http://www.cisco.com/en/US/products/ps6128/prod_release_note09186a008053
a3ed.html

READ it carefully.  Looks like it's a complicated two step / three step
shuffle for upgrades.

Highlights of new features:

MAC Address Wildcard Support for Device Filters
NAT Session Throttle
New Hardware Driver Support (tg3)

Release 3.6(1) provides a new tg3 driver that resolves the release
3.6(0) Broadcom NIC workaround (IPMI feature had to be disabled)
specified in caveat CSCsd08348. With this new driver, VLAN tags are
retained and the need to disable the IPMI feature using the Broadcom
utility is eliminated. 


*The Clean Access Agent can now be run by a restricted user on the local
machine (user is not an administrator or power user). Administrator
privileges are still necessary to perform the initial Agent
installation.

*The event.log file used for Agent debug logging is now stored in the
user's home directory (e.g. C:\Documents and
Settings\<username>\Application Data\CiscoCAA\event.log) instead of the
Agent installation directory, and the path of the registry key changes
to HKEY_CURRENT_USER. See Enable Debug Logging on the Clean Access Agent
for details.