ArrayOS TM Release Note

Transcription

1 Introduction ArrayOS TM Release Note Update Date: May 11, 2012 This release note summarizes the new features, general enhancements, resolved issues and known limitations for ArrayOS TM Contacting Customer Support To contact Array Networks, Inc. Customer Support, please call or the team at Additional Information: Array Networks, Inc McCarthy Blvd. Milpitas, CA Phone: (408) Toll Free: MY-ARRAY Fax: (408) Telephone access to Array Networks, Inc. is available Monday - Friday, 9 A.M. to 5 P.M. PST. Array Networks, Inc. All Rights Reserved. 1

2 Table of Contents WHAT S NEW... 3 vapv - APV Virtual Edition... 3 TCP Option Optimization... 4 TLS1.2 Support for SSL Virtual Hosts... 6 LLB Bandwidth Management Optimization... 7 SDNS Manual and Batch Switchover... 8 ENHANCEMENTS Secure Socket Layer (SSL) Link Load Balance (LLB) Global Server Load Balance (GSLB) General System/Tools RESOLVED ISSUES Server Load Balance (SLB) Secure Socket Layer (SSL) Global Server Load Balance (GSLB) General System/Tools WebUI KNOWN LIMITATIONS Server Load Balance (SLB) Global Server Load Balance (GSLB) Array Networks, Inc. All Rights Reserved. 2

3 WHAT S NEW vapv - APV Virtual Edition From ArrayOS TM , Array Networks introduces the APV Virtual Edition Application Delivery Controller - vapv. Powered by Array s award winning 64-bit SpeedCore ADC platform, the vapv extends Array APV s value and rich features to virtual datacenter environments in the enterprise and to cloud service providers. The vapv brings flexibility and agility for application services running in virtual environments, delivering on-demand scalability, availability, security and acceleration for both production and test workloads. The vapv is the same as the physical APV appliance from a functional perspective. The only difference lies in that the vapv runs in a virtual machine on industryleading hypervisors, while APVs are hardware appliances. Highlights & benefits Multi-processor parallel traffic management architecture for industry-leading performance and scalability. Load balancing, caching, TCP multiplexing, software compression, IPv6, and a stateful packet inspection firewall, etc. Active-active and active-standby clustering of up to 32 appliances for redundancy and industry-leading scalability. Scale-up, scale-out or scale-down as needed without disruptive upgrades. Traffic burst protection to automatically handle unexpected traffic increases for maximum customer satisfaction and revenues. Common 64-bit SpeedCore platform for unified management and plug-andplay migration between Array s vapv and physical APV hardware appliances. Support all solutions supported by our current APV Series, for example, Exchange System requirements Hypervisors supported VMware ESXi 4.1 or later Citrix XenServer 5.6 or later Virtual machine environment (requirement for each instance of vapv) Array Networks, Inc. All Rights Reserved. 3

4 Virtual CPU: 1 2 Memory: 2GB Virtual network adaptor: 2 Minimum available disk space: 40GB License control In addition to the traditional license policy of the physical APV appliances, the vapv newly introduces four items for license control: Maximum number of vcpus Maximum number of NICs Maximum system RAM Maximum bandwidth capacity If the assigned amount of vcpu, NIC, or system RAM exceeds the maximum limit licensed, the license will be invalid. To upgrade the license, customers simply purchase the appropriate upgrade to replace their existing license with a new license. License upgrades are nondisruptive and can be applied while the vapv is running. The license limit information can be viewed in the output of the show version command. Limitations vapv only runs in virtual environments on 64-bit x86 servers supporting Virtualization Technology (VT). The following features are currently not supported by vapv: SSL FFO (Clustering/HA) Hardware compression Serial console is not supported. Hardware monitoring (on fan speed, system/cpu temperature, etc.) is not supported. TCP Option Optimization ArrayOS TM optimizes TCP options by supporting three new options: Window Scale, Timestamp, and Selective Acknowledgement (SACK). Array Networks, Inc. All Rights Reserved. 4

5 TCP Option Window Scale Timestamp SACK Benefits Allows TCP connections to use larger window sizes, and therefore enhances the TCP transmission speed. Improves the accuracy of the round-trip time measurement and therefore facilitates packet retransmission. Protects TCP segments against wrapped sequence numbers. Optimizes the quick retransmission algorithm and therefore enhances the TCP transmission speed. In addition, ArrayOS TM fully supports the Maximum Segment Size (MSS) option. Note: For the Window Scale option, Timestamp option, SACK option, and MSS option to take effect for the system or a specified virtual service, you must have enabled the Syncache function. Please configure TCP options for SLB virtual services based on the configurations of TCP options on SLB real servers. The Session Stateful Failover (SSF) function supports only the Window Scale, Timestamp, and MSS options. It does not support the SACK option. New CLI commands To support this new feature, the following commands are added: system tune tcp option wscale on [shift_count] This command is used to enable the Window Scale option for the system. system tune tcp option wscale off This command is used to disable the Window Scale option for the system. system tune tcp option timestamp on This command is used to enable the Timestamp option for the system. system tune tcp option timestamp off This command is used to disable the Timestamp option for the system. system tune tcp option sack on This command is used to enable the Selective Acknowledgment (SACK) option for the system. system tune tcp option sack off This command is used to disable the Selective Acknowledgment (SACK) option for the system. system tune tcp syncache on This command is used to enable the Syncache function for the system and SLB virtual services. system tune tcp syncache off Array Networks, Inc. All Rights Reserved. 5

6 This command is used to disable the Syncache function for the system and SLB virtual services. system tune tcp rmem_max [size] This command is used to set the maximum receive buffer size for the system. slb tcpoption wscale <virtual_service> {on off} [shift_count] This command is used to enable or disable the Window Scale option for a virtual service. slb tcpoption timestamp <virtual_service> {on off} This command is used to enable or disable the Timestamp option for a virtual service. slb tcpoption sack <virtual_service> {on off} This command is used to enable or disable the SACK option for a virtual service. slb tcpoption mss <virtual_service> [size] This command is used to set the maximum segment size (MSS) for a virtual service. Furthermore, APV WebUI allows you to configure these TCP options for SLB virtual services. For details, please refer to the ArrayOS APV CLI Handbook and WebUI Handbook. TLS1.2 Support for SSL Virtual Hosts The APV appliances that adopt the Cavium NPX (CN16XX) cards support the TLS1.2 protocol. However, the TLS1.2 protocol is only supported on SSL virtual hosts currently. This new feature improves the application delivery security for customers. The following table describes the current support matrix of cipher suites by protocols SSL3.0, TLS1.0 and TLS1.2 for SSL virtual hosts and real hosts respectively. Cipher Suites Bits Protocols - Virtual Hosts Protocols - Real Hosts SSL3.0 TLS1.0 TLS1.2 SSL3.0 TLS1.0 TLS1.2 RC4-MD5 128 x RC4-SHA 128 x DES-CBC-SHA 64 x x x x DES-CBC3-SHA 192 x AES128-SHA 128 x AES256-SHA 256 x AES128-SHA x x x x x AES256-SHA x x x x x EXP-RC4-MD5 40 x x x x x EXP-DES-CBC-SHA 40 x x x x x Note: Array Networks, Inc. All Rights Reserved. 6

7 In the preceding table, indicates that the cipher suite is supported; x indicates that the cipher suite is not supported. The TLS1.2 columns apply only to the APV appliances that adopt the Cavium NPX (CN16XX) cards. To support this new feature, two CLI changes have been made: The version parameter of the command ssl settings protocol <host_name> <version> supports the TLS1.2 protocol, in addition to SSL3.0 and TLS1.0 protocols. The default version value for SSL virtual hosts has changed to SSLv3:TLSv1:TLSv12. The cipher_string parameter of the command ssl settings ciphersuite <host_name> <cipher_string> supports all cipher suites supported by the TLS1.2 protocol. The default cipher_string value for SSL virtual hosts has changed to RC4-MD5:RC4-SHA:DES-CBC3-SHA:DES-CBC-SHA:AES128- SHA:AES256-SHA:AES128-SHA256:AES256-SHA256:EXP-RC4-MD5:EXP- DES-CBC-SHA:!SSLv2. The default cipher_string value for SSL real hosts has changed to RC4-MD5:RC4-SHA:DES-CBC3-SHA:AES128-SHA:AES256- SHA:!SSLv2. In addition, WebUI also supports this enhancement. When you turn on the TLS1.2 protocol for SSL virtual hosts on APV appliances that do not adopt the Cavium NPX (CN16XX) cards, both CLI and WebUI will prompt TLSv12 is not supported by hardware. LLB Bandwidth Management Optimization ArrayOS TM optimizes the link bandwidth management. When performing link selection, the system considers not only the routing policies configured for links but also the load status of each link. That is, when the current link has reached the configured bandwidth threshold, the APV appliance will search for available links from matched routes according to the descending sequence of priorities. The APV appliance first searches for available links from routes with the same priority as the current link. If all available links reach their bandwidth thresholds, the APV appliance will search for available links from routes with lower priorities. If the gateways of all matched routes are down or reach the configured bandwidth thresholds, the APV appliance will still choose the current link to transmit traffic. In addition, the APV appliance allows you to configure a priority for the LLB link bandwidth. If the priority of a matched route is higher than the LLB link bandwidth Array Networks, Inc. All Rights Reserved. 7

8 priority, the gateway of this route is not affected by the configured LLB outbound bandwidth threshold. Note: If the traffic hits a RTS or IPflow route,the traffic will be directly forwarded through the relevant LLB link no matter whether the LLB link reaches the bandwidth threshold. If an Eroute has been configured with the source IP address, source mask, source port number, destination IP address, destination mask, and destination port number and these IP addresses and masks are set to and port numbers are set to 0, the APV appliance will not search for available links from the matched routes whose priorities are lower than With the optimized LLB bandwidth management function, you do not need to configure Eroutes with the same priorities for multiple links. This improves the efficiency and flexibility of link bandwidth configuration and management. SDNS Manual and Batch Switchover Manual switchover The manual switchover function allows you to manually switch the resolved IP address of a domain name from the currently used IP address to an IP address with the specified priority. This function ensures application availability and improves user experience. Note: The prerequisites for using the manul switchover function are: the region method is configured for domain names and the IP overflow (IPO) pool method is configured for corresponding SDNS pools. The manual switchover function is available only when the automatic switchover function of the SDNS pool is disabled or when the automatic switchover function is enabled but the preemption mode is set to non-preemptive. Batch switchover To help manually switch the resolved IP addresses of domain names in batch, the APV appliance allows you to add specific domain names to a group for unified monitoring and management. WebUI provides a visible domain group monitoring and management function. When the resolved IP addresses of multiple domain names become unavailable, you can use this function to switch the resolved IP addresses to desired IP addresses in batch. Array Networks, Inc. All Rights Reserved. 8

9 Application scenario The SDNS manual and batch switchover function applies to the scenario where the following conditions are met: Multiple servers are deployed for an application and these servers work in active-standby mode. Automatic switchover is unsuitable for server disaster tolerance because, for example, the configurations on the active and standby servers are not the same. A large number of such applications are deployed. In the preceding scenario, you can use this function to manually switch the resolved IP addresses of domain names in batch. Benefits Effectively ensures the service usability and improves the experience of end users. Helps customer administrators to flexibly configure and manage SDNS pools and to improve the capabilities of disaster tolerance. Save the management time in the case of relevant configuration changes. Related CLI commands The following are the newly added commands: sdns pool ipo autoswitch <host> {site region} {on off} This command is used to enable or disable the automatic switchover function for an SDNS pool configured with the IPO method. sdns pool ipo resetgroup <group_name> [desired_priority] This command is used to switch all the resolved IP addresses in an SDNS pool for the specified group of host names to the available IP addresses with a specified priority. sdns host group name <group_name> This command is used to create an SDNS host group. no sdns host group name <group_name> This command is used to delete a specified SDNS host group. sdns host group member <group_name> <host_name> This command is used to add a host to a specified SDNS host group. no sdns host group member <group_name> <host_name> This command is used to remove a host name from the specified SDNS host group. clear sdns host group member <group_name> This command is used to clear all host names from a specified SDNS host group. Array Networks, Inc. All Rights Reserved. 9

10 clear sdns host group name This command is used to clear the configurations of all SDNS host groups. show sdns hostgroup [group_name] This command is used to show the configurations of a specified SDNS host group or all SDNS host groups. The following are the modified commands to which a new parameter group_name has been added: show sdns pool [host_name rule_name] [pool_name] [group_name] show statistics sdns host [host_name] [group_name] For details, please refer to the ArrayOS APV User Guide, CLI Handbook and WebUI Handbook. Array Networks, Inc. All Rights Reserved. 10

11 ENHANCEMENTS Secure Socket Layer (SSL) SSL command backward compatibility improvement (ID: 35943) Before, the parameter cert_index is mandatory in the commands ssl import certificate, ssl import key, and ssl activate certificate. To make these commands become better backward compatible, the parameter cert_index is changed from mandatory to optional. ssl import certificate <host_name> [cert_index] [tftp_ip] [filename] ssl import key <host_name> [cert_index] [tftp_ip] [file_name] ssl activate certificate <host_name> [cert_index] For details, see the ArrayOS APV CLI Handbook. Support for Outlook Anywhere with HTTP/HTTPS virtual service (ID: 30251) To simplify Exchange setup, the APV HTTP method list is extended so that the Exchange Outlook Anywhere application traffic can be processed by the HTTP parser. Now the same HTTP/HTTPS virtual service on the APV appliance can serve both the Exchange OWA and OA access. To support this enhancement, the method value of the http permit method <method> [vip] command has been updated to support the following new methods: rpc_in_data rpc_out_data Link Load Balance (LLB) IPflow entry scaled up (ID: 34783) ArrayOS TM extends the maximum capacity of IPflow entries allowed for APV appliance models with different memory sizes. The following table shows the latest information. Memory Size Maximum IPflow Entries 4GB 1,000,000 8GB 2,400,000 16GB 5,000,000 32G or above 10,000,000 Array Networks, Inc. All Rights Reserved. 11

12 Global Server Load Balance (GSLB) SDNS proximity rule scaled up (ID: 35029) ArrayOS TM extends the maximum number of SDNS proximity rules allowed for APV appliance models with different memory sizes. The following table shows the latest information. Memory Size Maximum Proximity Rules 4GB 5,000 8GB 5,000 16GB 20,000 32G or above 50,000 Support for specifying a gateway for the DPS detector (ID: 34769&34568) A gateway can be specified for the DPS detector on the APV appliance. In this way, the DPS detector can send detection packets to the local DNS servers through the specified gateway. This enhances the flexibility of DPS detectors. To support this enhancement, the gateway_ip parameter is added to the following command: sdns dps localdetector <detector_name> <ip> <interface> [detect_port] [dps_port] [detect_timeout] [gateway_ip] In addition, WebUI also supports this enhancement. Note: In the case of multiple links, do not set the ip parameter to when specifying the gateway for the DPS detector. General System/Tools XML-RPC mechanism optimization (ID: 35900) ArrayOS TM optimizes the XML-RPC mechanism working on the APV appliance. To manage the APV appliance by using XML-PRC, the system will skip reading the YES or NO inputs when the administrator is executing interactive commands, and directly use the default input YES to continue the command execution. With this enhancement, XML-RPC supports both non-interactive and interactive commands and you do not need to input YES or NO for interactive commands in XML-RPC scripts. MIB incompatibility between 6.x and 8.x releases (ID: 34618) ArrayOS uses different MIB names to distinguish the MIB files used by ArrayOS TM 6.x and ArrayOS TM 8.x releases. Array Networks, Inc. All Rights Reserved. 12

13 The MIB names used by ArrayOS TM 6.x and ArrayOS TM 8.x are as follows: ArrayOS TM 6.x: CA-SNMP-MIB ArrayOS TM 8.x: CA-SNMP-MIB8 Please note that the same OID may have different meanings in the MIB files used by ArrayOS TM 6.x and ArrayOS TM 8.x releases. Therefore, please select the correct MIB file for an ArrayOS release. Complete support for APV management via XML-RPC (ID: 34337&33816) XML-RPC provides remote management on the APV appliance. However, XML- RPC requires batch-mode processing of CLI commands and command execution using XML-RPC will be blocked by interactive CLI commands that need additional inputs, such as YES or NO, to confirm the command execution. Now, a new XML-RPC method arrayos_cli_config_with_input has been developed to fully support all the interactive CLI commands requiring additional inputs. For details, please refer to the ArrayOS APV User Guide. Support modifying the MTU value of a bond interface through CLI (ID: 33280&35319) If the network between two hosts uses the PPPoE protocol, certain applications that do not support fragmentation will not be able to communicate with each other. To ensure smooth communication, administrators must be able to modify the MTU value as required. ArrayOS TM optimizes the method for setting the MTU value of a bond interface. Originally, the MTU value was fixed to 1500 bytes. At present, the MTU value can be modified through CLI or WebUI. The default value is still 1500 bytes. To support this optimization, the interface_id parameter of the interface mtu <interface_id> <mtu_size> command can be the name of a bond interface. New SNMP OID to obtain the serial number (ID: 30163) A new SNMP OID is added for obtaining the serial number of the APV appliance. The content of the SNMP OID is Array Networks, Inc. All Rights Reserved. 13

14 RESOLVED ISSUES Server Load Balance (SLB) Response packets lost with RADIUS SLB in transparent mode (ID: 35420) Due to a data structure problem, some response packets were lost with RADIUS SLB in transparent mode. This issue has now been resolved. Invalid command slb persistence timeout (ID: 35242) If the timeout value of a group was specified but the global timeout value was not, the slb persistence timeout <timeout_minutes> [group_name] command did not take effect for the group. This issue has now been resolved. The slb persistence timeout <timeout_minutes> [group_name] command supports groups using the hash algorithm. If the group_name parameter is not specified, the command takes effect globally. If the timeout_minutes parameter is set to 0, the command is disabled. Health check connection closed by RST (ID: 35119) In the earlier x builds, health check connections were closed by the RST flag, and this resulted that the health check packets were treated as error by some real servers. This issue has now been resolved, and health check connections are closed by the FIN flag. HTTP header case-sensitive issue (ID: 34945) To conform to RFC specifications, ArrayOS TM changes HTTP header names from case-sensitive to case-insensitive. Compression working abnormally with HTTP 1.0 (ID: 34721) With compression enabled, when the HTTP version used by the client or the real server is different (one uses HTTP 1.0 while the other uses HTTP 1.1), the APV appliance would insert the "Transfer-Encoding: chunked header in the response, which however was not supported by HTTP 1.0. As a result, the compressed response could not be displayed on the client browser. This issue has now been resolved. Compression working improperly (ID: 34679) Array Networks, Inc. All Rights Reserved. 14

15 In transparent mode, the compression function might work improperly on the APV appliance. As a result, some applications failed to respond. This issue has now been resolved. Secure Socket Layer (SSL) Security vulnerabilities (ID: 35656&34571) The SSL components of the APV appliance have been upgraded to the latest version to address the security vulnerability reported by CVE , CVE , CVE , CVE , CVE , CVE and CVE SSL memory leak (ID: 34973) With the FastCRL feature enabled and CRL Distribution Points (CDPs) of HTTP type configured, SSL memory leak might occur when CDPs of the LDAP type existed in the client certificate extensions. This issue has now been resolved. Failed to execute configuration synchronization (ID: 34779) Configuration synchronization failed because privileges on the directories used for synchronization were incorrectly changed. This issue has now been resolved. SLB virtual service name display incomplete (ID: 33237) The SLB and SSL modules had different length limits on the virtual service names. When an SSL virtual host name was associated with an SLB virtual service name whose length is longer than 24 characters (using the command ssl host virtual ), only the first 24 characters of the SLB virtual service name were displayed in SSL configurations. This issue has now been resolved, and the length limit of the virtual service name is unified as 40 characters. Global Server Load Balance (GSLB) Improper IP address selecting from the root region (ID: 28871) SDNS improperly selected the virtual IP address from the matched SDNS region/site s root region instead of the parent region if both following conditions were met: Each SDNS region on the APV appliance was configured with the same weight. The SDNS region/site matched with a client s DNS query request had no available IP addresses. Array Networks, Inc. All Rights Reserved. 15

16 This issue has now been resolved. General System/Tools Incorrect display of the default header name (ID: 35808) The default value of the header_name parameter in the http serverconnip <virtual_service> [header_name] command was displayed incorrectly. Furthermore, this parameter did not take effect. This issue has now been resolved. The default value of the header_name parameter is displayed as X-Forwarded- For and this parameter is effective. System instability (ID: 35379&32495) The APV system might become unstable or even be rebooted due to a software endless loop in the ArrayOS. This issue has now been resolved. OID values overflowed in SNMPv2c trap notifications (ID: 34953) The OID values might overflow in the SNMPv2c trap notifications sent from the APV appliance to the SNMP management host. This issue has now been resolved. Add prompt for executing debug disable (ID: 34896) To execute the command debug ftp <user_name> < remote_ftp_ip> [file_name] or debug scp <username@remote_scp_ip host> [file_name] with the parameter file_name set to all, you must execute the command debug disable in advance. ArrayOS TM has added a friendly prompt for executing the command debug disable. System vulnerabilities (ID: 34755) ArrayOS TM has upgraded the Apache server to its latest version to address the system vulnerabilities reported by CVE and CVE Two fastlog logs moved to syslog logs (ID: 34674) Upon system startup/restart/shutdown, the ulandmond process printed fastlogs stopping ulandmond for... and ulandmond: started new uproxy. These logs are unnecessary for users. Therefore, both logs were moved to syslog logs, and are not revealed to users. WebUI startup failure after configuration synchronization (ID: 34586) Array Networks, Inc. All Rights Reserved. 16

17 After the synconfig to command is executed to synchronize the configurations on the active appliance to the backup one, WebUI of the backup appliance failed to start up. This issue has now been resolved. System timeout conflict (ID: 34524) The APV appliance determines whether TCP connections time out by using the timeout setting of the slb timeout command in precedence to that of the system tune tcpidle command. However, if the timeout period specified by the slb timeout command was longer than the timeout period specified by the system tune tcpidle command, the APV appliance used timeout setting of the system tune tcpidle command to determine whether these connections of HTTP applications timed out. This issue has now been resolved. TCP connection failure between APV and log server after system reboot (ID: 34224) When being shut down or rebooted, the APV appliance did not actively remove the TCP connection to the log server. After the APV appliance started up again, it might fail to establish the TCP connection to the log server. This issue has now been resolved. WebUI Output of the show sdns member/site/overflow command being in disorder (ID: 35140) The outputs of the show sdns member, show sdns site, and show sdns overflow commands were in disorder. This issue has now been resolved. The ArrayOS optimized the output of these commands in CLI and on WebUI by organizing the output information to be clearer and easier to read. Statistics cleared after a real service was disabled (ID: 35110) After a real service was disabled on the WebUI, related statistics were cleared. This issue has now been resolved. After a real service is disabled on the WebUI, its statistics are still available. Display issue with the Filter IP feature on WebUI (ID: 34772) The output of the Filter IP feature was displayed in a poor format within the RTS Statistics and IPFlow Statistics areas under the path System Configuration > Basic Networking > Routing > RTS/IPFlow/Eroutes. This issue has now been resolved. Array Networks, Inc. All Rights Reserved. 17

18 KNOWN LIMITATIONS Server Load Balance (SLB) http serverconnip working only with the transparent mode (ID: 35955) The configuration of the command http serverconnip <virtual_service> [header_name] takes effect only in transparent mode. It is recommended to use this command only when the transparent mode is enabled. Global Server Load Balance (GSLB) SDNS local detector might fail to start (ID: 36120) The SDNS local detector might fail to start if the following conditions are both met: The number of active interfaces is greater than eight. The parameter interface is set to all in the command sdns dps localdetector <detector_name> <ip> <interface> [detect_port] [dps_port] [detect_timeout] [gateway_ip]. To avoid this issue, it is recommended to set the parameter interface to a specific system interface. Array Networks, Inc. All Rights Reserved. 18