Check Point VPN-1 Pro NGX IPv6Pack Release Notes May 10, 2006

Size: px

Start display at page:

Download "Check Point VPN-1 Pro NGX IPv6Pack Release Notes May 10, 2006"

Ashlie Howard
6 years ago
Views:

Check Point VPN-1 Pro NGX IPv6Pack Release Notes May 10, 2006 IMPORTANT Check Point recommends that customers stay up-to-date with the latest service packs and versions of security products, as they

Introduction page 1 Build Numbers page 2 Minimum Hardware Requirements by Platform page 2 Minimum Software Requirements by Platform page 3 Installation Instructions page 3 Known Limitations page 4

1 Check Point VPN-1 Pro NGX IPv6Pack Release Notes May 10, 2006 IMPORTANT Check Point recommends that customers stay up-to-date with the latest service packs and versions of security products, as they contain security enhancements and protection against new and changing attacks. Introduction page 1 Build Numbers page 2 Minimum Hardware Requirements by Platform page 2 Minimum Software Requirements by Platform page 3 Installation Instructions page 3 Known Limitations page 4 Introduction Thank you for using Check Point's VPN-1 Pro NGX IPv6Pack. This document contains important information not included in the documentation. Review this information before installing your products. IMPORTANT Before you begin, read the latest available version of these Release Notes at: 1

2 Build Numbers Product Command Platforms Build Number Build Numbers NGX IPv6Pack $FWDIR/bin/fw6 ver All platforms NGX_IPv6Pack GX_NGX Build 089 SmartConsole (GUI) Help > About Check Point SmartDashboard Windows NGX GX / NGX IPv6Pack Build 13 SVN Foundation $CPDIR/bin/cpshared_ver All platforms NGX_IPv6Pack GX_NGX Build 015 SecurePlatform ver SecurePlatform NGX IPv6Pack Build 006 Minimum Hardware Requirements by Platform Nokia Hardware Requirements page 2 SecurePlatform Hardware Requirements page 3 Nokia Hardware Requirements NGX IPv6Pack is supported on IPSO version 3.9 and version 4.0 on the following Nokia IP platforms: For the latest information on which IPSO releases are supported, see the Nokia Support Web at IP130, IP260, IP330, IP350, IP380, IP530, IP650, IP710, IP740, IP1220, IP1260 And the following flash-based platforms: IP355, IP385, IP1220, IP1260, IP2250 Note - Nokia IPSO flash-based platform IP265 is currently not supported. Please contact Check Point Technical Services if you would like to use this platform. The minimum hardware requirements for installing NGX IPv6Pack on a Nokia IPSO platform are: Memory 256MB Network Adapter One or more Nokia network adapter cards Check Point VPN-1 Pro NGX IPv6Pack Release Notes. Last Update May 10,

3 SecurePlatform Hardware Requirements SecurePlatform Hardware Requirements On SecurePlatform, the minimum hardware requirements for installing a VPN-1 Pro NGX IPv6Pack are: Processor CPU Free Disk Space Memory CD-ROM Drive Network Adapter Video Adapter Intel Pentium III 300+ MHz or equivalent processor 4GB 256MB (512MB recommended) Yes (bootable) One or more supported network adapter cards supports 1024 x 768 resolution For details about SecurePlatform on specific hardware platforms, see Minimum Software Requirements by Platform Nokia Platform Software Requirements This release supports IPSO 3.9 and IPSO 4.0. For the latest information on which IPSO releases are supported, see the Nokia Support Web at Installation Instructions Please see the VPN-1 Pro NGX IPv6Pack Getting Started Guide for installation instructions, and the VPN-1 Pro NGX IPv6Pack Upgrade Guide for Upgrade Instructions. You can download the documents from: Check Point VPN-1 Pro NGX IPv6Pack Release Notes. Last Update May 10,

4 Known Limitations Known Limitations Firewall-1 Firewall-1 page 4 VPN-1 page 7 IPv6 Clustering page 7 General 1. Memory usage is higher with IPv6 enabled modules when compared to regular IPv4 modules. The initial amount of memory used will be approximately twice the amount when not using IPv6. 2. NGX IPv6Pack is currently not officially supported on Solaris. Testing of this platform has not been completed. Follow up with the latest updates in the download center 3. NGX IPv6Pack is currently not supported on SecurePlatform Pro in a Cluster environment. IPv6 General page 4 IPv6 page 4 Nokia page 5 Policy Installation page 6 Logging page 6 Upgrade, Backout and Backward Compatibility page 6 4. The Protocol field in the logs is resolved using /etc/protocols instead of services definitions. 5. The fw6 monitor cannot be filtered with expressions. When trying to use expressions the filter does not show any packets. 6. Full Intra Tunnel Inspection of IPv6 in IPv4 SIT traffic is not supported for IPv6 fragmented traffic. Check Point VPN-1 Pro NGX IPv6Pack Release Notes. Last Update May 10,

5 Firewall-1 7. When assigning an IPv6 address to an interface object, it is mandatory to also assign an IPv4 address to the same interface. 8. Track Source or Track Destination on an IPv6 connection log does not function correctly. 9. When collecting topology information interfaces that only have IPv6 addresses are missing. 10. Groups with exclusion do not work with IPv6 objects. 11. Enabling Configuration apply to all connections under SmartDefense > FTP > FTP Security Server settings, causes FTP connections over IPv6 to be rejected, without a log. The same applies to HTTP and SMTP connections over IPv The RSH protocol is not supported over IPv IPv6 objects cannot be defined from the Manage menu. In order to define IPv6 hosts or network objects right-click on the network objects tree and select New. 14. IPv6 Rule Base verification is not as strict as IPv4 verification. For example, you can install the following Rule Base where A and B are IPv6 objects and the policy will not fail verification: Source Destination Service Action Rule 1 A B Telnet, Accept Rule 2 A B Telnet Reject Nokia 15. The client authentication feature is not supported for IPv6 in the Nokia platform. 16. Nokia IPSO platform Only When connecting to the IPv6 IPv4 'compatible' firewall address (for example, ::x.y.z.w), the following appears on the console: Jan 14 09:37:32 shif [LOG_CRIT] kernel: fw_filterin: 0 unknown interface This message can be safely ignored in such configurations. In order to disable it completely, run the following command and reboot: modzap _fw_verbose_unknown_if $FWDIR/boot/modules/fwmod.o 0x0 Check Point VPN-1 Pro NGX IPv6Pack Release Notes. Last Update May 10,

6 Policy Installation Firewall When creating a rule with Source: IPv6 network and Destination: cpmodule, with an IPv4 and IPv6 address, the following error will appear in the policy installation message: Rule 1: "SOURCE" and "DESTINATION" must match in IP version. Both IPv6, both IPv4, or both mixed. Work Around: add a dummy object with an IPv4 address in the SOURCE. 18. Performing Policy Uninstall from the GUI only removes the IPv4 policy. The IPv6 policy remains loaded. Logging 19. SmartDefense suppressed logs for IPv6 attacks appear with a wrong source and destination addresses. 20. When using SIP over IPv6 when logging an illegal redirection, the address information is incorrect. 21. No logs are generated for IPv6 virtual defragmentations. 22. IPv6 address resolving is not supported by SmartView Tracker IPv6 logs. 23. Eventia Reporter can be installed and used on a NGX IPv6Pack Management. In addition to installing the Eventia Report package, the following operations are required: 1. cpstop 2. cp $FWDIR/conf/reporting/R60/reporting_*.C $FWDIR/conf 3. cpstart Upgrade, Backout and Backward Compatibility 24. When NGX IPv6Pack (R60) is managed by R61 managment and SmartDefense > DNS > Domain black list is selected DNS traffic will be dropped Work Around: Disable this feature. VOIP 25. SIP over IPv6: If the gap between Invite and Ack is more than 4 seconds, increase the fwfrag_timeout parameter through GuiDBedit to the number of maximum seconds allowed for the gap. Check Point VPN-1 Pro NGX IPv6Pack Release Notes. Last Update May 10,

7 VPN-1 VPN-1 VPN-1 Diagnostics (logging, monitoring, planning) 26. When tunneling IPv6 over IPv4, only one Encrpt log entry will appear for the tunnel and an accept log entry will appear for each IPv6 connection on this tunnel. IPv6 Clustering General page 7 State Synchronization page 7 VPN-1 Clusters page 7 SecurePlatform page 7 General 27. When unloading a policy on a fw6 driver (fw6 unloadlocal) Policy Pnote is not inserted. As a result of this action the state will not be changed. 28. Cluster Fold and Cluster Hide are not available for Clustering IPv6 connections. State Synchronization 29. When rebooting a cluster member the following messages appear after the disks are already synchronized: fw_unlock: static_s is A synchronized connection on a cluster cannot be disabled for IPv6. Disabling the "synchronize on cluster" on a service that is used by both IPv4 and IPv6 will not stop the IPv6 synchronization. 31. SIP over IPv6 is currently not synchronized in a cluster deployment. For the latest updates refer to the download center VPN-1 Clusters 32. VPN-1 encryption for IPv6 traffic using SIT is not supported on a cluster. SecurePlatform 33. ClusterXL Load Sharing for IPv6 is not supported on SecurePlatform. Only High Availability new mode is supported for IPv6 over SecurePaltform. Check Point VPN-1 Pro NGX IPv6Pack Release Notes. Last Update May 10,

8 Provider ping on a ClusterXL Virtual IPv6 address is not supported. In such a case, ClusterXL will not reply to an icmpv6 echo request on the Virtual IPv6 address. Provider-1 Licensing 35. When managing an NGX IPv6Pack module with Provider-1 you should install an IPv6 license on the MDS and not on the CMA. Check Point VPN-1 Pro NGX IPv6Pack Release Notes. Last Update May 10,

VPN-1 Power VSX NGX R65 Upgrade Guide

VPN-1 Power VSX NGX R65 Upgrade Guide March 03 2008 In This Document Upgrade Overview page 2 Upgrading the Management Server to R65 page 4 Installing the GUI Clients page 6 Activating the VSX Plug-in in