Release Notes for. LCOS Software Release RU9

Transcription

1 Relese Notes for LCOS Softwre Relese RU9 Copyright (c) LANCOM Systems GmbH, Wuerselen (Germny) LANCOM Systems GmbH does not tke ny gurntee nd libility for softwre not developed, mnufctured or distributed by LANCOM Systems GmbH, especilly not for shrewre nd other extrneous softwre. LANCOM Systems GmbH Adenuerstrsse 20 / B Wuerselen Germny Internet: , MKoser Tble of Contents 1. Prefce New fetures, improvements, nd history... 3 LCOS improvements RU RU LCOS improvements RU RU LCOS improvements RU RU LCOS improvements RU RU LCOS improvements RU RU LCOS improvements SU RU LCOS improvements RU SU LCOS improvements SU RU LCOS improvements Rel SU LCOS improvements RC Rel LCOS improvements RC RC LCOS RC Importnt dvice Bcking up the current configurtion Notes Device-specific dvice Using converter firmwres Dynmic VPN registrtion LCOS RU9-EN LANCOM Systems GmbH, Wuerselen (Germny) Pge 1 of 20

2 1. Prefce LCOS ( LANCOM Operting System ) is the operting system for ll LANCOM routers, wireless LAN ccess points nd Wi-Fi controllers. In the context of the hrdwre given by the products the t time ltest LCOS version is vilble for ll LANCOM products nd is vilble free of chrge for downlod from LANCOM Systems. This document describes the innovtions within LCOS softwre relese RU9, s well s the improvements since the previous version. Before upgrding the firmwre, plese py close ttention to chpter 3 of this document. Ltest support notes nd known issues regrding the current LCOS version cn be found in the support re of our website LCOS RU9-EN LANCOM Systems GmbH, Wuerselen (Germny) Pge 2 of 20

3 2. New fetures, improvements, nd history Devices delivered with LCOS or higher utomticlly connect to the LANCOM Mngement Cloud (LMC). This functionlity provides zero-touch instlltion for new devices. In cse you do not wnt to use the LMC, this feture cn be disbled while running the defult setup wizrd for the initil configurtion, or t ny time from within LANconfig under Mngement > LMC. You cn mnully re-enble the usge of the LMC whenever you wnt. LCOS improvements RU RU9 Generl After firmwre updte to the version RU8 n immedite restrt of the router could occur. The device subsequently fell bck to the firmwre in the second firmwre slot. LCOS improvements RU RU8 Generl A sudden restrt could occur on the devices OAP-82x / OAP-830 if no OAP VPN Option ws stored on the device, nd n ccess to WEBconfig ws ttempted. This error occurred while ccessing the device vi the LANCOM Mngement Cloud, too. While performing n ICMP trce route (ping -r <trget ddress>) from the router no ccurte output to the commnd line occurred, dependent on the used embedding method of the originl pcket into the nswer pcket. The nswers of the hops, however, could be seen in the ICMP/IP router trce. VoIP If the defult ISDN user DEFAULT ws used in the Voice Cll Mnger, outgoing clls were rejected with the error messge "no user responding", nd thus could not be executed. The defult ISDN user "DEFAULT" is used by connected ISDN user on outgoing clls if n MSN is nnounced which is not listed in the ISDN user tble under "Voice Cll Mnger / Users / ISDN users". LCOS RU9-EN LANCOM Systems GmbH, Wuerselen (Germny) Pge 3 of 20

4 LCOS improvements RU RU7 New Fetures Support for the Medisec heders for encrypted VoIP connections IKE pckets re now tgged with DSCP CS6 for prioritiztion. Generl If VLAN nd VRRP ws configured simultneously per LANconfig on the slve router, or the configurtion ws imported (from regulr configurtion file or script), the router did not see the VRRP pckets of the VRRP mster. This resulted in the slve router propgting itself s VRRP mster. If long nme for cellulr network ws specified in the configurtion of LANCOM cellulr router, firmwre updte could cuse sudden router restrt with fllbck to the previous firmwre. Minimum bndwiths set up under LCOS RU6 did not work when solely n Internet connection of the type "PPP over Ethernet (PPPoE)" or "IP over Ethernet (IPoE / DHCPoE)" ws configured on the device. Cloud-redy devices connect to the LANCOM Mngement Cloud utonomously vi PSK. If this process ws denied once by the piring server, the device still tried to connect using the PSK, even if the user wnted to connect the device mnully by using n ctivtion code. An dditionl 5 ws dded to the IP ddress in the LLDP stndrd MIB. This could led to problems if monitoring pplictions tried to red the IP ddress of device. If both VDSL modems were used by LANCOM 19xx device, connection estblishment to n Internet site which ws configured on the VDSL1 interfce could led to n error messge on the VDSL2 interfce. VPN A sudden device restrt could occur with certificte-bsed VPN connections, if the device tried to estblish VPN connection before the certificte ws creted, while its cretion ws still in progress by the SCEP client. Infrequently, sudden device restrt could occur if the VPN lod blncer ws ctivted on the device, nd script contining VPN prmeters ws uploded to the device. If fulty certificte continer ws referenced in the configurtion for certificte-bsed IKEv2 connection, this could led to sudden device restrt. Wi-Fi A sudden device restrt could occur, if the IP ddress ws written fulty in n iperf bndwidth test (e.g. "iperf c "). In Public Spot scenrio which ccepts logins vi VLAN-seprted LAN interfce, it could hppen tht previously logged in Public Spot users who fterwrds chnged their VLAN could no longer communicte with the network. When using DSLoL s remote site type it could hppen with LCOS RU6 tht the remote sttion did no longer work. A Spectrl Scn with LANCOM 1783VAW ws not strted in new window (like usul), but in the sme window. Pressing the bck button in tht window did not terminte the Spectrl Scn. Only router restrt terminted the Spectrl Scn. LCOS RU9-EN LANCOM Systems GmbH, Wuerselen (Germny) Pge 4 of 20

5 VoIP If LANCOM VoIP router received n "INVITE" which SDP prt contined two m-lines, the device nswered with SIP pcket contining only one m-line in the SDP prt. This ws not RFC-complint nd could led to filed clls when intercting with third-prty mnufcturers. Outgoing encrypted clls to the provider Telekom were rejected, if the SIP line ws configured for "Signling encryption". The INVITE ws nswered with "503 Service Unvilble". On outgoing clls of n extension only the min office number ws trnsmitted. The P-Preferred Idenitity ws not set correctly by the SIP mpping. On incoming clls to Telekom SIP trunk the LANCOM Voice Cll Mnger did not forwrd the PAI heder prmeter user=phone to the SIP user. If SIP PBX line ws estblished from LANCOM VoIP router to preceding O2 box, it could hppen tht incoming clls were rejected by the LANCOM router showing the messge "Missing Mndtory Heders". The LANCOM VoIP router deleted SIP clls which were terminted by connection timeout. As result, the remote sttion ws not informed with CANCEL messge. LCOS improvements RU RU6 New Fetures When selecting mobile rdio network depending on signl qulity, you cn now crete blcklist for llowed mobile rdio networks. The service lists of the lyer-7 ppliction detection hve been updted. The devices L-1302cn dul Wireless nd L-1310cn dul Wireless indicte non-sufficient PoE power supply by permnent ornge power LED. Generl Cisco cble modem types 3208, 3212, nd 3925 stopped working due to n incorrectly ssembled TCP pcket by the LANCOM router, nd could only continue to work fter restrting them. The incorrectly ssembled TCP pcket is no longer sent. A router which ws mnged vi TR-069 (Crrier device mngement ) nd IPv6 could not be ccessed by its WAN IPv6 ddress fter tking over the configurtion. The lyer-7 ppliction detection showed mssive increse of the kbps counter for the ctegory unknown within two minutes. If DTMF signling ws configured to "Telephone events fllbck to in-bnd" for SIP users (Voice Cll Mnger > SIP users), s well s for SIP lines (Voice Cll Mnger > SIP lines > Advnced), events were trnscoded into RTP events on incoming clls. If the commnd defult -r ws inserted fter the prmeter flsh no, nd the commnd flsh yes ws deleted from the end of script which ws generted using the commnd redscript -m -i, sudden router restrt occurred, if the modified script ws executed using the commnd beginscript nd inserting the script file. If the configurtion snpshot of device within cluster scenrio which hd to be synchronized ws bigger thn 1 Mbyte, config sync did not work. LCOS RU9-EN LANCOM Systems GmbH, Wuerselen (Germny) Pge 5 of 20

6 VPN If firmwre updte to LCOS SU3 ws performed on the inititor of n IKEv2 connection with configured IKEv2 lod blncing, the VPN connection to the IKEv2 lod blncer could no longer be estblished. The CA sttus of the LANCOM generted the error messge "Mximum size of certificte list reched. No new certifictes will be creted.". Due to tht, no new certifictes could be creted, becuse the certificte sizes were limited by the CA. After optimizing GRE, routing performnce of GRE tunnels hs been improved by pprox. 15% (LAN- LAN nd LAN-WAN). When using multiple Internet connections nd IKEv2-VPN connections, delete notifictions were routed vi the flse Internet route when chnging the Internet connection. Wi-Fi When using iphones in Wi-Fi network brodcsted by LANCOM LN-17xx ccess point, issues could occur while trnsmitting dt which could only be fixed by short disconnect of the Wi-Fi connection. Due to fulty trnsmission of CAPWAP pckets, sudden restrt of LANCOM WLAN controller could occur. In big networks it could hppen tht ARP replies could not be trnsmitted when using P2P connections, client bridge, or Auto WDS. With c ccess points nd enbled sttion monitoring high Wi-Fi dt throughput could cuse high CPU lod nd high chnnel lod. This led to dissocition of the Wi-Fi client from the Wi-Fi network. VoIP In the menu "Voice Cll Mnger > Extended > Qulity of Service > Prioritize outgoing pckets" the vlue "PMTU reduction & frgmenttion" ws set s the defult fter fctory reset, lthough the defult vlue "PMTU reduction" should be set. When trnsferring fx with T.38 (Deutsche Telekom), ReINVITE of the LANCOM router ws cknowledged with "200 OK" by the Deutsche Telekom. Anywy, the fx trnsmission filed. While no cll routing rule ws executed, conversion of the cll number ws done in the FROM field from "+" to "00". This did not comply with the E.164 formt. When using cll groups, it could hppen tht the "Busy-on-Busy" flg ws not trnsmitted ccurtely. This could cuse unwnted multiple clls. The "Busy-on-Busy" flg is now trnsmitted even if "Busy-on- Busy" is disbled in the router s configurtion. After hving updted to LCOS RU5, it could hppen tht clls to prticulr end devices (e.g. SNOM-phones) were no longer put through. A sudden VoIP router restrt could occur if n nlog user cncelled mistkenly diled number while cll estblishment. LCOS RU9-EN LANCOM Systems GmbH, Wuerselen (Germny) Pge 6 of 20

7 LCOS improvements RU RU5 Generl Issues concerning the config reset hve been fixed. LCOS improvements SU RU4 New fetures Besides the relm types "Mil Domin" nd "MS Domin", the RADIUS server now supports the relm type "MS-CompAuth" by defult. The devices LANCOM LN-1700, LN-1702, LN-860, nd LN-862 indicte non-sufficient PoE power supply by permnently ornge power LED. The VDSL line code for devices of the LANCOM 1781, 1783, 1784, R800, R88x series, nd for the LANCOM 730VA hs been updted. Connection estblishments nd clerings nd connection errors of SIP lines re now sved to the syslog. Blocked IPv4 routes for RFC 1918 networks re no longer ctivted by defult in new configurtions. Devices mnged by the LMC cn now synchronize locl configurtion chnges with the LMC on demnd. Generl No WAN sttistics were sent per SNMP which cused missing displys in e.g. LANmonitor. While checking for free ddresses, the DHCP server blocked ddresses tgged s lredy llocted with the mximum lese time. These ddresses re now blocked for only five minutes. The defult rule for the Content Filter in the IPv6 firewll cptured ll protocols nd ll sttions to ll sttions. SNMP ccess to LANCOM router ws not possible vi WAN interfce, if the SNMP right red only ws configured for the WAN interfce s ccess rights. In some cses routes with ctivted sticky for RIP" were not propgted ccurtely per RIP protocol. The LANCOM ARP implementtion included check to discrd received ARP pckets with sender MAC ddress nd set group bit (multi- / brodcst). This could cuse non-functioning lyer-2 communiction nd e.g. filed ping to locl server. Port forwrding of the UDP port 500 did not work s expected in some scenrios. If configurtion ws red s script, it could not be written bck ccurtely due to error messges within the Public Spot module. If configurtion snpshot for synchronizing ws bigger thn 1 Mbyte, prmeter lignment could not be done by config sync. Sttic routes cn be distributed per route redistribution in OSPF. After restrt of the LANCOM router the route ws deleted from the OSPF dtbse, nd thus could not be distributed vi the LSAs. If LANCOM router received time request (NTP vi UDP) which contined 0 checksum, the request ws rejected by the internl router service. LCOS RU9-EN LANCOM Systems GmbH, Wuerselen (Germny) Pge 7 of 20

8 DHCPoE bsed Internet connections which received n dditionl msquerding ddress used this ddress only for hlf of the DHCP lese time. On DHCP renew the ddress got lost nd from tht time on the ddress which ws received by DHCP ws used. VPN Stticlly configured routes on VPN tunnels re now propgted per route redistribution by OSPF. No dt ws trnsmitted through VPN tunnel if n IKEv2 connection ws estblished vi IPSec-over- HTTPS mode. Affected were IKEv2 connections between two LANCOM routers, nd IKEv2 connections between Advnced VPN Client nd LANCOM router, too. If n dditionl dministrtor ccount should be creted using WEBconfig, some fields for configurtion prmeters nd checkboxes for functionl rights were missing on the GUI. With some browsers the WEBconfig configurtion interfce could freeze nd the CPU lod of the configured router could increse to 100% if the setup wizrd "Provide remote ccess" ws used in combintion with the option "VPN client with user-defined prmeters". Wi-Fi Devices with c Wve1 Wi-Fi modules could suddenly restrt which ws cused by fulty reset of the Wi-Fi module. EAPoL pckets for 802.1X uthentiction were not forwrded by the ccess point, if protocol filters were configured on the devices (under Wireless-LAN Security Protocols), which should discrd pckets from clients. An explicit llow filter for EAPoL pckets (Ethertype 888e) solved the problem. After firmwre updte to LCOS SU3 LANmonitor displyed no vlue for "TX rte (to remote site)" for point-to-point connections. The Spectrl Scn function of WEBconfig led to freezing browser tb fter short time, so tht no Spectrl Scn dt could be displyed nymore. If no templte cche ws ctivted for Public Spot templte pge, it could hppen tht the login pge of the Public Spot could not be invoked fter some time. For devices with more thn 128 Mbytes of RAM the templte cche is now enbled by defult. When ctivting Public Spot option on LANCOM device the needed folders were not creted in the LCOS menu tree. The folders were then creted only fter mnul device restrt. After firmwre updte to LCOS SU3 it could hppen in some cses, tht previously working point-to-point connection could no longer be estblished. This behvior ws only seen when the spnning tree protocol (STP) ws ctivted, too. After firmwre updte it could hppen tht some Wi-Fi clients could not connect if the Wi-Fi protocol filter ws enbled. VoIP When using the LANCOM router s VoIP gtewy, bndwidth reservtions for telephony could cuse n Internet communiction loss in certin cses. A CANCEL request which ws received by the LANCOM router while estblishing the cll ws not forwrded to the phone. The cll ws still indicted t the phone. SIP ws written in cpitl letters within the URI of SIP pcket s route heder, which ws not conforming to RFC nd could result in clls being ended fter 30 seconds. If n UnREGISTER pcket ws unnswered, further UnREGISTER pckets were sent insted of norml REGISTER pcket, which cused tht SIP line could not be registered t some providers. Clls with suppressed cller number could not be put through if they were sent vi trunk lines which needed SIP-ID within the "FROM" heder. If T.38 ReINVITE ws nswered directly with 487 Request Terminted, the LANCOM router did not immeditely terminte the cll. As result, no more fxes could be received. LCOS RU9-EN LANCOM Systems GmbH, Wuerselen (Germny) Pge 8 of 20

9 Clls filed which should be forwrded from DECT user (connected vi DECT bse sttion 510) to SIP or ISDN user. While forwrding, the DECT bse sttion dded second (proxy) uthoriztion field to the SIP heder which could not be hndled by the LANCOM Voice Cll Mnger. After loss of the primry WAN connection registered SIP lines were not reconnected fter switching to n vilble LTE bckup. The tble for nlog users ws reduced from four to two entries in LCOS version REL, which resulted in deletion of the third nd fourth user on firmwre updte. The Voice Cll Mnger did not evlute the llow heders of received SIP pckets, but dded his own, fixed llow list when putting through cll. If VoIP configurtion ws written to the device by the setup wizrd, nd cll ws put through vi the still existing VoIP configurtion in tht precise moment, sudden device restrt could occur. LCOS improvements RU SU3 Security updte for LANCOM routers, gtewys, ccess points, nd WLAN controllers This updte fixes security-relted vulnerbility in the mngement functionlities. Potentilly ffected re ll devices running the following firmwre versions: LCOS REL, SU1, RU2 LCOS RU2, PR, RU4 LCOS 9.24 RU6, SU7, RU8 This updte is recommended for these devices. All other versions re not ffected. LCOS improvements SU RU2 New fetures The driver for the IEEE c Wve1 Wi-Fi modules of the following products ws updted: LN-630cn dul Wireless, LN-830cn dul Wireless, L-1310cn dul Wireless, L-1302cn dul Wireless, IAP-821, IAP-822, OAP-821, OAP-822, OAP-830 vrouter licenses of type "vrouter 500" cn now be ctivted. Zero touch provisioning with the LANCOM Mngement Cloud: By defult, LANCOM routers with Ethernet WAN port connect to the LANCOM Mngement Cloud vi DHCPoE using the WAN port. Generl Writing the configurtion vi LANconfig per TFTP or seril interfce ws not possible if the LANCOM device did not hve n ctivted Public Spot Option. A configured WWAN connection (LTE or UMTS) on LANCOM 1780EW-4G+ could spordiclly not be used, becuse the mobile rdio module did no longer get n IP ddress per DHCP. 2G (GPRS) could be configured s fllbck for mobile rdio connections on LANCOM 1780EW-4G+, lthough the device does not support it. LCOS RU9-EN LANCOM Systems GmbH, Wuerselen (Germny) Pge 9 of 20

10 The LCOS-internl CA hierrchy which cretes the device certifictes for HTTPS connections to the device ws fulty for the LANCOM 7100(+) VPN, 9100(+) VPN, WLC-4025+, nd WLC Due to this, device certifictes were not ccepted by the web browser. A filed SCEP request prevented the execution of further SCEP requests, lthough the request ws for different certifiction site. A connection to DHCPoE remote site could not be estblished if the llocted DSLoL interfce of the remote sttion ws llocted to bridge group. If the iperf commnd ws entered incomplete or bbrevited on the LANCOM device s commnd line (e.g. "iper" insted of "iperf"), the iperf server strted displying wrning messge. Two servers could not be specified s trget under /Setup/DNS/DNS Destintions, if one or both were extended by '@ chrcter. You cn dd routing tg using chrcter. Informtion bout the configured BOOTP server under Boot imges ws missing in the DHCP offer for BOOTP client. No objects contining the '@ chrcter could be creted in the firewll (LCOS menu tree: /Setup/IP- Router/Firewll/Objects; LANconfig: Firewll/QoS > IPv4 rules > Sttion objects), lthough the llowed chrcter set included chrcter. Pckets which should be deferred by firewll rule were trnsmitted if two QoS rules with ctivted linking were ctive in the firewll ( Observe further rules fter this rule mtches ), nd the pckets mtched to one of these rules. VPN A sudden device restrt could occur when IPSec disconnection nd delivery of dt pcket, still belonging to the disconnected session, hppened simultneously. It ws not possible to execute more thn one Dynmic VPN negotitions simultneously. Due to tht, the corresponding VPN tunnels could not be estblished. Wi-Fi A configured trnsmission power reduction for the IEEE c module ws not observed in subbnd 2. The reduction ws clculted on the EIRP nd not, s desired, on the mximum trnsmission power of the module. The function "Adptive RF Optimiztion" ws enhnced by chnnel usge rting by other Wi-Fi devices. The WPA rekeying mechnism did not work s expected due to missing rekeying ID. VoIP A SIP line could lose its registrtion if the DNS nme of the registrr ws resolved by DNS server which supplied TTL=0. Setting cll prefix to SIP remote sttion under "Voice Cll Mnger > Lines > SIP Lines >..." resulted in forwrding the clling numer in n invlid formt (e.g. 0+49), becuse the interntionl dil prefix ws not converted (e.g. from +49 to 0049). If n incoming Voice-over-IP cll ws signled for longer thn 120 seconds without being nswered nd ws then cncelled by the provider, the cll remined in the clling list with sttus ringing. LCOS RU9-EN LANCOM Systems GmbH, Wuerselen (Germny) Pge 10 of 20

11 LCOS improvements Rel SU1 Wi-Fi A security issue within WPA2 uthentiction (KRACK ttck) using r (Fst-Roming) while in AP mode (bse sttion) hs been fixed: CVE : ccepting retrnsmitted Fst BSS Trnsition Ressocition Request nd reinstlling the pirwise key while processing it Plese check with the mnufcturer of your Wi-Fi client for the vilbility of updtes. These devices need to be updted, too. A security issue within WPA2 uthentiction (KRACK ttck) using WLAN client mode / WLAN sttion mode with c-Wi-Fi modules s well s while using P2P connections with c- nd /b/g/n Wi-Fi modules hs been fixed: Note: CVE : reinstlltion of the pirwise key in the Four-wy hndshke CVE : reinstlltion of the group key in the Group Key hndshke The WLAN client mode / WLAN sttion mode with /b/g/n Wi-Fi modules is not ffected. LCOS is not ffected by the following WPA2 security issues (KRACK ttck): CVE : reinstlltion of the STK key in the PeerKey hndshke CVE : reinstlltion of the Tunneled Direct-Link Setup (TDLS) PeerKey (TPK) key in the TDLS hndshke CVE : reinstlltion of the group key (GTK) when processing Wireless Network Mngement (WNM) Sleep Mode Response frme CVE : reinstlltion of the integrity group key (IGTK) when processing Wireless Network Mngement (WNM) Sleep Mode Response frme CVE : reinstlltion of the group key in the Four-wy hndshke CVE : reinstlltion of the integrity group key in the Four-wy hndshke CVE : reinstlltion of the integrity group key in the Group Key hndshke LCOS RU9-EN LANCOM Systems GmbH, Wuerselen (Germny) Pge 11 of 20

12 LCOS improvements RC Rel Generl After restrt of the LANCOM device ll ports remined in disbled sttus, lthough Spnning Tree ws ctivted. An LMC domin which ws llocted per DHCP option ws ignored by the LANCOM device when it ws working s DHCP client. An ADSL connection with encpsultion VC-MUX nd trnsprent Lyer-2 (insted of PPPoE) could not be estblished successfully. After the lese time expirtion no new IP ddress ws obtined by n Internet remote sttion with lyer DHCPoEoV, nd the connection ws temporrily cut. If server in the DMZ ws sending too big pckets (bigger thn the MTU of the trget remote sttion) with ctivted DF bit (don t frgment) to LANCOM router, the router did not nswer with n ICMP error messge frgmenttion needed nd discrded these pckets. If VLAN ID ws stored in the network definition of the LANCOM Mngement Cloud which ws bigger thn 999, this configurtion ws not ccepted, lthough VLAN IDs up to 4096 re llowed in network definitions. If n NTP server ws configured within the network INTRANET, the configurtion of the device could not be written bck by LANconfig fter ny configurtion chnge. Within bridge group (e.g. BRG-1), routed multicsts (e.g. video strems to DSL-1) were bridged to the interfce LAN-1 pst the IGMP snooping nd to WLAN-1, too, if client ws registered to the wireless network. This cused the wireless network to be flooded with multicst pckets with incresing Wi-Fi chnnel lod, resulting in wireless connection which ws not performing well. In VRRP lod blncing scenrio with RIP, ICMP redirects were sent with the source IP ddress of the ARF context insted of the VRRP IP ddress. No dt ws trnsmitted through n EoGRE tunnel which hd not been llocted ny bridge goup under interfces > LAN > Port tble. Wi-Fi By AutoWDS, no point-to-point connection could be estblished between LANCOM ccess points. The configured ccess points for AutoWDS were shown under the pproprite SSID in LANmonitor, but no connection could be estblished. Clients which were registered initilly to the LANCOM Public Spot could not connect to the WAN, becuse DNS requests of the initil domin were not forwrded to the preceding device (which provided WAN ccess). When reding the configurtion of LANCOM WLAN controller by LANconfig the wireless IDS profile Defult" ws not red, which cused tht the configurtion dt could not be written bck to the LANCOM WLAN controller. VoIP If WEBconfig s Configure Voice-over-IP / All-IP" setup wizrd ws used for configuring n All-IP connection, the configured ISDN interfce remined in off sttus fter the wizrd ws finished. If the busy on busy function ws enbled for user within the user settings of the LANCOM Voice Cll Mnger (Voice Cll Mnger > Users > User Settings), this user could not receive ny clls. LCOS RU9-EN LANCOM Systems GmbH, Wuerselen (Germny) Pge 12 of 20

13 VPN & Routing An IKEv2 connection with digitl signture profile RSASSA-PSS with SHA-384 nd SHA-512" could not be estblished. If no IPv4 ddress pool ws creted for n IKEv2 client connection, n IKEv2 client who got n IP ddress by the LANCOM router vi IKE config mode did not get DNS server entry. The LANCOM router lloctes its own IP ddress s DNS server ddress to the IKEv2 client if no IPv4 ddress pool ws creted. On n IKEv2 connection which ws uthenticted by IKEv2 RADIUS no outgoing dt ws sent fter 24 hours. The lifetimes for RADIUS uthentiction hd not been pplied correctly by the LANCOM router. Only UDP nd ICMP pckets were trnsmitted through n estblished VPN tunnel on n IKEv2 connection with AES-GCM encryption. TCP connections did not work t ll (SSH, HTTPS etc.). If the commnd show vpn ws entered on the commnd line of LANCOM router, the output displyed VPN rules of configured IKEv2 connection s IKEv1 rules. If msked IKEv2 VPN connection between two LANCOM routers ws estblished with one-sided trnsprently ccessible DMZ (msking settings only Intrnet"), the DMZ ws msked, too. Dynmic VPN connections (IKEv1 vi UDP) between two LANCOM routers with privte IP ddress on the Internet connection for the dynmic site (behind NAT router) could not be estblished. A dynmic VPN connection vi ICMP worked. LCOS improvements RC RC2 New Fetures Generl WAN ccess vilbility cn now be configured for the COM port server Dynmiclly generted VLAN memberships cn be shown on the CLI using the show vln commnd. Updted service lists for the Lyer 7 ppliction detection The Lyer 7 ppliction detection now supports QUIC session detection. Support for Ethernet OAM bsed on 1TR112 Wi-Fi The driver for the IEEE c Wve1 Wi-Fi module of the following devices hs been updted: LN-630cn dul Wireless, LN-830cn dul Wireless, LN-822cn dul Wireless, LN-830E Wireless, L-1310cn dul Wireless, L-1302cn dul Wireless, IAP-821, IAP-822, OAP-821, OAP-822, OAP-830 VoIP Busy-on-Busy is now configurble for cll groups LCOS RU9-EN LANCOM Systems GmbH, Wuerselen (Germny) Pge 13 of 20

14 Generl The ctegory Cloud pplictions ws defined s forbidden within three defult Content Filter profiles. This ws now chnged to llowed. The time which is periodiclly set by the LANCOM Mngement Cloud (LMC) ws overwritten by WLAN controller within the sme network while nnouncing the time to mnged LANCOM ccess point. The option for configuring the LACP interfces Bundle-1 nd Bundle-2 ws missing in the configurtion interfce of the LANCOM 1783VAW. VPN & Routing If VPN connections using AES-GCM encryption were terminted on LANCOM router, the vlues for the columns Crypt-Alg nd Hsh-Alg were missing in the LCOS tble /Sttus/VPN/ESP. If only defult routes with routing tg different from 0 were configured on LANCOM Router, IKEv2 connections could not be estblished, if the IKEv2 peer ws not recognized by its IP ddress. Further IPSec rules were creted if solely super ordinte IPSec rule (e.g. ANY-to-ANY) ws defined for VPN remote sttion, but lso one or more N:N NAT entries were defined for this VPN remote sttion, which included the super ordinte IPSec rule. Wi-Fi The country profile Austrli hs been fixed. ARP pckets re now trnsmitted relibly when using the client bridge mode with IEEE c cpble Wi-Fi modules. If profiles were defined under Public-Spot > Wizrd > Bndwidth profiles, the ccording vlues were displyed swpped lter in the wizrd nd on the voucher. The IEEE c module of LANCOM ccess point ws sending becons with dt rte of 1 Mbps in the 2.4 GHz bnd in gn/mixed mode, s well s in Greenfield mode. This led to becons being visible even on n b client, lthough the b mode ws disbled in the ccess point configurtion. No logout link is shown on the sttus pge for the Public Spot uthentiction mode login vi greement. On the login pge of the Public Spot gtewy the pge contining the terms of use could not be displyed for pple clients, if the Public Spot uthentiction method ws set to Login dt will be sent by e-mil / SMS. If Public Spot ws operted on router with Wi-Fi module, nd n ccess point within the sme network brodcsted the Public Spot SSID, too, the entry for client ws deleted from the uto relogin tble if the client ws roming from the router to the ccess point. This cused n dditionl login to the Public Spot. A negtive vlue ws shown in LANmonitor for mnged ccess points fter rdio field optimiztion on LANCOM WLAN controller. LCOS RU9-EN LANCOM Systems GmbH, Wuerselen (Germny) Pge 14 of 20

15 VoIP Unidirectionl communiction could occur while operting VoIP line (SIP trunk) over BNG s internet connection nd using n ISDN phone system behind LANCOM VoIP router. The internl ISDN user could not her the externl subscriber nymore. Phone clls from n internl SIP phone system vi LANCOM VoIP router to Deutsche Telekom SIP trunk line were disconnected fter pprox. 15 minutes. If one or more prefixes for internl clls were configured in the menu Voice-Cll-Mnger > Advnced, the configured prefix ws not dded to the source cll number. Thus, n outgoing cll could not be estblished. After successful registrtion of SIP line vi IPv6 incoming clls did not work due to INVITE pckets were nswered with ICMP port unrechble by the firewll of the LANCOM VoIP router. This hppened even though n existing inbound firewll rule ws configured for the SIP server. LCOS RC1 Currently, devices running LCOS RC1 cn not be configured or mnged vi the LANCOM Mngement Cloud. New fetures Generl LACP - virtul ethernet port bundling for mximized relibility Public Spot support for the LANCOM vrouter Commnd for switching the firmwre with utomtic device restrt File import per Copy & Pste Smrt Ticket / SMS - Whitelist for re codes Elimintion of the port 8080 for WEBconfig nd Public Spot Content Filter enhncements by further ctegories IPv6 support for the Content Filter VPN & Routing IKEv2 Lod Blncer for lod blncing of incoming VPN connections Freely configurble DHCPv6 options OSPFv2 OCSP check in the TLS / Rollout wizrd Switchble Not-HTTPS communiction vi port 443 in the Content Filter Support of AES-GCM for IKEv2 Support of the elliptic curve Diffie-Hellmnn groups (ECDH) 19, 20, 21, nd the ECC Brinpool curves 28, 29, nd 30 for IKEv2 Support of RADIUS CoA for IKEv2 Lod Blncer for IKEv2 Mximum VPN vilbility thnks to dditionl bckup mechnics Support for TACACS shell uthoriztion Vribles for IPv6 LAN ddress nd prefix in the ction tble ICMPv4 nd ICMPv6 rte limiting Support for MD5 in NTP client nd server NTP server for ech ARF net vilble LCOS RU9-EN LANCOM Systems GmbH, Wuerselen (Germny) Pge 15 of 20

16 Wi-Fi Multicst > Unicst trnsformtion for Judder-free IPTV streming in the Wi-Fi As of now, the menus for the Public Spot configurtion re generlly vilble within LCOS, but cn only be used fter successful ctivtion of the Public Spot option x: Avilbility check for RADIUS server c Wve 2 fetures configurble vi WLC Coordinted Wireless epper chnnel selection VoIP The SIP user ID field cn now be configured Overlp Diling for fster connection estblishment Generl If the vlidity of n RA certificte ended before the vlidity of the CA certificte, the SCEP client did not updte the RA certificte. If the spnning tree functionlity on LANCOM ccess point ws enbled by LANconfig, this chnge ws not sved correctly, so spnning tree ws not enbled fter sving the device s configurtion. When uploding vrouter configurtion per WEBconfig, the configurtion prmeters were only pplied completely fter wrm boot of the vrouter following the uplod. When using bckup RADIUS server for device uthentiction the login ws checked on the bckup server first, insted on the primry RADIUS server. If the DHCP client did restrt within the time of the DHCP request, it could occur tht the LANCOM DHCP server did not llocte n IP ddress to this client fter its restrt. In this cse, the DHCP trce log displyed the messge "ARP in progress". Proxy-ARP did not work for communiction between identicl IP networks which re mnged by the LANCOM device. On n internet connection, which ws configured s DS-Lite, LANCOM device did not use its IPv6 WAN ddress for IPv6 pckets, but its IPv6 LAN ddress s sender ddress in some cses. A sudden device restrt could occur if periodic 300 seconds request ws configured in the LCOS CRL client (LANconfig: "Certifictes -> CRL-Client: Retrieve regulrly (per CRL)") nd the CRL client could not fetch the CRL (e.g., due to n error of the externl CA). The tble "Setup/DNS/DNS-Destintions" (LANconfig: IPv4 -> DNS -> Forwrding) ccepted only vlues smller or equl thn 999 for the prmeter "Rtg-tg" (Routing tg). The tbles for configuring bckup nd ccounting were missing in the LANCOM vrouter under "/Setup/WAN". If the commnd "show script" ws entered on the CLI, the output did not contin sesseion ID, so running scripts could not be stopped by using the commnd "killscript <Session-ID>". The setup menu (/Setup/WAN/RADIUS) for uthenticting vi externl RADIUS server ws not vilble in the LANCOM vrouter. An xdsl connection could not be stopped immeditely, if the pproprite DSL remote sttion ws detched from the configurtion by script. Invoking the user-defined rollout wizrd could led to sudden device restrt, if more item vlues thn item texts were defined in the rollout wizrd s list box. LCOS RU9-EN LANCOM Systems GmbH, Wuerselen (Germny) Pge 16 of 20

17 VPN If DHCP request should be forwrded vi VPN tunnel which got its IP ddress by config mode, the config mode ddress ws set s GI ddress in the DHCP heder. If n existing VPN connection ws disconnected by delete informtion, the VPN debug trce did not show ny informtion bout the disconnect reson. Nme descriptors for two configurble prmeters were missing in the WEBconfig configurtion dilogue for IKEv2 rekeying prmeters (Configurtion -> VPN -> IKEv2/IPSec -> vlidity period). If n IKE connection which should be estblished between vrouter nd VPN router ws monitored by DPD, frequent disconnections due to DPD timeout did occur. DPD ws not executed properly on the LANCOM vrouter. Wi-Fi The trigger for re-initilizing SCEP client could fil when the client ws currently initilizing. The vlue for limiting the dt volume for utomticlly generted Public Spot users in the pth "/Setup/Public-Spot-Module/Authentiction-Modules/User-Templte/Volume-Budget" ws limited to mximum of Mbytes. When creting Public Spot users by HTTP commnd, commnd which ws included within the URL ws not pplied to the creted user profile. A sudden device restrt could occur if the ccess point provided WLC tunnel (CAPWAP dt tunnel) for Wi-Fi clients nd tried to provide n ICMP pcket frgmenttion needed to Wi-Fi client,becuse the received dt pcket ws too big for the CAPWAP dt tunnel. VoIP If cll ws estblished vi n ISDN phone system which is connected to the internl ISDN interfce of the LANCOM router, nd hs configured cll forwrding to externl numbers, unidirectionl communiction could hppen, if the cll ws finlly forwrded to the provider vi SIP by the VCM. A country code strting with + (e.g. +49 for Germny) ws not converted to the formt 0049 by the LANCOM Voice Cll Mnger on outgoing clls, so tht n ISDN phone sttion ws not ble to evlute the cll number. If SIP line ws disconnected on the CLI using the commnd "do /other/mnul-diling/disconnect <Connection>", the LANCOM Voice Cll Mnger ws not informed bout tht. This resulted in showing lines which used this connection still s being registered. Outgoing clls vi SIP provider M-net could not be estblished, becuse the provider requires second uthentiction fter uthentiction vi "INVITE", nd "PRACK", too. If VoIP provider nswered 400 Bd Request to SIP line de-registrtion, the LANCOM Voice Cll Mnger could not interpret this error messge correctly, so the de-registrtion ws constntly repeted. If cll group ws intended to be used s bckup line, e.g. for connection to telephone system, this entry did not work. A SIP session which ws tgged with routing tg by firewll rule nd mnged by the SIP ALG, could not be estblished, becuse the nswer pckets were tgged with the sme tg by the SIP ALG, nd thus were discrded by the IP router. A SIP line which ws registered using OPTIONS pckets ws interpreted s non-registered line by the SIP ALG, so incoming clls (INVITE pckets) could not be ssigned correctly. Due to the prmeter "trnsport=udp" in the contct heder of SIP pcket some locl SIP clients lost their registrtion to the LANCOM VoIP router fter few minutes. An infrequent issue with LANCOM VoIP routers occured t clls with the involvement of the LANCOM N510 DECT sttion. If n externl cll on SIP line reched the LANCOM VoIP router nd ws nswered internlly by hndset of the LANCOM N510 DECT, the cller could her the internl user, but the internl user could not her the cller. LCOS RU9-EN LANCOM Systems GmbH, Wuerselen (Germny) Pge 17 of 20

18 A sudden device restrt could occur if the received OK pcket on SIP line did not contin n EXPIRES vlue within the CONTACT heder. Unidirectionl communiction could infrequently occur if n incoming cll vi SIP line ws signlled by the LANCOM VoIP router to more thn two interfces (ISDN nd nlog interfces). A SETUP, which ws received on the ISDN nd did contin trget number of type "Ntionl Number", ws not completed with zeroes by the cll routing, like it is the cse with numbers of type "Interntionl Number". Thus, cll routing using service numbers did fil. After n nlog cll ws finished, it remined in the cll counter tble of the LANCOM VoIP router in some cses. A Linphone SIP client ws rejected while registering t the Voice Cll Mnger (VCM) due to client specific prmeters within the registrtion. LCOS RU9-EN LANCOM Systems GmbH, Wuerselen (Germny) Pge 18 of 20

19 3. Importnt dvice Bcking up the current configurtion Before upgrding your LANCOM devices to new LCOS version it is essentil to bckup the configurtion dt! Due to extensive fetures it is not possible to downgrde to previous firmwre without using the bckup configurtion. If you wnt to upgrde devices which re only ccessible vi router connections or Wi-Fi bridges, plese keep in mind to upgrde the remote device first nd the locl device fterwrds. Plese see the LCOS reference mnul for instructions on how to upgrde the firmwre. We strongly recommend updting productive systems only fter internl tests in client environment. Despite intense internl nd externl qulity ssurnce procedures possibly not ll risks cn be eliminted by LANCOM Systems. Notes LCOS relese updtes including bugfixes nd generl improvements re vilble on regulr bsis for devices which do not support the ltest LCOS version. You cn find n overview of the ltest supported LCOS version for your device under Device-specific dvice LANCOM 178x 4G: To void delyed connection estblishments within mobile rdio (eg in cse of bckup) it is recommended to use the ltest firmwre version for the LTE mobile modem (Sierr MC-7710). Plese refer lso to the following Knowledgebse rticle: Link Using converter firmwres To use ny firmwre from version 8.8 in your LANCOM , 1724 nd in the L-320gn, L-321gn nd L-322gn (less thn hrdwre relese E), enough spce must be vilble in the memory of your device. Due to the implementtion of severl new fetures within the current build of the firmwre, it is no longer possible to store two min firmwre versions side by side. To gin more free spce for the current version, it is now necessry to uplod converter firmwre into your device. The converter-firmwre hs much smller size, so tht it is now possible to store the min relese of the firmwre besides the converterfirmwre. This setup is only necessry once for single device nd is done with the so-clled converter-firmwre (see redme.pdf of the ffected devices). After hving flshed the converter-firmwre the firmsfe function of the LANCOM device is vilble only on limited scle. The updte to newer firmwre is furthermore possible. However, in cse of n updte filure the LANCOM will only work with miniml-firmwre which llows just locl ccess to the device. Any extended functionlity, in prticulr remote dministrtion, is not possible when running the minimlfirmwre. LCOS RU9-EN LANCOM Systems GmbH, Wuerselen (Germny) Pge 19 of 20

20 Dynmic VPN registrtion By reson of ptent you hve to register the functionlity Dynmic VPN with IP ddress trnsmission over ISDN. This operting mode is usully required when you configure VPN tunnel with dynmic IP ddresses on both sides without dynmic DNS services. Any other Dynmic VPN opertion mode (e.g. trnsmitting the IP ddress vi ICMP, provoking cllbck etc.) does not require registrtion. The registrtion process is fully nonymous - no personl or compny dt will be trnsmitted. The registrtion of the Dynmic VPN option requires dministrtor rights on the LANCOM device. LCOS RU9-EN LANCOM Systems GmbH, Wuerselen (Germny) Pge 20 of 20