Best PIX Software Release

[timbo]

Can any of you gentlemen please advise me on the best Soft Version to go to ?…

We all know putting the latest and greatest releases can also be opening a can of worms when it comes to up-grades… so what in your opinion would be the most stable and reliable version for the

PIX 515.

Just interested to see what some of you might think

Thanks

[travis-dennis_2]

A TAC engineer suggested 5.32 for stability. Said the newer versions have not turned out to be as stable but I have been using 6.01 for a while now with now problems on a 506. Just got a 515 and thinking about loading 6.x on it. Anyone else have any thoughts?

[timbo]

Thanks for the insight - i think i'll play my cards with the 5.3(2)ver.

Sounds good, i suppose it's best to go for a older more tested version than a recent copy thats still got to be see some months before called a reliable version.

If it anin't broke - dont fix it! :-)

Thanks.

[phil.benn]

We currently run a combination of 5.3.1 and 6.0.1, and find both to be stable.

Version 6.1.1 is available now, and fixes the MailGuard vulnerability among other issues, which may be an issue if you run firewalled SMTP servers. Check the PSIRT notices for details. Haven't deployed 6.1.1 anywhere yet so cannot comment on the stability.

[murriware]

We run PIX software since 4.4 and now we are 6.1: never encountered a stability problem.

6.1 is just as good as the vulnerabilities that it fixes.

Bye

Maurizio

[elehman]

TAC is correct. 5.3.2 is the most stable. I've seen many bugs in lower versions like 5.2.6 and 5.2.3 - especially with VPN tunnels and believe it or not, simple routing. The only thing i suggest is that upgrading IOS also means upgrading memory. make sure your PIX meets the requirements for the new IOS first. 6.0 is not bad - actually a lot of bugs were fixed in that release. currently i've been running 6.1.1 for a while with no incident - vpn or otherwise, but you never know.

[caleb]

I was told 5.26 was the most stable. The engineer also mentioned that it really depends on how many whiz-bang features you need.