Release Notes. Juniper Networks. Unified Access Control 4.0R5.1. UAC Build # OAC Version Copyright 2010, Juniper Networks, Inc.

Transcription

1 Release Notes Juniper Networks Unified Access Control 4.0R5.1 UAC Build #17205 OAC Version Copyright 2010, Juniper Networks, Inc. i

2 This is an incremental release notes describing the changes made from C4.0R1 release to C4.0R5.1. The C4.0R1 release notes still apply except for the changes mentioned in this document. Please refer to C4.0R1 release notes for the complete version. Platform Support Added in C4.0R2 Snow Leopard (Mac OSX 10.6) is now a supported platform. However, two features are not supported, dynamic Open/WEP and Ad hoc networks. Details can be found in the Known Issues/Limitations section. The NSM schema for this software version will not be published. 1. Since the schema for this software version is not published an attempt to manage a device running this version would result in adjust-os-version to fail on NSM. Device object needs to be deleted and recreated in NSM. After that, NSM will be able to manage the device using the published schema. 2. IC Device upgrade to this OS version using NSM would not work as noted in the General NSM limitations Section. General NSM Limitations 1. If there is a mismatch between software catalog build version and release build version on the device, upgrading the device using NSM will not work. For example, C3.1R3 schema was published using build (software catalog version), but subsequently, C3.1R3.1 was released with build In this case, NSM will not recognize build as a valid upgradable release. However, if device is manually upgraded to build 14353, since there were no additional schema changes, the device should still be manageable via NSM. (523868) Known Issues Fixed in C4.0R5.1 The following list enumerates known issues which were fixed in this release: 1. asg-endpointintegrity-others When Shavlik patch assessment is configured, the associated files do not get downloaded to the client machine, so the policy fails and end users will not be able to login. (572301) Known Issues Fixed in C4.0R5 Copyright 2010, Juniper Networks, Inc. 2

3 1. aaa-client-cert - IC allows forbidden certificate. (544579) 2. uac-auth 802.1X authentication fails if the Framed-MTU is set to more than 1500 in the switch. (562998) 3. uac-auth Earlier releases of UAC fail the third-party PKI tests. (565615) 4. uac-sbr Authentication is rejected when OAC does session redumption. (572870) Known Issues Fixed in C4.0R4 1. endpointintegrity-loginflow - Machine certificate check is failing when there is a comma present in the CA's CN field. (549640) 2. uac-sbr - High memory utilization issue, caused by radius - debug process. (554452) 3. uac-sbr - RADIUS attributes are not getting logged in the User Access Logs, when MAC session re-authenticates. (559389) Odyssey Access Client (OAC) 1. uac-oac-client-installer - OAC installer fails when it is unable to delete Endpoint installer files. (566937) 2. uac-oac-i18n - When the end-user localization option is set to automatic, the upgrade prompt for OAC will be displayed in English irrespective of the client locale. (420032) Known Issues not Fixed in C4.0R3 The following list enumerates known issues not fixed in this release: 1. If you use NSM to update a URL for a manually configured CDP, you will get unpredictable results. Until this issue is fixed, update the URL on the device. (552725) Known Issues Fixed in C4.0R3 Copyright 2010, Juniper Networks, Inc. 3

4 1. uac-auth - With mac-authenticated users logged in, macauthd process snapshot is generated after upgrade. (536605) 2. uac-oac-client-other - OAC is getting disconnected on a few Windows 7 machines when IC incorrectly detects both OAC and Junos Pulse connections from the remote client. (555244) 3. uac-screenos - Traffic dropped at firewall when two dynamic IPSEC tunnels are established from OAC. (534640) Known Issues not Fixed in C4.0R2 The following list enumerates known issues not fixed in this release. Some of these issues may exist in previous releases as well: 1. Odyssey unsupported upgrade (for example, 4.72 to 5.10) may result in error: "Odyssey unable to load the module name JNPRNAAPI.dll. Error Code 126" 2. On Snow Leopard, dynamic Open/WEP networks with 802.1X profiles aren t supported and the CoreWLAN framework does not support Open/WEP networks configured with different indexed keys other than key index On Snow Leopard, the ad hoc independent basic service set (IBSS) provided by the CoreWLAN framework only supports Open/WEP with 40-bit and 104-bit WEP keys. There is no support for WPA encryption. Known Issues Fixed in C4.0R2 1. aaa-active-directory - The smb server crashes with logging enabled for certain customer scenarios. (522781) 2. uac-agentman - Agentman memory usage high. (538676) 3. uac-auth - OAC machine authentication over L3 is failing. (528138) 4. uac-dmi-logging - Need an interim re-try mechanism for IC/IVE logging to NSM. (462200) 5. uac-gateman - Need to add more logging in case this situation comes up again (one node in a/a/a cluster stopped creating auth-table entries). (522688) 6. uac-gateman - Auth table entry not being synced with new ICs. (530834) Copyright 2010, Juniper Networks, Inc. 4

5 7. uac-gateman - Gateman memory usage high after upgrade. (536761) 8. uac-other - Wrong Session timeout behavior with Siteminder Auth Server. (526553) 9. uac-sbr - Concurrent user limit is not enforced correctly when using RADIUS open protocols (534121) 10. uac-sbr - Radius accounting stop messages not handled correctly by IC (538338) Odyssey Access Client (OAC) 1. uac-oac-client-other - When using machine auth on an XP, computer boot time is increased by a minute. Note that the fix for this issue will not affect Vista. (531086) 2. uac-oac-client-other - OAC on Vista/Windows 7 unable to connect to SSID with mix of special characters (533066) 3. uac-oac-client-tray - OAC system tray icon is not properly displaying the connection status when wireless suppression is used. (502123) Copyright 2010, Juniper Networks, Inc. 5