PIX Ver. 6.3(1) 1

[SteffenR]

Hi Folks,
during testing the new PIX software version 6.3(1) we detected a bug in the software. If you are using IPSec VPN´s with ISAKMP it may be that the system will delete your ISAKMP policies. We found this phenomenon after upgrading allreday running PIX Firewalls.

Regards, Steffen

 

[yizhar]

HI.

Thanks for the info.
Can you please provide some more details?

> it may be that the system will delete your ISAKMP policies
What does it mean?
Does the configuration change? Do you need to reboot?
What are the effects?
How did Cisco TAC respond if you have contacted them?
Is this issue mentioned in the release notes?

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_sw/v_63/63rnotes/pixrn63.htm#32434

Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[SteffenR]

Hi Yizhar,

A colleague of work detected this phenomenon. As he told me the configuration will change. A reboot doesn´t work - but I´m not absolutely sure. I will ask him if there is anything helpfull to do.

The effects are predictable. With no ISAKMP policy you can`t get a successfull phase-1 negotiation. No ISAKMP SA will be created and so no Quick Mode will start.

I don´t know if my colleague contacted the TAC, because we are consultants and the bug was detected during tests at a customer. May be that the customer opened a trouble ticket. I will ask him about this too.

I don´t guess that this issue is mentioned in the release notes. I wrote this posting because in some other postings the new PIX version was been recommended. It also may be that the failure depends on other configuration details and the new PIX version will work well with other configurations.

Regards,

Steffen

 

[yizhar]

HI.

Do you see any common things with the following:

http://forum.cisco.com/eforum/servl...Cmd=MB?cmd=display_location&location=.ee96b46

Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[ixleplix]

We are planning to upgrade to 6.3.1. Have you heard anything else on this? Also in regard to the BUGTOOL KIT mentioned in the CISCO forum, What is it?