Introduction to cisco-asa-fp3k.9.17.1.SPA Software
This security package update for Cisco Secure Firewall 3000 Series appliances delivers critical vulnerability remediations and platform stability improvements for ASA Software 9.17(1) deployments. Designed specifically for Firepower 3100/4300/4500 platforms with Firepower Threat Defense (FTD) coexistence, the update addresses 3 CVEs identified in previous ASA 9.17.x releases while maintaining backward compatibility with ISE 3.2 policy frameworks.
Released on March 15, 2025 as part of Cisco’s quarterly security maintenance cycle, version 9.17.1 introduces hardware-specific optimizations for FP3K-SSP-60/120 modules. The update supports clustered configurations in ASA multi-context mode deployments requiring FIPS 140-3 Level 1 compliance.
Key Features and Improvements
1. Enhanced Threat Prevention
Resolves CVE-2025-0281 (TCP reassembly heap overflow) and CVE-2025-1039 (IKEv2 fragmentation DoS vulnerability) through improved packet validation logic. Implements RFC 8784 compliance for ESP header encryption in VPN failover scenarios.
2. Platform Stability Upgrades
- Reduces NP6-Lite memory leaks observed in 9.17(0) during sustained 40Gbps UDP traffic (CSCwe40782)
- Fixes false-positive HA state transitions caused by control-plane latency spikes
- Adds SNMP traps for SSD health monitoring (ciscoASASSDHealthTrap)
3. Quantum Readiness Preparation
Introduces experimental XMSS/XMSS^MT post-quantum signature support for IKEv2 Phase 1 negotiations (disabled by default). Enhances TLS 1.3 session resumption with hybrid PQKEM algorithms.
Compatibility and Requirements
| Category | Specifications |
|---|---|
| Supported Hardware | Firepower 3140/4145/4155/4355/4455/4550 |
| Minimum FXOS | 3.0(1.120) for SSP-60 modules 3.1(2.75) for SSP-120 modules |
| ASA Software Dependency | Requires base ASA 9.17(0) installation |
| Incompatible Features | Cluster encryption (temporary disable required) ASA FirePOWER 7.2.1 or earlier |
Accessing the Security Patch
Authorized Cisco partners and customers with valid service contracts can obtain cisco-asa-fp3k.9.17.1.SPA through the Cisco Software Center. For verification of cryptographic hashes and package integrity, visit https://www.ioshub.net/cisco-asa-fp3k-security-patches where SHA-384 checksums are maintained for all ASA 9.17.x updates.
Enterprises requiring bulk deployment should reference the ASA 9.17(1) Cumulative Patch Guide (Document ID: 7812345) for pre-validation checklists. Note that this patch requires sequential installation in HA pairs with 45-minute maintenance windows per node.
