What s New in VPN-1 Power VSX NGX

Transcription

1 VPN-1 Power VSX NGX Scalability Pack Release Notes February 5, 2007 IMPORTANT Before you begin installation, read the latest available version of these release notes at: In This Document What s New in VPN-1 Power VSX NGX page 1 Information About This Release page 3 Resolved Limitations page 7 Clarifications and Known Limitations page 8 What s New in VPN-1 Power VSX NGX VPN-1 Power VSX NGX Scalability Pack (referred to in this document as VPN-1 Power VSX) has the following enhancements: ClusterXL Virtual System Load Sharing Resource Control Lightweight QoS ClusterXL Virtual System Load Sharing VPN-1 Power VSX provides the ability to distribute Virtual Systems on different members of a cluster, effectively spreading the Virtual System traffic load within the cluster. This cluster mode is called ClusterXL Load Sharing, and it provides the following benefits: Capacity - ClusterXL Load Sharing leverages the cluster machines to handle greater network volume by efficiently distributing the load between the machines. Copyright 2006 Check Point Software Technologies, Ltd. All rights reserved 1

2 Resource Control Redundancy - A ClusterXL Load Sharing cluster with n machines offers full redundancy by maintaining connectivity for all the Virtual Systems even when n-1 machines fail. Cost efficiency - A ClusterXL Load Sharing cluster requires only a standard Layer 2 switch to achieve load sharing. Configuration simplicity - Virtual Systems are automatically distributed among all the cluster members - no special configuration is required. Priority designation - Mission-critical Virtual Systems can be separated from the other Virtual Systems, providing advantages in terms of bandwidth and resources. System scalability - Every cluster member added to the cluster increases the overall system capacity and redundancy. Resource Control Resource Control for VPN-1 Power VSX provides the ability to manage the processing power of a VSX machine. As different Virtual Systems have different levels of criticalness, resource consumption, and security needs, the ability to manage and allocate available system resources by Virtual System can be an important component of a VSX deployment. By assigning a weight for each Virtual System, you can apportion the system s free CPU resources according to your deployment s specific needs. Virtual Systems of lower priority (lighter weight) can be guaranteed less CPU time, while busy or mission critical Virtual Systems can be assigned more. Resource Control thus provides the following benefits: By guaranteeing that each Virtual System will receive its minimum CPU allocation, no Virtual System can deny another access to the CPU. Any CPU resources that are not consumed by the Virtual Systems to which they are allocated are made available for use by other Virtual Systems, until they are needed. Note that Resource Control draws upon only the CPU resources available, after allocating whatever is necessary for other processes on the system. Lightweight QoS Check Point Lightweight QoS Enforcement for VPN-1 Power VSX provides the ability to control the network quality of service in the VSX network environment. Lightweight QoS supports the Differentiated Services protocol and allows assigning different transmission characteristics to different classes of service. The major characteristics VPN-1 Power VSX NGX Scalability Pack Release Notes. Last Update February 5,

3 New Device Support which are controllable by Lightweight QoS are latency and bandwidth allocation. Lightweight QoS is designed to provide QoS functionality with minimal impact on performance. Lightweight QoS works seamlessly with Check Point Performance Pack. For further information, see the VPN-1 Power VSX NGX Scalability Pack Administration Guide. New Device Support Support for the following devices is now available: IBM eserver BladeCenter HS20 Intel IXGB driver for the 10G network interface cards Intel PRO/1000 GT and other Intel network interface cards using the e1000 driver version and above Intel e1000 version network interface cards HP DL385 SmartArray P600, with the ccis driver, and PCI ID 103c:3220 (The onboard Broadcom NetXtreme II NIC, however, is not supported.) Dell PowerEdge 850 and DL2950 servers (Mega RAID SAS is not supported with the DL2950). Information About This Release This document contains important information not included in the documentation. Review this information before setting up VPN-1 Power VSX. In This Section License Upgrade Requirement page 4 Build Numbers page 4 Non-upgradable Products page 4 Minimum Hardware Requirements page 5 Unsupported Features page 5 The Regular Expression (RX) Library page 6 VPN-1 Power VSX NGX Scalability Pack Release Notes. Last Update February 5,

4 License Upgrade Requirement License Upgrade Requirement Licenses from previous VSX versions must be upgraded to VSX NGX. Licenses from previous versions are no longer valid. The license upgrade procedure can be performed if you have purchased any of the Enterprise Software Subscription services. License upgrade will fail for products and accounts for which you do not have software subscription. Log in to: to manage your accounts, licenses, and Enterprise Support Programs coverage (under SupportPrograms). Build Numbers The following table lists all VPN-1 Power VSX software products available, and the build numbers as they are distributed on the product CD. To verify each product s build number, use the given command format or direction within the GUI. Product Build No. CLI Command / GUI Selection SecurePlatform VSX B ver SVN Foundation B cpshared_ver VSX B fw ver Dynamic Routing B GateD -h Performance Pack B sim ver -k VPN-1 Power VSX gateways can be managed by SmartCenter or Provider-1 starting from version R62. Supported Platforms VPN-1 Power VSX is supported on the following platforms: VPN-1 Power VSX Gateways SmartCenter Management Provider-1 Management SecurePlatform VSX Solaris 8, 9 & 10 Solaris 8, 9 & 10 Crossbeam Red Hat Enterprise Linux 3.0 Red Hat Enterprise Linux 3.0 SecurePlatform Windows Server 2003, 2000 Advanced Server, 2000 Server SecurePlatform Non-upgradable Products The following Check Point products cannot be directly upgraded to VPN-1 Power VSX: VSX SmartCenter server VPN-1 Power VSX NGX Scalability Pack Release Notes. Last Update February 5,

5 Minimum Hardware Requirements VSX gateway To upgrade these products, you must first upgrade them to VSX NG AI. Minimum Hardware Requirements The minimum hardware requirements for a VPN-1 Power VSX gateway are: Processor Intel Pentium III CPU 1GHz or equivalent processor Free Disk Space 4GB Memory 256MB Network Interface Cards 3 (4 if you are planning to deploy a VSX cluster) Additionally, to install the Scalability Pack, each gateway must have either a bootable CD-ROM drive, or a floppy diskette drive and a CD-ROM drive, or a floppy diskette drive and access to a remote file server with the installation media. Maximum Number of Interfaces The number of interfaces that can be configured on a Virtual System is 64. Unsupported Features This release contains a number of unsupported features: Security Servers Network Address Translation (NAT) for MGCP ConnectControl Management of VSX objects via SmartLSM ClusterXL Multicast and Pivot mode (High Availability mode is supported) RADIUS Server for Office Mode IP assignment UserAuthority Server VPN Routing Interfaces (VTIs) CPMAD MEP SmartUpdate (for VSX software updates) L2TP clients SAM SSL Network Extender SmartView Monitor Remote Access Visitor Mode User / Client / Session Authentication Check Point QoS VPN-1 Power VSX NGX Scalability Pack Release Notes. Last Update February 5,

6 The Regular Expression (RX) Library The Regular Expression (RX) Library VPN-1 Power VSX uses the RX Library. The library license agreement (LGPL) can be downloaded from: VPN-1 Power VSX NGX Scalability Pack Release Notes. Last Update February 5,

7 Resolved Limitations Management This section contains previously documented limitations that now stand as resolved in this release. Management 1. When using advanced upgrade (upgrade_export, upgrade_import), it is no longer necessary to re-install the security policy on all virtual devices before using the vsx_util upgrade command to upgrade the modules. 2. When creating a Virtual Device, it is no longer necessary to make sure that its main IP address is not used as the main IP address for any other Virtual Device. 3. Defining Virtual Devices with the same name, even if the Virtual Devices are defined on different CMAs, is now supported. 4. When a VSX cluster member resides on a different subnet than the management server, it is no longer necessary to configure a default gateway for the VSX gateways in order for the VSX Cluster wizard to succeed. 5. Using the VSX Wizard to create VSX NG AI Objects pre-defined as NON-DMI is now supported. 6. Changing the anti-spoofing configuration of an unnumbered interface of a Virtual System is now supported. 7. When editing an unnumbered interface of a Virtual System, it is no longer necessary to recreate routes. 8. In previous versions, after creating a Virtual Router or Virtual Switch using the VSX Wizard, it was possible assign that same interface to a Virtual System. This issue has been resolved. 9. The command vsx_util add_member is now supported on Crossbeam clusters. Gateway 1. Administrators can now use the arp command to add and delete ARP entries for the VSX gateway as well as for Virtual Devices. 2. When installing this release on an IBM eserver BladeCenter HS20, the CD-ROM drive may not mount the CD in certain scenarios. To resolve this issue, when presented with the installation location dialog box, press OK to mount the CD-ROM and proceed. VPN-1 Power VSX NGX Scalability Pack Release Notes. Last Update February 5,

8 Management Clarifications and Known Limitations In This Section Management Management page 8 Gateway page 12 Provider-1/SiteManager-1 1. The CPD process may work irregularly if there is a problem in the file $CPDIR/database/session.NDB. Run cpstop (or stop the relevant CMA/CLM in a Provider-1 environment) and remove the problematic file. 2. Make sure that the IP address of the management object is set before running vsx_util or creating any Virtual Devices. 3. When attempting to delete a Virtual Device from a CMA, and the CMA database on which the VSX is defined is locked, the operation will fail, and an error message will be displayed. This is the proper behavior. However, this operation also causes the Virtual Device to disappear from the Tree view. To resolve this issue, restart SmartDashboard. 4. Deleting a VSX cluster or gateway is not supported when one of the Virtual Systems has Global Use enabled. Before deleting the VSX cluster or gateway, disable Global Use on the Virtual System. 5. After making changes to Global Policy, the policy must be installed manually to a VSX. 6. The vsx_util operation, when running on target CMAs, is limited by a timeout. When this timeout expires, the connection is disconnected. To increase the MDS session timeout, do the following: 1. Set the environment variable MSP_GLOBAL_LOCK_NOT_FORGOTEN_TIMEOUT to the required time interval in seconds. The default timeout is 360 seconds. 2. Restart the fwm mds with the commands mdsstop -m and mdsstart -m. 3. Run vsx_util. If the operation times out again, repeat the steps above to increase the timeout. When the vsx_util operation completes, it is recommended to re-institute the default timeout. To revert to the default timeout, do the following: VPN-1 Power VSX NGX Scalability Pack Release Notes. Last Update February 5,

9 1. Stop the mds with mdsstop -m. 2. Unset the MSP_GLOBAL_LOCK_NOT_FORGOTEN_TIMEOUT environment variable. 3. Restart the mds with the command mdsstart -m. SmartCenter Management 7. Selecting a group with exclusion is not supported on the Origin column in SmartView Tracker. 8. When working in management High Availability, and the secondary management is active, Virtual Systems cannot be created. 9. To establish trust with newly created Virtual Devices, the IP address of the management server must be routable from the VSX gateway. When a management server has more then one interface, make sure to select the IP address of the proper interface to serve as the management server's IP address. 10. A SmartCenter server managing a VSX gateway or cluster cannot be assigned a static NAT address. 11. The Install Database operation is not supported on Virtual Devices. 12. The Policy Uninstall operation is not supported on VSX clusters. 13. When the management interface of a VSX gateway is connected to a non-dmi Virtual Router, a connection cannot be established from the gateway context to the external network behind the Virtual Router. To resolve this issue, configure a manual route on the Virtual Router with the VSX cluster IP address as its destination. 14. NAT rules referring to a cluster s virtual IP address are not enforced. To use NAT rules with a cluster s virtual IP address, do the following 1. Edit the file /opt/cpxxxx/fw1/lib/table.def on the management machine, where CPxxxx is the directory name for the appropriate backward compatibility package of the gateway being managed. (Note: In a typical scenario, where the management and gateway are the same version, the path is $FWDIR/lib/dcom.def). 2. Add an entry with the relevant destination port and protocol to the field no_fold_services_ports. VPN-1 Power VSX NGX Scalability Pack Release Notes. Last Update February 5,

10 SmartDashboard Management 15. When changing the topology of a specific Virtual System (e.g. adding/removing an interface, changing an IP address, changing routes), the change will take effect only after installing policy on that Virtual System. This means that after deleting a warp interface, the cphaprob -a command continues to show the warp interface until the next policy installation. 16. After creating a VSX gateway or cluster, its IP address cannot be changed. 17. The name of a Virtual Device should not exceed 64 characters. In cluster scenarios, the Member Virtual Device name is a composite of the Member name and the Cluster Virtual Device name. This could result in a Virtual Device name which contains more than 64 characters. 18. After resetting the SIC for a VSX gateway or cluster member, reinstall policy. 19. When defining NAT routes on the Topology tab of the Virtual System, insert two IP addresses, the first and last address of the IP range used for NATing. Note that large ranges can result in a slow response from the SmartCenter server. 20. When adding NATed addresses to the topology of a Virtual System, only address ranges are supported. To add a single IP address or an IP subnet, define it as an address range. 21. The names of network objects created in SmartDashboard: can contain numbers but not begin with them can contain the letters from a-z, upper or lower case cannot use the hyphen (-) character 22. When creating an NG AI Virtual Device, the main IP address of the Virtual Device should be routable from the management server. 23. When configuring a host object as a Web Server in a deployment that contains configured Virtual Systems, on the Web Server tab, set the Protected by field to contain targets that do not include Virtual Systems. 24. Editing the name of the VSX management interface is not supported. 25. DNS traffic is not accelerated by SecureXL on a VSX gateway. To accelerate DNS traffic, do the following: a. In SmartDashboard, select Manage > Services. b. Edit the service domain-udp. c. Select Advanced. d. For Protocol Type, select None. This removes DNS enforcement for this service on the Virtual System. VPN-1 Power VSX NGX Scalability Pack Release Notes. Last Update February 5,

11 e. Click OK when needed to save the changes. f. Install policy. Note that this setting affects all gateways managed by the CMA/SmartCenter. To reactivate DNS enforcement, repeat the above steps, and in step d select DNS_UDP. Management 26. When activating the General HTTP Worm Catcher SmartDefense protection on a VSX gateway, all HTTP traffic is scanned for worms, regardless of the scope. 27. Propagating routes from Virtual Routers to Virtual Systems is not supported. 28. The following operating systems are not supported in this release, even though they appear in the possible choices for OS when editing a Virtual Device in SmartDashboard: BladeFusion Nokia Nortel 29. When editing a VSX gateway or cluster object using the Creation Templates tab, you can only switch to a Customized Virtual System. Please note that this act is irreversible. 30. Changes to the connection limit on a Virtual System (using the Capacity Optimization tab) take effect on a gateway only after a policy is installed on that Virtual System. Make sure that you install a policy on all affected gateways after changing the connection limit. 31. To block the metasploit msrpc_dcom_ms03_026, do the following: 1. Edit the file /opt/cpxxxx/fw1/lib/dcom.def on the management machine, where CPxxxx is the directory name for the appropriate backward compatibility package of the gateway being managed. (Note: In a typical scenario, where the management and gateway are the same version, the path is $FWDIR/lib/dcom.def). 2. Search for the term sr12 = 0x Replace it with sr12 = 0x0004 or sr12 = 0x0000. Policy Installation 32. Policy cannot be installed on more then 10 Virtual Systems simultaneously. VPN-1 Power VSX NGX Scalability Pack Release Notes. Last Update February 5,

12 Gateway Gateway 33. When using the fw commands of the VSX gateway CLI, the -vs switch should not be used together with the vsx option. For example: fw -vs 11 vsx fetch should be avoided. 34. To enable the synchronization of routing information between cluster members, the policy on the VSX cluster must allow communication between cluster members on TCP port The VLAN tag 4094 is not supported. 36. When adding a Virtual Switch, the state of the standby cluster member will change to down for a short period of time. 37. Prior to defining VSX objects on a VSX NGX SmartCenter server, make sure that the SmartCenter server and the clocks on the VSX gateways are synchronized. Lack of synchronization prevents the policy installation phase of the VSX Wizard from completing successfully. 38. Restarting the network service using the command service network restart is not supported. 39. When working in a cluster environment, the router-id of each Virtual System and Router must be configured to a unique value. Run the following commands from the GateD command line: 1. configure terminal 2. ip router-id a.b.c.d 40. Only one instance of the fw monitor command can be run at any one time. Running more than one instance will result in incorrect output. 41. The cpshell command snmp is not supported. For SNMP operations, use the command service snmpd from expert mode. 42. To use securid authentication where the Virtual System uses its own cluster IP address to connect to the ACE/Server, do the following: 1. Create a file named sdopts.rec, and enter the cluster IP address of the Virtual System. 2. Add this file to the directory $FWDIR/CTX/CTX0000X/conf. 3. Restart the process vpnd on the Virtual System. 43. The commands cpstop and cpstart must be run from VRF-0; running these commands from other VRFs is not supported. 44. The From Template option for LDAP account users is not supported for SecureClient users authenticating to a Virtual System. VPN-1 Power VSX NGX Scalability Pack Release Notes. Last Update February 5,

13 To resolve this issue, perform the following steps: Gateway 1. Open the LDAP User Properties window. On the Encryption tab, deselect the From Template option. 2. Use a pre-defined LDAP template from the LDAP server. 45. When configuring OSPF to run between a Virtual Router and a Virtual System that are directly connected, an automatic OSPF route to the Virtual Router's cluster IP address is added to the Virtual Router, with the next hop being the Virtual System's wrp. This route is harmless and can be ignored. 46. When configuring OSPF between a Virtual Router and a Virtual System connected to it, routes that are published between them have a cost of 20 instead of the default 10. A workaround is to configure a cost of 5 on both the Virtual Router's wrpj interface and the Virtual System's wrp interface. From the command line of the router, enter the following commands: interface wrpxxx ip ospf cost 5 exit interface wrpjxxx ip ospf cost 5 exit 47. When enabling Single Virtual System Failover, each Virtual Switch must have a physical interface that provides connectivity between cluster members. 48. Dynamic Routing does not support SNMP in this release. 49. To change the shell context from some Virtual Device context to the VSX gateway's context, use the number "0", as in fw vsx set 0. Do not use the VSX gateway's name. 50. When working with a non-dedicated management interface, you cannot add new members to an existing VSX cluster using the vsx_util command. 51. To avoid warning messages during policy installation, interfaces defined on a Virtual System or Virtual Router should be associated with a route. 52. When creating, deleting or updating a Virtual System, Switch, or Router, the database of the CMA containing the VSX gateway is locked. Attempting to connect to the CMA via SmartDashboard results in a message to that effect, and selecting Disconnect will not unlock the database. The connection to the CMA may be resumed when the operation finishes. 53. When configuring PIM between a Virtual System and a Virtual Router, configure a unicast dynamic routing protocol to: VPN-1 Power VSX NGX Scalability Pack Release Notes. Last Update February 5,

14 Gateway 1. run between the Virtual System and the Virtual Router 2. redistribute kernel routes 3. make all of the routes that are learned eligible in the multicast RIB. 54. When two Virtual Systems with internal IP addresses that originate from identical subnets (i.e. overlapping subnets) are connected through a Virtual Switch, the internal interface of one of the Virtual Systems cannot be propagated. 55. Do not use the command if config <interface_name> down on a VSX interface in order to simulate a failover. 56. When using ClusterXL Load Sharing, the file $FWDIR/boot/modules/fwkern.conf must contain the line fwha_monitor_all_vlans= All the interfaces of a Virtual System in bridge mode must have the same VLAN ID. 58. After using the commands vsx_util reconfigure or vsx_util add_member_reconf, reboot the target gateway. 59. When working with ClusterXL Load Sharing, Virtual Routers are not supported, and should not be created. 60. Connections from Virtual Devices in the Backup state cannot be initiated. 61. When running VSX with ClusterXL Load Sharing, bridge mode is not supported. 62. Running the command fw fetch local during policy installation is not supported. 63. Make sure that all VSX cluster members have identical hardware. 64. When running the command vsx resctrl stat, the columns 1 hour and 24 hours will display the relevant information only when the Resource Control monitor is active for more than 1 hour and 24 hours, respectively. 65. In some cases, after adding a member to a cluster in ClusterXL Load Sharing mode, and running the command vsx_util redistribute, the distribution of Virtual Systems among the members is not as expected. To resolve this issue, do the following: 1. Open GuiDBedit and select Network-object. 2. Select the cluster object and change the parameter HA_mode to Higher UP. 3. Reinstall policy on the VSX. 66. Check Point QoS and Resource Control are not supported simultaneously on the same VSX cluster. One or the other can run, not both. 67. NAT and VPN are not supported for Virtual Systems in bridge mode. 68. The cprestart command is not currently supported. Use the cpstop and cpstart commands instead. VPN-1 Power VSX NGX Scalability Pack Release Notes. Last Update February 5,

15 Gateway 69. Using LDAP user groups in Desktop Policy rules is not currently supported. 70. The cphastop and cphastart commands are not currently supported. Use the cpstop and cpstart commands instead. 71. Unidirectional UDP sessions on Virtual Systems in bridge mode cannot be accelerated. 72. For DHCP relay to work properly, add the interface that is closest to the server as the last interface in the list of interfaces in the dhcrelay-vrf<vsid> file. The file is found in the directory /etc/sysconfig/dhcrelay.vrf/. 73. SNMP status information can only be retrieved from a VSX gateway, or Virtual Devices on a VSX gateway, using the VSX gateway's IP address. 74. The command reset_gw is not supported. 75. While reconfiguring a member, the warps of the other members are erroneously reported as down in the output of the command cphaprob -a if. When reconfiguration finishes, the command reports the proper statuses. 76. When working with more then 4096 hosts directly connected to a VSX gateway (on all Virtual Systems), use a text editor to open the file /etc/sysctl.conf, and change the parameter net.ipv4.neigh.default.gc_thresh3 to be greater than the number of hosts. VSX ClusterXL 77. In a cluster environment, it is not possible to use the SecurePlatform backup utility with the TFTP option on the standby member from an interface which uses the automatic member IPs option. To backup to a TFTP Server, configure the interface with the automatic member IPs option disabled. 78. If the external interface of a Virtual Switch in a cluster configuration is connected to a network without hosts or routers, rebooting a cluster member will cause the cluster to failover when the cluster member recovers. 79. To prevent a Virtual System in bridge mode from creating loops in a clustered environment, a spanning tree protocol is required. 80. In a deployment where Virtual Systems are hosted on a cluster and connected only to Virtual Switches (and have no other VLAN or physical interfaces), a problem with the sync interface will interrupt communication between the cluster members. Running the command cphaprob stat on other cluster members will indicate that they are in the Down state, when in fact the Virtual Systems are in the Active state on all members. As a result, the cluster will not function properly. To prevent this issue, it is recommended to use multiple sync interfaces in a cluster environment. 81. When disabling or enabling ClusterXL Load Sharing, the gateway must be restarted. VPN-1 Power VSX NGX Scalability Pack Release Notes. Last Update February 5,

16 Gateway 82. Only two interfaces are supported for Virtual Systems in bridge mode when used in conjunction with ClusterXL. 83. RIP version 1 is not supported on VSX. 84. After removing a member, it is necessary to run the commands cpstop and cpstart on the remaining members. This action can be done one by one; it is not necessary to restart them all simultaneously. Platform Specific SecurePlatform 85. When configuring a new VSX gateway or cluster on an IBM xseries 346 machine, the onboard NICs are not displayed in the Physical Interface list. To resolve this issue, click Next, then Back. The onboard NICs will now be displayed. 86. Checking link status on the VLAN trunk interface using the command mii-tool is not supported. 87. Routing protocols cannot be configured on a Virtual System that is in the backup state (ClusterXL in Load Sharing mode only). To configure dynamic routing on a Virtual Device on a ClusterXL cluster member in Load Sharing mode, do the following: 1. Configure the primary and standby Virtual Systems with the identical configuration parameters using the CLI. 2. Log in to the backup Virtual System as an Expert. 3. Copy /etc/gated<vsid>.ami from the VSX member on which the active Virtual system is hosted to the member hosting the backup Virtual System. SecureXL 88. When using ClusterXL and SecureXL, making a change to the notification delay for TCP services via SmartDashboard is ignored. To resolve this issue, set the desired delay time via one of the following methods: Edit the file fwkern.conf and set the parameter cphwd_delayed_notif_default_tmo=time. Run the command fw ctl set int cphwd_delayed_notif_default_tmo <time> The default delay time is five seconds. 89. Sequence Verifier and SecureXL are not supported simultaneously. One or the other can run, not both. VPN-1 Power VSX NGX Scalability Pack Release Notes. Last Update February 5,