This document contains release information for Cisco Firepower eXtensible Operating System (FXOS) 2.14.1.

Use these Release Notes as a supplement with the other documents listed in the documentation roadmap:


The online versions of the user documentation are occasionally updated after the initial release. As a result, the information contained in the documentation on supersedes any information contained in the context-sensitive help included with the product.


The Cisco security appliance is a next-generation platform for network and content security solutions. The security appliance is part of the Cisco Application Centric Infrastructure (ACI) Security Solution and provides an agile, open, secure platform that is built for scalability, consistent control, and simplified management.

The security appliance provides the following features:

  • Modular chassis-based security system—Provides high performance, flexible input/output configurations, and scalability.

  • Chassis Manager—Graphical user interface provides a streamlined, visual representation of the current chassis status and allows for simplified configuration of chassis features.

  • FXOS CLI—Provides command-based interface for configuring features, monitoring chassis status, and accessing advanced troubleshooting features.

  • FXOS REST API—Allows users to programmatically configure and manage their chassis.

What's New

New Features in FXOS

Fixes for various problems (see Resolved bugs in Resolved bugs in FXOS

New Features in FXOS 2.14.1

Cisco FXOS 2.14.1 introduces the following new features:

Feature Description

Monitor Chassis-level health alerts in Secure Firewall Management Center

This feature allows you to monitor your chassis in the management center for chassis-level health alerts. To monitor chassis-level health alerts in the management center, you must manually configure the management center as manager on the chassis, and then register the chassis in the management center.

New/modified CLI: create device-manager manager_name hostname {hostname | ipv4_address | ipv6_address} nat-id nat_id

Integrated firmware upgrade

The FXOS firmware upgrade package is now integrated with platform bundle for firmware auto-upgrade during the FXOS upgrade. Whenever you upgrade your FXOS to latetst version, the firmware package gets unpacked based on the platform and the system checks for the firmware version running on your supervisor. If the firmware version is lower than the firmware version integrated in the platform bundle, the firmware gets auto-upgraded without any user intervention.

New/modified CLI: No new CLIs added. You can use the existing show firmware monitor command to monitor the upgrade process.

Firmware Package Included: Firmware package 1.0.19

Secure Firewall chassis manager single sign-on

The chassis manager now supports single sign-on (SSO) for external users configured at any third-party SAML 2.0-compliant identity provider (IdP).

New/modified pages:

  • Login > Single Sign-On (SSO)

  • Platform Settings > AAA > Single Sign-On (SSO)

Software Download

You can download software images for FXOS and supported applications from one of the following URLs:

For information about the applications that are supported on a specific version of FXOS, see the Cisco FXOS Compatibility guide at this URL:

Important Notes

  • In FXOS 2.4(1) or later, if you are using an IPSec secure channel in FIPS mode, the IPSec peer entity must support RFC 7427.

  • When you configure Radware DefensePro (vDP) in a service chain on a currently running threat defense application on a Firepower 4110 or 4120 device, the installation fails with a fault alarm. As a workaround, stop the threat defense application instance before installing the Radware DefensePro application.


    This issue and workaround apply to all supported releases of Radware DefensePro service chaining with threat defense on Firepower 4110 and 4120 devices.

  • When you upgrade a network or security module, certain faults are generated and then cleared automatically. These include a “hot swap not supported” fault or a “module removed when in online state” fault. If you have followed the appropriate procedures, as described in the Cisco Firepower 9300 Hardware Installation Guide or Cisco Firepower 4100 Series Hardware Installation Guide, the fault(s) are cleared automatically and no additional action is required.

  • From FXOS 2.13 release, the set maxfailedlogins command no longer works. The value can still be set, but if you try to log in a greater number of times than the already set value with an invalid password, you are not locked out. For compatibility, a similar command, set max-login-attempts, is available under scope security. This command also prevents logging in after a certain number of failed attempts but sets the value for all users. These commands are only available for Firepower 2100 platform mode and do not affect other platforms.

System Requirements

  • You can access the chassis manager using the following browsers:

    • Mozilla Firefox—Version 42 and later

    • Google Chrome—Version 47 and later

    • Microsoft Internet Explorer—Version 11 and later

    We tested FXOS 2.14.1 using Mozilla Firefox version 42, Google Chrome version 47, and Internet Explorer version 11. Other versions of these browsers are expected to work. However, if you experience any browser-related issues, we suggest you use one of the tested versions.

Upgrade Instructions

You can upgrade your Firepower 9300 or Firepower 4100 series security appliance directly to FXOS 2.14.1 if it is currently running FXOS version 2.2(2) or later. Before you upgrade your Firepower 9300 or Firepower 4100 series security appliance to FXOS 2.14.0, first upgrade to FXOS 2.2(2), or verify that you are currently running FXOS 2.2(2).

For upgrade instructions, see the Cisco Firepower 4100/9300 Upgrade Guide.

Installation Notes

  • From FXOS 2.14.1, the FXOS firmware is bundled with FXOS software image. During FXOS upgrade, the system will auto-upgrade the firmware to the latest version if applicable. If the firmware is upgraded, the system will reboot 2 times and the total FXOS upgrade duration will be extended.

    Following tables lists the time taken for upgrade with or without firmaware uprade:

    FXOS Upgrade With Firmware Upgrade Duration(in mins)
    Initiate FXOS Upgrade with integrated FW changes -
    First Reboot triggered by FXOS upgrade ~9
    CLI after FXOS Upgrade (before FW Upgrade) ~8
    Second Reboot triggered by FW Upgrade ~1 to 20 *
    CLI after FXOS Upgrade and FW Upgrade ~8
    Blade to come online ~13
    Application to come online ~10
    Total ~49-70mins
    FXOS Upgrade Without Firmware Upgrade Duration(in mins)
    Initiate FXOS Upgrade with integrated firmware changes -
    Reboot triggered by FXOS upgrade ~9
    CLI after FXOS Upgrade (before firmware upgrade) ~8
    Blade to come online ~13
    Application to come online ~10
    Total ~40 mins
  • If you are upgrading a Firepower 9300 or Firepower 4100 series security appliance that is running a standalone logical device or if you are upgrading a Firepower 9300 security appliance that is running an intra-chassis cluster, traffic does not traverse through the device while it is upgrading.

  • If you are upgrading a Firepower 9300 or a Firepower 4100 series security appliance that is part of an inter-chassis cluster, traffic does not traverse through the device being upgraded while it is upgrading. However, the other devices in the cluster continue to pass traffic.

  • Downgrade of FXOS images is not officially supported. The only Cisco-supported method of downgrading an image version of FXOS is to perform a complete re-image of the device.

Resolved and Open Bugs

The resolved and open bugs for this release are accessible through the Cisco Bug Search Tool. This web-based tool provides you with access to the Cisco bug tracking system, which maintains information about bugs and vulnerabilities in this product and other Cisco hardware and software products.


You must have a account to log in and access the Cisco Bug Search Tool. If you do not have one, you can

For more information about the Cisco Bug Search Tool, see the Bug Search Tool Help & FAQ.

Resolved bugs in FXOS

The following table lists the previously release-noted and customer-found bugs that were resolved in FXOS




ASA crashed with SAML scenarios.


Upgrade to CiscoSSH 1.13.46 in FXOS address CVE-2023-48795.


Entropy mixing breaks NPU build.


FP2100/FP1000: ASA Smart licenses lost after reload.


FP 3100 MTU change on management interface is NOT persistent across reboots (returns to default MTU).


Failing to dowload FTD image via SAML SSO login.


FXOS: Remove enforcement of blades going into degraded state after multiple DIMM correctable errors.


Upgrade to CiscoSSL 1.1.1v.7.3.338-fips in SSP MIO.


Adding Jent library in SSP MIO.


Jent Implemention in SSP MIO.


Using entropy mixing with CiscoSSL.


Use kill tree function in SMA instead of SIGTERM.


ENH: Combine firmware bundle packages into FXOS MIO update packages.


SSP MIO: Swims token support in signing image.


Timezone not working correctly on 9300/4100 platforms.

Online Resources

Cisco provides online resources to download documentation, software, and tools, to query bugs, and to open service requests. Use these resources to install and configure FXOS software and to troubleshoot and resolve technical issues.

Access to most tools on the Cisco Support & Download site requires a user ID and password.

Contact Cisco

If you cannot resolve an issue using the online resources listed above, contact Cisco TAC:

Communications, Services, and Additional Information

  • To receive timely, relevant information from Cisco, sign up at Cisco Profile Manager.

  • To get the business impact you’re looking for with the technologies that matter, visit Cisco Services.

  • To submit a service request, visit Cisco Support.

  • To discover and browse secure, validated enterprise-class apps, products, solutions and services, visit Cisco Marketplace.

  • To obtain general networking, training, and certification titles, visit Cisco Press.

  • To find warranty information for a specific product or product family, access Cisco Warranty Finder.