Cisco Cisco ASA 5555-X Adaptive Security Appliance 發佈版本通知

Identity NAT configurable 
proxy ARP and route lookup

In earlier releases for identity NAT, proxy ARP was disabled, and a route lookup was always 
used to determine the egress interface. You could not configure these settings. In 8.4(2) and 
later, the default behavior for identity NAT was changed to match the behavior of other static 
NAT configurations: proxy ARP is enabled, and the NAT configuration determines the egress 
interface (if specified) by default. You can leave these settings as is, or you can enable or 
disable them discretely. Note that you can now also disable proxy ARP for regular static NAT.

For pre-8.3 configurations, the migration of NAT exempt rules (the nat 0 access-list command) 
to 8.4(2) and later now includes the following keywords to disable proxy ARP and to use a 
route lookup: no-proxy-arp and route-lookup. The unidirectional keyword that was used for 
migrating to 8.3(2) and 8.4(1) is no longer used for migration. When upgrading to 8.4(2) from 
8.3(1), 8.3(2), and 8.4(1), all identity NAT configurations will now include the no-proxy-arp 
and route-lookup keywords, to maintain existing functionality. The unidirectional keyword 
is removed.

We modified the following screens:

Configuration > Firewall > NAT Rules > Add/Edit Network Object > Advanced NAT Settings
Configuration > Firewall > NAT Rules > Add/Edit NAT Rule

PAT pool and round robin 
address assignment

You can now specify a pool of PAT addresses instead of a single address. You can also 
optionally enable round-robin assignment of PAT addresses instead of first using all ports on a 
PAT address before using the next address in the pool. These features help prevent a large 
number of connections from a single PAT address from appearing to be part of a DoS attack 
and makes configuration of large numbers of PAT addresses easy.

Currently in 8.4(2), the PAT pool feature is not available as a fallback method for 
dynamic NAT or PAT. You can only configure the PAT pool as the primary method for 
dynamic PAT (CSCtq20634).

We modified the following screens:

Configuration > Firewall > NAT Rules > Add/Edit Network Object
Configuration > Firewall > NAT Rules > Add/Edit NAT Rule

IPv6 Inspection

You can configure IPv6 inspection by configuring a service policy to selectively block IPv6 
traffic based on the extension header. IPv6 packets are subjected to an early security check. The 
ASA always passes hop-by-hop and destination option types of extension headers while 
blocking router header and no next header. 

You can enable default IPv6 inspection or customize IPv6 inspection. By defining a policy map 
for IPv6 inspection you can configure the ASA to selectively drop IPv6 packets based on 
following types of extension headers found anywhere in the IPv6 packet: 

Hop-by-Hop Options

Routing (Type 0)

Fragment

Destination Options

Authentication

Encapsulating Security Payload

We introduced the following screen: Configuration > Firewall > Objects > Inspect Maps > 
IPv6.