Dell Secure Mobile Access About Dell Secure Mobile Access

Transcription

1 Dell Secure Mobile Access May 2016 These release notes provide information about the Dell Secure Mobile Access (SMA) release. About Dell Secure Mobile Access Supported platforms New Features s s Upgrading information Product licensing Technical support resources About Dell About Dell Secure Mobile Access The Dell Secure Mobile Access (SMA) release is a general release that provides new features and resolves a number of issues found in previous releases. Dell Secure Mobile Access

2 Supported platforms Supported appliances The Dell SMA release is supported on the following Dell SMA 1000 series appliances: EX9000 EX7000 EX6000 SMA 6200 SMA 7200 SMA 8200v (ESX/Hyper-V) Supported releases Client machines running version client software can be used with Dell SMA appliances running one of the following firmware versions: , , , , System compatibility Dell SonicWALL GMS is only supported when CMS is not enabled. GMS will not be supported in a future release. Secure Virtual Desktop is no longer supported. Central Management is not supported for High Availability (HA) nodes Central Management and Policy Replication are mutually exclusive. For example, Policy Replication cannot be enabled when Central Management is enabled. Dell Secure Mobile Access

3 New features New features in Secure Mobile Access 11.4 include: Global Traffic Optimizer (GTO) GTO allows customers to deploy a VPN infrastructure without the need for load balancers or global traffic management using a CMS and SMA 1000 series appliances. The SMA appliances may be located in a datacenter or globally distributed. Connect Tunnel clients must upgrade to 11.4 to use GTO. For detailed information about GTO, see the Dell SMA 11.4 CMS Administration Guide. Integrating an SMA appliance with a Dell SonicWALL firewall Dell SMA 1000 series appliances running firmware version and higher can be integrated to work with Dell SonicWALL TZ, NSA, and SuperMassive series firewalls running firmware version SonicOS 5.9.X and higher. Outlook Anywhere support Outlook Anywhere is an Outlook client that connects to the Microsoft Exchange server using RPC over HTTP or MAPI over HTTP. TLS and NLA support for HTML5 RDP Secure Mobile Access 11.4 provides Transport Layer Security (TLS) and Network Level Authentication (NLA) for HTML5 browser clients that want to connect to remote hosts via the Remote Desktop Protocol (RDP). SAML 2.0 Identity Provider CA SiteMinder has been replaced with SAML 2.0 Identity Provider, which supports CA SiteMinder as well as other identity providers. Suite B Ciphers support Suite B is a set of security algorithms or ciphers approved by the National Security Agency (NSA) for assuring the security and integrity of information passed over public networks. Replication Deprecation Replication will be deprecated in favor of Central Management Server (CMS) after SMA Replication is still available in SMA 11.4, but it will not be available in the next SMA release. Authentication API The Authentication API is a RESTful interface exposed by the SMA appliance, which allows a customer to write custom code to perform authentication against the SMA appliance on behalf of end-users. The Authentication API is published as a standalone document. See the Dell Secure Mobile Access Authentication API Reference Guide. Management API The Management API is a RESTful interface exposed by the SMA appliance, which allows a customer to view and modify appliance data in JSON format. The API is divided into two primary resources, Setup and Console, which handle HTTP requests before and after the appliance has completed initial configuration, respectively. The Management API is published as two standalone documents. See the Dell Secure Mobile Access Appliance Management Console Setup API Reference Guide and the Dell Secure Mobile Access Appliance Management Console API Reference Guide. Dell Secure Mobile Access

4 s The following is a list of resolved issues addressed in this release. Access Control Resource objects cannot be configured from the Resources page top menu. Occurs when attempting to add, edit, or delete a resource object from the Security Administration > Resources page top menu Authentication Memory leaks and a constant increase in memory utilization is observed in the Authentication server by the policy server process. Occurs when the cache is disabled. VPN binaries show SonicWALL Inc. as the name of the Code Signer instead of Dell Inc. Occurs when viewing the Signatures List on the DLL properties page for the VPN Connect Tunnel Phones display an error, Modem Not found. Occurs when a phone with a data card is connected to a Windows machine over a VPN client. Appliance throughput drops below 10%. Occurs when Encapsulating Security Payload (ESP) is enabled in a Connect Tunnel client. RA resolved IP address for the appliance hostname in the Connect Tunnel Session Statistics window on Mac/Linux is needed. Occurs when configuring an IP address for an SMA appliance in Connect Tunnel. Connect Tunnel shows invalid DHCP DNS suffix list, only from Option 15. Option 119 is also now supported, but is not shown. Occurs when connected to food.eng.sonicwall.com High Availability HA pair does not synchronize or allow administrative interaction. Occurs when attempting to view or configure an HA pair System Configuration Appliance fails to boot. Occurs during Pilot testing of the firmware. The checkbox for, Use only US government recommended encryption in the Configure SSL Encryption dialog is being selected by the system unexpectedly. Occurs when the selected ciphers in the Configure SSL Encryption dialog are changed Dell Secure Mobile Access

5 Support for TLSv1.2 GCM ciphers is needed. Occurs when the selecting ciphers in the Configure SSL Encryption dialog Virtual Appliance (8200v) No ESX, Parallels, VirtualBox, or HyperV support is available for SATA or SCSI hard drives for virtual machines. Occurs when building a Virutal Machine (VM) from scratch WorkPlace The keyboard language for the client browser locale is always English. Occurs when a different keyboard language is selected on the Manage Bookmarks page in WorkPlace for HTML5 RDP. There is no simple way to create a public WorkPlace shortcut in the AMC. Occurs when adding a shortcut to an external resource in WorkPlace. Workaround: Add the resource to the resource exclusion list s The following is a list of known issues in this release. API The Authentication APIs have no options to set (POST, PATCH, or PUT) the extended attributes for a user bookmark. Occurs when adding a user bookmark Authentication RADIUS IP table rules are not being enforced. Occurs when RADIUS Authentication packets are being received on the SMA appliance. Authentication for bookmark access does not respond. Occurs when a user attempts to access an FQDN-mapped bookmark using SAML 2.0 Identity Provider. Login screen is not displayed for WorkPlace. Occurs when sending an authentication signing request using an EC certificate and SAML IDP. There is currently no way to control ciphers and protocols used for backend LDAPS connections, because they are hard coded. We need to allow administrators to override which SSL/TLS ciphers and protocols are allowed on the backend, using a CEM extension Dell Secure Mobile Access

6 ACL checks are not occurring as they should. Occurs when an Active Directory (AD) server is used as an LDAP server and short name groups are defined in the ACL. Users cannot access Workplace. Group authorization MATCH FALSE is returned without parsing the subsequent Permit ACL. Occurs when the user is logged in to the RADIUS server, but is not logged in to the local authentication server. The Deny ACL was configured for the local user group, but the user is not part of the denied ACL group. When the Deny ACL is disabled, access to WorkPlace is granted even though the group affinity check fails Cache Cleaner Cache Cleaner exit wipe initiates, but does not clean any of the browser data. Occurs when using Firefox in Windows. Cache cleaner does not delete the browser history or cookies. Occurs when using MAC Safari with recent Java update and the user attempts to access WorkPlace with Cache Cleaner enabled for the realm. Cache cleaner does not delete the browser history or cookies. Occurs when using MAC Safari with recent Java update and the user attempts to access WorkPlace with Cache Cleaner enabled for the realm. All history items are cleared even though the "Clean Session items only" option is enabled for the Realm. Occurs when CacheCleaner is enabled for the Realm, and the user is trying to access WorkPlace using the Firefox browser and then logs out and checks the history items Central Management The CMC displays 5000 as the platform capacity and the maximum licenses for the DELL SMA 8200v, instead of the actual values, which are 5000 for ESXi and 250 for Hyper-V Occurs when viewing the CMC > Management Server > Configure > Licensing > License Distribution page for a managed Dell SMA 8200v virtual appliance. A licensed CMS Spike License is listed as expired on the Manage Licenses page. Occurs when the CMS Spike License is renewed and then synchronized. Manage Licenses page does not display the status of spike licenses. Occurs after the Spike License is activated on CMS. There is no provision to pause/resume or start/stop a Spike License at CMC. Occurs when activating a Spike License. Rollback issues between CMS and managed appliances. Occurs when upgrading the CMS. CMS forward compatibility issues. Occurs when upgrading the CMS. Policy synchronization with managed appliances does not respond. Occurs when CMS has been upgraded Dell Secure Mobile Access

7 The CMS shows appliances in an error state with the error, Secure link could not be established, and does not allow the registration of appliances or virtual appliances. Occurs after a checkpoint operation when the CMS is deployed on Microsoft Hyper-V with ISO. However it does allow registration of virtual appliances deployed on Microsoft Hyper-V without ISO. Workaround: Click the here link to re-establish a secure connection, or reboot the CMS after reverting to a checkpoint. The managed appliances configuration is overwritten by the CMS. Occurs when the "Each node has its own authentication server" option is selected on the Management Server > Configure > CMS Settings > Policy Synchronization page. Multiple alerts cannot be disabled on the Management Server > Alerts > Configure Alerts page. There needs to be an option to disable multiple alerts on the Management Server > Alerts > Configure Alerts page Connect Tunnel Connecting tunnels with gratuitous-arp for VIP are needed. Reconnecting tunnels reaching a different appliance on the same internal network must issue a gratuitous-arp to flush the stale neighbor table entries in other hosts on the link, importantly the gateway. Linux Connect Tunnel clients do not provide the VIP last connection address. Occurs when a GTO redirect does not happen. Network access is lost in Connect Tunnel. Occurs when Redirect-All Reconnect is enabled on a Linux Tunnel Client. Appliance displays the incorrect firmware version number. Occurs when the appliance is running version It shows it as version The Connect Tunnel connection is displayed as a dial-up connection rather than a VPN connection. Occurs when Connect Tunnel is installed on a Windows 10 machine. Client computers display the error: Modem Not Found. Occurs when a client tries to establish a VPN via a data card or phone plug-in on a USB port. Attempts to establish a Connect Tunnel do not respond. Occurs when Connect Tunnel is re-installed on a Windows 10 machine. Connect Tunnel returns a modem error. Occurs when Connect Tunnel is installed on a Windows 10 machine. Upgrading Connect Tunnel, OD Tunnel from WorkPlace, or other client software from previous versions 10.5.x, 10.6.x , , , and return an error: "The subject is not trusted for the specified action." Occurs because there is a change in the certificate from SonicWALL Inc. to SonicWALL L.L.C. Workaround: Connect Tunnel must be installed from an appliance running Clt-hotfix or higher, Clt-hotfix or higher, and Clt-hotfix or higher in order to be upgraded to version Dell Secure Mobile Access

8 End point control Access to the Linux Calculator application is denied. Occurs when basic End Point Control (EPC) with Linux Calculator is configured as a device profile and is associated to the Realm, and the user logs in via Extra Web. Access is denied, post authentication, and the user is taken to the Extra Web page that says Access Denied. Occurs when End Point Control (EPC) is enabled, and the user is logged in to WorkPlace from a Mac OS X client machine. The inactivity timeout has no effect. Occurs when the Inactivity Timeout is set under Zone and End Point Control (EPC) is disabled for tunnel clients Extra Web The templates, authentication-status.tmpl and status.tmpl, are not recognized by Extra Web. Occurs when a customer s password is ready to expire High availability cluster Both nodes in a High Availability Cluster go into Standby mode, and users cannot login to the AMC. Occurs when two SMA devices are deployed in a High Availability Cluster, and you try to change the active node to Standby. The other node remains in Standby also Provisioning OnDemand Tunnel activation does not respond. Occurs when using Windows 10 in All Browser combination mode. Incorrect icons are displayed after installing agents on the client machine. Occurs when the SMA 11.x agents (SEM, CT, Webifiers, OPSWAT EPC, possibly others) are installed on the client machine and later uninstalled, then older agents such as those from are installed on the same machine. The 11.x icons are still displayed for the agents in Add/Remove Programs and as the CT desktop shortcut Users and Groups Some users and groups in a community disappear. Occurs when other users or groups in the same community are modified Virtual Appliance CMS runs out of memory. Occurs when CMS is hosted on Hyper-V Dell Secure Mobile Access

9 Virtual Assist Virtual Assist does not respond. Occurs when a Virtual Assist technician window is open Web Proxy OnDemand Proxy does not respond Occurs when attempting to activate OnDemand Proxy in an IE11 browser with ActiveX enabled in Windows 10. ODProxy/EWPCA/ODT with Manual Proxy does not respond, but displays an error message: Connection for user... has not been properly classified into a zone, status = 0, authorization denied." Occurs when a manual outbound proxy is configured at system level, the ODP or EWPCA realms are configured on the SMA appliance, and the appliance is connected to any browser on a Windows OS. Single Sign-On (SSO) does not respond for the SSO profile OWA Occurs when the user is using WorkPlace in either Firefox or Chrome, and the SSO profile is port mapped. The ActiveSync connection on Android returns a 401 Unauthorized error. Occurs when trying to connect and Captcha is enabled on an ActiveSync Realm Windows Some Secure Mobile Access features (including client components) do not work on older Windows systems. Occurs when Secure Mobile Access and client components are installed on an XP or Vista device (includes SEM and Connect Tunnel). Note: Beginning in SMA 11.1, Windows XP is no longer supported and Vista is supported on a best-effort basis only WorkPlace Some bookmarks cannot be displayed. Occurs when the bookmark has a UTF-8 unicode character in it. HTML5 telnet does not respond and shows a blank page. Occurs when using IPv6 addresses in WorkPlace. HTML5 SSH is not accessible in WorkPlace and displays an error message. Occurs when attempting to access an IPv6 address in WorkPlace. The Help link in the Deprecation note on the Advanced Settings page in WorkPlace links to the wrong page that is not a Help page. Occurs when the Force Java option is enabled in the AMC. WorkPlace does not respond, but no error is displayed. Occurs when trying to connect to WorkPlace using Chrome 45, which does not support NPAPI plugins like Java. Users cannot access WorkPlace, and this error message is displayed: "Unable to authorize request. Zone classification process has not completed. Occurs when the user is using Firefox on a Linux system with Java 1.7u71 installed Dell Secure Mobile Access

10 Upgrading information For information about an E-Class SMA appliance to version from an earlier release, be sure to consult the Dell SMA Upgrade Guide, available on or on the Support website at: Product licensing Dell SMA or E-Class SMA appliances must be registered on MySonicWALL to enable full functionality and the benefits of Dell SonicWALL security services, firmware updates, and technical support. Technical support resources Technical support is available to customers who have purchased Dell software with a valid maintenance contract and to customers who have trial versions. Dell SonicWALL Administration Guides and related documents are available on the Dell Software Support site at The Support Portal provides self-help tools you can use to solve problems quickly and independently, 24 hours a day, 365 days a year. In addition, the portal provides direct access to product support engineers through an online Service Request system. To access the Support Portal, go to The site enables you to: Create, update, and manage Service Requests (cases) Obtain product notifications Engage in community discussions Chat with a support engineer View Knowledge Base articles at: View instructional videos at: Select the version of Mobile Connect that applies to your device at: Dell Secure Mobile Access

11 About Dell Dell listens to customers and delivers worldwide innovative technology, business solutions and services they trust and value. For more information, visit Contacting Dell Technical support: Online support Product questions and sales: (800) Dell Secure Mobile Access

12 2016 Dell Inc. ALL RIGHTS RESERVED. This product is protected by U.S. and international copyright and intellectual property laws. Dell, SonicWALL, and the Dell logo are trademarks of Dell Inc. in the United States and/or other jurisdictions. All other marks and names mentioned herein may be trademarks of their respective companies. For more information, go to Legend CAUTION: A CAUTION icon indicates potential damage to hardware or loss of data if instructions are not followed. WARNING: A WARNING icon indicates a potential for property damage, personal injury, or death. IMPORTANT NOTE, NOTE, TIP, MOBILE, or VIDEO: An information icon indicates supporting information. Last updated: 5/6/ Rev C Dell Secure Mobile Access