StoneGate SSL VPN. Release Notes for Version 1.4.0

Transcription

1 SSL VPN Release Notes for Version Created: February 2, 2010

2 Table of Contents What s New... 3 New Features... 3 Enhancements... 3 Fixes... 4 System Requirements... 6 Build Version... 6 Product Binary Checksums... 6 Compatibility... 7 Upgrade Instructions Known Issues... 11

3 What s New New Features The enhancements introduced in SSL VPN version are described in the table below. The following table lists the features briefly. Please consult the product documentation for more details. Feature Support for license in SMC SSL VPN Virtual Appliance Appliance HW Monitoring from SMC HW Assessment Plug-in v2.1 New Licensing Options End Point Security (assessment) for MAC OS X TCP Port Forwarding Description It is now possible to manage SSL VPN appliance licensing in the Management Client. If SSL VPN engines are used without Management Center, appliance license management continues to be done in the SSL VPN Administrator interface. SSL VPN is now available as a Virtual Appliance for deployment in VMware-based virtual infrastructures. The SSL VPN Virtual Appliance is subject to specific licensing and is not counted toward the node count limit in the SMC. It is now possible to monitor the hardware (filesystem and NIC status) of an SSL VPN appliance in the Management Client (requires SMC or ). The new version of the Hardware Assessment Plug-in supports extending data file in.csv format with MAC address information of the connecting client. This is an additional check, beside the existing ones for motherboard serial numbers, memory modules serial numbers, and hard disk serial numbers. Three new licensing options have been made available: Spike Licensing, HA Licensing and Virtual Appliance Licensing. For additional information, please refer to the Price List. It is now possible to use assessment rules with MAC OS X clients. The functionality can be used to check the presence of files and their checksums. TCP Port Forwarding allows the setting of port forwarding configurations in the SSL VPN, making it act as a proxy with the option of combining port forwarding rules with certificate authentication. Additional information can be found in TN Enhancements The enhancements introduced in SSL VPN version are described in the table below. The following table lists the features briefly. Please consult the product documentation for more details. Feature Improved Logging to SMC Improved Ticket SSO Initial configuration from scripted interface New set of icons for Application Portal Description The logging stream to the Management Server has been cleaned up and improved to enhance the readability of logs. It is now possible to group SSL VPN logs related to an activity, and to filter information from the collected data (for example, booting information and user logins/logouts). Ticket Single Sign On support has been extended and tested with systems such as Salesforce.com and Fronter elearning. Ticket SSO allows dynamic web-service-to-web-service conversation to automate and empower authentication processes. New SSL VPN Appliances can be configured with a script automatically run at boot, allowing selection of settings such as the IP address for the main NIC, the root password, etc. It is now possible to choose from a new set of icons to represent Resources in the Application Portal. 3 SSL VPN Release Notes for version 1.4.0

4 Fixes Problems described in the table below have been fixed since SSL VPN version A workaround solution is presented for earlier versions where available. Synopsis Engines vulnerable to Sockstress denial-of-service tool (#52279) Resource access does not work with some acquired IP addresses due to a bad route setting on the client side (#52267) Viewing an imported Certificate in Administrator interface displays internal error (#52484) Wrong message in dynamic tunnel set with resource network (#54041) Cannot use external DB for OATH - connector cannot be installed. (#54240) Certificate Authentication does not work after upgrade from version (#54043) Certificate Authentication does not work (#53830) Download issues using MS Outlook Web Access (OWA) 2007 with MS Internet Explorer 8 (#53923) Description SSL VPN engines are vulnerable to attacks using the Sockstress denial-of-service tool (ref. CVE ). A successful attack causes a denial-of-service condition in Web Console management connections. This does not affect the traffic that goes through the SSL VPN engine. More information can be found at: 9_17_09.html A bad route setting on the client side prevents resource access with some acquired IP addresses. For example, TFTP does not work for specific acquired IP addresses. In a test case, the TFTP server Resource Host has the IP address The client IP address pool is from to , and the IP of the SSL GW is TFTP does not work when the set route includes the host resource address. In the SSL VPN Administrator interface, clicking Manage System>Certificates>Add server certificate and save allows you to add a certificate in the system. Clicking view certificate leads to Internal System Error When defining a tunnel set for a Network Resource, the error message "A virtual IP-address is needed for this resource" incorrectly appears in the Dynamic Tunnel Set definition. It is now possible to define external databases for OATH, as instructed in TN After upgrading to SSL VPN version from version 1.2.1, certificate-based authentication does not work. Certificate-based authentication in SSL VPN version does not work, creating the following error in the Policy Service log: "AUTHENTICATION NOT_AVAILABLE_AUTHENTICATION_SERVICE: AUTHENTICATION_MECHANISM: [8] INTERNAL SERVER ERROR." Using Advanced MS OWA 2007 mode (optimized for IE) with MS Internet Explorer causes some issues in downloading xls attachments. Workaround for previous versions None None None None, the message is harmless If an external database is needed for OATH, use Hsql DB ( None None There are two workarounds to these issues: 1) If possible, use the Mozilla Firefox web browser. 2) To resolve the attachment download issue, add the desired extension (*.xls) + *.ashx to the cached mime types. You can add the cached mime types in the SSL VPN Administrator interface by editing the web resource. Select OWA web resource> edit resource host> Advanced settings. Check the Authorization Settings, and add *.xls and *.ashx as Cache MIME types. 4 SSL VPN Release Notes for version 1.4.0

5 Logoff from OWA 2007 with MS IE disconnects user from Application Portal (#55496). AccessClient does not start on 64-bit Windows Vista machines(#54307) Clicking the Logoff button to terminate an Outlook Web Access (OWA) 2007 session in Microsoft Internet Explorer disconnects the VPN user from the SSL VPN Application Portal. Regardless of the browser used and whether it runs in administrator mode, the Access Client returns error on 64-bit Windows Vista machines. Use Firefox to get consistent and correct behavior. If not possible, leave the OWA 2007 window open until you need to close the SSL VPN session, then close it. Contact Stonesoft Support 5 SSL VPN Release Notes for version 1.4.0

6 System Requirements Appliances SSL VPN version is supported on all SSL appliances and on SSL VPN Virtual Appliances. Build Version The SSL VPN version build version is Product Binary Checksums sslgw_engine_ _i386.iso MD5SUM 6a7ad090714c76764e742c2ccbf71c73 SHA1SUM 6b9fde48334d655cc89a8c165a9df47eb24f7c96 sslgw_engine_ _i386.zip MD5SUM 5e4db0b00feb5dd fb5b15 SHA1SUM 188dfa9a9d0c8a75b08c5ee365716ad79bdc67cc sslgw_engine_ _vmwarefw-esx.zip MD5SUM 90F7BB480FA9A224F449BD000B2F94D0 SHA1SUM C6DFC43E6FE4941C4DB87047B8093FE1C332DB3F 6 SSL VPN Release Notes for version 1.4.0

7 Compatibility Browser and Client OS Compatibility for SSL VPN Administrator, Application Portal, Access Client, and MobileID SSL VPN version administration requires the use of a workstation with a TCP/IP network configured and a Web browser installed. To use the Application Portal, the connecting client must have TCP/IP configured and a Web browser installed. To use tunnel resources, such as client/server TCP/UDP-based applications, the connecting client must have TCP/IP configured and a Web browser compatible with Java or ActiveX technologies installed. To use the Web authentication method, the client must support Java technology to display the clickable webpad. To use the MobileID (Synchronized or Challenge) authentication method the client must have MobileID software installed and seeded. The table below contains the compatibility matrix for the functionalities described above. SSL Web End Application VPN MobileID Access Client Access Client Point Security Portal Administrator (soft tokens) (Windows for (Java Assessment Clients) Clients) Abolishment MAC OS X Java (included in Universal N/A Java (included in Java (included in 10.4/10.5/10.6 MAC OS X) Application MAC OS X) MAC OS X) (assessment only) SUSE Linux Sun JRE 1.4 or Java (bundled) Sun JRE 1.4 or N/A N/A Enterprise Server 10 Red Hat Linux Enterprise Linux 5 Mobile Phone with Any JavaScript N/A N/A MIDP 1.0 or N/A N/A N/A Java Support enabled browser CLDC 1.0 or Pocket PC Smartphone IE Mobile N/A N/A Native N/A N/A N/A BlackBerry RIM BlackBerry N/A N/A MIDP 1.0 or N/A N/A N/A Browser CLDC 1.0 or Palm Sony Ericsson P800/P900 Opera Mini N/A N/A Native N/A N/A N/A iphone Safari 3.x/4,x N/A N/A N/A N/A N/A N/A Android Android Browser N/A N/A N/A N/A N/A N/A 7 SSL VPN Release Notes for version 1.4.0

8 SSL Web End Application VPN MobileID Access Client Access Client Point Security Portal Administrator (soft tokens) (Windows for (Java Assessment Clients) Clients) Abolishment MS Windows XP MS IE 6/7/8 MS IE 6/7/8 Sun JRE 1.5 or Java (bundled) Installable Native Installable Native Sun JRE 1.5 or Home Edition Client Client (SP1,SP2,SP3) ActiveX For web For web ActiveX Professional integration either integration either (SP1,SP2,SP3) MS IE 6/7/8 ActiveX support ActiveX support MS IE 6/7/8 MS Windows is required or a is required or a 2003 browser running browser running Server with Sun JRE 1.4 with Sun JRE 1.4 (SP2) or or MS IE 6/7/8 MS IE 6/7/8 MS Windows MS IE 7/8 MS IE 7/8 Sun JRE 1.5 or Java (bundled) Installable Native Installable Native Sun JRE 1.5 or 2008 Client Client Server 32/64 bit ActiveX For web For web ActiveX (SP2) integration either integration either MS IE 7/8 ActiveX support ActiveX support MS IE 7/8 MS Windows is required or a is required or a Vista browser running browser running Enterprise with Sun JRE 1.4 with Sun JRE /64 bit or or (SP1,SP2) Business MS IE 7/8 MS IE 7/8 32/64 bit (SP1,SP2) Home/Premium 32/64 bit (SP1,SP2) MS Windows 7 MS IE 8 MS IE 8 Sun JRE 1.5 or Java (bundled) Installable Native Installable Native Sun JRE 1.5 or Home/Premium Client Client Professional ActiveX For web For web ActiveX 32/64 bit integration either integration either MS IE 8 ActiveX support ActiveX support MS IE 8 is required or a is required or a browser running browser running with Sun JRE 1.4 with Sun JRE 1.4 or or MS IE 8 MS IE 8 8 SSL VPN Release Notes for version 1.4.0

9 Directory Services User information can be stored in an internal user directory, or one of the following external directory services can be used: Microsoft Active Directory 2003 Novell edirectory OpenLDAP Sun Java System Directory Server Oracle Internet Directory (authentication only) Tivoli Directory Server (authentication only) IBM RACF LDAP (authentication only) NOTE - External directory service is required for mirrored pair configuration. For additional information please refer to the SSL VPN Administrator s Guide. Additionally, when using the Access Client on Windows Vista, the following requirements apply: Requirement Access Client on Microsoft Windows Vista requires administrator rights. ActiveX Client Loader requirements. Drive letter mapping in Windows Vista. Remove AES cipher suites from Access Point configuration. Java Runtime Environment. Details The Access Client requires administrator rights to run properly on Windows Vista. To run the ActiveX Access Client loader successfully with Windows Vista UAC, you must add the Access Point server https address to the list of trusted sites in Internet Explorer. A single drive letter (for example, F :) cannot be used as a startup command in Windows Vista. All commands must be executed using runas to elevate to administrator mode since the mapping is done in administrator mode, and F: is not a valid executable. Use the following startup command instead: explorer /root, F: This works on both Windows XP and Windows Vista. The AES ciphers in Vista are not compatible with the SSL engine used in Access Point. You must remove the AES ciphers from Cipher Suites for your Access Point under Manage Global Access Point Settings. Remove the following ciphers: RSA_AES_128_CBC_SHA and RSA_AES_256_CBC_SHA. To run the PortWise Java Access Client, use Sun Java 1.6 Update 2 or. 9 SSL VPN Release Notes for version 1.4.0

10 Upgrade Instructions When upgrading mirrored systems, see the upgrade instructions in the SSL VPN Administrator's Guide, which is available from It is recommended to publish the configuration after a successful upgrade. Upgrade from previous version Upgrading the SSL VPN from to is normally done through the Web Console or Management Center Remote Upgrade functionality. After upgrade, log on to the SSL VPN Administrator interface and publish the updated configuration. Upgrade from version or prior versions If upgrading the SSL VPN from version or prior versions to version 1.4.0, you must first upgrade to version then to move to version as a step. To upgrade to SSL VPN version to 1.3.2, please refer to the appropriate Release Notes. NOTE Starting from version 1.4.0, using SSL VPN with Management Center requires a valid SSL VPN 1.4 license to be imported in Management Center. SSL VPN and higher physical appliance nodes consume 1 node count on SMC when managed by Management Center. SSL VPN Virtual Appliances do not consume any node count since the license includes an SMC count factor. For additional information about SSL VPN Licensing, please refer to the Stonesoft Price List. 10 SSL VPN Release Notes for version 1.4.0

11 Known Issues The current known issues of SSL VPN v1.4.0 are described in the table below. For an updated list of known issues, consult our Web site at Synopsis Description Workaround SSL VPN Breaks Browser Domain- Based Security Model - Refs:CVE , CERT VU# (#55542) In mirrored configuration, OATH database must be configured as an external db. (#50490) WINS Forwarding in Tunnel Set does not work. (#33675) Client Firewall does not work on Windows Vista clients (#40657) Configuring Directory Service as MS AD setting RootDN with a container class object is not accepted.(#50034) Use of IP pool address with Active FTP does not work on a Vista system. (#50028) SSL VPN breaks the browser domainbased security model. The vulnerability lies in the architecture of the SSL VPN solution. As a result of the vulnerability, all resources under a single SSL VPN domain may potentially steal or modify each other's active web content, such as web cookies. In a mirrored configuration with OATH activated, adding secondary Authentication Service causes the following error message: "To validate if OATH is used on the configured Authentication Service-node (i.e. tokens are imported), it has to be started. A system with more than one Authentication Service-node cannot use a local database; it would result in data inconsistency." Even if configuration of WINS forwarding is allowed in the Administration Service, the settings are not applied. When a Client Firewall is configured for a resource, the Access Client stops working on Windows Vista. This is a Microsoft Active Directory-specific problem. Organizational Unit is not an allowed child object of the class "containers" within the Active Directory default schema. "ou=accounts,..." is an Organizational Unit. Hence "ou=accounts" can't be added to "cn=users,..." since "cn=users,..." is a container (objectclass=container,objectcategory="cn=cont ainer,cn=schema,cn=configuration,..." RootDN should start with an Organizational Unit ( OU="...",... ). Using an SSL VPN resource for active FTP with an IP Address Pool from a Windows Vista machine fails when the server starts the transfer. The problem is caused by the IP address used in the PORT command, which is not the same IP address assigned from the IP pool. Recommended Actions: SSL VPN administrators should deploy only trusted resources to the SSL VPN portal. Resources with significantly different security zones, such as resources hosted by different companies, should be deployed using Pooled DNS Mapping or Reserved DNS Mapping. Untrusted resources should not be deployed to the SSL VPN portal at all. If these types of resources are needed, they should be deployed as External Sites so that the SSL VPN portal gives a direct link to the resource, instead of making the client to route the traffic to the resource through the SSL VPN portal. Please consult the SSL VPN Administrator's Guide for further information about deploying the Pooled DNS Mapping, Reserved DNS Mapping or defining External Sites. Configure OATH in SSL VPN Administrator (Manage System - OATH Configuration - Database Connection) to point to an external URL (for example: jdbc:hsqldb:hsql:// :9001/:shutdown=tru e ) Alternatively, you can disable OATH in the Web Console. None. Add the following three "Outgoing" rules for the Client Firewall: W.X.Y.Z-W.X.Y.Z 443 TCP Any Accept TCP Any Accept UDP Any Accept Where W.X.Y.Z is the IP address of your access point. If using multiple APs, add a corresponding rule for each. In the SSL VPN Administration interface, configure RootDN to set Organizational Unit as not part of a container. For example, OU=Accounts,DC=DOMAIN,DC=COM or OU=Accounts,OU=SSLVPN,DC=DOMAIN,DC=C OM Use passive FTP or an FTP program that allows setting the client IP address to be used for the PORT command. 11 SSL VPN Release Notes for version 1.4.0

12 Web Console used through Application Portal: switching to mirror mode does not generate mirror.conf file for replication. (#47252) Support for special characters is not complete When the Web Console is accessed through the Application Portal, switching to mirror mode does not generate the mirror.conf file needed for replication. There have been some minor issues when using special characters in paths. Perform the "Switching to mirror mode" operation from a direct connection to the Web Console and not through the Application Portal. Contact Stonesoft Support if problems occur. 12 SSL VPN Release Notes for version 1.4.0

13 Copyright and Disclaimer Stonesoft Corporation. All rights reserved. These materials, Stonesoft products, and related documentation are protected by copyright and other laws, international treaties and conventions. All rights, title and interest in the materials, Stonesoft products and related documentation shall remain with Stonesoft and its licensors. All registered or unregistered trademarks in these materials are the sole property of their respective owners. No part of this document or related Stonesoft products may be reproduced in any form, or by any means without written authorization of Stonesoft Corporation. Stonesoft provides these materials for informational purposes only. They are subject to change without notice and do not represent a commitment on the part of Stonesoft. Stonesoft assumes no liability for any errors or inaccuracies that may appear in these materials or for incompatibility between different hardware components, required BIOS settings, NIC drivers, or any NIC configuration issues. Use these materials at your own risk. Stonesoft does not warrant or endorse any third party products described herein. THESE MATERIALS ARE PROVIDED "AS-IS." STONESOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, AS TO, THE INFORMATION CONTAINED HEREIN. IN ADDITION, STONESOFT MAKES NO EXPRESS OR IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE OR USE WITH RESPECT THE INFORMATION CONTAINED IN THESE MATERIALS. IN NO EVENT SHALL STONESOFT BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL OR INCIDENTAL DAMAGES, INCLUDING, BUT NOT LIMITED TO, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING FROM THE USE OF THESE MATERIALS, EVEN IF ADVISED IN ADVANCE OF THE POSSIBILITY OF SUCH DAMAGES. Trademarks and Patents Stonesoft, the Stonesoft logo and are all trademarks or registered trademarks of Stonesoft Corporation. Multi-Link technology, Multi-Link VPN, and the clustering technology-as well as other technologies included in are protected by patents or pending patent applications in the U.S. and other countries. All other trademarks or registered trademarks are property of their respective owners. Stonesoft Corporation Itälahdenkatu 22A FI Helsinki Finland Tel Fax Stonesoft Inc Crown Pointe Parkway Suite 900 Atlanta, GA USA Tel Fax Copyright 2010 Stonesoft Corporation. All rights reserved. All specifications are subject to change.