Supported Devices and Software Versions for Cisco Security Manager 4.17
Available Languages
Table of Contents
Supported Devices and Software Versions for Cisco Security Manager 4.17
General Device to Feature Support for Cisco Security Manager
IPv6 Support Summarized by Device Class and Application
Explicitly Supported Devices for Cisco Security Manager
Generically Supported Devices for Cisco Security Manager
Supported Software for Cisco Security Manager
Software Supported in Downward Compatibility Mode
Supported Devices and Software Versions for Auto Update Server
Communications, Services, and Additional Information
Supported Devices and Software Versions for Cisco Security Manager 4.17
Cisco Security Manager and its related applications support the devices and operating system versions listed in these sections:
- General Device to Feature Support for Cisco Security Manager
- IPv6 Support Summarized by Device Class and Application
- Explicitly Supported Devices for Cisco Security Manager
- Generically Supported Devices for Cisco Security Manager
- Supported Software for Cisco Security Manager
- Software Supported in Downward Compatibility Mode
- Supported Devices and Software Versions for Auto Update Server
- Product Documentation
Note From version 4.17, though Cisco Security Manager continues to manage the following devices, it will not provide support for any enhancements:
- Cisco Catalyst 6500 and 7600 Series Firewall Services Modules (EOL8184)
- Cisco Catalyst 6500 Series Intrusion Detection System Services Module 2 ( EOL8843)
- Cisco Intrusion Prevention System: IPS 4200, 4300, and 4500 Series Sensors ( EOL9916)
- Cisco SR 500 Series Secure Routers ( EOL7687, EOL7657)
- PIX Firewalls (EOL)
General Device to Feature Support for Cisco Security Manager
Broadly speaking, Cisco Security Manager has these main features: device configuration, event management, report management, health and performance monitor, and image management. Table 1 explains which classes of device are supported for each feature. The exact models and software versions supported in each device class are listed in subsequent sections.
IPv6 Support Summarized by Device Class and Application
Cisco Security Manager provides some support for IPv6, but only for configuring policies on a device (for example, firewall rules). Support is for traffic through the device. However, Cisco Security Manager does not support client-server communication using IPv6.
Cisco Security Manager also provides management support for ASA devices.
Table 2 summarizes IPv6 support by device class in each Cisco Security Manager application (for example, Configuration Manager).
If a particular device class has no policies that use IPv6, then the table lists “Not applicable.” The table also lists “Not applicable” for devices that are not supported at all by a particular application (for example, Image Manager supports only ASAs and ASAv’s).
For the specific policies that you can configure, see the Getting Started chapter in the User Guide for Cisco Security Manager.
Adaptive Security Appliance (ASA), including the Cisco Adaptive Security Virtual Appliance (ASAv) and service modules |
Yes1 |
Explicitly Supported Devices for Cisco Security Manager
The following table lists the devices you can manage in Cisco Security Manager. These specific models are explicitly supported, that is, Cisco Security Manager is aware of the features available on the device and recognizes the device module.
Tip
If a device model is not listed in this table, you might still be able to manage it as a generic device type. For more information, see Generically Supported Devices for Cisco Security Manager.
Generically Supported Devices for Cisco Security Manager
Cisco Security Manager can manage some device models even if the model does not appear in the supported device list. This type of generic device support relies on the fact that device features are controlled more by the software running on the device than the device model.
If you have a device that does not appear in the explicitly supported device list, you can try to manage it as a generic device using the device modules listed in the following table.
- This type of generic support works best for new models of series that are already explicitly supported. For example, a new model in the ASR 1000 series. Generic support does not work with carrier-class routers (the CRS).
- Because this support is generic, Cisco Security Manager cannot determine if a particular feature is not available on the specific model you are managing. You are responsible for determining if a feature that you are allowed to configure in Cisco Security Manager is not supported on the device. If you configure an unsupported feature, you will see errors when you deploy the configuration to the device.
- If the device contains an explicitly supported module, the module is also supported. However, the module’s model must be explicitly supported: there is no generic module support.
- If a particular ASR is not listed as being explicitly supported in Table 3, but a previous version is, that particular ASR is supported generically in Cisco Security Manager with “Generic Router Backward Compatibility Support.”
The following table lists the device models that have been tested for generic support:
Supported Software for Cisco Security Manager
Cisco Security Manager supports the software on the devices that it manages as described in:
Note Cisco Security Manager deployment will fail if ASA router has engineering image. Deployment will be successful only with released ASA router images.
ASA Supported Software Versions
The following list describes the minimum supported software versions plus the specific release numbers that have additional support in Cisco Security Manager for devices that run operating systems. You must use a software version that meets at least the minimum required version. If you use a version that is not listed, Cisco Security Manager will treat it as one of these versions (the most closely-matching version, which is typically the release number nearest to it but lower). Any features that are unique to the version you are using are not supported in Cisco Security Manager.
Tip The primary software support that is new in Version 4.17 of Cisco Security Manager is ASA 9.9.2.
- Cisco ASA-5500 Series Adaptive Security Appliances (ASA)—ASA Software Release 7.0(1-2, 4-8), 7.1(1-2), 7.2(1-5), 8.0(2-3, 5), 8.1(1-2), 8.2(1-3), 8.3(1-2), 8.4(1-6), 8.5(1), 8.6(1), 9.0(1), 9.1(1-5), 9.2(1-3), 9.3(1-2), 9.4.1, 9.5.1, 9.5.2, 9.6.1, 9.6.2, 9.6.4, 9.7.1, 9.8.1, 9.8.2, and 9.9.1.
Note If you upgrade to ASA Version 9.4(4)34 or later, you must upgrade Cisco Security Manager to Version 4.19 or later. Earlier versions of Cisco Security Manager are not compatible with ASA 9.4(4)34.
The following special cases and exceptions apply to ASA software support:
– If you upgrade a device that you are already managing in Cisco Security Manager from 8.x to 9.0(1) or higher, you must rediscover the device inventory so that Cisco Security Manager starts interpreting the device as a 9.x device and then you must rediscover the policies on the device to ensure that Cisco Security Manager looks for and discovers the appropriate policy types. Alternatively, you can delete the device from Cisco Security Manager and then add the device again.
– If you perform one of the following upgrades to a device that you are already managing in Cisco Security Manager:
—from any lower version to 8.3(1) or higher
—from 8.3(x) to 8.4(2) or higher
you must rediscover the device in Cisco Security Manager. This is required due to significant policy changes between the two releases.
For detailed information on these scenarios, refer to the section titled “Validating a Proposed Image Update on a Device” in the User Guide for Cisco Security Manager 4.8 at the following URL:
http://www.cisco.com/c/en/us/support/security/security-manager/products-user-guide-list.html
– Although 8.2(4) is supported in downward compatibility mode as 8.2(3), Cisco Security Manager does support ASA 5585-X models with SSP-10 and SSP-40 running 8.2(4).
– You cannot use Cisco Security Manager to manage SSL VPNs on ASA 7.x.
– You cannot use Cisco Security Manager to manage an ASA 8.3+ device if you enable password encryption using the password encryption aes command. You must turn off password encryption before you can add the device to the Cisco Security Manager inventory.
– The ASA-SM does not support any type of VPN configuration for this version. However, starting from the 9.0(1) version, ASA-SM supports VPN configurations.
– Release 8.6(1) applies to the following Cisco ASA 5500-X based Adaptive Security Appliance models only: 5512-X, 5515-X, 5525-X, 5545-X, and 5555-X.
– Cisco Security Manager 4.8 supports ASAv’s when you are using ASA 9.2(1) or other versions of ASA that support ASAv’s.
– Table 5 provides the details of the ASA platforms that are supported and not supported for ASA 9.2(1) and above.
Cisco IOS Software Supported Versions
The following sections explain the basic versions supported for Cisco IOS Software and the limitations and restrictions that apply to managing Cisco IOS Software devices:
Basic Cisco IOS Software Support
The following list describes the minimum supported Cisco IOS Software versions plus the specific release numbers that have additional support in Cisco Security Manager for standard routers. You must use a software version that meets at least the minimum. If you use a version that is not listed, Cisco Security Manager will treat it as one of these versions (the most closely-matching version, which is typically the release number nearest to it but lower). Any features that are unique to the version you are using are not supported in Cisco Security Manager. Note that the device model might limit the versions you are allowed to install; this is not controlled by Cisco Security Manager.
Note Cisco Security Manager provides limited support for features in routers running the Cisco IOS Software releases. The Eventing, Monitoring, Reporting, and Image Management functionalities are not supported on IOS devices. For Cisco Security Manager to manage IOS routers, you must make sure that the IOS versions comply with the list of supported versions.
- 15.4(2)S
- 15.3T—Versions include 15.3(1)T, 15.3(2)T, and 15.3(2)S.
- 15.2T—Versions include 15.2(1)T1 and 15.2(2)T.
Note Cisco Security Manager supports 15.2(1)T1 on 88x, 89x, 19xx, 29xx, and 39xx routers only. ScanSafe is the only supported new feature in this version.
- 15.1T—Versions include 15.1(1)T.
- 15.0—Versions include 15.0(1)M.
- 12.4T—Versions include 12.4(2)T, 12.4(4)T, 12.4(6)T, 12.4(9)T, 12.4(11)T, 12.4(11)T1, 12.4(11)T2, 12.4(15)T, 12.4(20)T, 12.4(22)T, 12.4(24)T.
- 12.4—Versions include 12.4(1), 12.4(1a), 12.4(3).
- 12.3(2)T—Versions include 12.3(2)T, 12.3(2)T1-9, 12.3(4)T, 12.3(4)T1-11, 12.3(7)T, 12.3(7)T1-7, 12.3(8)T, 12.3(8)T1-7, 12.3(11)T, 12.3(11)T1-3, 12.3(13)T, 12.3(14)T, 12.3(14)T2.
- 12.3—Versions include:
– 12.3(1), including 12.3(1a)B.
– 12.3(2), including the XA3, XB3, XC2, XE2, and XF versions.
– 12.3(3), including the B and B1 versions.
– 12.3(4), including the XD4, XG3, XK2, and XQ1 versions.
– 12.3(5), including the 12.3(5a)B, 12.3(5a)B0a, and 12.3(5a)B1-4 versions.
– 12.3(7), including the XI6, XR, XR2, XR4, XJ2, and XS2 versions.
– 12.3(8), including the XU4, XW3, XX1, YA1, YD1, YG2, YH, YI, and YI1 versions.
– 12.3(9), including the 12.3(9a)BC, BC1, and BC2 versions.
– 12.3(11), including the XL1, YK1, and YS versions.
– 12.2(11)YU, YX, YX1, YZ, and YZ2.
– 12.2(13)T, T12, ZD2, and ZE.
– 12.2(14)S, SU, SU2, SX, SY, and SZ.
– 12.2(18)SE, SW, SXD, SXE, and SXF.
– 12.2(20)EW, EWA, EX, and S8.
– 12.2(25)EY, EZ, FX, FY, JA, SEA, SEB, SEC, SED, SEE, and SG.
Basic Cisco IOS XE Software Support
The Cisco ASR 1000 Series Aggregation Services Routers use Cisco IOS XE Software, which uses a different numbering scheme from standard Cisco IOS Software. However, these release numbers are mapped to standard IOS release numbers in Cisco Security Manager. The following are the supported Cisco IOS XE Software releases and the Cisco IOS software equivalent releases used in Cisco Security Manager:
- 2.1.x—Called 12.2(33)XNA.
- 2.2.x—Called 12.2(33)XNB.
- 2.3.x—Called 12.2(33)XNC. Cisco Security Manager treats this release as equivalent to 2.2 (12.2(33)XNB) except for the addition of GET VPN support.
- 2.4.x—Called 12.2(33)XND. No features that are new in this release are supported. This is the lowest release supported on the ASR 1002 Fixed Router.
- 2.5.x—Called 12.2(33)XNE. Cisco Security Manager treats this release as equivalent to 2.4 (12.2(22)XND) except for the addition of DMVPN phase 3 support (for direct spoke-to-spoke communications).
- 2.6.x—Called 12.2(33)XNF. No features that are new in this release are supported.
- 3.1.x—Called 15.0(1)S. No features that are new in this release are supported.
- 3.5.x—Called 15.2(1)S. No features that are new in this release are supported.
- 3.8.x—Called 15.3(1)S. No features that are new in this release are supported.
- 3.9.x—Called 15.3(2)S. No features that are new in this release are supported.
- 3.12.x—Called 15.4(2)S. No features that are new in this release are supported.
Tip Although the 2.x ASR releases are mapped to IOS 12.2 releases, you must select IOS 12.3+ as the operating system type when adding the device to the Cisco Security Manager inventory.
Restrictions for Cisco IOS Software Devices
Cisco routers and switches have these software restrictions:
- Cisco Security Manager does not support Cisco IOS Software Release 15.x for Catalyst switches.
- For routers running Release 12.1 and 12.2, there is limited support for Layer 3 access rules, interfaces, and FlexConfigs, but not for any other features.
- The software release you can use on a device is always limited to those releases that the hardware supports. For example, the 1900, 2900, and 3900 series ISRs require 15.0(1)M as a minimum release.
- The Cisco ASR 1000 Series Aggregation Services Routers require Cisco IOS XE Software. For more detailed information, see Basic Cisco IOS XE Software Support.
- For the Catalyst 6500/7600, you can use Cisco IOS Software Release 12.1, 12.2 and these versions at the specified point release and later: 12.1(13)E, 12.1(17B)SXA, 12.1(19)E, 12.1(20)E, 12.1(22)E, 12.1(23)E, 12.1(26)E, 12.2(14)SX, 12.2(14)SY, 12.2(17a)SX, 12.2(17d)SXB, 12.2(18)SXD, 12.2(18)SXE, 12.2(18)SXE1, 12.2(18)SXE2, 12.2(18)SXE4, 12.2(18)SXF2, 12.2(18)SXF4, 12.2(33)SRA, 12.2(33)SRB, 12.2(33)SXH, and 12.2(33)SXI.
Note You cannot use the Catalyst Operating System on a device managed by Cisco Security Manager.
- For the Catalyst 3500/4500, you can use Cisco IOS Software Release 12.1 and 12.2 and the following versions at the specified point release and later. Note that specific devices support a subset of the listed versions:
– 12.2(25)EWA, FZ, EZ, EY, SE, EW, SEA, SEB, SEC, SED, SEE, SEG
- To configure and manage VPNs on Catalyst 6500/7600 devices, the earliest software release is Cisco IOS Software Release 12.2(17b)SXA.
- To configure and manage IDSM settings on Catalyst 6500/7600 devices, the earliest software release is Cisco IOS Software Release 12.2(18)SXF4.
- For routers running an IPS-enabled version of Cisco IOS Software, the earliest supported Cisco IOS Software release is 12.4(11)T2. In addition, to perform signature updates on routers running Cisco IOS Software release 15.0, you need a a separate ios-ips-update license, which you must manually apply to the device.
- The IPS subsystem has a separate numbering scheme, which you can view in the device properties in Cisco Security Manager. The 3.x subsystems are equivalent to IPS 5.x. The subsystems are:
– 3.000.001, supported in 12.4(11)T to 12.4(11)T4.
– 3.001.001, supported in 12.4(15)T to 12.4(15)T2.
Software Supported in Downward Compatibility Mode
Cisco Security Manager directly supports many individual point releases for the various operating systems you can use with the supported devices. When Cisco Security Manager supports a specific point release, it means that you can configure some features new to that release using the product.
Some point releases are supported in “downward compatibility mode.” In this mode, you can use the product to configure devices running that point release, but you cannot configure features that are new in the release unless you use FlexConfigs. Thus, the point release is treated as being the same as the nearest point release to it, and Cisco Security Manager maps the release number to that supported release.
The following table lists the releases that are specifically supported in Cisco Security Manager, and the point releases that are supported as downward equivalents to the release. The table might not include information about every downward compatible release. In general, if a version is not listed here or in Supported Software for Cisco Security Manager, Cisco Security Manager will treat it as one of the supported versions (the most closely-matching version, which is typically the release number nearest to it but lower).
Supported Devices and Software Versions for Auto Update Server
You can use the Auto Update Server application with any Cisco ASA-5500 Series Adaptive Security Appliance and the ASA software versions supported by Cisco Security Manager.
Note You cannot use devices configured in multiple-context mode with Auto Update Server.
Product Documentation
For the complete list of documents supporting this release, see the release-specific document roadmap:
http://www.cisco.com/c/en/us/support/security/security-manager/products-documentation-roadmaps-list.html
Lists document set that supports the Cisco Security Manager release and summarizes contents of each document.
http://www.cisco.com/go/csmanager
Communications, Services, and Additional Information
- To receive timely, relevant information from Cisco, sign up at Cisco Profile Manager.
- To get the business impact you’re looking for with the technologies that matter, visit Cisco Services.
- To submit a service request, visit Cisco Support.
- To discover and browse secure, validated enterprise-class apps, products, solutions and services, visit Cisco Marketplace.
- To obtain general networking, training, and certification titles, visit Cisco Press.
- To find warranty information for a specific product or product family, access Cisco Warranty Finder.
Cisco Bug Search Tool
Cisco Bug Search Tool (BST) is a web-based tool that acts as a gateway to the Cisco bug tracking system that maintains a comprehensive list of defects and vulnerabilities in Cisco products and software. BST provides you with detailed defect information about your products and software.
Feedback