Table Of Contents

Release Notes for Management Center for Firewalls 1.1.2 on Windows 2000

New Features

Product Documentation

Additional Information Online

Resolved Problems in Firewall MC 1.1.2

Known Problems

Obtaining Documentation

Documentation CD-ROM

Ordering Documentation

Documentation Feedback

Obtaining Technical Assistance

Technical Assistance Center

Obtaining Additional Publications and Information

Release Notes for Management Center for Firewalls 1.1.2 on Windows 2000

These release notes are for use with the CiscoWorks Management Center for Firewalls 1.1.2 (FirewallMC). FirewallMC is a web-based interface that enables you to configure new PIXFirewalls and Firewall Services Modules (FWSM) and import configurations from existing firewalls. You can configure firewall device settings, access rules, and translations rules, and deploy these configurations to your network. FirewallMC also provides a powerful tool for controlling changes made to your network, showing configuration and status changes.

These release notes provide:

New Features

Product Documentation

Additional Information Online

Resolved Problems in FirewallMC 1.1.2

Known Problems

Obtaining Documentation

Obtaining Technical Assistance

New Features

Release 1.1.2 contains the following new features:

Product name changes:

Management Center for PIXFirewalls is now Management Center for Firewalls.

PIXMC is now FirewallMC.

CiscoWorks2000 Server is now CiscoWorks Server.

Optional workflow. With workflow disabled, activities and jobs are not required for configuration changes and deployments.

Protocol fixup table split into basic fixups and multimedia fixups.

GUI support for PIXFirewall software version 6.3 fixup commands (PPTP, ESP-IKE, ICMP Error, SIP UDP, CTIQBE, and MGCP).

Addition of Timeout protocols (H.225 and MGCP).

Support for additional PIXFirewall software version 6.3(x) commands using the Beginning and Ending Commands feature.

Logout button renamed to Close and behavior changed to close FirewallMC without logging the user out of the CiscoWorks desktop.

Product Documentation

Note Although every effort was made to validate the accuracy of the information in the printed and electronic documentation, you should also review the FirewallMC 1.1.2 documentation on for any updates.

Use these publications to learn how to install and use FirewallMC 1.1.2:

Installing Management Center for Firewalls 1.1.2 on Windows 2000 (DOC-7815400=)—describes how to install and configure FirewallMC. Available by order and on at

Using Management Center for Firewalls 1.1.2 (DOC-7815399=)—describes FirewallMC, including how to configure and use the tool. Available by order and on at

FirewallMC online help—contains information from Using Management Center for Firewalls 1.1.2. This ensures you have the information needed to use FirewallMC even if you do not have the manual readily available.

Additional Information Online

Supported Devices, OS Versions and Commands for Management Center for Firewalls 1.1.2 (OL-3792-01) lists devices supported by FirewallMC 1.1.2 and describes support available for PIXFirewall and Firewall Services Module (FWSM) CLI Commands. It is available on at

The Release Notes for CiscoWorks Common Services 1.0 on Windows 2000 contains information on issues that affect FirewallMC. It is available on at

Resolved Problems in Firewall MC 1.1.2

The following table lists problems that were resolved in this release.

Table 1 Resolved Problems 

Bug ID


Invalid option when selecting FWSM OS version.


Installer may falsely report that there is not enough disk space to install PIXMC.


Deployment error should not default to rebooting the PIX.


Importing while another import is in process will cause problems.


Placing an apostrophe in activity name caused problem in add job


ospf sometimes generate errors in Ending Commands.


Need Ending Commands file support for the access-list (ospf ) cmd.


Cannot import from devices with AAA authentication.

Known Problems

This section contains the following problems known to exist in this release:

Activity Management Known Problems, Table2

Authentication Known Problems, Table3

Conduits and Outbound List Conversion Tool Known Problems,

Configuration Known Problems, Table5

Database Known Problems, Table6

Deployment Known Problems, Table7

Documentation Known Problems, Table8

Generate Known Problems, Table9

GUI Known Problems, Table10

Import Known Problems, Table11

Installation Known Problems, Table12

FirewallMC Server Known Problems, Table13

Known Problems with CiscoWorks Common Services that Affect FirewallMC, Table14

NoteThe problems in the following tables are known to affect Firewall MC 1.1.2. However, some of the problems were found in earlier releases of the product, so they might contain references to PIX MC and CiscoWorks2000. Any such references apply to Firewall MC and CiscoWorks as well.

To obtain more information about known problems, access the Cisco Software Bug Toolkit at (You will be prompted to log into

Table 2 Activity Management Known Problems 

Bug ID
Additional Information


Device Agent Framework crashes after activity submit or approval.

The Device Agent Framework can unexpectedly crash when processing an activity. When you later try to use PIXMC, you receive the following message: The application you are attempting to access has dependency holds in place!

Another message appears at the bottom of the page: The held services and their messages are listed below: Service Identifier: daframework Current message: Device Agent Framework is not operational. There appears to be a problem as DAF should not be down by itself. If this persists you may want to try restarting the CW2000 Daemon Manager service, and if that fails, contact customer service.

This information means that the CiscoWorks2000 Device Agent Framework process has stopped.

To work around this problem, restart the CiscoWorks2000 Daemon Manager. The activity that was in progress should be shown as submitted or approved. If the activity is submitted but Require Activity Approval is turned off:

1. Select Admin>Workflow Setup , and then select Require Activity Approval .

2. Select Workflow>Activity Management , and then reject the activity.

3. Submit the activity.

4. Approve the activity.

5. Select Admin>Workflow Setup , and then deselect Require Activity Approval .

CSCdy04737 or CSCdy22303

When approval disabled, submit privs required to use Approve button.

When approval is disabled, the button for completing (submitting) an activity or job is labeled Approve and there is no Submit button. However, you must have submittal privileges, not approval privileges, to click the Approve button in this case.

To work around this problem, assign submit privileges to users who need to use the Approve button.


Changed element in addr trans pool does not appear in report.

If you change an existing element in the address translation pool, the change might not appear in the activity report.

To make a change appear in the report, insert a new element and then delete it.


Activity report does not name the network object that was changed.

If you modify the information for a network object, but not the object name, the activity report does not display the changed object name.

There is no workaround.


Activity report is empty after ICMP service change.

If you modify a service definition that uses ICMP as the transport protocol, the activity report remains empty until you create a new activity.

If you must change a service definition that uses ICMP as the transport protocol, do so in its own activity.


Activity Management page should show error message if command generation fails.

When you submit an activity (or approve an activity if the required approval is disabled), new configurations are generated for the affected devices. After a successful generation, the activity enters the submitted state (or approved if required approval is disabled). If an error occurs during configuration generation, the activity will not be submitted (or approved) and the description for the activity is finish generating configuration. You are not told of the error.

To work around this problem, select the activity from the Activity Management page and click Status . A popup window displays the generation status for each device. You can review any errors from this page.


Different user discarding an activity might cause problems.

When a second user discards an activity while a first user is editing it, the first user might have a problem when creating another new activity.

To work around this problem, if, after creating the new activity, the activity bar reads "none", go to the Activity Management page. Close and then reopen this new activity.


System may fail if database maintenance occurs during product use.

If you compact or restore the database while another user is performing an operation with PIXMC, the user performing the operation might receive a null pointer exception.

To work around this problem, restart the CW2000 Daemon Manager and repeat the operation again after the database compact or restore is complete.

Table 3 Authentication Known Problems 

Bug ID
Additional Information


Users with help desk role cannot view activity report.

If you have view-only permission, you cannot view the activity report. This is because all radio buttons and check boxes are disabled for users who have view-only permission.

To work around this problem, log in under a different role with more privileges, or give additional permissions to users who require activity report access.


The Approve button might not be active after an activity is submitted for approval.

Activities might remain in the Generate_Open state if you log out immediately after submitting the activity.

To work around this problem, if an activity remains in the Generate_Open state, select the activity from the Activity Management page and click Cancel . When the activity returns to the Edit state, resubmit it.

Table 4 Conduits and Outbound List Conversion Tool Known Problems 

Bug ID
Additional Information


Conduits and Outbound List Conversion Tool gives confusing error message on NAT 0 access list.

If you run the Conduits and Outbound List Conversion Tool on a configuration file that contains a NAT 0 access-list command, the following error message appears: invalid name 'access-list'. This error message should state that PIXMC does not support the NAT 0 access-list command.

To work around this problem, remove the NAT 0 access-list command from the configuration file.


Conduits and Outbound List Conversion Tool does not ignore unsupported commands.

The Conduits and Outbound List Conversion Tool does not understand some CLI commands and gives an error message when it receives these commands.

To work around this problem, remove the unsupported commands, run the Conduits and Outbound List Conversion Tool, then add the unsupported commands back to the output of the tool.

Table 5 Configuration Known Problems 

Bug ID
Additional Information


Implementation of IDS Policy default attack and information actions have no effect.

In the PIXMC implementation of IDS Policy, the default attack and information action settings are meaningless. The default settings are never used.

To work around this problem, select an action on a specific interface.

Table 6 Database Known Problems 

Bug ID
Additional Information


Null pointer exception occurs after database is compacted.

Under unusual circumstances, the database might get corrupted after it is compacted.

To work around this problem, back up the database before compacting and make sure all FirewallMC windows are closed while compacting.


PIXMC database fails when disk space or virtual memory is low.

When the PIXMC database (fms.exe process) runs out of virtual memory or disk space, it shuts down and logs an error message in the Windows Event Viewer.

To detect this problem, check the Windows Event Viewer to learn whether the fms.exe process shuts down due to running out of disk space or virtual memory is low. To work around this problem, shut down the daemon manager while you free up the appropriate resources, and then restart the daemon manager.


Database locks during checkpoint.

Under unusual circumstances, the PIXMC database (fms.exe) might consume all of the CPU performing a checkpoint.

To work around this problem if the fms.exe process continues to monopolize system resources for more than 10 minutes, reboot the machine to get fms.exe out of the deadlocked situation.

Table 7 Deployment Known Problems 

Bug ID
Additional Information


Deploy errors are reported for OSPF epilog commands.

When you deploy a configuration to a device, FirewallMC sends all OSPF commands in the Ending Commands section at the same time. If any of the commands being deployed are invalid, or if certain commands being deployed already exist in the running configuration, FirewallMC generates a deployment error. The error text might not identify which specific command had problems.

For example, if the ospf message-digest-key <key> md5 <passwd> command is configured on a device and you try to send the command again, you receive a message that the key already exists.

To work around this problem, ensure that the Ending Commands section does not contain invalid commands or commands already configured on the device.

If you cannot determine which commands are causing the deployment error, you can break up the subcommands to get a more detailed report. For example, instead of entering the following in the Ending Commands section:

main cmd subcmd 1 subcmd 2 subcmd 3

You can enter:

main cmd subcmd1 main cmd subcmd2 main cmd subcmd3


Failure to remove LAN failover commands causes deploy error.

If you configure LAN failover for a device and then you disable it in FirewallMC, deploying the generated configuration without bootstrapping to remove the LAN failover commands causes a deployment error.

To work around this problem, bootstrap the firewall device to remove LAN failover commands, and then use FirewallMC to deploy.


Restart during deployment leaves activity in deploying state.

If workflow is disabled and the system fails or restarts during deployment, your deployment might remain in the deploying state. If you check the status of the deployment, you will see no devices.

This problem does not affect the operation of the system.


A misleading error is generated when you deploy to AUS if the PIXMC user account for AUS does not have correct privileges.

If the AUS (Auto Update Server) user account on PIXMC does not have the API_View or API_Write privilege required to deploy to the AUS server, an error stating STATUS_FAILED authentication failed! appears when you deploy to AUS.


You cannot view transcript when deployment fails.

If deployment fails before PIXMC can send any commands to the device, you cannot get a deployment transcript. This failure might occur due to an invalid device contact IP address, an incorrect password, or something similar.

To work around this problem, identify its cause by looking at the error message text in the deployment task status page, fix the error, and then redeploy.

CSCdz64763 or CSCdy72146

Deployment, import, or generate operations remain in waiting state.

During the deployment of devices, the status might change to STATUS_WAITING and stay at that state indefinitely.

To work around this problem, restart the CW2000 Daemon Manager service. This should cause the deployment to resume and finish.


global [ (if_name) ] number interface not removed during deployment.

PIXMC allows only a single global pool for each interface to use the keyword interface. When a second global pool on a given interface attempts to use the keyword interface, PIXMC produces a message that simply displays the syntax of the global command. PIXMC will not detect that two pools on the same interface are using the keyword interface. During deployment, PIXMC will blindly send the global command that will attempt to create the second pool and receive the PIXMC error message.

To work around this aspect of the problem, you must ensure that multiple pools on a given interface do not use the keyword interface.

CSCea02913 (continued)

global [(if_name)] number interface not removed during deployment. (continued)

In other instances, a more subtle problem can occur. Suppose that an interface pool exists that is using the keyword interface but that pool itself is no longer going to be used. A second pool on the same interface is planning to use the keyword interface. The correct PIXMC behavior would be to make sure the unwanted pool is removed by PIXMC before it creates the new pool. Since PIXMC does not enforce the restriction that only a single interface pool can use the keyword interface, it also fails to ensure that the old pool is removed before the new one is created. Whether that pool is removed before or after the new pool is created is done randomly.

To work around this aspect of the problem, do any of the following:

Remove the old pool in one deployment and add the new pool in a second deployment.

Remove the command directly from the device before deployment.

Insert a command temporarily to negate this command in the Beginning Commands file in the following form: no global [( interface_name)] number interface but remember to remove it subsequent to the deployment.

Perform device deployment using AUS.


Problems might occur if multiple users deploy jobs concurrently.

When multiple users deploy a number of devices each, PIXMC could stop working and the daemon manager would need to be restarted. If deployed jobs are cancelled after the system restarts, this could cause the system to fail again.

To work around this problem, restart CW2000 Daemon Manager, but do nothing to the affected job. Retry the deployment by creating a new job.


Deploy fails if number of interfaces in GUI and device differ.

Sometimes the number of interfaces or their respective hardware IDs defined in the GUI does not match those on the physical device. An example of this is if you were to define only ethernet0 and ethernet1 in the GUI, when the device also contains ethernet2. During deployment, PIXMC tries to remove all configuration settings for the undefined interface, such as its IP address, which causes deployment errors and possibly failure, depending on the meta settings you established regarding error handling.

To work around this problem, make sure your configuration of hardware interfaces matches those which are on the device. This includes the number of interfaces and their hardware IDs.


AAA match statements mishandled during deploy to device

Deploying a AAA match statement might result in a deployment error if the ACL used in the match statement is not valid for AAA. For example, if the ACL used in a AAA accounting match command is permit ip any any, the deployment might result in an error state. The reason is that ip any any includes ICMP, which can not be accounted for.

To work around this problem, make sure the ACL used in AAA match statements is of the appropriate type.


Remove dhcpd ip address <pool-range> treated as error during deploy.

Removing a dhcpd command configuration from a firewall device during configuration deployment results in the command no ip address <pool-range> inside being sent to the device.

The device responds with Received:DHCPD disabled on inside interface because address pool is removed, which PIXMC interprets as an error. If you set the default On Deployment Error behavior to Restore previous config (reboot), PIXMC will reboot the device when it receives this message.

Note With PIX OS 6.2(2), dhcpd commands are not synchronized from the active to the standby unit in a LAN-based failover network environment.

To work around this problem:

1. Select Configuration>Settings>PIXMC Controls>Management .

2. Under the On Deployment Error setting, select the Continue radio button.

Table 8 Documentation Known Problems 

Bug ID
Additional Information

CSCdx18147 See also CSCdy01919

PIXMC forces you to enter an enable password for each device.

PIXMC requires an enable password that contains at least one character (this field cannot be left empty), even though PIXFirewall does not. Although the tool will import a configuration from a PIXFirewall that has an empty enable password, you must supply an enable password before completing the activity in which the import is performed.

Requiring an enable password enhances enterprise security.

Table 9 Generate Known Problems 

Bug ID
Additional Information


Generation should not take place when there are no changes

When workflow is disabled, clicking Generate & Deploy triggers generation even when there are no changes.

To work around this problem, click Resume Edit to resume editing.


Serial failover on secondary unit fails to start w/o failover cmd.

Serial failover fails to start on the standby unit when configured in FirewallMC.

To work around this problem, add the command write standby as the very last command in the Ending Commands section. This command forces the active device to replicate its configuration to the standby unit, eliminating the need to manually enter failover on the standby unit to initiate configuration replication.


Global settings cause problems for devices with no outside interface.

Default setting populations assume that an outside interface is present. If you rename the outside interface, the configuration generation will fail when it generates the anti-spoofing command.

To work around this problem:

1. Override the Anti-spoofing page at the device level.

2. Deselect the outside interface.

3. Select the new name for the outside interface.

4. Select Apply .

Table 10 GUI Known Problems 

Bug ID
Additional Information


AUS contact info may require change after device import.

If you import a device, FirewallMC uses the imported information and mandatory/default settings inherited from the group to which the device is being imported to define the device's settings within FirewallMC.

Depending on your group hierarchy and your inheritance settings, you may need to modify some of the device settings after import.

When you import a device that is configured with AUS settings, the AUS contact information that is imported from the device is stored as the contact information for both the device and for FirewallMC. If the FirewallMC contact information differs, you must modify the contact information after import.


Service groups cannot be attached to web filter rules.

If you specify a service group in the Service(s) field when you define web filter rules, an error occurs.

To work around this problem, select the set of services to include, individually, from the Selecting Services dialog box and not the Service Group.


IP address/mask can become empty when you paste rules.

If a firewall, AAA, web filter, or translation exception rule uses an IP address and mask in its source or destination address, and if the rule is pasted to a new rule, you cannot cut or delete the original or the new rule. If you delete either rule, the IP address and mask become empty for the other rule after the activity is approved.

To work around this problem, create the new rule manually instead of pasting it.


Duplicate building block service name and service-group name.

When you add a service or service group, the GUI allows you to use an existing name. This results in two identical names appearing in the Selecting Services dialog box.

To work around this problem, do not use an existing name.

CSCea56582 or CSCdz87319

Editing/adding service should not require port entry.

When you edit a predefined service building block (e.g. Citrix-ICA), the default source port range results in the following error: Zero value in port range: 0-65535.

To work around this problem, use a port range of 1-65535.


Error encountered when attempting to open an activity.

You might receive an error when you try to open a previously created activity.

To work around this problem, click Back .


Importing multiple devices from CSV causes exception error.

If the last line of a *.csv file for multiple device import has a trailing carriage-return/linefeed, then the following error occurs:

You have encountered an ERROR!


The error message is listed below:


ERROR - The request attribute command is processWizard - The request attribute target is null - The custom msg is - The application error is Nested exception during invocation of processWizard on the target


The exception is java.lang.StringIndexOutOfBoundsException: String index out of range: 0


The exception message is String index out of range: 0


The exception type is: java.lang.StringIndexOutOfBoundsException


The exception message is: String index out of range: 0


The exception stack trace is as follows:

(stack trace omitted)

To work around this problem, remove trailing carriage-return/linefeeds from the *.csv file, navigate back in the browser, and retry the import.


No warning of invalid firewall version for AUS.

FirewallMC does not display any errors or warnings if you enable AUS and select a PIXFirewall version (e.g. 6.0) that does not support the AUS feature.

FirewallMC generates the configuration successfully, but the configuration does not contain the auto-update commands.

There is no workaround.


Select all rules in access table does not take effect fast enough.

After you select a large number of rules and click any button in the Access Rules table, you might see an error message stating that you must select a row.

To work around this problem, reselect all the devices, wait until the browser stops using nearly all the CPU cycles, and then click the appropriate button.


Disabled interface requires IP address.

If you select Configuration > Device Settings > Interfaces to disable an interface, you must enter an IP address.

To work around this problem, enter an IP address that is not used by any active or disabled interface.


Cannot fix incorrect IP address or subnet mask on interface.

If you enter an incorrect or illegal IP address while adding or editing an interface, click Back , and then click Next , you will see an error related to the subnet IP address.

To work around this problem, cancel out of the wizard, click Add or Edit again, and then enter the correct address.


Service group added in pix-a, showed up in pix-b.

If you add a service or service group in one scope, change to another scope, and then try to insert a rule, the service or service group you added for the original scope is available in the current scope.

To work around this problem, click Cancel to close the Selecting Services dialog box, and then click Select again. The service or service group will not show up.


Blank screen appears during backup stress tests.

When two users are logged into the system, with one user doing FirewallMC operations and another user doing a database backup, the first user might get a blank screen.

To work around this problem, wait until the backup is complete, close all browsers, and start FirewallMC again. It is best to back up the system when no one else is using it.


Deleting an interface can cause generation errors.

If you use the GUI to delete an interface, other settings referring to that interface are not removed from the GUI automatically. This causes generation errors saying that the settings are defined on an invalid interface.

To work around this problem, delete any settings that refer to a nonexistent interface.


Deleting a rule can corrupt other rules.

If you delete an access rule from an access rule table (Firewall, AAA, or Web Filter) that had a IP address for its source or destination, other rules that referred to the IP address of the deleted rule show an empty Source/Destination field after the activity is approved.

To work around this problem, write down the source and destination IP addresses before deleting the rule. After approving the activity, create another activity and go to the table from which you deleted the rule. Edit all the rules that have an empty Source/Destination and enter the correct IP address value.


PIXMC supports only a single browser page.

PIXMC supports only a single browser page. However, Internet Explorer does not prevent you from creating multiple browser pages. If you use multiple pages on one client computer to contact the same PIXMC server, the results are unpredictable.

To work around this problem, use only a single browser page to contact the PIXMC server on each client.



CSCdx05082See also CSCdy59541

If you do not click Apply before you leave a GUI page, your changes are not saved.

You lose edits in a settings page if you click a navigation link before clicking Apply. No warning is displayed before this loss occurs.

To work around this problem, you should always click Apply.


Job workflow does not prevent multiple jobs from deploying configurations to the same device.

PIXMC does not prevent you from putting the same device in more than one job. This could lead to a deployment error if more than one job tries to deploy to the same device at the same time. Also, you could inadvertently deploy an older approved configuration over a newer one, depending on the order in which the pending jobs are deployed.

To work around this problem, avoid adding devices that are part of a pending job when you create new jobs.


Problems using browser's Back button after completing a wizard.

If you click Finish on a wizard and then navigate back to a page in the wizard using the browser back function, clicking Finish again could cause an error or strange navigation.

To work around this problem, never use the back function of the browser in a PIXMC page.

CSCdy01919 See also CSCdx18147

PIXMC unable to import from devices with blank enable passwords.

When importing from a device, you must enter a non-empty enable password in the PIXMC import wizard. This prevents you from importing from devices with empty enable passwords.

To work around this problem, write the device configuration to a file and then import it from a file or set a non-empty enable password in the device.


Device names shown in GUI might change during imports.

When you import from a file, the device name used in the Import Status page is the same as the filename from which the configuration is imported. However, the Submit/Approve wizard, the Generate Status page (the one that appears after you click Finish in the Submit/Approve wizard or after you click Status in the Activity Management for the Generate_Open/Submitted/Approved activity) and the Object Selector use the hostname in the configuration as the device name, if one is present. (If the hostname is missing, the filename is used.)

To work around this problem, make sure that the filename for each configuration matches the hostname specified in the configuration file.


GUI allows incorrect PAT specifications yielding incorrect device configurations.

The global address pool that is used for a dynamic PAT can be specified to use the interface keyword on the PIXFirewall. An undocumented restriction of the PIXFirewall is that only one global pool per interface on the PIXFirewall is allowed to use the interface keyword. If multiple global pools for a given interface on a PIXFirewall use the interface keyword, the PIXFirewall responds with an obscure error (the syntax of the command).

FirewallMC does not check to ensure that the interface keyword is used only once per interface for a given device.

To work around this problem, make sure that the interface keyword is used only once per interface per device.


Import of a configuration file containing special characters hangs.

If you try to import a configuration file that contains illegal characters, for example, ctrl-C, the import hangs and the status for each device being imported remains in the STATUS_INITIALIZING state. The overall task status remains at STATUS_UNKNOWN.

To work around this problem, make sure configuration files contain only legal characters. If an import does hang due to illegal characters in a configuration file, cancel the import, correct the problem, and try the import again.


Deleting a device before deployment causes an error.

If you delete a device that is in a pending job, when you deploy the job you will receive the following error message: You have encountered an ERROR!

To work around this problem:

1. Close the PIXMC GUI and start PIXMC from the CiscoWorks2000 Server desktop again.

2. Go to the Job Management page. The job containing the deleted device will be shown as deploying.

3. Select the job and click Status to show the names of the deleted devices that should appear "deleted" to confirm that the problem was because of a deleted device.

4. Create a new job to deploy to the devices that were not deleted.


Inherit settings from: lists wrong group name when not inheriting.

Whenever you do not select the Inherit settings from a check box, the text reads Inherit setting from: Global, instead of specifying the group from which the information would be inherited where this item selected. This is only a display problem. If you select the Inherit check box, PIXMC inherits correctly and the updated page shows the group from which you are inheriting.

To work around this problem, use the object selector or the quick links next to SCOPE to walk up the group hierarchy towards Global to find out from where the setting is inherited. The closest ancestor that has its own settings (not inheriting) is the one from which the setting would be inherited.


See also CSCdw37546 or CSCdx05082

Various settings pages require clicking Apply before clicking Insert, Edit, or Delete.

The following Settings pages have both a dialog portion with Apply and Reset buttons, and a table portion with Insert, Edit, and Delete buttons:



Secure Shell



URL Filter Server

If you make changes in the dialog portion of the page and then click an action button in the table portion, your edits are not saved.

To work around this problem, click Apply after editing the dialog portion of the page and before clicking any of the action buttons in the table portion.


Abbreviated interface names cause problems.

PIXMC parses the hardware or VLAN ID entries distinctly during command generation. Conversely, the firewall will parse these commands identically when entered into the CLI. For example eth1 , ether1 , and ethernet1 should all translate the same, but they will get parsed as distinct commands when entered into the Interface panel.

To work around this problem, avoid using abbreviations in the Interface panel.


Incorrect password reset results in no password change.

On the Easy VPN Remote page, when the new and confirming passwords are mismatched (entered differently), no password changes occurs.

If you try to change your password and enter mismatched passwords, PIXMC will issue an error message, but if you do not fix the problem and click Apply for other changes on the page, no password change will take effect.

To work around the problem, reenter the passwords.


Adding a space after a Failover IP address causes an error.

PIXMC produces an error message if the Failover IP address has an extra space after it.

To work around this problem, make sure you do not add additional spaces when you enter the Failover IP address.


Internet Explorer might crash during an operation.

In some instances, Internet Explorer might crash while performing an operation in PIXMC.

To work around this problem, close all browsers, open a new browser, log into the desktop and launch PIXMC again to retry the operation.


Direct authentication fails due to password length.

When you use the direct login API, through either an emailed link to a report or through a bookmark to the direct URL, authentication fails if your password has a number of characters that is a multiple of 4.

To work around this problem, change your password to a number of characters that is not a multiple of 4.


Not specifying mask in HTTPS causes http <intf>

If you do not enter a mask when you add the interface or address for addresses with HTTPS access to a firewall device, the command http <interface> is generated. This allows any host connected to that interface to access the device via HTTP.

No error message will be displayed, but you will see the warning ***Caveat Warning: Cannot find setting:Reading PdmHttpIpMask when you generate a configuration for the device.

To work around this problem, specify an IP mask when entering interface/address information.


Toggling Use-Local and not reentering vpdn pwd sends * to device

When you edit the PPPoE information for an interface, if you do not reenter the vpdn password after enabling and then disabling the Use Local feature, PIXMC will try to set the password to a string of asterisks (*****). This results in an error on the firewall device.

To work around this problem, always reenter the vpdn password after clearing the Use Local checkbox for an interface.


Applet for access rules doesn't load after enabling SSL for CW2K desktop

If you enable SSL for the CiscoWorks2000 Server desktop, the PIXMC server must be synchronized with the CiscoWorks2000 Server so that they use the same certificate. Using a different certificate causes an error while the access rules applet is loading. The symptoms of this error are that the applet fails to load, the message Loading Java Applet appears, and the screen freezes.

To work around this problem, direct the PIXMC server to use the CiscoWorks2000 Server certificate. For details, see "Changing the SSL Certificate", Section 3-18 in Using Common Services or the following excerpt.

CSCin33388 (continued)

Applet for access rules doesn't load after enabling SSL for CW2K desktop (continued)

To change the SSL certificate used by CiscoWorks Common Services:

1. Select VPN/Security Management Solution > Administration > Configuration > Certificate from the navigation tree. The Certificate Configuration page appears. The certificate that is used by CiscoWorks Common Services to secure the SSL connection is selected.

2. To change the selection, click the desired certificate.

3. Click Finish.

4. Click OK.

5. Shut down and restart CiscoWorks Common Services. This restarts your session using the selected certificate.

If the browser still does not load the applet, you must resynchronize the JRE with the desktop. Do the following:

1. Select Settings > Control Panel > Add/Remove Programs.

2. Select the JRE and remove it.

3. In the browser, enter the URL for the CiscoWorks2000 Server. You are prompted to install JRE.

4. Reinstall the JRE. The browser JRE and server JRE are synchronized.

Table 11 Import Known Problems 

Bug ID
Additional Information


Abbreviated nameif sec does not import.

FirewallMC does not support the use of command abbreviations. Many of the commands supported by PIXFirewall and FWSM include alternative abbreviated syntaxes. When importing from a file or a device, FirewallMC does not interpret the synonymous abbreviations; instead, it generates errors and the import fails.

To prevent this problem, use the full-length syntax of the commands, including beginning and ending commands. Do not use any command abbreviations at the CLI of the device.


PIXMC does not check for missing URL server on import.

PIXMC does not check to see if a URL server is present when a filter URL is configured.

To work around this problem, make sure you specify the URL server in the import configuration file if it enables URL filtering.


Canceled imports create incorrect device settings.

You cannot cancel an import if the import status page displays STATUS_INITIALIZING. In addition, if the device status is STATUS_WORKING or STATUS_WAITING and you cancel the import, the devices that were not imported before the cancellation retain their default settings.

To work around this problem, wait for the device status to show STATUS_WORKING or STATUS_WAITING before canceling an import. After you cancel the import, delete the devices showing STATUS_CANCELLED. You can delete the devices that were imported successfully if you plan to import the devices again. Alternatively, if no changes other than the imports were made in this activity, undo the activity and start over with a new activity.


Device import of a CSV file formatted for interfaces causes errors.

Importing from a CSV file that is not of the right format might cause a null pointer exception.

To work around this problem, do one of the following:

Click your browser's Back button

Close the browser and reopen PIXMC.

Table 12 Installation Known Problems 

Bug ID
Additional Information


File copy window should not have cancel button

Clicking Cancel during the file copy portion of the PIXMC installation corrupts the installation.

This is not a problem when you perform a clean install because PIXMC 1.1 reinstalls over a incomplete previous installation with no difficulties. However, if you are upgrading from a previous release to release 1.1, you might be unable to use the previous version of PIXMC without uninstalling and reinstalling Common Services and CiscoWorks2000.

To work around this problem, back up your database before performing an upgrade.

Table 13 Firewall MC Server Known Problems 

Bug ID
Additional Information


Cannot add element to existing addr pool first time.

If you insert an element to an existing address translation pool, the change might not appear.

To work around this problem, insert the element a second time.


IP address comparison will not work.

Deploying an older version PIX OS device to a newer version might sometimes produce unnecessary negated IP address commands. FirewallMC might think that otherwise equal IP address commands are different.

This problem causes no adverse effects.


FirewallMC allows deploy to AUS with unique identity undefined.

If you do not define the Unique Identity page for a device, you can still deploy the configuration to the Auto Update Server, but the necessary auto-update command that the device needs to contact the AUS is not generated in the configuration.

To work around this problem, select Configuration > Settings > Firewall Device Administration > Unique Identity , and then enter the unique identity information so the auto update feature can work correctly.


Deploy fails if interfaces and IP addresses not set on PIX 6.3(1).

If only the preconfiguration routine is performed on a firewall device without enabling all interfaces and their IP addresses, any deployment to the firewall device fails.

To work around this problem, you must configure the interface settings for a firewall device before deploying a configuration to that device from FirewallMC.


Last detected version not in effect if config and device mismatch.

If you deploy a configuration with an incorrect software version to a firewall device (for example, you deploy a 6.2(x) configuration to a 6.3(x) device), you receive a version mismatch error, as expected, and FirewallMC automatically updates the last detected version for the firewall device. However, if you redeploy to the device, FirewallMC does not regenerate the configuration and you will receive the version mismatch error again.

To work around this problem, do one of the following:

Select the correct version from the Supported Firewall OS Version list instead of using the last detected version.

Make another configuration change for the firewall device so that FirewallMC regenerates the configuration on deployment.


NTP server cmd on device returns an error when deployed to device.

If the command ntp server <ip_address> source <interface_name> exists on a firewall device, and the device configuration is imported and later deployed back to the same device, the transcript returns an error.

To work around this problem, remove the NTP server command from the Ending Commands section after import.


Static command problem if interface name same as named IP.

When importing a configuration that contains a named IP alias that matches the name of an interface, FirewallMC parses the static command incorrectly and reports a confusing error. For example:

*** Caveat Info: Input line: "static (vlan-10,outside) ..."!

*** Caveat Error: Unexpected token "outside". Local ip address expected (assumed)!

To work around this problem, rename either the alias or the interface name, and then reimport.


Device Contact Info and AUS Contact settings are not retained as part of a job.

When you create a job, the PIX Device Contact Info and AUS Contact settings for each device in the job are not stored as a part of the job. When you deploy the job, the current values for these settings are used to deploy to a device, or to AUS. This means that changes made to these settings after a job is created will affect how a job operates when it is deployed.

To work around this problem, deploy existing jobs before changing the PIX Device Contact Info and AUS Contact settings for any device in any undeployed jobs.


Modifying routes might disconnect communication with PIXFirewalls.

Before PIXMC can manage any PIXFirewall, you must bootstrap the device with the right routes and http settings so that PIXMC can communicate with it. Any changes in PIXMC to the routes that affect connectivity between PIXMC and the device could cause a deployment to the device to fail.

To work around this problem, correct the routes in PIXMC and redo the boostrapping process on the PIXFirewall if you are disconnected.


Changing an interface name causes generate and deployment errors.

When generating a configuration, some settings refer to interface names and will cause generation errors after the interface is renamed. These settings have to be changed to refer to the new name as well.

These settings refer to interfaces and must be changed to use the new name:


Static Routes


Proxy Arp



Secure Shell


ICMP Interface Rules


URL Filter Server

TFTP Server

IDS Policy



CSCdy54803 (continued)

Changing an interface name causes generate and deployment errors. (continued)

When PIXMC deploys to a device, it might need to negate commands. Some of those commands could refer to an interface by that interface's name. An example is the route command, whose form is route if_name ip_address netmask gateway_ip [metric], where if_name is the name of the interface. If the interface name changes, these negated commands will use the interface's old name instead of the new name, which will cause deployment errors.

To work around this problem, do not change an interface name and other aspects of a device within a single deployment. For example, change the interface name, deploy that change, and then make further changes as needed.


Settings might be duplicated after a crash during an import.

If the database crashes while PIXMC is performing an import, the import resumes automatically when PIXMC restarts. Those device imports that were not completed before the crash will be reinitiated. If information about a device from the initial import was committed before the crash, the task will be performed a second time, and the second import will add the information to the device without removing the old information. Consequently, there might be duplicate table entries for fixups, translation rules, access rules, and others. When you generate a configuration, warnings and errors about the duplicate items will be generated.

To work around this problem, delete devices with duplicate information and reimport them.


Job Status/View Config pages are not checked for privileges.

If you use PIXMC with Cisco Secure ACS, and use the ACS Network Device Groups feature to assign permissions to a device or group, PIXMC does not check permissions for the View Config and View Transcript functions in the Job Status popup window. However, the permissions are correct in the Configuration pages. When the device is deployed, unauthorized users can see the status of the job that deployed the device, can access the configuration with the View Config function, or see the transcript with View Transcript.

There is no workaround.


Access rules might reference deleted network objects.

If you delete a network object that is being used in an access rule, you are left with an unresolved reference in the access rule.

To work around this problem, edit the access rule so that it no longer references the obsolete network object.


Serial parameter for aaa commands should be removed.

PIXMC generates the aaa authentication serial console group_tag command for FWSM if such an entry is configured in the GUI. This generated command will cause your deployment to fail if the metasetting is not set to Continue with deployment errors .

To work around this problem, either unconfigure this AAA authentication serial entry in the GUI, or change the meta setting to allow the deployment to continue with errors.


Client might be slow when connecting to a PIXMC server remotely.

Remote access might be slow when you connect to a PIXMC server without the appropriate DNS entry (Address and Pointer Records).

To work around this problem, verify that a DNS entry was created.


Need Ending Commands file support for the access-list (ospf ) cmd.

FWSM has added a new type of access list commands (ACLs) for ospf commands. These new ACLs are not supported by this version of PIXMC and are not easily distinguishable from normal ACLs. For these reasons, if they are encountered, they create parsing errors, prevent you from importing configurations from devices or files, and cause deployment errors.

The ideal workaround for this problem is to avoid using the new ACLs. If you must use them, do not deploy directly to device. Instead, import a configuration without the new commands, then modify the Ending Commands file and deploy to file.


The command no rip parses incorrectly.

Some versions of CSPM generate this command before optimizing deployment. Therefore, if you manually export the Command tab settings from CSPM and try to import them into PIXMC, you might have this problem. The command is interpreted as a positive rip command, which enables rip instead of disabling an existing command. The negated form of the rip command parses correctly although the system might report an error. The command will be processed as a positive rip command.

To work around this problem, remove the no rip commands from the file before importing.

Table 14 Known Problems with CiscoWorks Common Services that Affect Firewall MC 

Bug ID
Additional Information


User is not notified of failure when shutting down during restore.

For details, see


Restore freezes during management/monitoring center command generation.

For details, see


Services do not start after reboot during installation.

For details, see


Difficulty browsing CiscoWorks2000 desktop from server machine.

For details, see


Restoring during scheduled backup requires reboot.

For details, see


MDCSupport utility does not erase its temporary directory.

For details, see


Cannot launch CW2K desktop after Common Services installed on system with netForensics.

For details, see


Licensing error when SQL service is not started

For details, see


Sybase service problem on Win2K server with Terminal Services on.

For details, see


Changing the Windows password causes service startup to fail.

For details, see


CiscoWorks links do not work due to change in server IP address.

For details, see

Obtaining Documentation

Cisco provides several ways to obtain documentation, technical assistance, and other technical resources. These sections explain how to obtain technical information from Cisco Systems.

You can access the most current Cisco documentation on the World Wide Web at this URL:

You can access the Cisco website at this URL:

International Cisco websites can be accessed from this URL:

Documentation CD-ROM

Cisco documentation and additional literature are available in a Cisco Documentation CD-ROM package, which may have shipped with your product. The Documentation CD-ROM is updated regularly and may be more current than printed documentation. The CD-ROM package is available as a single unit or through an annual or quarterly subscription.

Registered users can order a single Documentation CD-ROM (product number DOC-CONDOCCD=) through the Cisco Ordering tool:

All users can order monthly or quarterly subscriptions through the online Subscription Store:

Ordering Documentation

You can find instructions for ordering documentation at this URL:

You can order Cisco documentation in these ways:

Registered users (Cisco direct customers) can order Cisco product documentation from the Networking Products MarketPlace:

Nonregistered users can order documentation through a local account representative by calling Cisco Systems Corporate Headquarters (California, U.S.A.) at 408526-7208 or, elsewhere in North America, by calling 800553-NETS (6387).

Documentation Feedback

You can submit comments electronically on On the Cisco Documentation home page, click Feedback at the top of the page.

You can e-mail your comments to

You can submit comments by using the response card (if present) behind the front cover of your document or by writing to the following address:

Cisco Systems
Attn: Customer Document Ordering
170 West Tasman Drive
San Jose, CA 95134-9883

We appreciate your comments.

Obtaining Technical Assistance

Cisco provides, which includes the Cisco Technical Assistance Center (TAC) website, as a starting point for all technical assistance. Customers and partners can obtain online documentation, troubleshooting tips, and sample configurations from the Cisco TAC website. registered users have complete access to the technical support resources on the Cisco TAC website, including TAC tools and utilities. offers a suite of interactive, networked services that let you access Cisco information, networking solutions, services, programs, and resources at any time, from anywhere in the world. provides a broad range of features and services to help you with these tasks:

Streamline business processes and improve productivity

Resolve technical issues with online support

Download and test software packages

Order Cisco learning materials and merchandise

Register for online skill assessment, training, and certification programs

To obtain customized information and service, you can self-register on at this URL:

Technical Assistance Center

The Cisco TAC is available to all customers who need technical assistance with a Cisco product, technology, or solution. Two types of support are available: the Cisco TAC website and the Cisco TAC Escalation Center. The type of support that you choose depends on the priority of the problem and the conditions stated in service contracts, when applicable.

We categorize Cisco TAC inquiries according to urgency:

Priority level 4 (P4)—You need information or assistance concerning Cisco product capabilities, product installation, or basic product configuration. There is little or no impact to your business operations.

Priority level 3 (P3)—Operational performance of the network is impaired, but most business operations remain functional. You and Cisco are willing to commit resources during normal business hours to restore service to satisfactory levels.

Priority level 2 (P2)—Operation of an existing network is severely degraded, or significant aspects of your business operations are negatively impacted by inadequate performance of Cisco products. You and Cisco will commit full-time resources during normal business hours to resolve the situation.

Priority level 1 (P1)—An existing network is "down," or there is a critical impact to your business operations. You and Cisco will commit all necessary resources around the clock to resolve the situation.

Cisco TAC Website

The Cisco TAC website provides online documents and tools to help troubleshoot and resolve technical issues with Cisco products and technologies. To access the Cisco TAC website, go to this URL:

All customers, partners, and resellers who have a valid Cisco service contract have complete access to the technical support resources on the Cisco TAC website. Some services on the Cisco TAC website require a login ID and password. If you have a valid service contract but do not have a login ID or password, go to this URL to register:

If you are a registered user, and you cannot resolve your technical issues by using the Cisco TAC website, you can open a case online at this URL:

If you have Internet access, we recommend that you open P3 and P4 cases online so that you can fully describe the situation and attach any necessary files.

Cisco TAC Escalation Center

The Cisco TAC Escalation Center addresses priority level 1 or priority level2 issues. These classifications are assigned when severe network degradation significantly impacts business operations. When you contact the TAC Escalation Center with a P1 or P2 problem, a Cisco TAC engineer automatically opens a case.

To obtain a directory of toll-free Cisco TAC telephone numbers for your country, go to this URL:

Before calling, please check with your network operations center to determine the Cisco support services to which your company is entitled: for example, SMARTnet, SMARTnet Onsite, or Network Supported Accounts (NSA). When you call the center, please have available your service agreement number and your product serial number.

Obtaining Additional Publications and Information

Information about Cisco products, technologies, and network solutions is available from various online and printed sources.

The Cisco Product Catalog describes the networking products offered by CiscoSystems, as well as ordering and customer support services. Access the Cisco Product Catalog at this URL:

Cisco Press publishes a wide range of networking publications. Cisco suggests these titles for new and experienced users: Internetworking Terms and Acronyms Dictionary, Internetworking Technology Handbook, Internetworking Troubleshooting Guide, and the Internetworking Design Guide. For current Cisco Press titles and other information, go to Cisco Press online at this URL:

Packet magazine is the Cisco quarterly publication that provides the latest networking trends, technology breakthroughs, and Cisco products and solutions to help industry professionals get the most from their networking investment. Included are networking deployment and troubleshooting tips, configuration examples, customer case studies, tutorials and training, certification information, and links to numerous in-depth online resources. You can access Packet magazine at this URL:

iQ Magazine is the Cisco bimonthly publication that delivers the latest information about Internet business strategies for executives. You can access iQ Magazine at this URL:

Internet Protocol Journal is a quarterly journal published by Cisco Systems for engineering professionals involved in designing, developing, and operating public and private internets and intranets. You can access the Internet Protocol Journal at this URL:

Training—Cisco offers world-class networking training. Current offerings in network training are listed at this URL:


Posted: Fri Mar 5 01:43:46 PST 2004
All contents are Copyright © 1992--2004 Cisco Systems, Inc. All rights reserved.
Important Notices and Privacy Statement.