VPN-1 Power VSX VSX NGX R65 HFA 10. Release Notes

Transcription

1 VPN-1 Power VSX VSX NGX R65 HFA 10 Release Notes 12 November, 2009

2 More Information To view the latest version of this document, see the User Center ( For additional technical information about Check Point visit Check Point Support Center ( Feedback Check Point is engaged in a continuous effort to improve its documentation. Please help us by sending your comments to us (mailto:cp_techpub_feedback@checkpoint.com?subject=feedback on VPN-1 Power VSX VSX NGX R65 HFA 10 Release Notes) Check Point Software Technologies Ltd. All rights reserved. This product and related documentation are protected by copyright and distributed under licensing restricting their use, copying, distribution, and decompilation. No part of this product or related documentation may be reproduced in any form or by any means without prior written authorization of Check Point. While every precaution has been taken in the preparation of this book, Check Point assumes no responsibility for errors or omissions. This publication and features described herein are subject to change without notice. RESTRICTED RIGHTS LEGEND: Use, duplication, or disclosure by the government is subject to restrictions as set forth in subparagraph (c)(1)(ii) of the Rights in Technical Data and Computer Software clause at DFARS and FAR TRADEMARKS: Please refer to our Copyright page ( for a list of our trademarks. Please refer to our Third Party copyright notices ( for a list of relevant copyrights.

3 Contents Introduction... 4 What's New... 4 Supported Versions, Platforms, and Builds... 5 Supported VSX Versions... 5 Supported Platforms... 5 Included Builds... 5 Known Limitations... 7 Installation... 7 Uninstallation... 7 Resolved Issues... 8 VSX... 8 ClusterXL... 9 GateD... 9 SecurePlatform... 9 SecureXL SmartDefense URL Filtering VoIP VPN Gateway Protection... 11

4 Introduction Thank you for updating your Check Point products with VPN-1 Power VSX NGX R65 HFA 10 (Hotfix Accumulator). This HFA is a recommended update that resolves various issues and contains improvements for VPN-1 Power VSX and other Check Point products on a variety of platforms. Please read this document carefully prior to installing this HFA. We also recommend that you refer to the appropriate Check Point user documentation and release notes, which contain hardware requirements, software requirements, and version recommendations. What's New New Web Filtering engine focusing on hazardous and malicious websites New comprehensive protection against the sockstress vulnerability. Multiple stability issues have been fixed Resolutions for customer reported issues Fixes for major issues in VSX NGX R65 Improved quality of SmartDefense protections Improved quality of SecureXL Improved quality of Dynamic Routing Improved quality of VOIP Fixes for Linux security issues Important - During installation of the new Web Filtering engine, no default database is installed; therefore, the Web Filtering policy is not enforced until a signature update is performed.the first update may take a long time, depending on your environment. Subsequent updates should take significantly less time, as only incremental information is downloaded. Page 4

5 Supported Versions, Platforms, and Builds Supported VSX Versions This HFA can be installed on top of the Check Point VPN-1 VSX NGX R65 versions shown in the following table. To verify the build installed, run: fw ver -k. Platform VPN-1 VSX NGX R65 on SecurePlatform Build Number Output of fw ver -k This is Check Point VPN-1 VSX NGX R65 - Build 517 kernel: NGX R65 - Build 517 VPN-1 VSX NGX R65 on SecurePlatform VPN-1 VSX NGX R65 on SecurePlatform VPN-1 VSX NGX R65 on VSX-1 VPN-1 VSX NGX R65 on IPSO This is Check Point VPN-1 VSX NGX R65 - Build 550 kernel: NGX R65 - Build This is Check Point VPN-1 VSX NGX R65, Hotfix Build 004 kernel: NGX R65, Hotfix Build This is Check Point VPN-1 VSX NGX R65 - Build 008 kernel: NGX R65 - Build This is Check Point VPN-1 VSX NGX R65, Hotfix Build 011 kernel: NGX R65, Hotfix Build 011 Supported Platforms The following operating systems and hardware platforms are supported for HFA installation: Platform Version SecurePlatform cpsmp IPSO 5.0 VSX , 9070, 9090 Crossbeam XOS 8.1+ Included Builds To verify that you have the HFA described in this document: From the HFA file you downloaded, open take_number.conf and make sure it contains: take_29 Take 29 of VSX NGX R65 HFA 10 consists of the following builds: Page 5

6 Component Build Number Verify Command and Output Firewall The output of fw ver -k should be similar to: This is Check Point VPN-1 VSX NGX R65 HFA_10, Hotfix Build 027 kernel: NGX R65 HFA_10, Hotfix Build 037 SecurePlatform The output of splat_ver should be similar to: ecu hfa Performance Pack The output of sim ver -k should be similar to: This is Check Point Performance Pack version: NGX R65 HFA_10, Hotfix Build 004 Kernel version: NGX R65 HFA_10, Hotfix Build 004 Dynamic Routing The output of gated_ver is a list of information including: Page 6

7 Known Limitations This HFA is intended for enforcement gateway installation only. Installing this HFA on a SmartCenter server or Provider-1 MDS is not supported and may cause unexpected behavior If you install this HFA and activate Web Filtering, and then want to uninstall the HFA, take the following precaution: Deactivate Web Filtering on every SmartDashboard object before uninstalling the HFA. Leaving the Web Filtering activated may cause HTTP traffic to be blocked. If you already had Web Filtering before installing this HFA, you do not need to take this precaution before uninstalling the HFA. Installation Install this HFA on supported VSX gateways. To install the HFA: Note - The Full Connectivity Upgrade Procedure (FCU) is not supported for VSX. 1. Download the HFA.tgz file to the VSX Gateway and extract the package. For SecurePlatform: Check_Point_VSX_NGX_R65_HFA_10.linux.tgz (' For IPSO: Check_Point_VSX_NGX_R65_HFA_10.ipso.tgz ( 2. Run the installation script:./unixinstallscript 3. Follow the on-screen instructions to install all of the components. When the installation completes, it says succeeded for each component. 4. Follow the prompt to reboot the machine. Uninstallation To uninstall the HFA on SecurePlatform or IPSO: Important - Do not run the uninstall command twice in a row. This may cause unexpected behavior. If you need to run the uninstall command again, reboot the machine first. 1. From the command line, run: /opt/cpuninstall/vsx_ngx_r65_hfa_10/unixinstallscript -u 2. Reboot the machine. Note - If you reboot the machine from the /opt/cpuninstall/vsx_ngx_r65_hfa_10 directory, an error message appears that can be ignored. Page 7

8 Resolved Issues In This Section: VSX 8 ClusterXL 9 GateD 9 SecurePlatform 9 SecureXL 10 SmartDefense 10 URL Filtering 10 VoIP 11 VPN 11 Gateway Protection 11 VSX Improved gateway stability when enabling VPN-1 on Virtual Systems Improved stability when a gateway attempts to create a new VLAN tag and fails Improved stability when running cplogd. This resolves a problem where cplogd became unresponsive, and may have produced error messages such as, [cplogd 2025]@albert CLogDaemonApp::sigExitHandler : sig == 15, not in the main thread (2051!= 1024), forwarding to the main thread Improved stability in DHCP relay processes The correct value for hmem peak bytes is displayed when running: fw ctl pstat/snmp/cpstat -f hmem Improved stability during policy installation Improved stability when deleting a Virtual System Improved stability of the fwm logexport command Improved stability when unloading the fw driver Improved stability of interfaces with bnx2 drivers Improved gateway stability when installing policy after a customer deletes a service Improved stability in the fw process when running fw tab -u -t connections Sequence mismatch errors, which caused high CPU consumption by the fwd process, no longer appear. The following is an example of output that may have appeared in few.elg as a result of the sequence mismatch error: rtm_input: unexpected sequence number: expected , received Page 8

9 ClusterXL Failover on VSX with Load Sharing, configured with a Virtual Switch and with the kernel parameter fwha_recovery_delay_timeout enabled, now works correctly Improved performance, as there is no longer redundant CCP traffic on the Virtual Switch Improved connectivity in High Availability as a Standby Virtual System connected to a Virtual Switch sends ARP requests correctly, using the MAC address of the Active Virtual System. GateD On Crossbeam, the OSPF restart process has been improved to allow additional time before checking the Self-Originated LSAs Improved GateD performance in Crossbeam after CPM Failover when the NFS is back up After failover between VAP group members in a Crossbeam Cluster, one GateD is set as master and the routing table is synchronized correctly Problems with synchronization between neighbors after a failover have been resolved Improved stability when updating while using dynamic routing in situations where a large amount of routes need to be learned. This resolves a problem with updates that may have produced the following error message in syslog: recvmsg failed Routes learned from an IBGP peer are now successfully installed On Crossbeam, OSPF routing now works consistently after hard reset of the master VAP APM Improved stability in GateD when configuring an OSPF virtual link. SecurePlatform , , Improved stability when a machine has reached its maximum memory usage When enabling crontab,the following error messages are no longer sent incorrectly to the gateway console: application bug: crond(1646) has SIGCHLD set to SIG_IGN but calls wait(), application bug: crond(1663) has SIGCHLD set to SIG_IGN but calls wait() Bnx2 drivers now automatically change settings to 1000/Full Duplex when autoneg is selected. Page 9

10 Fixed vulnerability CVE SNMPv3 HMAC: Verification relies on the client to specify the HMAC length, which makes it easier for remote attackers to bypass SNMP authentication via a length value of 1, which only checks the first byte Fixed Vulnerability CVE The SNMP agent allows remote attackers to cause a denial of service (CPU and memory consumption) via a GETBULK request with a large max-repeaters value Fixed Vulnerability CVE Integer underflow in the e1000_clean_rx_irq function allows remote attackers to cause a denial of service (panic) via a crafted frame size. SecureXL SecureXL now supports the keep_df_flag (DF=Don't Fragment) The link collision mechanism is now activated by default; this resolves issues with using NAT traversal and IP compression in order to connect to a VPN with SecureClient. SmartDefense Failover on VSX with Load Sharing, configured with a Virtual Switch and with the kernel parameter fwha_recovery_delay_timeout enabled, now works correctly Improved performance, as there is no longer redundant CCP traffic on the Virtual Switch Improved connectivity in High Availability as a Standby Virtual System connected to a Virtual Switch sends ARP requests correctly, using the MAC address of the Active Virtual System. URL Filtering Uncategorized websites can be blocked and unblocked using the following kernel parameters: vsx set <vsid> fw ctl set int g_ci_uncategorized_accept_vsid <vsid> fw ctl set int g_ci_uncategorized_accept_opt <0 to block, 1 accept> Page 10

11 VoIP Improved stability when MGCP traffic is used MGCP traffic is no longer dropped due to the short buffer length of the Endpoint IP Improved stability in the event of Cluster failover with SIP TCP traffic In the SCCP inspection, all of the sk_hdr_content_verifier defenses are now per VS and not global to all Virtual Systems Improved stability of SCCP inspection, especially when logging is used SIP traffic now passes successfully when the 2xx response is to a port other than VPN In SecureRemote/SecureClient, Remote access rules based on groups defined on the RADIUS server are now properly applied to all users The SecureClient connections are now maintained after a failover in VSX with Load Sharing Improved VPN connectivity after changing the authentication method from username/password to RADIUS ActiveIdentity In the event of an IP address collision between a remote access client and a host in the encryption domain, a new connection to the remote access client's IP address will be sent to the IP address in the encryption domain. Note: This behavior mitigates security threats associated with IP collision. For more details see sk34579 ( Gateway Protection In response to the Sockstress TCP DoS vulnerability, this HFA provides a comprehensive protection for Check Point Security Gateways and the resources behind them. See sk Page 11