Table Of Contents
Release Notes for Cisco Security Manager 3.1.1
What's New in Security Manager 3.1.1
Cisco Security Manager 3.1.1 Download and Installation Instructions
Cisco Security Manager 3.1.1 Service Pack 3 Download and Installation Instructions
Catalyst 6500/7600 Configuration
Diagnostics, Monitoring, and Troubleshooting Tools
Site-to-Site/Remote Access/SSL VPN Configuration
Auto Update Server (AUS) 3.1.1
New Features in Security Manager 3.1
Discovering Remote Access VPN Policies
Device OS Version Interoperability with Device Managers Started from Security Manager
Obtaining Documentation, Obtaining Support, and Security Guidelines
Release Notes for Cisco Security Manager 3.1.1
Revised: April 14, 2008CDC Date: April 14, 2008Contents
Introduction
This document contains release note information for the following:
•
Cisco Security Manager 3.1.1 (including Service Packs 1, 2, and 3)
Cisco Security Manager (Security Manager) enables you to manage security policies on Cisco security devices. Security Manager supports integrated provisioning of firewall, VPN, and IPS services across IOS routers, PIX and ASA security appliances, and Catalyst 6500/7600 services modules (FWSM, VPNSM, VPN SPA, and ISDM-2). Security Manager also supports provisioning of many platform-specific settings, for example, interfaces, routing, identity, QoS, logging, and so on.
Security Manager efficiently manages a wide range of networks, from small networks consisting of a few devices through to large networks with thousands of devices. Scalability is achieved through a rich feature set of shareable objects and policies and device grouping capabilities.
Security Manager supports multiple configuration views optimized around different task flows and use cases.
•
The Auto Update Server (AUS) is a tool for upgrading PIX security appliance software images, ASA software images, PIX Device Manager (PDM) images, Adaptive Security Device Manager (ASDM) images, and PIX security appliance and ASA configuration files. Cisco IOS routers that have dynamic IP addresses communicate with AUS that is running the Cisco Networking Services (CNS) Gateway Protocol to provide their IP addresses.
Security Manager can interoperate with AUS. To manage the devices in Security Manager, you must provide the device identity and the AUS information when you add a device. Security Manager uses the device identity information to retrieve the device IP address from an AUS that can be reached.
Note
This release note document includes ID numbers and headlines for each known problem identified in the document and a description of each. This document also includes a list of resolved problems. If you accessed this document from Cisco.com, you can click any ID number, which takes you to the appropriate release note enclosure in the Bug Toolkit. The release note enclosure contains symptoms, conditions, and workaround information.
What's New in Security Manager 3.1.1
•
•
•
–
–
–
–
•
Cisco IPS 4270 Sensor - http://www.cisco.com/en/US/products/hw/vpndevc/ps4077/index.html
•
•
•
If you started the device manager for a device with a different HTTPS port number than the currently configured value, the changed port number does not take effect for the first instance of device manager launch. This failure occurs because Security Manager attempts to establish a connection with a device with the cached port number, based on the connection timeout and retry count values specified in the Device Communication page. However, subsequent attempts to start the device manager are successful because Security Manager connects to the device using the changed port number.
•
•
•
Installation Notes
•
•
•
Cisco Security Manager 3.1.1 Download and Installation Instructions
To download and install Cisco Security Manager 3.1.1:
Step 1
Step 2
Note
Step 3
Note
Step 4
The InstallShield Wizard extracts files to a temporary directory and checks their integrity while it constructs the Cisco Security Manager Setup application, which starts automatically.
Note
Tip
Cisco Security Manager 3.1.1 Service Pack 3 Download and Installation Instructions
Note
To download and install Cisco Security Manager 3.1.1 Service Pack 3:
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Step 7
Step 8
Step 9
Note
Step 10
Important Notes
•
•
•
•
•
•
•
1.
2.
3.
4.
5.
6.
7.
Note
IPS and IOS IPS Notes
•
•
•
•
•
Caution
Resolved Problems
Service Pack 3 is superset of Service Pack 2 and Service Pack 1, so it contains all problem resolutions included in Service Pack 2 and Service Pack 1, as well as those in Service Pack 3.
•
•
•
•
Note
Table 1 Resolved Problems in Service Pack 3
Description: Under a rare condition, the Access Rules table cannot be loaded after you add or delete rules in the table.
Description: A duplicate order_id in the same policy group might occur when multiple firewall policy groups are modified with an insertion.
Description: When you start IPS Device Manager (IDM) from a Security Manager client, you are prompted with a message stating that an instance is already open even if no previous instance of device manager is running.
Description: Firewall devices (PIX/ASA running 6.x, 7.x) are not able to access the AUS server. Apache generates "Access Violations."
Description: While submitting changes to the device, Security Manager hangs for a long time at the validating screen.
Description: All policies are deleted on the Security Contexts when you deploy to a device or when you do a preview config.
Description: After an IOS device is added to Security Manager, the device target type cannot be changed unless it is deleted, then added again.
Description: Security Manager 3.1.1 discovering an FWSM 3.1(x) blade in multi-context mode with active/active failover configured fails.
Description: TACACS+ should be supported for authentication for remote access purposes.
Description: Each time a PIX or ASA device is accessed in Security Manager, unwanted error log entries are printed in vmsbesvcs.log.
Description: When you deploy large configuration changes to PIX 6.2 devices, deployment fails with the "Error: 24112 : IO error during SSL communication" message recorded in the transcript.
Description: When you install Security Manager 3.1.1 SP3 on top of 3.1.1 that is already running on a server, an error message is displayed at the end of the installation, even though the operation is successful.
Table 2 Resolved Problems in Service Pack 2 (Also included in Service Pack 3)
Description: When adding a Static NAT to a PIX/ASA/FWSM device, the original address and translated address fields report an error if a network object that contains a non-host address is selected.
Description: For multiple context FWSMs, Security Manager allows url-mempool to be configured to a value between 2-512 and fails to deploy configurations with a value set greater than 512. For single context FWSMs, Security Manager should allow the deployment of configurations with a url-mempool value between 2-10240.
Description: When a dynamic NAT rule on IOS is referring to an ACL policy object, and the ACL policy object is modified in Security Manager, after deployment, the ACEs (contents) of the ACL on the device might be in a different order than the order of the ACEs in Security Manager.
Description: Unable to import ASA 8.0 if SSL VPN/WEBVPN is enabled on the device.
Description: Not all Cisco Security Manager activity is being logged to the ACS server.
Description: In the case of ACL policy objects, each ACL can refer to multiple ACE policy objects. Each ACE policy object could in turn refer to multiple Network policy objects. This kind of nested references makes conflict detection a performance intensive task. Each additional ACE object in the system makes a perceivable difference in the performance of discovery.
Description: When an IOS router device is added to Cisco Security Manager without IPS capability, later if the user reimages the ISR with an IOS image which supports IPS, rediscovering the ISR will not discover IPS policies.
Description: When sorting the IPS licenses by "Expires On", the licenses become sorted in alphabetical order rather than chronological expiration order.
Description: Security Manager does not allow 255.255.255.255 subnet mask to be configured for interfaces. This check should be removed for PPPoE interfaces with setroute enabled.
Description: Security Manager might hang not respond while discovering large number of devices.
Table 3 Resolved Problems in Service Pack 1 (Also included in Service Pack 2)
Description: Security Manager's flexconfig does not contain a system variable for the dynamic "policy-map" and "class-map" names that are generated on PIX/ASA/FWSM devices. To apply an advanced inspection map that is not supported by Security Manager, you must use the flexconfig; however, since the names are dynamic, you must preview the configuration and manually change the flexconfig every time a change is made in order to match the dynamic name. This enhancement uses system variables that allow you to reference policy-map or class-map names in the flexconfig for ASA/PIX/FWSM devices.
Description: If you create a filter in the access rules table, then select an entry within the table some table-pages down, if you click Clear, the access rules browser jumps to the beginning of the table and the rule is no longer selected.
Description: This is an enhancement. CNS CE reply states the device already exists in CE when Security Manager creates a device via CE API call. CE might return misinformation in some cases.
Description: When you restart the Security Manager server without launching the Security Manager client, initiating flexconfig through the SDP servlet causes a class not found exception.
Description: The AAA include/exclude commands can each have multiple instances, but the current rule file models them as a single instance command and, therefore, leaves only one instance after processing.
Description: Printing from a diff dialog (e.g. Tools -> Preview Configuration, Tools -> Configuration Archive -> View diff) might produce an incomplete document. "Incompleteness" includes: the document might be missing its last several rows; some rows might be cropped along the right-hand side; and page breaks might occur in the middle of row text.
Description: When you add a new Device to Security Manager 3.1, then copy a shared policy, the following error message results: "Both NTP and Clock are configured on same Device".
Description: When you make a simple change to the access rule table, you might see several unreferenced object groups deployed to a device.
Description: IOS User Group validation fails in the GUI when the IP Address Pool is configured with a singleton address. IP address ranges can be configured fine in the IOS User Group Address Pool.
Description: A protocol object-group containing TCP and UDP protocols that is used in an access-list (access-rule) is not discovered correctly.
Description: When you deploy multiple devices in the same job, you might encounter a deployment failure.
Description: After the CNS server has been rebooted, it sets all CNS jobs to the 'stopping' state, which is the failed CNS job status. The Security Manager monitor will then treat this state as a failure, mark the Security Manager job as 'failed' and clear the CNS job.
Description: If a PIX/ASA or FWSM firewall is configured for Active/Active Failover, adding the 'Management IP Address' within the respective Security Contexts' > Device Properties > General section will be removed after the initial deployment if it is not replicated within the System Execution Space's (System Contex) > Security Context policy page.
Description: The following QoS commands cannot be discovered into Security Manager:
match ip precedence x
match ip dscp x
set ip precedence x
set ip dscp x
Description: There are two symptoms: 1) When you add multiple NAT-0 rules that have the same interface and direction, the remarks for these rules are generated multiple times. 2) When the "Do not translate VPN traffic" checkbox is enabled, the NAT-0 rules are not generated.
Description: A selected row in the deployment job table is no longer visible/selected on screen.
Description: Security Manager deploys the standard ACL used in the router SNMP configuration. Under certain conditions, in a subsequent deployment, even if no changes are made to the ACL, Security Manager might remove the standard ACL that was previously deployed and redeploy a new ACL with the entries (ACEs) re-ordered.
Description: VPN operations keep getting slower and slower with time. In some cases, even if you modify one spoke policy, all spokes show up in the "Modified Device List" during deployment.
Description: Security Manager allows multiple deployment jobs to be created for the same device, which might cause deployment to fail.
Description: Added new API to VpnToolAPI for getting the Vpn Nodes given to the devices.
Description: Incorrect OOB message might be reported in a failover configuration. If a failover occurs after you deploy to the active unit, a subsequent deployment might report the following out-of-band change:
!<!failover lan unit primary!>!failover lan unit secondary!>>>> End of differences.!Out of Band (OOB) change detected on device: <device-name>. Stop !provisioning.Description: When several devices exist in the system and there are several deployment jobs, sometimes when the Deployment Manager GUI is invoked, the GUI hangs and an Out Of Memory error is observed in the server log.
Description: The IP address is negated for Management0/0 interface.
Description: When the CNS server reboots, all pending CNS jobs will be put in the STOP state, but they are actually in the INVALID state. This means that restarting the jobs will not put them back in a valid pending state. Security Manager must delete these CNS jobs and recreate new ones, then correspond these new CNS jobs with existing Security Manager jobs when the CNS server reboots.
Description: When a device is deleted from Device view and the device participates in a VPN, you should get a warning or error message that explains if the device can or cannot be deleted from the VPN. If you proceed, the device is also removed from the VPN.
In some specific conditions, the warning or error message is not displayed and the device is deleted from Security Manager, but the VPN still maintains a reference to the device, which causes database inconsistencies that result in errors to activity validation and deployment.
Description: In rare cases, a Cisco CNS server might not update CNS job status to the Completed state after the status of all devices inside the CNS job has already been updated to a final state. As a result, Security Manager cannot update the corresponding Security Manager job status.
Description: There is not an easy way to track Security Manager client user login session information from the Security Manager itself (either through an API or DesktopServlet command).
Description: Deployment or cross-launch to other applications from Security Manager might not work.
Description: If a Crypto RSA key (chain) is generated within an ISR's configuration, and is imported into Security Manager, a Preview Configuration operation will display that the key material is marked red for deletion.
Description: Security Manager generates '0.0.0.0' as part of the VPN dynamic routing protocol.
Description: If a configuration pre-exists on the FWSM firewall where the LAN failover and stateful failover interfaces are shared, for example:
failoverfailover lan unit primaryfailover lan interface failover Vlan2failover replication httpfailover link failover Vlan2failover interface ip failover 1.1.1.1 255.255.255.252 standby 1.1.1.2After the import, performing a preview configuration shows that the stateful failover link is incorrectly removed from the configuration with the next deployment:
no failover link failover vlan 2Description: Transcript does not exist, although Security Manager has started with device communication.
Description: When a deployment job is created and then aborted, if it is deployed after and scheduled to run at a later time, it starts immediately, within 5 minutes.
Description: Security Manager generates "pim" and "igmp" CLI on those interfaces that mutlicast is not enabled.
Description: Failure to update IPS signatures or deploy changes to IPS from Cisco Security Manager.
Description: VPN discovery fails.
Description: When discovering a DMVPN between a catalyst 6500 or cisco 7600 device and any other router, the VPN discovery fails with an error message that states there was a DatabaseException.
Description: 3.1.1 SP1 can be installed on versions such as 3.0.2, 3.0 etc.
Description: Even though CNS doesn't integrate with CNS image service, it would be beneficial if Security Manager can set the image ID when creating a CE device for customers who use CNS image service, such as CiscoIT. This should be a feature that can be turned on/off in a property file, since the set image ID will create a separate object in the CE database. For a customer that doesn't use image service, this is not desired.
Description: Security Manager might still manage the CLIs for unmanaged policies that are configured from Tools > Administration > Policy Management.
Description: In the Policy View the policy "GRE Modes" cannot be saved after any change is made to the default values
Description: For an ASA 5505, the speed and duplex of the switchports are set to be auto/auto no matter what the speed and duplex are set to on the device.
Description: The aaa-server <aaa_tag> (inside) host command is always generated in delta and deployed to the device in some cases.
Description: When discovering a VPN with HSRP configured on the hubs, the protected networks are not discovered. Discovery status reports that the protected networks are not discovered.
Description: When you use Security Manager to deploy IPS signature updates, Security Manager changes tuned signatures back to default if the update contains modified signatures.
Description: When the Address Pool selector in the Address Pool Wizard has its select button clicked, nothing happens and an exception is seen in the client log.
Description: The second and third columns are greyed out and you cannot create any filters.
Description: After an update via CCO operation for any sentinel license type of devices, CCO credentials are displayed in clear text inside the CCO request xml string in stdout.log.
Table 4 Resolved Problems in Security Manager 3.1.1
Description: For FWSM3.1(1) context, if you modify the AAA rules table, then deploy the change to the device, you might get the following deployment error:
ERROR: Unable to find AAA ACE Error acl_updated: aaa_acl_changed failed ERROR: Unable to delete ACE from dependent modulesDescription: Deploying to FWSM 3.1(4) fails with an error saying "Specified remark does not exist" in the deployment transcript. This happens only when the "Let FWSM decide when to compile access-list" admin setting is unchecked and the access policies contain a number of comments.
Description: When you use Security Manager to roll back an ASA 7.2(2) device to a configuration that contains default inspection class-map and policy-map "global_policy". If you change Web Filter rules, then deploy the change, the deploy operation might fail.
Description: Deployment might fail if an IP address is configured with a non-standard mask for an address pool. Although the UI allows it, the only device version that allows non-standard masks is PIX/ASA 7.2+.
Description: If TCP Map is assigned in the "IPS, Qos and Connection Rules" then redundant tcp-options commands might be generated even if no changes are made to the TCP Map or related policy.
Description: If an access-list entry (ACE) with an object group is internally expanded into a number of ACEs and if one of the expanded ACEs is inserted into the access-list, FWSM 3.1(3)12 and later rejects this ACE with an error "found duplicate element".
Description: Security Manager deployment details may show 'Interface defined on device does not have a name' warnings if the interface name is empty. For example, some of the interfaces defined on a device do not have a name defined. Rules bound just to these interfaces will not be deployed.
Description: If you delete the transparent firewall rules from Security Manager and deploy to the device, the rules are not removed from the device; however, Security Manager continues to show those rules as deleted.
Description: When you change an access list that is shared between a static command and another command, deployment to the device might fail.
Description: The Hit Count option, which is accessed from the Tools menu that is located below the Access Rules table, is disabled when you select access rules that belong to an inherited policy.
Description: Show cell contents for Sources/Destinations might show empty contents or "no value" if the cell contains a network with a non-standard mask.
Description: The Create Network from Cell contents or Create Network from Selected Contents does not work if the cell contains an IP address range.
Description: You receive a 404 error when attempting to access IPS Manager in CSM 3.1. This link should not exist, because Security Manager 3.1 manages IPS devices in the client, not through the IPS Manager.
Description: Database archival feature that enables you to archive real-time events does not work in IEV started from Security Manager. However, this problem does not occur on a system in which IEV is installed separately from Cisco.com and started outside of Security Manager.
Description: During import, a network policy object might not get reused, even if the contents in Security Manager are the same as the contents of the network being imported.
Description: Users are unable to add AIP-SSM devices from DCR into Security Manager 3.1. This occurs when the user was previously managing AIP-SSM devices with Security Manager 3.0, upgraded from Security Manager 3.0 to 3.1, and then attempted to add these devices from DCR.
Description: Some IPS MC 2.2 backups contain sensor information that is not complete. This can happen if a default device is added and never discovered before a backup is made.
Description: When deploying to an IPS sensor with the bypass mode set to 'on', the 'on' is replaced with 'auto' during deployment, causing the sensor to come out of bypass mode.
Description: Attempts to update the sensor license from Cisco.com fail.
Description: When downloading from Cisco.com and using an IIS proxy server, the download will fail.
Known Problems
This section contains information about the problems known to exist in Cisco Security Manager 3.1.1 (including Service Packs 1 and 2).
Catalyst 6500/7600 Configuration
Table 5 Catalyst 6500/7600 Configuration
Description: Deployment fails when you attempt to change the running mode of the data port VLAN from Trunk (IPS) to Capture (IDS) from the IDSM Data Port VLANs dialog box and the following error message is displayed:
Command Rejected: Remove trunk allowed vlan configuration from data port 1 before configuring capture allowed-vlansDescription: If you modify the allowed VLANs of an IDSM data port that has been configured as a capture port and deploy configurations to the device, the following error occurs:
"Capture not allowed on a SPAN destination port"Description: Deployment might fail when you attempt to modify the physical port configuration type from access to trunk mode for a Catalyst switch and keep the Enable DTP negotiation check box selected in the trunk port mode.
Description: When you migrate a Security Manager 3.0 or 3.0.1 database to 3.1 in workflow mode, and try to discover the configuration of the upgraded Catalyst 6500 Series switch, Cisco 7600 Series router, or FWSM managed using the chassis before creating an activity, discovery fails.
Client Software
Table 6 Client Software
Description: On a PC with many users, only the person who installs Security Manager Client can see the desktop and Start menu shortcuts that show that Security Manager Client is installed.
Deployment
Table 7 Deployment
Deployment fails if access rules containing certain options are associated with Layer 2 interfaces of ISR routers.
Description: Deployment to AUS-managed device fails if the deployment configuration contains the CLI command "enrollment url http:..."
Description: After Security Manager successfully deploys the configuration file to CNS, and Cisco IOS routers configured for CNS poll and apply the configuration changes at the predefined polling period, the Status column in the Deployment Manager window continues to display the job state as "Deploying".
Description: A device's certificate is changed after retrieving the config file from the AUS server. The certificate stored in Security Manager would be out of sync with the device, hence cause the preview to fail with certificate mismatched error.
Device Management
Table 8 Device Management
Description: If you try to import a system context that belongs to a multi-mode PIX Firewall 7.0 or an ASA device from DCR to Security Manager, the import fails and an error message results.
Description: Deployment to Cisco IOS router fails when SSL is the transport protocol and you see a confusing error message.
Description: You cannot import an AUS-managed device from DCR to Security Manager.
Description: Authorization and duplicate display name errors occur when you add devices to a Security Manager server that uses Cisco Secure ACS for AAA.
Diagnostics, Monitoring, and Troubleshooting Tools
Table 9 Diagnostics, Monitoring, and Troubleshooting Tools
Description: When you install only Common Services 3.0.5 or AUS 3.1 from the Security Manager DVD, an IEV error message is displayed even if you did not select Security Manager 3.1 during installation.
Description: During installation of Security Manager server 3.1 on systems that do not contain C: drive, IEV server fails to install and an error message is displayed. Also, an error is logged in the server installation log file.
Description: After you perform configuration changes for Cisco IOS devices using SDM 2.4 started from the Security Manager client and click Discard Changes to reset to the previously applied configurations, many of the pages are blank or empty.
Description: You cannot start IEV client from Security Manager client on a system in which the Symantec Client Firewall Port Scanning Module or Symantec Secure Port application is running.
Discovery
Table 10 Discovery
Description: Device level overrides for policy objects corresponding to object groups can be created after discovering only the inventory policies like interfaces.
Description: On a 7.2 ASA/PIX with multiple AUS servers, changing the order of the AUS servers does not generate any commands.
Description: The interface parameter is not discovered for the AAA-server building block discovered from IOS routers.
Firewall Services
Table 11 Firewall Services
Description: Security Manager does not support TCP flag specifications, such as urg, fin, psh, and ack, in access rules. As a result, during discovery, Security Manager drops the specifications.
Description: Security Manager does not support ACE options such as DSCP, ToS, or precedence. As a result, during discovery, Security Manager drops the options.
Description: Although the GUI allows you to enable the Object Group Search option for FWSM devices, the FWSM does not expand object groups when listing access rules after a "show access-list" command and Hit Count results are inaccurately displayed.
Description: Security Manager does not check if the firewall rules that you configured in Security Manager permit management traffic (SSH and HTTPS) to the IOS device being managed. As a result, after firewall rules are deployed to the device, connection to the device might be lost.
Description: IOS 87x ISR routers do not support BGP as a routing protocol or as a service in ACLs when the device has only 24 MB of memory; however, BGP is supported when the device has more than 24 MB memory. Security Manager does not detect the amount of memory available on the device and cannot enforce any restrictions. As a result, job deployment containing an ACL with ACEs having BGP will fail.
Description: IOS devices require that HTTP is used as the traffic type for authentication proxy, which generates the command ip http server. Security Manager does not remove the CLI when authentication proxy is unassigned from the device in Security Manager.
Description: If an AuthProxy configured on an IOS device has a user-specified name that does not comply with the naming convention used by Security Manager, the name is not removed if the device is discovered and the policy is unassigned.
Description: If you create AAA or inspection rules for "all" interfaces on an IOS device, deployment fails if the device is using Layer 2 port.
Description: IOS devices use standard ACLs for filtering; however, standard ACLs are not recognized when Hit Count reports are generated.
Description: When you create an access rule for a PIX 6.x device, you can specify a time range in the GUI; however, the device does not support the time range feature in the ACE and no warning is displayed during activity validation or deployment.
Description: If Security Manager tries to deploy AAA server groups to a device that already has the maximum number of AAA server groups, deployment fails.
Description: IOS inspection port-map commands are not generated if inspection rules configured in Security Manager conflict with port definitions of predefined inspection protocols.
Description: Some options are omitted from rules that are created using the Import Rules tool, for example, empty port values and destination port values that are not validated for 'eq' and 'neq' for IOS devices.
Description: Rule section changes are not reported in the activity reports.
Description: AAA Server policy objects cannot be reused because of mismatched interfaces. This might result from an interface role used to define an interface that is not matched to a physical interface after rediscovery. For PIX/ASA7.x devices, this might result from using "inside" (or an interface name that starts with "inside") to describe the interface.
Description: Changes to the match-condition order for a gtp-map used in a PIX 7.0 or PIX 7.1 device do not get deployed to the device.
Description: When you associate interfaces with another bridge-group and provision it in Security Manager, the deployment shows an error; however, the device in this case has been provisioned correctly.
Description: If two filter commands of the same type are defined with the same port ranges (service) or overlapping port ranges and overlapping networks, deployment to a device fails. The device does not accept overlapping filter commands.
Description: For ASA 7.2 HTTP Maps, if the body match maximum is set to 0 (zero), the device accepts the command as "body-match-maximum" but shows it in show run as "body-match-maximum 0". This causes the delta to always contain the removal of the http policy-map subcommands and adding them back.
Description: The access rules table might not finish loading for a newly discovered device if the discovered configuration has access-list remarks that contain quotes or double quotes.
Description: When you create overlapping global rules on different interfaces for PIX/ASA/FWSM devices, Security Manager returns an error about overlapping IP ranges even though the global interfaces are different.
Description: WAAS inspection ru
Guest
