StoneGate Firewall/VPN 2.5 TECHNICAL NOTE. Server Pool Monitoring Agent Protocol

Transcription

1 StoneGate Firewall/VPN 2.5 TECHNICAL NOTE Server Pool Monitoring Agent Protocol

2 Protocol Description This document describes the Server Pool Monitoring Agent Protocol that is used for communications between StoneGate firewalls and the server pool monitoring agents. The monitoring agent uses the port 7777/UDP by default. An example implementation of the monitoring agent is provided in Appendix: Example Code, on page 7. For more information on server pool monitoring agents and their use, please see the StoneGate Administrator s Reference. Message Header Four-letter ASCII codes represent the protocol message types and message codes. All numeric fields are in network byte order (most significant byte first). The term byte refers to an 8-bit octet. Hexadecimal values are indicated with a leading 0x. The header of the protocol message is illustrated in Figure 1.1. FIGURE 1.1 Message Header of the Monitoring Agent Protocol Bytes 0-3 Bytes 4-7 Bytes 8-11 Bytes 12- Monitoring agent protocol preamble: MATS (0x4d415453) Protocol version: 0x Message identifier: HELO PRTO STTS GETI INFO Message data The current version of the monitoring agent protocol is 1 (0x ). The message identifiers can differ in later versions of the protocol. The message types and message data fields for this version of the protocol are described below: Protocol (PRTO) Message, on page 2 Hello (HELO) Message, on page 3 Status (STTS) Message, on page 3 GetInfo (GETI) Message, on page 4 Information (INFO) Message, on page 4. Optionally, some messages may contain log entries. The syntax is described in: Log Entry Fields, on page 5. Protocol (PRTO) Message The Protocol message (PRTO) is used to query and inform the supported protocol versions. The identifier for this message is PRTO in ASCII (0x f). When StoneGate sends a PRTO message to a monitoring agent, the agent responds with a PRTO message. TECHNICAL NOTE 2

3 FIGURE 1.4 STTS Message In a PRTO message, the protocol version field in the header identifies the highest supported protocol version. FIGURE 1.2 PRTO Message Bytes 0-11 (Header) MATS 0001 PRTO The PRTO message contains no data. Hello (HELO) Message The Hello message (HELO) is used to query the status of a server. The identifier for this message is HELO in ASCII (0x48454v4f). When StoneGate sends a HELO message to a monitoring agent, the agent responds with a STTS message. FIGURE 1.3 HELO Message Bytes 0-11 (Header) Bytes Bytes MATS 0001 HELO Query identifier Acknowledged log entry Query identifier is used to match the query and the corresponding response. Acknowledged log entry indicates the identifier of the last log entry received from the agent. The agent sends unacknowledged messages repeatedly until it receives an acknowledgement. All messages with a smaller identifier than the acknowledged log entry are considered acknowledged as well. Status (STTS) Message The Status message is a response to a HELO query. The identifier for this message is STTS in ASCII (0x ). When a monitoring agent receives a HELO message from StoneGate, the agent responds with a STTS message. Bytes 0-11 (Header) Bytes Bytes Bytes Bytes Bytes 28- MATS 0001 STTS Query identifier Server load Server status: OKAY FAIL FATL Number of log entries Query identifier is used to match the query and the corresponding response. Log entries TECHNICAL NOTE 3

4 Server load gives a numerical value of the current processing load on this server pool member. This load measurement is defined in the agent s load-index setting. Server status indicates whether the server is operating normally. OKAY (0x4f4b4159): The server operates normally. This status is displayed as OK in the GUI. FAIL (0x c): A test has failed. No new connections are assigned to this server. This status is displayed as Suspended in GUI. FATL (0x c): A fatal test failure has occurred. No traffic is forwarded to this server. This status is displayed as Excluded in the GUI. Number of log entries indicates the log entry count in the message. Log entries relayed through to the monitoring agent for logging. The syntax is explained in Log Entry Fields, on page 5. GetInfo (GETI) Message The GetInfo message (GETI) can be used to query information about the server pool member. The identifier for this message is GETI in ASCII (0x ). When StoneGate sends a GETI message to a monitoring agent, the agent responds with an INFO message. FIGURE 1.5 GETI Message Bytes 0-11 (Header) Bytes MATS 0001 GETI Query identifier is used to match the query and the corresponding response. Information (INFO) Message The Information message (INFO) returns information about the server pool member. The identifier for this message is INFO in ASCII (0x494e464f). When a monitoring agent receives a GETI message from StoneGate, the agent responds with an INFO message. FIGURE 1.6 INFO Message Query identifier Bytes 0-11 (Header) Bytes Bytes Bytes 20- MATS 0001 INFO Query identifier Number of log entries Log entries Query identifier is used to match the query and the corresponding response. Number of log entries indicates the log entry count in the message. Log entries are relayed through to the monitoring agent for logging. The syntax is explained in Log Entry Fields, on page 5. TECHNICAL NOTE 4

5 FIGURE 1.7 Log Entry Fields Log Entry Fields The log entry fields can be used to relay any textual information through the monitoring agent for logging. One message can have multiple log entries one after another. Each log field begins at a four-byte boundary counted from the beginning of the protocol message header. Each field is padded with zeroes if the next field did not begin at a suitable offset. Bytes 0-3 Bytes 4-7 Bytes 8-11 Bytes Bytes Bytes 20- Log entry length Log entry identifier Log entry type Timestamp (reserved): 0x Log message text Log entry length indicates the log message text length in bytes. Log entry identifier is used for acknowledgement by StoneGate. The agent starts from 1 and increments the identifier consecutively for each generated log entry. Log entry type indicates the type of the log message as listed in Table 1.1. Timestamp is a standard UNIX timestamp for the log entry (seconds since :00). Log message text contains the actual log message. The Log entry types are listed in Table 1.1. Note that the logging level byte values 0x00 0x08 are represented as 0 8 in ASCII. TABLE 1.1 Log Field Types ASCII Byte Representation Hexadecimal Value Description x Generic type VERS 0x Version information message that is used in a response to GETI message. LOG0 0x4c4f4700 Alert level log message LOG1 0x4c4f4701 Critical level log message LOG2 0x4c4f4702 Error level log message LOG3 0x4c4f4703 Warning level log message LOG4 0x4c4f4704 Notice level log message LOG5 0x4c4f4705 Information level log message LOG6 0x4c4f4706 Debug level 1 log message TECHNICAL NOTE 5

6 TABLE 1.1 Log Field Types (Continued) ASCII Byte Representation Hexadecimal Value Description LOG7 0x4c4f4707 Debug level 2 log message LOG8 0x4c4f4708 Debug level 3 log message TECHNICAL NOTE 6

7 Appendix: Example Code /* StoneGate Monitoring Agent open source version Copyright (c) Stonesoft Corp. All rights reserved. Permission to use, copy, modify, and distribute this source code for any purpose and without fee is hereby granted, provided that this copyright and permission notice appear on all copies of the software and supporting documentation, the name of Stonesoft Corp. ("Stonesoft") may not be used in advertising or publicity pertaining to distribution of the subject program without specific prior permission, and notice be given in any supporting documentation that modification, copying and distribution is by permission of Stonesoft only. Stonesoft makes no representations about the suitability of this software for any purpose. THIS SOFTWARE IS PROVIDED `AS IS' AND WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. /* Compiling the StoneGate Monitoring Agent open source version This software has been written for UNIX platforms. To compile it on another type of platform, some changes may be required. Linking requires E.g. to compile with Gcc: gcc -Wall -o osagent osagent.c #include <netinet/in.h> #include <stdio.h> #include <unistd.h> #include <fcntl.h> #include <sys/types.h> #include <sys/socket.h> #include <string.h> #include <errno.h> #include <time.h> #include <arpa/inet.h> #if defined linux # include <sys/types.h> # ifndef U_INT32_T_DEFINED # define U_INT32_T_DEFINED # endif # ifndef U_INT16_T_DEFINED # define U_INT16_T_DEFINED # endif TECHNICAL NOTE 7

8 #elif defined _WIN32 # ifndef U_INT32_T_DEFINED typedef unsigned int32 u_int32_t; # define U_INT32_T_DEFINED # endif # ifndef U_INT16_T_DEFINED typedef unsigned int16 u_int16_t; # define U_INT16_T_DEFINED # endif #else # ifndef U_INT32_T_DEFINED typedef unsigned int u_int32_t; # define U_INT32_T_DEFINED # endif # ifndef U_INT16_T_DEFINED typedef unsigned short u_int16_t; # define U_INT16_T_DEFINED # endif #endif /* The supported agent protocol #define AGENT_PROTOCOL 1 /* Maximum number of bytes in a message #define AGENT_MSGSIZE_MAX 2048 /* The default port for communication #define AGENT_PORT 7777 /* Protocol identifier #define AGENT_MSGMAGIC 0x4d /* (MATS) /* Message types #define AGENT_MSG_HELO 0x48454c4f /* Query message (HELO) #define AGENT_MSG_STATUS 0x /* Status message (STTS) #define AGENT_MSG_GETINFO 0x /* Info request message (GETI) #define AGENT_MSG_INFO 0x494e464f /* Info message (INFO) #define AGENT_MSG_PROTO 0x f /* Protocol version message (PRTO) /* Header for all protocol versions and messages struct agent_msgheader { u_int32_t magic; /* Must be htonl(agent_msgmagic) to be a valid message u_int32_t protocol; /* Protocol version identifier u_int32_t msg; /* AGENT_MSG_HELO etc. ; /* Protocol version 1 TECHNICAL NOTE 8

9 These are structures that the messages can be cast into when the protocol and message type are known /* Status values #define AGENT_STATUS_OK 0x4f4b4159 #define AGENT_STATUS_SUSPENDED 0x c #define AGENT_STATUS_EXCLUDED 0x c /* HELO struct agent_msg_helo { struct agent_msgheader hdr; u_int32_t queryid; /* A unique identifier for this query. u_int32_t text_message_ack; /* The Id of the last received log message. ; /* Text message types #define TEXTMSG_GENERIC 0x /* No type #define TEXTMSG_VERSIONINFO 0x /* (VERS) #define TEXTMSG_LOG_ALERT 0x4c4f4700 /* (LOG0) #define TEXTMSG_LOG_CRITICAL 0x4c4f4701 /* (LOG1) #define TEXTMSG_LOG_ERROR 0x4c4f4702 /* (.. ) #define TEXTMSG_LOG_WARNING 0x4c4f4703 #define TEXTMSG_LOG_NOTICE 0x4c4f4704 #define TEXTMSG_LOG_INFO 0x4c4f4705 #define TEXTMSG_LOG_DEBUG1 0x4c4f4706 #define TEXTMSG_LOG_DEBUG2 0x4c4f4707 #define TEXTMSG_LOG_DEBUG3 0x4c4f4708 /* If there are text messages, each will have a header like this struct agent_msg_textfield { u_int32_t length; /* Lenght of the text (excluding other fields) u_int32_t id; /* Id for this message to recognize duplicates Ids are consecutive numbers for consecutive messages. Zero is not a valid Id. u_int32_t type; /* The text message type, TEXTMSG_... u_int32_t time_lo;/* Time representation, seconds since epoch u_int32_t time_hi; char text[0]; ; /* STATUS struct agent_msg_status { struct agent_msgheader hdr; u_int32_t queryid; u_int32_t load; u_int32_t status; /* AGENT_STATUS_OK etc. u_int32_t text_messages; /* The number of text messages appended to TECHNICAL NOTE 9

10 ; this message (aligned to four byte borders) char text_fields[0]; /* actually struct agent_msg_textfield... /* GETINFO struct agent_msg_getinfo { struct agent_msgheader hdr; u_int32_t queryid; ; /* INFO struct agent_msg_info { struct agent_msgheader hdr; u_int32_t queryid; u_int32_t text_messages; /* The number of text messages appended to this message (aligned to four byte borders) char text_fields[0]; /* actually struct agent_msg_textfield... ; /* PROTO struct agent_msg_proto { struct agent_msgheader hdr; ; /* Error codes #define AGENT_MSGERR_OK 0 #define AGENT_MSGERR_INVALID -1 /* Invalid message #define AGENT_MSGERR_NOMEM -2 /* Not enough memory #define AGENT_MSGERR_TOOSMALL -3 /* The buffer suplied is too small #define AGENT_MSGERR_OUTOFBOUNDS -4 /* An index was out of bounds /* The align4 function returns a a value aligned to a four byte border. val The value to align Return value: If val is divisible by for, val. val incremented to a value divisible by four otherwise. static int align4( int val if ((val % 4) == 0 return (val); else { return (val + (4 - (val % 4))); TECHNICAL NOTE 10

11 /* The agent_msg_check function checks that a message is valid msg A pointer to the message Return value: 0 if the message is valid a negative errorcode otherwise int agent_msg_check( char *msg struct agent_msgheader *hdr; hdr = (struct agent_msgheader *)msg; if ( ntohl(hdr->magic)!= AGENT_MSGMAGIC ntohl(hdr->protocol) < 1 ( ntohl(hdr->protocol) > AGENT_PROTOCOL && ntohl(hdr->msg)!= AGENT_MSG_PROTO ) return (AGENT_MSGERR_INVALID); return (0); /* The agent_statusmsg_create function creates a status message into a buffer supplied by the caller. All arguments in host byte order. buf The buffer for the message size Size of the buffer queryid Queryid field in host byte order load load field in host byte order status status field in host byte order. Return value: 0 in case of success. int agent_statusmsg_create( char *buf, int size, u_int32_t queryid, u_int32_t load, TECHNICAL NOTE 11

12 u_int32_t status struct agent_msg_status *statusmsg = (struct agent_msg_status *)buf; if (size < sizeof(struct agent_msg_status) return (AGENT_MSGERR_TOOSMALL); statusmsg->hdr.magic = htonl(agent_msgmagic); statusmsg->hdr.protocol = htonl(agent_protocol); statusmsg->hdr.msg = htonl(agent_msg_status); statusmsg->queryid = htonl(queryid); statusmsg->load = htonl(load); statusmsg->status = htonl(status); statusmsg->text_messages = 0; return (0); /* The agent_msg_appendtext function appends a text message to the end of a message. All arguments in host byte order. buf A pointer to the buffer of the status message. size The size of the buffer (including the message). msg The message to append. msgsize The size of the message msgid The id of the message to append in host byte order. type The type of the message in host byte order time_lo The low time field in host byte order. time_hi The high time field in host byte order. Return value: 0 in case of success, a negative error code otherwise. int agent_msg_appendtext( char *buf, int size, char *msg, int msgsize, u_int32_t msgid, u_int32_t type, u_int32_t time_lo, u_int32_t time_hi struct agent_msgheader *hdr = (struct agent_msgheader *) buf; struct agent_msg_status *status = (struct agent_msg_status *)buf; struct agent_msg_info *info = (struct agent_msg_info *) buf; u_int32_t *text_messages; struct agent_msg_textfield *field; int i; TECHNICAL NOTE 12

13 if (0!= agent_msg_check(buf) return (AGENT_MSGERR_INVALID); if (ntohl(hdr->msg) == AGENT_MSG_STATUS field = (struct agent_msg_textfield *)&status->text_fields[0]; text_messages = &status->text_messages; else if (ntohl(hdr->msg) == AGENT_MSG_INFO field = (struct agent_msg_textfield *)&info->text_fields[0]; text_messages = &info->text_messages; else { return (AGENT_MSGERR_INVALID); for (i = 0; i < (int)ntohl(*text_messages); i++ field = (struct agent_msg_textfield *)( (char *)field + sizeof(struct agent_msg_textfield) + align4(ntohl(field->length)) ); /* Check for size if ( ( ((char *)field - (char *)buf) + (int)sizeof(struct agent_msg_textfield) + align4(msgsize) ) > size return (AGENT_MSGERR_TOOSMALL); *text_messages = htonl(ntohl(*text_messages) + 1); field->length = htonl(msgsize); field->id = htonl(msgid); field->type = htonl(type); field->time_lo = htonl(time_lo); field->time_hi = htonl(time_hi); memcpy(field->text, msg, msgsize); /* Fill the alignment bytes for (i = 0; i < msgsize % 4; i++ field->text[msgsize + i] = 0; return (0); /* The agent_msg_size function calculates the size of a message TECHNICAL NOTE 13

14 msg A pointer to the message buffer Return value: The number of bytes in the message. int agent_msg_size( char *msg struct agent_msgheader *hdr = (struct agent_msgheader *) msg; struct agent_msg_status *status = (struct agent_msg_status *) msg; struct agent_msg_info *info = (struct agent_msg_info *) msg; struct agent_msg_textfield *field; u_int32_t *text_messages; int i; int size = 0; if (0!= agent_msg_check(msg) return (0); switch (ntohl(hdr->msg) /* The simple cases case AGENT_MSG_HELO: return (sizeof(struct agent_msg_helo)); case AGENT_MSG_GETINFO: return (sizeof(struct agent_msg_getinfo)); case AGENT_MSG_PROTO: return (sizeof(struct agent_msg_proto)); /* The rest may have text fields case AGENT_MSG_STATUS: size = sizeof(struct agent_msg_status); field = (struct agent_msg_textfield *)&status->text_fields[0]; text_messages = &status->text_messages; break; case AGENT_MSG_INFO: size = sizeof(struct agent_msg_info); field = (struct agent_msg_textfield *)&info->text_fields[0]; text_messages = &info->text_messages; break; default: /* unrecognized message return (0); /* Check the text fields if (ntohl(*text_messages) > 0 for (i = 0; i < (int)ntohl(*text_messages); i++ field = (struct agent_msg_textfield *)( (char *)field + sizeof(struct agent_msg_textfield) + align4(ntohl(field->length)) ); return ((int)((char *)field - msg)); else { TECHNICAL NOTE 14

15 return (size); int sgsocket = 0; char *errprefix; char *agentinfo = "StoneGate Monitoring Agent open source version"; /* The errmsg function writes an error message to stderr. The message format is: <errprefix>: msg: <strerror(errno)> msg The error message void errmsg( char *msg fprintf( stderr, "%s%s%s%s%s\n", errprefix? errprefix : "", errprefix? ": " : "", msg, errno? ": " : "", errno? strerror(errno) : "" ); /* The set_nonblock function sets a socket to non-blocking mode sock The socket descriptor Return value: 0 in case of success int set_nonblock( int sock int rc = 0; if (0!= (rc = fcntl(sock, F_SETFL, O_NONBLOCK)) errmsg("couldn't set non-blocking mode for socket"); return (rc); TECHNICAL NOTE 15

16 /* The load function returns the current load value This function should query the current load value and return it Return value: Current load. int load( void int load = 0; /* Insert code to determine current load value return (load); /* The status function returns the current status. This function should query the current agent status. Return value: Current agent status u_int32_t status( void u_int32_t status = AGENT_STATUS_OK; /* Insert code to determine current status Return value has to be one of the following: AGENT_STATUS_OK AGENT_STATUS_SUSPENDED AGENT_STATUS_EXCLUDED return (status); /* The send_msg function sends a message to the specified address. buf The message to send addr The address, to which to send the message static void send_msg( char *buf, TECHNICAL NOTE 16

17 struct sockaddr_in *addr int rc; rc = sendto( sgsocket, buf, agent_msg_size(buf), 0, (struct sockaddr *)addr, sizeof(struct sockaddr_in) ); if (rc < 0 if (errno == EWOULDBLOCK rc = 0; else { errmsg("send failed"); /* The send_info function creates and sends an info message. addr The address, to which to send queryid The query id for the info message. static void send_info( struct sockaddr_in *addr, u_int32_t queryid static u_int32_t buf_4[agent_msgsize_max / 4]; char *buf = (char *)buf_4; int rc; struct agent_msg_info *info = (struct agent_msg_info *)buf; int size; info->hdr.magic = htonl(agent_msgmagic); info->hdr.protocol = htonl(agent_protocol); info->hdr.msg = htonl(agent_msg_info); info->queryid = htonl(queryid); info->text_messages = htonl(0); size = strlen(agentinfo); do { rc = agent_msg_appendtext( buf, AGENT_MSGSIZE_MAX, (char *)agentinfo, size, TECHNICAL NOTE 17

18 0, TEXTMSG_VERSIONINFO, time(null), 0 ); size--; while (rc == AGENT_MSGERR_TOOSMALL); send_msg(buf, addr); /* The send_status function creates and sends a status message. addr The address, to which to send the message queryid The query id for the message static void send_status( struct sockaddr_in *addr, u_int32_t queryid static u_int32_t buf_4[agent_msgsize_max / 4]; char *buf = (char *)buf_4; int rc; rc = agent_statusmsg_create( buf, AGENT_MSGSIZE_MAX, queryid, load(), status() ); if (rc == 0 /* To add text fields to the end of the message, call agent_msg_appendtext() send_msg(buf, addr); /* The send_proto function send protocol version message addr The address to which to send the message static void send_proto( struct sockaddr_in *addr static struct agent_msg_proto proto; proto.hdr.magic = htonl(agent_msgmagic); TECHNICAL NOTE 18

19 proto.hdr.protocol = htonl(agent_protocol); proto.hdr.msg = htonl(agent_msg_proto); send_msg((char *)&proto, addr); /* The handle_message function handles a received message buf The buffer containing a message len The message length addr The address, from which the message was received. void handle_message( char *buf, int len, struct sockaddr_in *addr struct agent_msgheader *hdr = (struct agent_msgheader *)buf; struct agent_msg_helo *helo; struct agent_msg_getinfo *getinfo; switch (ntohl(hdr->msg) case AGENT_MSG_HELO: if (len >= sizeof(struct agent_msg_helo) helo = (struct agent_msg_helo *)buf; /* If there is a message queue from which messages should be removed, use ntohl(helo->text_message_ack). send_status(addr, ntohl(helo->queryid)); else { fprintf( stderr, "%s: received invalid HELO message (size %d) from %s", errprefix, len, inet_ntoa(addr->sin_addr) ); break; case AGENT_MSG_GETINFO: if (len >= sizeof(struct agent_msg_getinfo) getinfo = (struct agent_msg_getinfo *)buf; send_info(addr, ntohl(getinfo->queryid)); else { fprintf( stderr, "%s: received invalid GETI message (size %d) from %s", errprefix, len, inet_ntoa(addr->sin_addr) ); TECHNICAL NOTE 19

20 break; case AGENT_MSG_PROTO: send_proto(addr); break; case AGENT_MSG_STATUS: case AGENT_MSG_INFO: default: /* Ignore unrecognized or unneccessary messages break; int main(int argc, char *argv[] struct sockaddr_in addr; const int one = 1; int rc; short port = AGENT_PORT; errprefix = argv[0]; /* Create the socket for listening incoming messages sgsocket = socket(pf_inet, SOCK_DGRAM, 0); if (!sgsocket errmsg("couldn't create socket"); return (-1); addr.sin_family = AF_INET; addr.sin_addr.s_addr = htonl(inaddr_any); addr.sin_port = htons(port); rc = bind(sgsocket, (struct sockaddr *)&addr, sizeof(addr)); if (rc!= 0 errmsg("couldn't bind socket"); return (-1); rc = setsockopt( sgsocket, SOL_SOCKET, SO_REUSEADDR, (char *)&one, sizeof(one) ); if (rc!= 0 errmsg("failed to set socket options"); return (-1); TECHNICAL NOTE 20

21 if (set_nonblock(sgsocket) return (-1); /* Main loop for (;; static u_int32_t buf_4[agent_msgsize_max]; char *buffer = (char *)buf_4; int size, len; struct sockaddr_in peeraddr; fd_set readfds; struct timeval t = {5, 0; FD_ZERO(&readfds); FD_SET(sgsocket, &readfds); rc = select(128, &readfds, NULL, NULL, &t); if (rc < 0 if (errno == EINTR errmsg("select"); continue; else { errmsg("select"); if (rc > 0 size = AGENT_MSGSIZE_MAX; len = sizeof(peeraddr); rc = recvfrom( sgsocket, buffer, size, 0, (struct sockaddr *)&peeraddr, &len ); if (rc < 0 switch (errno case EWOULDBLOCK: break; case ECONNREFUSED: default: errmsg("udp receive failed"); break; else { handle_message(buffer, rc, &peeraddr); close(sgsocket); return (0); TECHNICAL NOTE 21

22 Document Change History Document version Dec 2, 2004 Sep 1, 2004 Aug 26, 2004 List of changes Bug fixed in the example code s handle_message function. Example code appended to the document. First version of the document for StoneGate Firewall/VPN 2.2 with StoneGate Management Center 3.0. TECHNICAL NOTE 22

23 Trademarks and Patents Stonesoft, the Stonesoft logo and StoneGate are all trademarks or registered trademarks of Stonesoft Corporation. Multi-link technology, multi-link VPN, and the StoneGate clustering technology-as well as other technologies included in StoneGate-are protected by patents or pending patent applications in the U.S. and other countries. All other trademarks or registered trademarks are property of their respective owners. Copyright and Disclaimer Copyright Stonesoft Corporation. All rights reserved. These materials, Stonesoft products and related documentation are protected by copyright and other laws, international treaties and conventions. All rights, title and interest in the materials, Stonesoft products and related documentation shall remain with Stonesoft and its licensors. All registered or unregistered trademarks in these materials are the sole property of their respective owners. No part of this document or related Stonesoft products may be reproduced in any form, or by any means without written authorization from Stonesoft Corporation. Stonesoft provides this document for informational purposes only, is subject to change without notice and does not represent a commitment on the part of Stonesoft. Stonesoft assumes no liability for any errors or inaccuracies that may appear in these materials; use these materials at your own risk. Stonesoft does not warrant or endorse any third party products described herein. THESE MATERIALS ARE PROVIDED "AS-IS." STONESOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, AS TO, THE INFORMATION CONTAINED HEREIN. IN ADDITION, STONESOFT MAKES NO EXPRESS OR IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE OR USE WITH RESPECT THE INFORMATION OR TECHNIQUES CONTAINED IN THESE MATERIALS. IN NO EVENT SHALL STONESOFT BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL OR INCIDENTAL DAMAGES, INCLUDING, BUT NOT LIMITED TO, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING FROM THE USE OF THESE MATERIALS, EVEN IF ADVISED IN ADVANCE OF THE POSSIBILITY OF SUCH DAMAGES. Revision: International Headquarters Stonesoft Corp. Itälahdenkatu 22a FIN Helsinki, Finland tel fax. info.emea@stonesoft.com Business ID: VAT number: FI Americas Headquarters Stonesoft Inc. 115 Perimeter Center Place South Terraces, Suite 1000 Atlanta, GA tel fax. info.americas@stonesoft.com Asia Pacific Headquarters Stonesoft Corp. 90 Cecil Street # Singapore tel fax. info.asiapacific@stonesoft.com