
•
The Cisco VPN 3000 Concentrator series ignores all keepalive messages originating from the PIX Firewall unit.
•
PIX Firewall/Cisco VPN 3000 Concentrator: traffic does not restart after power cycling the concentrator.
•
The Cisco VPN 3000 Client does not support Group 2 for IKE transform sets.
•
From within the Cisco VPN 3000 Client status window, while a tunnel is available, if you press the Space key twice, the client hangs.
•
Use of the SNMP ip.ipAddrTable entry requires that all interfaces have unique addresses. If interfaces have not been assigned IP addresses, by default, their IP addresses are all set to 127.0.0.1. Having duplicate IP addresses causes the SNMP management station to loop indefinitely. The workaround is to assign each interface a different address. For example, you can set one address to 127.0.0.1, another to 127.0.0.2, and so on.
•
When starting a SSH session, a dot (.) displays on the PIX Firewall console before the SSH user authentication prompt appears.
The dot appears as follows:
pixfirewall(config)# .pixfirewall(config)# .The display of the dot does not affect the functionality of SSH. The dot appears on at the console when generating a server key or when decrypting a message using private keys during SSH key exchange, before user authentication occurs. These tasks can take up to two minutes or longer. The dot is a progress indicator that verifies that the PIX Firewall is busy and has not hung.
•
Cisco VPN 3000 Client has to use split tunneling to connect to a remote PIX Firewall unit if the Cisco VPN 3000 Client is going to browse through the private network on the inside of the remote PIX Firewall unit, as well as the local network of the Cisco VPN 3000 Client.
•
In version 5.2, when keys and certificates generated with the crloptional parameter to the ca command are replaced with new ones, ISAKMP negotiation fails. This caveat previously worked correctly in version 5.1. This caveat was observed after creating keys and certificates, sending traffic, and removing the keys and certificates on both PIX Firewall units. After new keys and certificates were created with the crloptional parameter to the ca command and new traffic started, ISAKMP negotiations failed.
•
An ip local pool range cannot have multiple subnets.
•
Port numbers are not appearing in syslog when using ACL.
•
If PIX Firewall crashes, it attempts to run the show tech-support command. A long configuration can cause further crashes.
•
PIX Firewall using RADIUS or TACACS+ requires username and password pairs for authentication, but only authorizes based on IP addresses. Once a multiuser host has been authenticated, all other users on that host are granted authentication. This may allow unauthorized users access to services normally denied them.
Setting the uauth timeout to zero partially solves this problem, but makes Web browsing difficult for authorized users because they must reauthenticate for every new page they view.
•
The Cisco VPN 3000 Concentrator, only supports a limited number of IPSec transform sets. The Cisco VPN 3000 Concentrator does not support the AH protocol. The supported transform sets are as follows:
esp-des esp-md5-hmacesp-des esp-sha-hmacesp-3des esp-md5-hmacesp-3des esp-sha-hmacesp-null esp-md5-hmac•
If you downgrade your license key from a UR to an R, thereby restricting the number of supported interfaces, PIX Firewall removes all commands from your configuration that reference the unsupported interfaces. In addition, PIX Firewall also removes all nat and static commands from the configuration.
•
PIX Firewall behaves differently when used with and without Xauth in combination with IKE Mode Config when used with the Cisco Secure VPN Client. Refer to the second bullet item in "Cisco Secure VPN Client" for more information.
•
The aaa authorization except command does not work for UDP.
•
Crash in Crypto PKI RECV thread during certificate enrollment.
•
The following syslog message incorrectly displays a field as "<>":
%PIX-3-106014: Deny inbound icmp src outside:IP_addr dst <>:IP_addr (type 0, code 0)
•
Small ARP timeouts cause short periods of packet loss.
•
Interface routing should be based on the DNAT address.
•
Outbound filtering is not working correctly. An example is as follows:
outbound 2 permit 0.0.0.0 0.0.0.0 0 tcpoutbound 2 deny 192.168.85.51 255.255.255.255 0 ipoutbound 2 deny 192.168.85.51 255.255.255.255 0 tcpapply (inside) 2 outgoing_srcIf you do not have the third command statement, the second line does not stop TCP packets. It may sound logical, the protocol values may be UDP, TCP, or the ICMP protocols. In this case, ip is not a valid protocol, and thus, not evaluated by the PIX Firewall, but it is not denied by PIX Firewall command line parser.
Resolved Caveats - Release 5.2(5)
•
Previously, if the Cisco VPN 3000 Client forced a disconnect from an IPSec tunnel, the PIX Firewall would crash. This has been fixed.
•
In an IPSec PIX Firewall VPN tunnel, the PIX Firewall no longer retransmits the Phase 2 Security Association timers when the tunnel is established.
•
Guest
