StoneGate SSL VPN. Release Notes for Version 1.5.0

Transcription

1 StoneGate SSL VPN Release Notes for Version Created: August 10, 2011

2 Table of Contents What s New... 3 Enhancements... 3 Fixes... 3 System Requirements... 4 StoneGate Appliances... 4 Build Version... 4 Product Binary Checksums... 4 Compatibility... 5 Browser and Client OS Compatibility... 5 Directory Services... 5 Upgrade Instructions... 6 Upgrade from Previous Version... 6 Upgrade from prior Versions... 6 Known Issues... 7

3 What s New Enhancements The enhancements introduced in StoneGate SSL VPN version are described in the table below. The following table lists the features briefly. Please consult the product documentation for more details. Feature New Access Client for Windows Description The Access Client has been completely rewritten to ensure compatibility with Windows 7 SP1 in 32 and 64 bit mode, as well as with previous Windows version. The icon to identity this new Access Client version in OS's System Tray has been changed also, branded with StoneGate logo. Fixes Problems described in the table below have been fixed since StoneGate SSL VPN version A workaround solution is presented for earlier versions where available. Synopsis Web Console used through Application Portal: switching to mirror mode does not generate mirror.conf file for replication (#47252) Standard Resource configuration for Outlook Web Access 2010 does not work correctly (#53679) Windows 7 32 and 64 bit with SP1 freeze when client application accesses dynamic tunnel set (#67923) LDAP browsing helpers into Administration Service Web client is bound to a fixed port. (#46746) Switching from single node to mirror mode does not generate the mirror.conf file needed for replication. (#47252) Access rules are not applied to Single Sign On domains. (#52012) SSL VPN gateway may freeze if Virtual IP is used in tunnel set. (#57968) Error "array index out of range" appears when saving an Access Rule containing AD Groups. (#64845) Description When the Web Console is accessed through the Application Portal, switching to mirror mode does not generate the mirror.conf file needed for replication. Standard Resources configured using the wizard for MS Outlook Web Access 2007 do not work correctly with MS Outlook Web Access 2010 because some required cookies are missing from the default configuration. If the user has Service Pack 1 installed, Windows 7 32 and 64 bit freeze when a client application tries to access a dynamic tunnel set. When configuring User Storage in SSL VPN Administrator, if the user specifies a port different than 389 for LDAP the user browse operation to select search rules DN does not work. When the Web Console is accessed through the Application Portal, switching to mirror mode does not generate the mirror.conf file needed for replication. Access rules are not affecting Single Sign On (SSO) domains. If complex tunnel set are configured, containing "reverse tunnels to the client", Access Point may freeze. If an Access Rule based on group membership contains AD Groups, an error "Array index out of range" may appear during Save operation. Workaround for previous versions Switch to mirror mode through a direct connection to the Web Console and not through the Application Portal. In the Web Resource Advanced Settings, insert the following list of Cookies to check: UserContext,sessionid,cadata, PBack,OutlookSession,logond ata,cookietest,owacsdc,asp. NET_SessionId,msExchEcpC anary,ecpcookietest,tzid,ecp UpdatedUserSettings,MstrPgL d1,mstrpgld2 Configure static tunnel sets, and enable the usage of the Pure Java Access Client in tunnel set advanced settings tab. None. Perform the switch to mirror mode through a direct connection to the Web Console and not through the Application Portal. Apply the Access Rules only on the resource, leaving "Any Authentication" access rule to protect SSO domain. Disable "Provide IP" option in advanced tunnel set configuraton. Avoid using "User Storage" group membership based access rules. 3 StoneGate SSL VPN Release Notes for version 1.5.0

4 Device Definition to detect Windows Vista or Windows 7 is missing from default definitions. (#64873) It is not possible to access XPI services as a web page. (#65506) Cannot change Admin password from Web Console (#67187) mgmtd daemon uses 98% CPU (#69490) Network Access Control (nac) driver crash when IP Address Pool configured. (#69764) Certificate: PrincipalName not recognized if there are other othername subjectalname attributes in certificate. (#69923) Due to a missing entry in Manage System -> Device Definitions -> Windows, Access rules based on device definitions do not correctly detect Windows Vista or Windows 7 platforms. Trying to access XPI Web Services in SSL VPN, configured as web resource, returns blank page. In a fresh SSL VPN installation, it is not possible to change Admin password from Web Console In some cases, mgmtd daemon can utilize almost 100% CPU, causing slow down of the system to unacceptable level. Under some circumstances, configuration of IP Address Pool causes the NAC driver to crash. Using digital certificate based authentication, PrincipalName not recognized if there are other othername subjectalname attributes in certificate. 1. In Manage System -> Device Definition, select Windows and add to the end of the list the entry: user-agent=*windows nt 6* 2. Click Save and Publish. None. None. Reboot the system when this situation appears. None. Use another attribute to identify username in digital certificate based authentication. System Requirements StoneGate Appliances StoneGate SSL VPN version is supported on all StoneGate SSL VPN appliances and on StoneGate SSL VPN Virtual Appliances. Build Version The StoneGate SSL VPN version build version is Product Binary Checksums sslgw_engine_ _i386.zip MD5SUM d6b0da4fc3c559c64e4169cbbb586de7 SHA1SUM b9e5b7d0a7b0d56db849dd0b23a2c1389df09a49 sslgw_engine_ _vmwarefw-esx.zip md5sum ec30d473e207e129148cc51f70fa1d44 SHA1SUM 793b796e7ecd50d68958c1b93423d03b1f75736d 4 StoneGate SSL VPN Release Notes for version 1.5.0

5 Compatibility Browser and Client OS Compatibility StoneGate SSL VPN version administration requires the use of a workstation with a TCP/IP network configured and a Web browser installed. To use the Application Portal, the connecting client must have TCP/IP configured and a Web browser installed. To use Tunnel Resources, such as client/server TCP/UDP-based applications, the connecting client must have TCP/IP configured and a Web browser compatible with Java or ActiveX technologies installed. To use the StoneGate Web authentication method, the client must support Java technology to display the clickable webpad. To use the StoneGate MobileID (Synchronized or Challenge) authentication method, the client must have MobileID software installed and seeded. For the full platform compatibility matrix for the functionalities described above, please see Technical Note Directory Services User information can be stored in an internal user directory, or one of the following external directory services can be used: Microsoft Active Directory 2003 Microsoft Active Directory 2008 Novell edirectory OpenLDAP Sun Java System Directory Server Oracle Internet Directory (authentication only) Tivoli Directory Server (authentication only) IBM RACF LDAP (authentication only) OpenDS 2.x NOTE An external directory service is required for a mirrored pair configuration. For additional information, please refer to the StoneGate SSL VPN Administrator s Guide. Additionally, when using the Access Client on Windows Vista or Windows 7, the following requirements apply: Requirement Access Client on Microsoft Windows Vista requires administrator rights StoneGate ActiveX Client Loader requirements Details The Access Client requires administrator rights to run properly on Windows Vista and Windows 7 the first time it is installed. It auto-upgrades afterwards. To run the ActiveX Access Client loader successfully with Windows Vista UAC, you must add the Access Point server HTTPS address to the list of trusted sites in Internet Explorer. 5 StoneGate SSL VPN Release Notes for version 1.5.0

6 Requirement Drive letter mapping in Windows Vista Java Runtime Environment Details A single drive letter (for example, F :) cannot be used as a startup command in Windows Vista and Windows 7. All commands must be executed using runas to elevate to administrator mode since the mapping is done in administrator mode, and F: is not a valid executable. Use the following startup command instead: explorer /root, F: This works on both Windows XP and Windows Vista/Windows 7. To run the Stonesoft Java Access Client, use Sun Java 1.6 Update 2 or later. Upgrade Instructions When upgrading mirrored systems, see the upgrade instructions in the SSL VPN Administrator's Guide, which is available from It is recommended to publish the configuration after a successful upgrade. Upgrade from Previous Version StoneGate SSL VPN is upgraded from to through the Web Console or using the Remote Upgrade functionality in the StoneGate Management Center. After the upgrade, log in to the StoneGate SSL VPN Administrator interface and publish the updated configuration if the Publish button is highlighted. Upgrade from prior Versions StoneGate SSL VPN is upgraded from 1.4.x to through the Web Console or using the Remote Upgrade functionality in the StoneGate Management Center. After the upgrade, log in to the StoneGate SSL VPN Administrator interface and publish the updated configuration if the Publish button is highlighted. Direct upgrade from other versions to StoneGate SSL VPN has not been tested although it may work. NOTE Starting from version 1.4.0, using StoneGate SSL VPN with the StoneGate Management Center requires a valid SSL VPN 1.4 license to be imported in the StoneGate Management Center. A StoneGate SSL VPN engine version or higher is counted as one unit in the StoneGate Management Center when the SSL VPN engine is managed by the StoneGate Management Center. Virtual StoneGate SSL VPN appliances are not counted as managed units in the StoneGate Management Center. For additional information on StoneGate SSL VPN licensing, please refer to the Stonesoft Price List. 6 StoneGate SSL VPN Release Notes for version 1.5.0

7 Known Issues The current known issues of StoneGate SSL VPN v1.5.0 are described in the table below. For an updated list of known issues, consult our Web site at Synopsis Description Workaround StoneGate SSL VPN Breaks Browser Domain- Based Security Model - Refs:CVE , CERT VU# (#55542) In a mirrored configuration, OATH database must be configured as an external database (#50490) Client Firewall does not work on Windows Vista clients (#40657) Configuring Directory Service as Microsoft Active Directory and setting RootDN with a container class object is not accepted (#50034) Use of IP pool address with Active FTP does not work on a Vista system (#50028) Support for special characters is not complete StoneGate SSL VPN breaks the browser domainbased security model. The vulnerability lies in the architecture of the SSL VPN solution. As a result of the vulnerability, all resources under a single SSL VPN domain may potentially steal or modify each other's active web content, such as web cookies. In a mirrored configuration with OATH activated, adding a secondary Authentication Service causes the following error message: "To validate if OATH is used on the configured Authentication Service-node (i.e. tokens are imported), it has to be started. A system with more than one Authentication Service-node cannot use a local database; it would result in data inconsistency." When a Client Firewall is configured for a resource, the Access Client stops working on Windows Vista. This is a Microsoft Active Directory specific problem. An Organizational Unit is not an allowed child object of the class "containers" within the Active Directory default schema. "ou=accounts,..." is an Organizational Unit. Hence "ou=accounts" cannot be added to "cn=users,..." since "cn=users,..." is a container (objectclass=container,objectcategory="cn=containe r,cn=schema,cn=configuration,..." RootDN should start with an Organizational Unit (OU="...",... ). Using an SSL VPN resource for active FTP with an IP address pool from a Windows Vista machine fails when the server starts the transfer. The problem is caused by the IP address used in the PORT command, which is not the same as the IP address assigned from the IP address pool. There have been some minor issues when using special characters in paths. Recommended Actions: Deploy only trusted resources to the SSL VPN portal. Resources with significantly different security zones, such as resources hosted by different companies, should be deployed using Pooled DNS Mapping or Reserved DNS Mapping. Untrusted resources should not be deployed to the SSL VPN portal at all. If these types of resources are needed, they should be deployed as External Sites so that the SSL VPN portal gives a direct link to the resource, instead of making the client route the traffic to the resource through the SSL VPN portal. Please consult the StoneGate SSL VPN Administrator's Guide for further information about deploying Pooled DNS Mapping, Reserved DNS Mapping, or defining External Sites. Configure OATH in the SSL VPN Administrator (through Manage System - OATH Configuration - Database Connection) to point to an external URL (for example: jdbc:hsqldb:hsql:// :9001/:shutdown=tru e) Alternatively, you can disable OATH in the Web Console. Add the following three "Outgoing" rules for the Client Firewall: W.X.Y.Z-W.X.Y.Z 443 TCP Any Accept TCP Any Accept UDP Any Accept where W.X.Y.Z is the IP address of your access point. If using multiple access points, add a corresponding rule for each. In the SSL VPN Administration interface, configure RootDN to set the Organizational Unit as not part of a container. For example, OU=Accounts,DC=DOMAIN,DC=COM or OU=Accounts,OU=SSLVPN,DC=DOMAIN,DC=C OM Use passive FTP or an FTP program that allows setting the client IP address to be used for the PORT command. Contact Stonesoft Support if problems occur. 7 StoneGate SSL VPN Release Notes for version 1.5.0

8 Copyright and Disclaimer Stonesoft Corporation. All rights reserved. These materials, Stonesoft products, and related documentation are protected by copyright and other laws, international treaties and conventions. All rights, title and interest in the materials, Stonesoft products and related documentation shall remain with Stonesoft and its licensors. All registered or unregistered trademarks in these materials are the sole property of their respective owners. No part of this document or related Stonesoft products may be reproduced in any form, or by any means without written authorization of Stonesoft Corporation. Stonesoft provides these materials for informational purposes only. They are subject to change without notice and do not represent a commitment on the part of Stonesoft. Stonesoft assumes no liability for any errors or inaccuracies that may appear in these materials or for incompatibility between different hardware components, required BIOS settings, NIC drivers, or any NIC configuration issues. Use these materials at your own risk. Stonesoft does not warrant or endorse any third party products described herein. THESE MATERIALS ARE PROVIDED "AS-IS." STONESOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, AS TO, THE INFORMATION CONTAINED HEREIN. IN ADDITION, STONESOFT MAKES NO EXPRESS OR IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE OR USE WITH RESPECT THE INFORMATION CONTAINED IN THESE MATERIALS. IN NO EVENT SHALL STONESOFT BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL OR INCIDENTAL DAMAGES, INCLUDING, BUT NOT LIMITED TO, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING FROM THE USE OF THESE MATERIALS, EVEN IF ADVISED IN ADVANCE OF THE POSSIBILITY OF SUCH DAMAGES. Trademarks and Patents Stonesoft, the Stonesoft logo and StoneGate are all trademarks or registered trademarks of Stonesoft Corporation. Multi-Link technology, Multi-Link VPN, and the StoneGate clustering technology-as well as other technologies included in StoneGateare protected by patents or pending patent applications in the U.S. and other countries. All other trademarks or registered trademarks are property of their respective owners. Stonesoft Corporation Itälahdenkatu 22A FI Helsinki Finland Tel Fax Stonesoft Inc Crown Pointe Parkway Suite 900 Atlanta, GA USA Tel Fax Copyright 2011 Stonesoft Corporation. All rights reserved. All specifications are subject to change.