Information regarding

Transcription

1 Informtion regrding LCOS Softwre Relese RC2 Copyright (c) LANCOM Systems GmbH, Wuerselen (Germny) LANCOM Systems GmbH does not tke ny gurntee nd libility for softwre not developed, mnufctured or distributed by LANCOM Systems GmbH, especilly not for shrewre nd other extrneous softwre. LANCOM Systems GmbH Adenuerstrsse 20 / B Wuerselen Germny Internet: , CBuersch Tble of Contents 1. Prefce New Fetures, improvements, nd history... 3 LCOS Rel... 3 LCOS RC LCOS RC Importnt dvice Bcking up the current configurtion Notes Device-specific dvice Using converter firmwres Dynmic VPN registrtion LCOS RC2-EN LANCOM Systems GmbH, Wuerselen (Germny) Pge 1 of 11

2 1. Prefce LCOS ( LANCOM Operting System ) is the operting system for ll LANCOM routers, wireless LAN ccess points nd Wi-Fi controllers. In the context of the hrdwre given by the products the t time ltest LCOS version is vilble for ll LANCOM products nd is vilble free of chrge for downlod from LANCOM Systems. This document describes the innovtions within LCOS softwre relese RC2, s well s the improvements since the previous version. Before upgrding the firmwre, plese py close ttention to chpter 3 of this document. Ltest support notes nd known issues regrding the current LCOS version cn be found in the support re of our website LCOS RC2-EN LANCOM Systems GmbH, Wuerselen (Germny) Pge 2 of 11

3 2. New Fetures, improvements, nd history Devices delivered with LCOS or higher utomticlly connect to the LANCOM Mngement Cloud (LMC). This functionlity provides zero-touch instlltion for new devices. In cse you do not wnt to use the LMC, this feture cn be disbled while running the defult setup wizrd for the initil configurtion, or t ny time from within LANconfig under Mngement > LMC. You cn mnully re-enble the usge of the LMC whenever you wnt. LCOS Rel Bugfixes / improvements Generl After restrt of the LANCOM device ll ports remined in disbled sttus, lthough Spnning Tree ws ctivted. An LMC domin which ws llocted per DHCP option ws ignored by the LANCOM device when it ws working s DHCP client. An ADSL connection with encpsultion VC-MUX nd trnsprent Lyer-2 (insted of PPPoE) could not be estblished successfully. After the lese time expirtion no new IP ddress ws obtined by n Internet remote sttion with lyer DHCPoEoV, nd the connection ws temporrily cut. If server in the DMZ ws sending too big pckets (bigger thn the MTU of the trget remote sttion) with ctivted DF bit (don t frgment) to LANCOM router, the router did not nswer with n ICMP error messge frgmenttion needed nd discrded these pckets. If VLAN ID ws stored in the network definition of the LANCOM Mngement Cloud which ws bigger thn 999, this configurtion ws not ccepted, lthough VLAN IDs up to 4096 re llowed in network definitions. If n NTP server ws configured within the network INTRANET, the configurtion of the device could not be written bck by LANconfig fter ny configurtion chnge. Within bridge group (e.g. BRG-1), routed multicsts (e.g. video strems to DSL-1) were bridged to the interfce LAN-1 pst the IGMP snooping nd to WLAN-1, too, if client ws registered to the wireless network. This cused the wireless network to be flooded with multicst pckets with incresing Wi-Fi chnnel lod, resulting in wireless connection which ws not performing well. In VRRP lod blncing scenrio with RIP, ICMP redirects were sent with the source IP ddress of the ARF context insted of the VRRP IP ddress. No dt ws trnsmitted through n EoGRE tunnel which hd not been llocted ny bridge goup under interfces > LAN > Port tble. Wi-Fi By AutoWDS, no point-to-point connection could be estblished between LANCOM ccess points. The configured ccess points for AutoWDS were shown under the pproprite SSID in LANmonitor, but no connection could be estblished. Clients which were registered initilly to the LANCOM Public Spot could not connect to the WAN, becuse DNS requests of the initil domin were not forwrded to the preceding device (which provided WAN ccess). When reding the configurtion of LANCOM WLAN controller by LANconfig the wireless IDS profile Defult" ws not red, which cused tht the configurtion dt could not be written bck to the LANCOM WLAN controller. LCOS RC2-EN LANCOM Systems GmbH, Wuerselen (Germny) Pge 3 of 11

4 VoIP If WEBconfig s Configure Voice-over-IP / All-IP" setup wizrd ws used for configuring n All-IP connection, the configured ISDN interfce remined in off sttus fter the wizrd ws finished. If the busy on busy function ws enbled for user within the user settings of the LANCOM Voice Cll Mnger (Voice Cll Mnger > Users > User Settings), this user could not receive ny clls. VPN & Routing An IKEv2 connection with digitl signture profile RSASSA-PSS with SHA-384 nd SHA-512" could not be estblished. If no IPv4 ddress pool ws creted for n IKEv2 client connection, n IKEv2 client who got n IP ddress by the LANCOM router vi IKE config mode did not get DNS server entry. The LANCOM router lloctes its own IP ddress s DNS server ddress to the IKEv2 client if no IPv4 ddress pool ws creted. On n IKEv2 connection which ws uthenticted by IKEv2 RADIUS no outgoing dt ws sent fter 24 hours. The lifetimes for RADIUS uthentiction hd not been pplied correctly by the LANCOM router. Only UDP nd ICMP pckets were trnsmitted through n estblished VPN tunnel on n IKEv2 connection with AES-GCM encryption. TCP connections did not work t ll (SSH, HTTPS etc.). If the commnd show vpn ws entered on the commnd line of LANCOM router, the output displyed VPN rules of configured IKEv2 connection s IKEv1 rules. If msked IKEv2 VPN connection between two LANCOM routers ws estblished with one-sided trnsprently ccessible DMZ (msking settings only Intrnet"), the DMZ ws msked, too. Dynmic VPN connections (IKEv1 vi UDP) between two LANCOM routers with privte IP ddress on the Internet connection for the dynmic site (behind NAT router) could not be estblished. A dynmic VPN connection vi ICMP worked. LCOS RC2-EN LANCOM Systems GmbH, Wuerselen (Germny) Pge 4 of 11

5 LCOS RC2 New Fetures Generl WAN ccess vilbility cn now be configured for the COM port server Dynmiclly generted VLAN memberships cn be shown on the CLI using the show vln commnd. Updted service lists for the Lyer 7 ppliction detection The Lyer 7 ppliction detection now supports QUIC session detection. Support for Ethernet OAM bsed on 1TR112 Wi-Fi The driver for the IEEE c Wve1 Wi-Fi module of the following devices hs been updted: LN-630cn dul Wireless, LN-830cn dul Wireless, LN-822cn dul Wireless, LN-830E Wireless, L-1310cn dul Wireless, L-1302cn dul Wireless, IAP-821, IAP-822, OAP-821, OAP-822, OAP-830 VoIP Busy-on-Busy is now configurble for cll groups Bugfixes / improvements Generl The ctegory Cloud pplictions ws defined s forbidden within three defult Content Filter profiles. This ws now chnged to llowed. The time which is periodiclly set by the LANCOM Mngement Cloud (LMC) ws overwritten by WLAN controller within the sme network while nnouncing the time to mnged LANCOM ccess point. The option for configuring the LACP interfces Bundle-1 nd Bundle-2 ws missing in the configurtion interfce of the LANCOM 1783VAW. VPN & Routing If VPN connections using AES-GCM encryption were terminted on LANCOM router, the vlues for the columns Crypt-Alg nd Hsh-Alg were missing in the LCOS tble /Sttus/VPN/ESP. If only defult routes with routing tg different from 0 were configured on LANCOM Router, IKEv2 connections could not be estblished, if the IKEv2 peer ws not recognized by its IP ddress. Further IPSec rules were creted if solely super ordinte IPSec rule (e.g. ANY-to-ANY) ws defined for VPN remote sttion, but lso one or more N:N NAT entries were defined for this VPN remote sttion, which included the super ordinte IPSec rule. LCOS RC2-EN LANCOM Systems GmbH, Wuerselen (Germny) Pge 5 of 11

6 Wi-Fi The country profile Austrli hs been fixed. ARP pckets re now trnsmitted relibly when using the client bridge mode with IEEE c cpble Wi-Fi modules. If profiles were defined under Public-Spot > Wizrd > Bndwidth profiles, the ccording vlues were displyed swpped lter in the wizrd nd on the voucher. The IEEE c module of LANCOM ccess point ws sending becons with dt rte of 1 Mbps in the 2.4 GHz bnd in gn/mixed mode, s well s in Greenfield mode. This led to becons being visible even on n b client, lthough the b mode ws disbled in the ccess point configurtion. No logout link is shown on the sttus pge for the Public Spot uthentiction mode login vi greement. On the login pge of the Public Spot gtewy the pge contining the terms of use could not be displyed for pple clients, if the Public Spot uthentiction method ws set to Login dt will be sent by e-mil / SMS. If Public Spot ws operted on router with Wi-Fi module, nd n ccess point within the sme network brodcsted the Public Spot SSID, too, the entry for client ws deleted from the uto relogin tble if the client ws roming from the router to the ccess point. This cused n dditionl login to the Public Spot. A negtive vlue ws shown in LANmonitor for mnged ccess points fter rdio field optimiztion on LANCOM WLAN controller. VoIP Unidirectionl communiction could occur while operting VoIP line (SIP trunk) over BNG s internet connection nd using n ISDN phone system behind LANCOM VoIP router. The internl ISDN user could not her the externl subscriber nymore. Phone clls from n internl SIP phone system vi LANCOM VoIP router to Deutsche Telekom SIP trunk line were disconnected fter pprox. 15 minutes. If one or more prefixes for internl clls were configured in the menu Voice-Cll-Mnger > Advnced, the configured prefix ws not dded to the source cll number. Thus, n outgoing cll could not be estblished. After successful registrtion of SIP line vi IPv6 incoming clls did not work due to INVITE pckets were nswered with ICMP port unrechble by the firewll of the LANCOM VoIP router. This hppened even though n existing inbound firewll rule ws configured for the SIP server. LCOS RC2-EN LANCOM Systems GmbH, Wuerselen (Germny) Pge 6 of 11

7 LCOS RC1 Currently, devices running LCOS RC1 cn not be configured or mnged vi the LANCOM Mngement Cloud. New fetures Generl LACP - virtul ethernet port bundling for mximized relibility Public Spot support for the LANCOM vrouter Commnd for switching the firmwre with utomtic device restrt File import per Copy & Pste Smrt Ticket / SMS - Whitelist for re codes Elimintion of the port 8080 for WEBconfig nd Public Spot Content Filter enhncements by further ctegories IPv6 support for the Content Filter VPN & Routing IKEv2 Lod Blncer for lod blncing of incoming VPN connections Freely configurble DHCPv6 options OSPFv2 OCSP check in the TLS / Rollout wizrd Switchble Not-HTTPS communiction vi port 443 in the Content Filter Support of AES-GCM for IKEv2 Support of the elliptic curve Diffie-Hellmnn groups (ECDH) 19, 20, 21, nd the ECC Brinpool curves 28, 29, nd 30 for IKEv2 Support of RADIUS CoA for IKEv2 Lod Blncer for IKEv2 Mximum VPN vilbility thnks to dditionl bckup mechnics Support for TACACS shell uthoriztion Vribles for IPv6 LAN ddress nd prefix in the ction tble ICMPv4 nd ICMPv6 rte limiting Support for MD5 in NTP client nd server NTP server for ech ARF net vilble Wi-Fi Multicst > Unicst trnsformtion for Judder-free IPTV streming in the Wi-Fi As of now, the menus for the Public Spot configurtion re generlly vilble within LCOS, but cn only be used fter successful ctivtion of the Public Spot option x: Avilbility check for RADIUS server c Wve 2 fetures configurble vi WLC Coordinted Wireless epper chnnel selection VoIP The SIP user ID field cn now be configured Overlp Diling for fster connection estblishment LCOS RC2-EN LANCOM Systems GmbH, Wuerselen (Germny) Pge 7 of 11

8 Bugfixes / improvements Generl If the vlidity of n RA certificte ended before the vlidity of the CA certificte, the SCEP client did not updte the RA certificte. If the spnning tree functionlity on LANCOM ccess point ws enbled by LANconfig, this chnge ws not sved correctly, so spnning tree ws not enbled fter sving the device s configurtion. When uploding vrouter configurtion per WEBconfig, the configurtion prmeters were only pplied completely fter wrm boot of the vrouter following the uplod. When using bckup RADIUS server for device uthentiction the login ws checked on the bckup server first, insted on the primry RADIUS server. If the DHCP client did restrt within the time of the DHCP request, it could occur tht the LANCOM DHCP server did not llocte n IP ddress to this client fter its restrt. In this cse, the DHCP trce log displyed the messge "ARP in progress". Proxy-ARP did not work for communiction between identicl IP networks which re mnged by the LANCOM device. On n internet connection, which ws configured s DS-Lite, LANCOM device did not use its IPv6 WAN ddress for IPv6 pckets, but its IPv6 LAN ddress s sender ddress in some cses. A sudden device restrt could occur if periodic 300 seconds request ws configured in the LCOS CRL client (LANconfig: "Certifictes -> CRL-Client: Retrieve regulrly (per CRL)") nd the CRL client could not fetch the CRL (e.g., due to n error of the externl CA). The tble "Setup/DNS/DNS-Destintions" (LANconfig: IPv4 -> DNS -> Forwrding) ccepted only vlues smller or equl thn 999 for the prmeter "Rtg-tg" (Routing tg). The tbles for configuring bckup nd ccounting were missing in the LANCOM vrouter under "/Setup/WAN". If the commnd "show script" ws entered on the CLI, the output did not contin sesseion ID, so running scripts could not be stopped by using the commnd "killscript <Session-ID>". The setup menu (/Setup/WAN/RADIUS) for uthenticting vi externl RADIUS server ws not vilble in the LANCOM vrouter. An xdsl connection could not be stopped immeditely, if the pproprite DSL remote sttion ws detched from the configurtion by script. Invoking the user-defined rollout wizrd could led to sudden device restrt, if more item vlues thn item texts were defined in the rollout wizrd s list box. VPN If DHCP request should be forwrded vi VPN tunnel which got its IP ddress by config mode, the config mode ddress ws set s GI ddress in the DHCP heder. If n existing VPN connection ws disconnected by delete informtion, the VPN debug trce did not show ny informtion bout the disconnect reson. Nme descriptors for two configurble prmeters were missing in the WEBconfig configurtion dilogue for IKEv2 rekeying prmeters (Configurtion -> VPN -> IKEv2/IPSec -> vlidity period). If n IKE connection which should be estblished between vrouter nd VPN router ws monitored by DPD, frequent disconnections due to DPD timeout did occur. DPD ws not executed properly on the LANCOM vrouter. LCOS RC2-EN LANCOM Systems GmbH, Wuerselen (Germny) Pge 8 of 11

9 Wi-Fi The trigger for re-initilizing SCEP client could fil when the client ws currently initilizing. The vlue for limiting the dt volume for utomticlly generted Public Spot users in the pth "/Setup/Public-Spot-Module/Authentiction-Modules/User-Templte/Volume-Budget" ws limited to mximum of Mbytes. When creting Public Spot users by HTTP commnd, commnd which ws included within the URL ws not pplied to the creted user profile. A sudden device restrt could occur if the ccess point provided WLC tunnel (CAPWAP dt tunnel) for Wi-Fi clients nd tried to provide n ICMP pcket frgmenttion needed to Wi-Fi client,becuse the received dt pcket ws too big for the CAPWAP dt tunnel. VoIP If cll ws estblished vi n ISDN phone system which is connected to the internl ISDN interfce of the LANCOM router, nd hs configured cll forwrding to externl numbers, unidirectionl communiction could hppen, if the cll ws finlly forwrded to the provider vi SIP by the VCM. A country code strting with + (e.g. +49 for Germny) ws not converted to the formt 0049 by the LANCOM Voice Cll Mnger on outgoing clls, so tht n ISDN phone sttion ws not ble to evlute the cll number. If SIP line ws disconnected on the CLI using the commnd "do /other/mnul-diling/disconnect <Connection>", the LANCOM Voice Cll Mnger ws not informed bout tht. This resulted in showing lines which used this connection still s being registered. Outgoing clls vi SIP provider M-net could not be estblished, becuse the provider requires second uthentiction fter uthentiction vi "INVITE", nd "PRACK", too. If VoIP provider nswered 400 Bd Request to SIP line de-registrtion, the LANCOM Voice Cll Mnger could not interpret this error messge correctly, so the de-registrtion ws constntly repeted. If cll group ws intended to be used s bckup line, e.g. for connection to telephone system, this entry did not work. A SIP session which ws tgged with routing tg by firewll rule nd mnged by the SIP ALG, could not be estblished, becuse the nswer pckets were tgged with the sme tg by the SIP ALG, nd thus were discrded by the IP router. A SIP line which ws registered using OPTIONS pckets ws interpreted s non-registered line by the SIP ALG, so incoming clls (INVITE pckets) could not be ssigned correctly. Due to the prmeter "trnsport=udp" in the contct heder of SIP pcket some locl SIP clients lost their registrtion to the LANCOM VoIP router fter few minutes. An infrequent issue with LANCOM VoIP routers occured t clls with the involvement of the LANCOM N510 DECT sttion. If n externl cll on SIP line reched the LANCOM VoIP router nd ws nswered internlly by hndset of the LANCOM N510 DECT, the cller could her the internl user, but the internl user could not her the cller. A sudden device restrt could occur if the received OK pcket on SIP line did not contin n EXPIRES vlue within the CONTACT heder. Unidirectionl communiction could infrequently occur if n incoming cll vi SIP line ws signlled by the LANCOM VoIP router to more thn two interfces (ISDN nd nlog interfces). A SETUP, which ws received on the ISDN nd did contin trget number of type "Ntionl Number", ws not completed with zeroes by the cll routing, like it is the cse with numbers of type "Interntionl Number". Thus, cll routing using service numbers did fil. After n nlog cll ws finished, it remined in the cll counter tble of the LANCOM VoIP router in some cses. A Linphone SIP client ws rejected while registering t the Voice Cll Mnger (VCM) due to client specific prmeters within the registrtion. LCOS RC2-EN LANCOM Systems GmbH, Wuerselen (Germny) Pge 9 of 11

10 3. Importnt dvice Bcking up the current configurtion Before upgrding your LANCOM devices to new LCOS version it is essentil to bckup the configurtion dt! Due to extensive fetures it is not possible to downgrde to previous firmwre without using the bckup configurtion. If you wnt to upgrde devices which re only ccessible vi router connections or Wi-Fi bridges, plese keep in mind to upgrde the remote device first nd the locl device fterwrds. Plese see the LCOS reference mnul for instructions on how to upgrde the firmwre. We strongly recommend updting productive systems only fter internl tests in client environment. Despite intense internl nd externl qulity ssurnce procedures possibly not ll risks cn be eliminted by LANCOM Systems. Notes LCOS relese updtes including bugfixes nd generl improvements re vilble on regulr bsis for devices which do not support the ltest LCOS version. You cn find n overview of the ltest supported LCOS version for your device under Device-specific dvice LANCOM 178x 4G: To void delyed connection estblishments within mobile rdio (eg in cse of bckup) it is recommended to use the ltest firmwre version for the LTE mobile modem (Sierr MC-7710). Plese refer lso to the following Knowledgebse rticle: Link Using converter firmwres To use ny firmwre from version 8.8 in your LANCOM , 1724 nd in the L-320gn, L-321gn nd L-322gn (less thn hrdwre relese E), enough spce must be vilble in the memory of your device. Due to the implementtion of severl new fetures within the current build of the firmwre, it is no longer possible to store two min firmwre versions side by side. To gin more free spce for the current version, it is now necessry to uplod converter firmwre into your device. The converter-firmwre hs much smller size, so tht it is now possible to store the min relese of the firmwre besides the converterfirmwre. This setup is only necessry once for single device nd is done with the so-clled converter-firmwre (see redme.pdf of the ffected devices). After hving flshed the converter-firmwre the firmsfe function of the LANCOM device is vilble only on limited scle. The updte to newer firmwre is furthermore possible. However, in cse of n updte filure the LANCOM will only work with miniml-firmwre which llows just locl ccess to the device. Any extended functionlity, in prticulr remote dministrtion, is not possible when running the minimlfirmwre. LCOS RC2-EN LANCOM Systems GmbH, Wuerselen (Germny) Pge 10 of 11

11 Dynmic VPN registrtion By reson of ptent you hve to register the functionlity Dynmic VPN with IP ddress trnsmission over ISDN. This operting mode is usully required when you configure VPN tunnel with dynmic IP ddresses on both sides without dynmic DNS services. Any other Dynmic VPN opertion mode (e.g. trnsmitting the IP ddress vi ICMP, provoking cllbck etc.) does not require registrtion. The registrtion process is fully nonymous - no personl or compny dt will be trnsmitted. The registrtion of the Dynmic VPN option requires dministrtor rights on the LANCOM device. LCOS RC2-EN LANCOM Systems GmbH, Wuerselen (Germny) Pge 11 of 11