Release Notes for AsyncOS 15.0 for Cisco Secure Web Appliance

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Release Notes for AsyncOS 15.0 for Cisco Secure Web Appliance

Welcome to the Secure Web Appliance First Published: May 11, 2023

About Secure Web Appliance

The Cisco Secure Web Appliance intercepts and monitors Internet traffic and applies policies to help keep your internal network secure from malware, sensitive data loss, productivity loss, and other Internet-based threats.

What’s New

What’s New In AsyncOS 15.0.0-355—General Deployment

The following features are introduced for this release:

Smart Software Licensing Enhancements

Following are the enhancements made to the Smart Software Licensing feature:

Deeper bandwidth control

You can manage the traffic bandwidth by configuring the bandwidth value in quota profile and mapping the quota profile in decryption policy and access policy URL category or overall web activity quota.

For more information, see Defining Time, Volume, and Bandwidth Quotas section in the user guide.

The clone policy feature allows you to copy or clone the existing configurations of a policy and to create a new policy.

For more information, see Policy Configuration section in the user guide.

Application Discovery and Control (ADC) engine

Supports ADC engine, an acceptable use policy component which inspects web traffic to gain deeper understanding and control of web traffic used for applications.

Starting with AsyncOS 15.0, you can use either AVC or ADC engine to monitor web traffic. By default, AVC is enabled. The ADC engine supports high performance mode.

For more information, see Configuring the URL Filtering Engine and Policy Configuration sections in the user guide.

REST API for ADC Configuration

You can now retrieve configuration information, and perform any changes (such as modify existing information, add a new information, or delete an entry) in the access policy configuration data of the appliance using REST APIs.

SNMP3 non-default username

Starting from AsyncOS 15.0, admin can opt to configure custom SNMPv3 username other than the default username v3get.

For more information, see Monitoring System Health and Status using SNMP section in the user guide.

The maximum length of the custom header is 16k.

For more information, see Adding Custom Headers To Web Requests section in the user guide.

Option to chose the secure tunnel interface and remote access connection

Allows you to select the interface through which the tunnel and remote access connection will be established.

For more information, see Enabling remote access to the appliance section in the user guide.

From AsyncOS 15.0, FreeBSD version has been upgraded to FreeBSD 13.0.

The following has been upgraded:

FreeBSD 13.0 is compatible with Cisco SSL version 1.1.1 only. Only Cisco SSH compatible cipher, mac and kex algorithms, will be supported for SSH connectivity to FreeBSD 13.0.

Changes in Behavior in AsyncOS 15.0.0-355 GD (General Deployment)

The DCA feature in Secure Web Appliance will be disabled as part of the AsyncOS15.0 GD release and will no longer be supported in future releases. Hence, we DO NOT recommend enabling it.

Known Limitations

This release has the following limitations:

Accessing the New Web Interface

The new web interface provides a new look for monitoring reports and tracking web services. You can access the new web interface in the following way:

Important!

If you change these default ports, ensure that the customized ports for the new web interface are not blocked in the enterprise firewall.

The new web interface opens in a new browser window and you must log in again to access it. If you want to log out of the appliance completely, you need to log out of both the new and legacy web interfaces of your appliance.

For a seamless navigation and rendering of HTML pages, Cisco recommends using the following browsers to access the new web interface of the appliance (AsyncOS 11.8 and later):

You can access the legacy web interface of the appliance on any of the supported browsers.

The supported resolution for the new web interface of the appliance (AsyncOS 11.8 and later) is between 1280x800 and 1680x1050. The best viewed resolution is 1440x900, for all the browsers.

Cisco does not recommend viewing the new web interface of the appliance on higher resolutions.

Release Classification

Each release is identified by the release type (ED - Early Deployment, GD - General Deployment, etc.) For an explanation of these terms, see http://www.cisco.com/c/dam/en/us/products/collateral/security/web-security-appliance/content-security-release-terminology.pdf.

Supported Hardware for This Release

The build is available for upgrade on all the existing supported platforms, whereas the enhanced performance support is available only for the following hardware models:

Upgrade Paths

Upgrading to AsyncOS 15.0.0-355

You can upgrade to the release 15.0.0-355 of AsyncOS for Cisco Web Security appliances from the following versions:

Post–Upgrade Requirements

After you upgrade to 15.0.0-355, you must perform the following steps if you have not registered your appliance with Cisco Threat Response:

Procedure

Create a user account in the Cisco Threat Response portal with admin access rights.

To create a new user account, navigate to the Cisco Threat Response portal login page using the following URL- https://visibility.amp.cisco.com and click ‘Create a Cisco Security Account’. If you are unable to create a new user account, contact Cisco TAC for assistance.

For registering your appliance with Security Services Exchange (SSE) cloud portal, generate token from SSE portal corresponding to your region.

While registering with SSE cloud portal, select the following FQDN based on your region from the web user interface of your appliance:

Make sure that you enable Cisco Threat Response under Cloud Services on the Security Services Exchange portal. Ensure that you open HTTPS (In and Out) 443 port on the firewall for the FQDN api-sse.cisco.com (America) to register your appliance with the Security Services Exchange portal.

To deploy a virtual appliance, see the Cisco Content Security Virtual Appliance Installation Guide, available from http://www.cisco.com/c/en/us/support/security/web-security-appliance/products-installation-guides-list.html.

Compatibility Details

Compatibility with Cisco AsyncOS for Security Management

For compatibility between this release and AsyncOS for Cisco Content Security Management releases, see the compatibility matrix at: https://www.cisco.com/c/dam/en/us/td/docs/security/security_management/sma/sma_all/web-compatibility/index.html.

IPv6 and Kerberos Not Available in Cloud Connector Mode

When the appliance is configured in Cloud Connector mode, unavailable options for IPv6 addresses and Kerberos authentication appear on pages of the web interface. Although the options appear to be available, they are not supported in Cloud Connector mode. Do not attempt to configure the appliance to use IPv6 addresses or Kerberos authentication when in Cloud Connector mode.

Functional Support for IPv6 Addresses

Features and functionality that support IPv6 addresses: