Cisco Cisco Firepower Management Center 4000 Release Notes

Version 5.3.0.2

Sourcefire 3D System Release Notes

42

Features Introduced in Previous Versions

Virtual Appliance Initial Setup Improvements

: Any

: Virtual, X-Series

: Virtual

As of Version 5.3, you can perform the initial setup on virtual devices without 

leaving the vCloud workflow by using the vSphere Hypervisor or the vCloud 

Director. You no longer need to connect to the virtual device console to change 

the default password, configure networking, set the initial detection mode, and 

configure the managing Defense Center during initial setup. Those configuration 

steps can now all be performed during the vCloud deployment workflow. Note 

that you can still deploy using ESXi, but that it requires additional setup on the 

VMware console.

Changed Functionality

You can now use a shell-based query management tool to locate and stop 

long-running queries. The query management tool allows you to locate 

queries running longer than a specified number of minutes and stop those 

queries. The tool logs an event to the audit log and to syslog when you stop 

a query.
Note that only administrative users with shell access rights on the Defense 

Center can access this tool. For more information, type 

query_manager -h

 

on the Defense Center shell or see Stopping Long-Running Queries in the 

Sourcefire 3D System User Guide.

Sourcefire identifies traffic referred by a web server as the web application 

for referred connections as of Version 5.3. For example, if an advertisement 

accessed via advertising.com is actually referred by CNN.com, Sourcefire 

identifies CNN.com as the web application.

You can no longer configure access control rules containing any of the 

following port conditions: 

IP 0

, 

IP-ENCAP 4

, 

IPv6 41

, 

IPv6-ROUTE 43

, 

IPv6-FRAG 44

, 

GRE 47

, 

ESP 50

, or 

IPv6-OPTS 60

.

If you are updating from an earlier version of the Sourcefire 3D System, the 

access control policy rule editor marks invalid rules with a warning and the 

object manager resets invalid port object values to TCP.

If you break a stack or cluster, the devices now remain in the primary 

device's group. Before Version 5.3, the system reverted the devices to the 

groups they belonged to before they joined a stack or cluster.

Improved the performance and stability of NetFlow data collection and 

logging. Sourcefire also added the following new fields for connections 

exported by NetFlow--enabled devices: NetFlow Destination/Source 

Autonomous System, NetFlow Destination/Source Prefix, NetFlow 

Destination/Source TOS, and NetFlow SNMP Input/Output.

You can use IPv6 addresses to create authentication objects as of Version 

5.3. Note that you cannot use authentication objects with IPv6 addresses to 

authenticate shell accounts.