Release Notes for Cisco PDM Version 4.1(4) for Firewall Services Module

November 2006

Introduction Cisco PDM Version 4.1(4) is a web-based application used to configure and monitor the Firewall Services Module (FWSM) on a Catalyst 6500 series switch or Cisco 7600 series router. PDM Version 4.1(4) requires FWSM Release 2.3 or 2.2 and supports all of the configuration features in this release. For more information, see FWSM Technical Documentation and the FWSM FAQ (Frequently Asked Questions) sections in Cisco.com.message.

Note PDM Version 4.1(4) is a single image that supports FWSM Release 2.3 and 2.2. It does not support FWSM Release 1.x, FWSM Release 3.x or above, or the ASA or PIX platforms.

This document includes the following sections:

• Introduction, page 1

• Switch and Router System Requirements, page 2

• PC and Workstation Requirements, page 3

• Features Introduced in PDM Version 4.1, page 4

• Caveats, page 5

• Obtaining Documentation, page 6

• Documentation Feedback, page 7

• Cisco Product Security Overview, page 7

• Product Alerts and Field Notices, page 8

• Obtaining Technical Assistance, page 9

• Obtaining Additional Publications and Information, page 10

Corporate Headquarters:

Copyright © 2006 Cisco Systems, Inc. All rights reserved.

Cisco Systems, Inc., 170 West Tasman Drive, San Jose, CA 95134-1706 USA

Switch and Router System Requirements

PDM Software OverviewPDM Version 4.1(4) is a single image that provides secure administration of the FWSM. PDM is implemented as a signed Java applet, which downloads to your PC or workstation when you point your browser at the FWSM and does not require a plug-in or other software to be preinstalled. PDM manages FWSM Release 2.3 and 2.2 when it runs in single or multiple context modes.

PDM provides a graphical user interface to the FWSM to administer it without requiring knowledge of the command-line interface (CLI). PDM also maintains compatibility with the FWSM CLI and includes a tool for using the standard CLI commands within the PDM application. PDM lets you graph many aspects of the FWSM, as well as print or export graphs of the traffic through the FWSM and of system activity.

To help you use PDM, the application provides online help as well as a help table of contents, index, and glossary.

Switch and Router System RequirementsThe switch and router models that are supported by the FWSM are as follows:

• Catalyst 6500 series switches with the following required components:

– Supervisor engine with Cisco IOS software or Catalyst operating system

– Multilayer Switch Feature Card (MSFC 2) with Cisco IOS software

• Cisco 7600 series routers, with the following required components:

– Supervisor engine with Cisco IOS software

– MSFC 2 with Cisco IOS software

For more information about supported supervisor engine and software versions and the supported Cisco IOS software, see the Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide Version 2.3.

Note The FWSM does not support a direct connection to a switch WAN port because WAN ports do not use static virtual local area networks (VLANs). However, the WAN port can connect to the MSFC, which can also connect to the FWSM.

For more information on switch or router requirements for FWSM, see the following website: http://www.cisco.com/univercd/cc/td/doc/product/lan/cat6000/mod_icn/fwsm/index.htm.

The following sections list the system requirements for PDM Version 4.1(4) software.

FWSM RequirementsThe FWSM must meet the following requirements to successfully install and run PDM:

• Minimum Software Versions—Verify that your FWSM meets the requirements listed in the Release Notes for the Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Software Release. You must have Release 2.3 or 2.2 installed on the FWSM before using PDM Version 4.1(4). For more information, see the Cisco PDM Installation and Configuration Guide for Firewall Services Module.

2Release Notes for Cisco PDM Version 4.1(4) for Firewall Services Module

78-16791-04

PC and Workstation Requirements

• Upgrading Software—When you install a new version of PDM, close all browser sessions before launching PDM. For information on upgrading your FWSM, see the following websites:

http://www.cisco.com/cgi-bin/tablebuild.pl/cat6000-fwsm

http://www.cisco.com/univercd/cc/td/doc/product/lan/cat6000/mod_icn/fwsm/index.htm

Caution If you are using Management Center for Firewalls, use PDM for monitoring only. All changes made using PDM will be overwritten the next time Management Center for Firewalls synchronizes with the FWSM.

Browser RequirementsThe following are required to access one or more firewalls through PDM:

• Java Virtual Machine (JVM)—PDM 4.1(4) supports the native JVM on Microsoft Internet Explorer 6.0, Sun Java 1.4.2 or 5.0. PDM 4.1(4) also supports Sun Java 1.4.2 on Solaris or Red Hat Linux.

• HTTP 1.1—For Microsoft Internet Explorer, be sure to use HTTP 1.1 for both proxy and non-proxy connections. This can be changed in Tools > Internet Options > Advanced tab. Scroll down to the “HTTP 1.1 settings” section.

Maximum Configuration File SizeFor optimum performance, we recommend a configuration file of no more than 500 KB when using PDM.

FWSM Firewall configuration files over 500 KB may interfere with the performance of PDM on your workstation in the following situations:

• While executing commands such as the write term command and the show running-config command

• Failover (the configuration synchronization time)

• When you click the Refresh button in PDM for the first time

PC and Workstation RequirementsPDM has different requirements depending on the platform from which it is accessed. PDM is not supported for use on computers equipped with the Macintosh operating system, or other versions of the Windows operating systems.

3Release Notes for Cisco PDM Version 4.1(4) for Firewall Services Module

78-16791-04

Features Introduced in PDM Version 4.1

Supported PlatformsTable 1 lists the supported platforms for PDM Version 4.1(4).

Note When using Netscape on some Linux platforms, if you select an item under the Properties tab or the Monitoring tab, the entire PDM window shifts a few pixels to the left and up. This movement happens when you select a pane that contains a text field or a combo box.

Features Introduced in PDM Version 4.1No new features have been introduced in PDM Version 4.1(4) since PDM Version 4.1(1). The purpose of this release is to resolve open caveats.

Important NotesThis section describes important notes for PDM software Version 4.1.

One-time PasswordPDM does not support the one-time password (OTP) authentication mechanism.

Table 1 Supported Platforms for PDM Version 4.1(4)

Operating System Browser Hardware

Windows Windows 2000 (Service Pack 3 or higher) or Windows XP operating systems1 (English or Japanese versions)

1. PDM is not supported on Windows 3.1, 95, 98, ME or Windows NT 4.

Internet Explorer 6.0 with native JVM (VM 3809 or higher), Sun Java 1.4.2 or 5.0

Netscape 7.1 or 7.2 with Sun Java 1.4.2 or 5.0

Any Pentium III or Pentium-compatible processor running at 450 MHz or higher.

At least 256 MB of RAM. We recommend 192 MB or more.

A 1024 x 768 pixel display and at least High Color (16-bit).

SUN Solaris Sun Solaris 8 or 9 Mozilla 1.7.3 with Sun Java 1.4.2

SPARC microprocessor.

At least 256 MB of RAM.

A 1024 x 768 pixel display and at least 256 colors. High Color (16-bit) recommended.

Linux Red Hat Linux 9 or Red Hat Enterprise Linux WS version 3

Mozilla 1.7.3 with Sun Java 1.4.2

At least 128 MB of RAM. 256 MB recommended.

A 1024 x 768 pixel display with at least 256 colors. High Color (16-bit) recommended.

4Release Notes for Cisco PDM Version 4.1(4) for Firewall Services Module

78-16791-04

Caveats

CaveatsThe following sections describe the caveats for PDM software Version 4.1(4).

For your convenience in locating caveats in the Cisco Bug Toolkit, the caveat titles listed in this section are taken directly from the Cisco Bug Toolkit database. These caveat titles are not intended to be read as complete sentences because the title field length is limited. In the caveat titles, some truncation of wording or punctuation may be necessary to provide the most complete and concise description. The only modifications made to these titles are as follows:

• Commands are in boldface type.

• Product names and acronyms may be standardized.

• Spelling errors and typos may be corrected.

Note To view additional caveat information, use Bug Navigator II on CCO. Bug Navigator II may be accessed at the following website:

http://www.cisco.com/support/bugtools

Open Caveats—Version 4.1(4)The caveats in Table 2 are yet to be resolved in this version.

Table 2 Caveats Still Open in Version 4.1(4)

ID Number Caveat Title

CSCdx28710 PDM shows wrong interface on outbound deny ACL

CSCdx44905 Match access list uses subnet wider than ip local pool

CSCeg54076 Failover enabled popup incorrect or misleading

CSCeg54474 PDM gets stuck at 96% after removing context and doing a refresh

CSCeg57996 After deleting a resource class, security context still shows resource

CSCeg71623 PDM should not change config if logged in as a read-only user

CSCeh15426 MFW failover monitoring screen caches interfaces from other contexts

CSCeh50272 Network object groups are created even when identity statics are used

CSCeh54110 Traffic graphs confused if two contexts use same interface names

CSCeh59768 PDM takes longer time to add Hosts/Networks Groups

CSCeh78484 PDM cannot print Access-Rules

CSCsb93749 Destination address in the Access Rules table is incorrect when using NAT/PAT

CSCsc20328 Search by Field for filtering has wrong search choices

CSCsc65102 Wrong security rules when using static translation + same security traffic

CSCsc88018 PDM allows user to modify config even if the maximum user limit is reached

5Release Notes for Cisco PDM Version 4.1(4) for Firewall Services Module

78-16791-04

Obtaining Documentation

Resolved Caveats—Version 4.1(4)The caveats in Table 3 are resolved in Version 4.1(4).

Obtaining DocumentationCisco documentation and additional literature are available on Cisco.com. This section explains the product documentation resources that Cisco offers.

Cisco.comYou can access the most current Cisco documentation at this URL:

http://www.cisco.com/techsupport

CSCsd10442 PDM Config refresh hangs while another session paused at -More- Prompt

CSCsd17010 PDM does not filter show arp output when using the include command

CSCsd98278 PDM hangs at 52% when loading with dynamic policy NAT in config

CSCse12882 PDM on FWSM stuck opening at 47% during loading

CSCse24811 Unable to add a network object group that is in use

CSCse47250 PDM locks at 52%

CSCsf33083 Adding an ACL is deleting the route

Table 2 Caveats Still Open in Version 4.1(4) (continued)

ID Number Caveat Title

Table 3 Caveats Resolved in Version 4.1(4)

ID Number Caveat Title

CSCsb86840 Search by field on Action field in the rules table does not work properly

CSCsc27272 PDM locks if you attempt to do something that is not allowed by the command authorization

CSCsc74421 Unknown IP protocol error occurs when you create a new access rule

CSCsc95805 PDM unexpected null rules generated for access rules

CSCsd12031 PDM moves around the remarks when editing an ACE rule

CSCsd19901 Null rule does not get updated even after fix and refresh

CSCsd30253 PDM on FWSM is stuck open at 47% during loading

CSCsd33096 PDM is stuck at 47% during loading because of access list configurations

CSCsd84342 PDM does not allow you to add or edit a valid policy NAT

CSCse09377 PDM does not show details for access rule when FWSM is in transparent mode

6Release Notes for Cisco PDM Version 4.1(4) for Firewall Services Module

78-16791-04

Documentation Feedback

You can access the Cisco website at this URL:

http://www.cisco.com

You can access international Cisco websites at this URL:

http://www.cisco.com/public/countries_languages.shtml

Product Documentation DVDThe Product Documentation DVD is a library of technical product documentation on a portable medium. The DVD enables you to access installation, configuration, and command guides for Cisco hardware and software products. With the DVD, you have access to the HTML documentation and some of the PDF files found on the Cisco website at this URL:

http://www.cisco.com/univercd/home/home.htm

The Product Documentation DVD is created and released regularly. DVDs are available singly or by subscription. Registered Cisco.com users can order a Product Documentation DVD (product number DOC-DOCDVD= or DOC-DOCDVD=SUB) from Cisco Marketplace at the Product Documentation Store at this URL:

http://www.cisco.com/go/marketplace/docstore

Ordering DocumentationYou must be a registered Cisco.com user to access Cisco Marketplace. Registered users may order Cisco documentation at the Product Documentation Store at this URL:

http://www.cisco.com/go/marketplace/docstore

If you do not have a user ID or password, you can register at this URL:

http://tools.cisco.com/RPF/register/register.do

Documentation FeedbackYou can provide feedback about Cisco technical documentation on the Cisco Technical Support & Documentation site area by entering your comments in the feedback form available in every online document.

Cisco Product Security OverviewCisco provides a free online Security Vulnerability Policy portal at this URL:

http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html

From this site, you will find information about how to do the following:

• Report security vulnerabilities in Cisco products

• Obtain assistance with security incidents that involve Cisco products

• Register to receive security information from Cisco

7Release Notes for Cisco PDM Version 4.1(4) for Firewall Services Module

78-16791-04

Product Alerts and Field Notices

A current list of security advisories, security notices, and security responses for Cisco products is available at this URL:

http://www.cisco.com/go/psirt

To see security advisories, security notices, and security responses as they are updated in real time, you can subscribe to the Product Security Incident Response Team Really Simple Syndication (PSIRT RSS) feed. Information about how to subscribe to the PSIRT RSS feed is found at this URL:

http://www.cisco.com/en/US/products/products_psirt_rss_feed.html

Reporting Security Problems in Cisco ProductsCisco is committed to delivering secure products. We test our products internally before we release them, and we strive to correct all vulnerabilities quickly. If you think that you have identified a vulnerability in a Cisco product, contact PSIRT:

• For emergencies only — security-alert@cisco.com

An emergency is either a condition in which a system is under active attack or a condition for which a severe and urgent security vulnerability should be reported. All other conditions are considered nonemergencies.

• For nonemergencies— psirt@cisco.com

In an emergency, you can also reach PSIRT by telephone:

• 1 877 228-7302

• 1 408 525-6532

Tip We encourage you to use Pretty Good Privacy (PGP) or a compatible product (for example, GnuPG) to encrypt any sensitive information that you send to Cisco. PSIRT can work with information that has been encrypted with PGP versions 2.x through 9.x.

Never use a revoked encryption key or an expired encryption key. The correct public key to use in your correspondence with PSIRT is the one linked in the Contact Summary section of the Security Vulnerability Policy page at this URL:

http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html

The link on this page has the current PGP key ID in use.

If you do not have or use PGP, contact PSIRT to find other means of encrypting the data before sending any sensitive material.

Product Alerts and Field NoticesModifications to or updates about Cisco products are announced in Cisco Product Alerts and Cisco Field Notices. You can receive Cisco Product Alerts and Cisco Field Notices by using the Product Alert Tool on Cisco.com. This tool enables you to create a profile and choose those products for which you want to receive information.

8Release Notes for Cisco PDM Version 4.1(4) for Firewall Services Module

78-16791-04

Obtaining Technical Assistance

To access the Product Alert Tool, you must be a registered Cisco.com user. (To register as a Cisco.com user, go to this URL: http://tools.cisco.com/RPF/register/register.do) Registered users can access the tool at this URL: http://tools.cisco.com/Support/PAT/do/ViewMyProfiles.do?local=en

Obtaining Technical AssistanceCisco Technical Support provides 24-hour-a-day award-winning technical assistance. The Cisco Technical Support & Documentation website on Cisco.com features extensive online support resources. In addition, if you have a valid Cisco service contract, Cisco Technical Assistance Center (TAC) engineers provide telephone support. If you do not have a valid Cisco service contract, contact your reseller.

Cisco Technical Support & Documentation WebsiteThe Cisco Technical Support & Documentation website provides online documents and tools for troubleshooting and resolving technical issues with Cisco products and technologies. The website is available 24 hours a day at this URL:

http://www.cisco.com/techsupport

Access to all tools on the Cisco Technical Support & Documentation website requires a Cisco.com user ID and password. If you have a valid service contract but do not have a user ID or password, you can register at this URL:

http://tools.cisco.com/RPF/register/register.do

Note Use the Cisco Product Identification Tool to locate your product serial number before submitting a request for service online or by phone. You can access this tool from the Cisco Technical Support & Documentation website by clicking the Tools & Resources link, clicking the All Tools (A-Z) tab, and then choosing Cisco Product Identification Tool from the alphabetical list. This tool offers three search options: by product ID or model name; by tree view; or, for certain products, by copying and pasting show command output. Search results show an illustration of your product with the serial number label location highlighted. Locate the serial number label on your product and record the information before placing a service call.

Tip Displaying and Searching on Cisco.com

If you suspect that the browser is not refreshing a web page, force the browser to update the web page by holding down the Ctrl key while pressing F5.

To find technical information, narrow your search to look in technical documentation, not the entire Cisco.com website. On the Cisco.com home page, click the Advanced Search link under the Search box and then click the Technical Support & Documentation radio button.

To provide feedback about the Cisco.com website or a particular technical document, click Contacts & Feedback at the top of any Cisco.com web page.

9Release Notes for Cisco PDM Version 4.1(4) for Firewall Services Module

78-16791-04

Obtaining Additional Publications and Information

Submitting a Service RequestUsing the online TAC Service Request Tool is the fastest way to open S3 and S4 service requests. (S3 and S4 service requests are those in which your network is minimally impaired or for which you require product information.) After you describe your situation, the TAC Service Request Tool provides recommended solutions. If your issue is not resolved using the recommended resources, your service request is assigned to a Cisco engineer. The TAC Service Request Tool is located at this URL:

http://www.cisco.com/techsupport/servicerequest

For S1 or S2 service requests, or if you do not have Internet access, contact the Cisco TAC by telephone. (S1 or S2 service requests are those in which your production network is down or severely degraded.) Cisco engineers are assigned immediately to S1 and S2 service requests to help keep your business operations running smoothly.

To open a service request by telephone, use one of the following numbers:

Asia-Pacific: +61 2 8446 7411Australia: 1 800 805 227EMEA: +32 2 704 55 55USA: 1 800 553 2447

For a complete list of Cisco TAC contacts, go to this URL:

http://www.cisco.com/techsupport/contacts

Definitions of Service Request SeverityTo ensure that all service requests are reported in a standard format, Cisco has established severity definitions.

Severity 1 (S1)—An existing network is “down” or there is a critical impact to your business operations. You and Cisco will commit all necessary resources around the clock to resolve the situation.

Severity 2 (S2)—Operation of an existing network is severely degraded, or significant aspects of your business operations are negatively affected by inadequate performance of Cisco products. You and Cisco will commit full-time resources during normal business hours to resolve the situation.

Severity 3 (S3)—Operational performance of the network is impaired while most business operations remain functional. You and Cisco will commit resources during normal business hours to restore service to satisfactory levels.

Severity 4 (S4)—You require information or assistance with Cisco product capabilities, installation, or configuration. There is little or no effect on your business operations.

Obtaining Additional Publications and InformationInformation about Cisco products, technologies, and network solutions is available from various online and printed sources.

• The Cisco Online Subscription Center is the website where you can sign up for a variety of Cisco e-mail newsletters and other communications. Create a profile and then select the subscriptions that you would like to receive. To visit the Cisco Online Subscription Center, go to this URL:

http://www.cisco.com/offer/subscribe

10Release Notes for Cisco PDM Version 4.1(4) for Firewall Services Module

78-16791-04

Obtaining Additional Publications and Information

• The Cisco Product Quick Reference Guide is a handy, compact reference tool that includes brief product overviews, key features, sample part numbers, and abbreviated technical specifications for many Cisco products that are sold through channel partners. It is updated twice a year and includes the latest Cisco channel product offerings. To order and find out more about the Cisco Product Quick Reference Guide, go to this URL:

http://www.cisco.com/go/guide

• Cisco Marketplace provides a variety of Cisco books, reference guides, documentation, and logo merchandise. Visit Cisco Marketplace, the company store, at this URL:

http://www.cisco.com/go/marketplace/

• Cisco Press publishes a wide range of general networking, training, and certification titles. Both new and experienced users will benefit from these publications. For current Cisco Press titles and other information, go to Cisco Press at this URL:

http://www.ciscopress.com

• Internet Protocol Journal is a quarterly journal published by Cisco Systems for engineering professionals involved in designing, developing, and operating public and private internets and intranets. You can access the Internet Protocol Journal at this URL:

http://www.cisco.com/ipj

• Networking products offered by Cisco Systems, as well as customer support services, can be obtained at this URL:

http://www.cisco.com/en/US/products/index.html

• Networking Professionals Connection is an interactive website where networking professionals share questions, suggestions, and information about networking products and technologies with Cisco experts and other networking professionals. Join a discussion at this URL:

http://www.cisco.com/discuss/networking

• “What’s New in Cisco Documentation” is an online publication that provides information about the latest documentation releases for Cisco products. Updated monthly, this online publication is organized by product category to direct you quickly to the documentation for your products. You can view the latest release of “What’s New in Cisco Documentation” at this URL:

http://www.cisco.com/univercd/cc/td/doc/abtunicd/136957.htm

• World-class networking training is available from Cisco. You can view current offerings at this URL:

http://www.cisco.com/en/US/learning/index.html

11Release Notes for Cisco PDM Version 4.1(4) for Firewall Services Module

78-16791-04

Obtaining Additional Publications and Information

Copyright © 2006 Cisco Systems, Inc. All rights reserved.

12Release Notes for Cisco PDM Version 4.1(4) for Firewall Services Module

78-16791-04