Software Update: Cisco SMA AsyncOS 12.0

Cisco has released a firmware update for its Content Security Management Appliances, which are abbreviated to SMA. The technology descends from IronPort Systems, which was bought by Cisco in 2007, so although that was more than a decade ago, you can still hear the name IronPort for these appliances. For the supported upgrade paths, it is recommended to read the documentation or contact Cisco’s TAC† This firmware is called 12.0 and has 12.0.0-452 as the exact version number. The list of changes looks like this:

What’s New In This Release

• New Web Interface for Reporting, Quarantine and Tracking
• Encrypting sensitive information on the appliance – You can use the adminaccessconfig > encryptconfig sub command in the CLI to configure encryption of sensitive information on your appliance.
• Message Tracking Enhancement – You can now search for messages based on the “Reply-To” header of the message.
• The trailblazerconfig CLI Command – You can use the trailblazerconfig command to route your incoming and outgoing connections through HTTP and HTTPS ports on the new web interface.
• Support for new features in AsyncOS 12.0 for Cisco Email Security Appliances
• Metrics Bar Widget – The Metrics Bar widget enables you to view the real time data of the file analysis done by the Cisco Threat Grid appliance on the Advanced Malware Protection report page.
• Advanced Malware Protection Report Enhancement – The Advanced Malware Protection Report page has the following enhancements:
  • A new section – Incoming Malware Files by Category to view the percentage of blacklisted file SHAs received from the AMP for Endpoints console that are categorized as Custom Detection. The threat name of a blacklisted file SHA obtained from AMP for Endpoints console is displayed as Simple Custom Detection in the Incoming Malware Threat Files section of the report.
  • A new section – Incoming Malware Files by Category to view the percentage of blacklisted file SHAs based on the threshold settings that are categorized as Custom Threshold.
  • You can click on the link in the More Details section of the report to view the file trajectory details of a blacklisted file SHA in the AMP for Endpoints console.
  • A new verdict – Low Risk is introduced when no dynamic content is found in a file after file analysis. You can view the verdict details in the Incoming Files Handed by AMP section of the report.
• New Web Interface for Web Reporting and Tracking
• HTTPS Reports Page – You can now view the overall aggregation of the HTTP/HTTPS traffic and the summary of the ciphers based on the client and server side connection for each HTTP/HTTPS traffic, on the HTTPS Reports report page.
• Support for Smart Software Licensing – Smart Software Licensing enables you to manage and monitor Cisco Email Security appliance licenses seamlessly. To activate Smart Software licensing, you must register your appliance with Cisco Smart Software Manager (CSSM) which is the centralized database that maintains the licensing details about all the Cisco products that you purchase and use.
• Integrating the Appliance with Cisco Threat Response Portal – You can integrate your appliance with Cisco Threat Response portal, and perform the following actions in Cisco Threat Response portal:
  • View the message tracking data from multiple appliances in your organization.
  • Identify, investigate and remediate threats observed in the message tracking.
  • Resolve the identified threats rapidly and provide recommended actions to take against the identified threats.
  • Document the threats in the portal to save the investigation, and enable collaboration of information among other devices on the portal.
• Support for the Office 365 Web Service External URL Categories feature in AsyncOS 11.5.1-124 for Cisco Web Security Appliances
• Web Traffic Tap Policies for web – Cisco Content Security Management appliance now allows you to set Web Traffic Tap Policies. You can define the Web Traffic Tap Policies based on which web traffic that passes through the Web Security appliance will be tapped. You must enable the Web Traffic Tap feature in Web Security appliance to set the Web Traffic policies in the Security Management appliance.

Changes in Behavior

• Change in Report Pages – The following reports are changed on the new web interface, in this release:
  • Overview report page is renamed to Mail Flow Summary.
  • Outbreak Filters report page is renamed to Outbreak Filtering.
  • Virus Types report page is renamed to Virus Filtering.
  • Advanced Malware Protection, AMP File Analysis, AMP Verdict Updates and Mailbox Auto Remediation report pages are merged as Advanced Malware Protection.
  • Incoming Mail and Outgoing Senders report pages are merged as Mail Flow Details.
  • TLS Connections report page is renamed to TLS Encryption.
  • Geo-Distribution report page is renamed to Connection by Country.
  • Internal Users report page is renamed to User Mail Summary.
  • Web Interaction Tracking report page is renamed to Web Interaction.
• Encrypting Passphrases – After you upgrade to this release, you can encrypt the user’s passphrases when updating the configuration files on the appliance.
• Changes in Accessing the Spam Quarantine – The administrative users can now access the Spam Quarantine page on the new web interface of the appliance. You can navigate to Quarantine > Spam Quarantine > Search page on the new web interface to access the Spam Quarantine page. The end-users can now access the Spam Quarantine portal on the new web interface.
• Changing the User’s Password After Expiry – Users are prompted to change the password after the user account is expired.
• Changes in Demo Certificates – Prior to this release, the appliance was pre-configured with a demonstration certificate to enable the TLS connections. After you upgrade to this release, the appliance generates a unique certificate to enable TLS connection. The existing demonstration certificate that is used in the following configurations are replaced with the new certificate:
  • Mail Delivery
  • LDAP
  • Networking
  • URL Filtering
  • SMTP Services