Filter
Top Products
2-8
Cisco ASDM User Guide
OL-16647-01
Chapter 2 Introduction to the Security Appliance
New Features by Platform Release
Smart Tunnel over Mac
OS
1
Smart tunnels now support Mac OS.
In ASDM, see Configuration > Remote Access VPN > Clientless SSL VPN Access > Portal >
Smart Tunnels.
Firewall Features
QoS Traffic Shaping If you have a device that transmits packets at a high speed, such as the security appliance with Fast
Ethernet, and it is connected to a low speed device such as a cable modem, then the cable modem
is a bottleneck at which packets are frequently dropped. To manage networks with differing line
speeds, you can configure the security appliance to transmit packets at a fixed slower rate. See the
shape command. See also the crypto ipsec security-association replay command, which lets you
configure the IPSec anti-replay window size. One side-effect of priority queueing is packet
re-ordering. For IPSec packets, out-of-order packets that are not within the anti-replay window
generate warning syslog messages. These warnings become false alarms in the case of priority
queueing. This new command avoids possible false alarms.
In ASDM, see Configuration > Firewall > Security Policy > Service Policy Rules > Add/Edit
Service Policy Rule > Rule Actions > QoS. Note that the only traffic class supported for traffic
shaping is class-default, which matches all traffic.
TCP Normalization
Enhancements
You can now configure TCP normalization actions for certain packet types. Previously, the default
actions for these kinds of packets was to drop the packet. Now you can set the TCP normalizer to
allow the packets.
• TCP invalid ACK check (the invalid-ack command)
• TCP packet sequence past window check (the seq-past-window command)
• TCP SYN-ACK with data check (the synack-data command)
You can also set the TCP out-of-order packet buffer timeout (the queue command timeout
keyword). Previously, the timeout was 4 seconds. You can now set the timeout to another value.
The default action for packets that exceed MSS has changed from drop to allow (the exceed-mss
command).
The following non-configurable actions have changed from drop to clear for these packet types:
• Bad option length in TCP
• TCP Window scale on non-SYN
• Bad TCP window scale value
• Bad TCP SACK ALLOW option
In ASDM, see Configuration > Firewall > Objects > TCP Maps.
TCP Intercept statistics You can enable collection for TCP Intercept statistics using the threat-detection statistics
tcp-intercept command, and view them using the show threat-detection statistics command.
In ASDM 6.1(5) and later, see Configuration > Firewall > Threat Detection. This command was
not supported in ASDM 6.1(3).
Threat detection shun
timeout
You can now configure the shun timeout for threat detection using the threat-detection
scanning-threat shun duration command.
In ASDM 6.1(5) and later, see Configuration > Firewall > Threat Detection. This command was
not supported in ASDM 6.1(3).
Table 2-3 New Features for ASA and PIX Version 8.0(4) (continued)
Feature Description