NetScaler SD-WAN Release Notes

Transcription

1 NetScaler SD-WAN Release Notes

2 Copyright and Trademark Notice CITRIX SYSTEMS, INC., ALL RIGHTS RESERVED. NO PART OF THIS DOCUMENT MAY BE REPRODUCED OR TRANSMITTED IN ANY FORM OR BY ANY MEANS OR USED TO MAKE DERIVATIVE WORK (SUCH AS TRANSLATION, TRANSFORMATION, OR ADAPTATION) WITHOUT THE EXPRESS WRITTEN PERMISSION OF CITRIX SYSTEMS, INC. Citrix, Citrix Systems, CloudBridge, Citrix Repeater, Branch Repeater, WANScaler, NetScaler, XenServer, Orbital Data, Orbital 5500, Orbital 6500, Orbital 6800, TotalTransport, AutoOptimizer Engine, and Adaptive Rate Control are trademarks of Citrix Systems. Citrix Systems assumes no responsibility for errors in this document, and retains the right to make changes at any time, without notice. Portions licensed under the Apache License, Version Portions licensed under the Gnu Public License, including xmlrpc++, glibc, rpmlibs, beecrypt, Wireshark. Portions licensed under the Gnu Public License with product-specific clauses, including the Linux kernel ( libstdc++, and libgcc. Portions are free software with vendor-specific licensing, including zlib ( netsnmp ( openssl ( krb5- libs ( /web.mit.edu/kerberos/krb5-1.3/krb /doc/krb5-install.html), tcp_wrappers (ftp://ftp.porcupine.org/pub/ security/tcp_wrappers_license), bzip2-libs ( sources.redhat.com/bzip2/), popt ( COPYING.DOC). Elfutilslibelf is licensed under the OSL 1.0 license, JPGraph licensed under the terms given in proversion.php. LZS licensed from Hifn corporation, Iperf licensed under the terms given in ui_license.html. This product includes PHP, freely available from

3 Contents Introduction... 5 Fixed Issues... 7 Known Issues... 8 Platform... 8 SD-WAN Appliances... 9 SD-WAN VPX Appliances... 9 SD-WAN 4000 WANOP and 4000 SE... 9 Two Box Mode... 9 SD-WAN 1000 / HDX CGP over SSL... 9 Configuration WAN GRE Tunnel IPsec Tunnel Configuration Enterprise Edition as MCN SSL Profile Configuration and Reporting Transparent proxy support for TLS Change Management (Single Step Upgrade) SD-WAN GUI Secure Peering Certificate and Keys Multicast Traffic DPI Functionality DPI- ICMP Functionality DPI Dual- mode IPERF test identifies traffic only from one node DPI Traffic for Top App Family as "Standard" and Top App as "Unknown Virtual protocol" for a Standard Edition appliance SD-WAN Center Limitations HDX... 12

4 ICA UDP SD-WAN Center and Diagnostics Tool Microsoft Azure... 13

5 Introduction This release notes describes known issues, and fixed issues applicable to Citrix NetScaler SD- WAN software release for the SD-WAN Standard Edition, WANOP, and Enterprise Edition appliances, and SD-WAN Center. For information about the previous release versions, see the NetScaler SD-WAN documentation on docs.citrix.com.

6 Whats New The NetScaler SD-WAN release version introduces the new 210 Standard Edition appliance. For more information, refer to the Hardware Platforms section on docs.citrix.com at;

7 Fixed Issues Issue ID : NetScaler SD-WAN appliance crashes when you try to generate STS while processing high traffic volume. Issue ID : In a HA deployment with NetScaler SD-WAN VPX appliance on VMware ESXi platform, the virtual path service becomes inactive. Issue ID : NetScaler SD-WAN service is disabled when MPLS QOS queues with all tagged queues are configured through a WAN Link Template, and on receiving a packet without DSCP tag. Issue ID : When GRE Routes with Gateway eligibility are enabled, ICMP Packets to check gateway eligibility are not guaranteed to be transmitted through the GRE Tunnel. If the tunnel is down or the gateway address does not route to the tunnel, the packet uses standard IP routing. This leads to a GRE route being eligible inappropriately. Issue ID : When DPI multi-threading is enabled, it can cause conn_mgr/other threads to wait for connection lock on platforms. This occurs when the release conn->lock is removed before returning from firewall. Issue ID : Packets sent to the SD-WAN (IP host) Virtual IP address from a trusted WAN interface is dropped when the flow table is exhausted or unable to allocate flows. In this case, proper ICMP reply was expected from the SD-WAN appliance. Issue ID : When you configure Virtual Path IPsec between MCN appliance and two of the branch appliances, and when you attempt to send traffic from Branch1 appliance to Branch2, WAN-to-WAN forwarding packets with large size are dropped by IPsec due to buffer overflow. Issue ID : When GRE tunnel is transmitted through an untrusted interface, for example; Internet Service, the ping requests are responded, but the IP host will not forward replies/messages back to the GRE tunnel. Issue ID : Do not update VLAN ID in the packet descriptor after DPI processing is complete. Issue ID : Disabling service on SD-WAN appliances configured with BGP peering for more BGP holdtime duration, results in the BGP session becoming disabled after enabling the service. Issue ID : DHCP is enabled on LOM by default on some factory shipped 410-SE appliances. Assign an unreachable IP address to the LOM.

8 Issue ID : SD-WAN Center encounters an internal error when trying to export configuration. The config file should be saved with a new name and then exported to change management to prevent internal error. Issue ID : The ability to reconfigure or disable two box mode is not possible when caches are configured with any other subnets other than /24. Issue ID : As part of change management procedure during SD-WAN appliance staging phase, configuration fails when you change MTU on the intermediate router to 600. Known Issues Platform

9 SD-WAN Appliances Issue ID : When you configure Primary MCN and Secondary MCN for the first time, the Primary MCN is incorrectly configured as secondary MCN. Workaround: Configure the site, which must be the Secondary MCN, in client mode. Once the configuration is active, reconfigure the site as Secondary MCN and activate the new configuration. SD-WAN VPX Appliances Issue ID : For High Availability in Amazon Web Services (AWS) environment, Virtual WAN service is disabled on a NetScaler SD-WAN VPX Primary (active) appliance citing duplicate IP address when the HA interface on the primary appliance goes down. Issue ID : On ESXi platform, converting SD-WAN VPX to VPX-L platform requires software re-image. You need to perform the first boot on a 16GB VM. SD-WAN 4000 WANOP and 4000 SE Issue ID : On a NetScaler SD-WAN 4000 WANOP appliance, uploading DER encoded certificate for the SSL profile is ignored and no error message is displayed in the web GUI. Only PEM encoded certificates are accepted. Two Box Mode Issue ID : After a factory reset on the SD-WAN SE appliance in a two box mode, configuration sync between SD-WAN WANOP and SD-WAN SE appliances fails due to stale SSL certificates. Workaround: Disable and re-enable two-box mode on the SD-WAN WANOP appliance. SD-WAN 1000 / 2000 Issue ID : When you upgrade SD-WAN 1000 / 2000 appliance from release build version to 9.2.x, a warning is displayed in the browser. HDX CGP over SSL Workaround: Perform the upgrade in an in-cognito mode window of the Google Chrome browser. Issue ID : HDX ICA/CGP over SSL session s behavior In Virtual WAN Standard Edition: HDX sessions are not being negotiated as multi stream sessions even though MSI is enabled on the appliance and MSI+MP policies are set on incoming ICA traffic. HDX traffic is classified as belonging to Hyper Text Transfer Protocol Secure (https) application and web family.

10 HDX traffic falls under interactive_very_low class. This may cause issues in QoS, bandwidth allocation and so on as application QoS will not be triggered because the traffic is not classified as HDX sessions. Configuration WAN GRE Tunnel Issue ID : a NetScaler SD-WAN appliance does not reassemble fragmented GRE tunnel packets properly. IPsec Tunnel Configuration Issue ID : On a NetScaler SD-WAN VPX appliance, a web GUI error is displayed and configuration fails when you try to add and configure IPsec tunnel through the SD-WAN configuration editor. Workaround: Configure IKE and IPsec parameters except protected networks and save the configuration. Edit the configuration to add protected networks. Enterprise Edition as MCN SSL Profile Issue ID : On a factory shipped Enterprise Edition appliance when you create an SSL profile and associate a Service Class to the profile with unidirectional setting, the SSL profile is not checked/enabled in the SSL Profile page of the SD-WAN EE web GUI. In addition, the service class is not associated to the SSL profile. Workaround: Create a new SSL profile and associate unidirectional service classes. Configuration and Reporting Issue ID : Audit errors are reported when you create more than one Service Class on an SD-WAN appliance with override options. This issue occurs only when you perform override for service class and create more than one service class. This behavior is not observed when you create only one Service Class under the default section. Transparent proxy support for TLS 1.2 Issue ID : In NetScaler SD-WAN WANOP 9.3.0, for SSL compression the SSL profile has to be configured in split mode only as transparent proxy mode is not supported. Change Management (Single Step Upgrade) SD-WAN GUI Issue ID : During software upgrade on an appliance using a Standard Edition license, a WAN optimization related waring message appears. After the scheduled upgrade and after the WAN optimization, SVM and XenServer hotfixes are installed the warning message is cleared. Workaround: Clear the warning messages manually or open the SD-WAN web UI in an incognito browser window.

11 Secure Peering Certificate and Keys Issue ID : In the SD-WAN GUI, on the Secure Peering Certificate and Keys page, the CA certificate contents are displayed when the private CA radio button is selected after setting the KeyStore password on a new appliance. Workaround: You need to switch between the radio buttons of the 'Private CA' and 'CA Certificate' once to get the correct contents displayed under 'Private CA' and 'CA Certificate' for Secure Peering Certificate and Keys. Multicast Traffic Issue ID : When you configure Application QoS rule with match type as "Application" to match 'icmp' and change the class to Realtime, and mode to loadbalance which overrides the default rule, the multicast traffic is not processed. DPI Functionality DPI- ICMP Functionality Issue ID : A firewall policy for blocking ICMP as an application blocks only pings (echo requests). All other ICMP types are allowed to pass through. Workaround: Instead of blocking ICMP as an application, block IP-protocol > ICMP. DPI Dual- mode IPERF test identifies traffic only from one node Issue ID : When dual-mode IPERF test is performed between two appliances, the traffic in NetScaler SD-WAN web management interface under Monitoring > Firewall > Connections with DPI identifies traffic flow only from one of the connections. DPI Traffic for Top App Family as "Standard" and Top App as "Unknown Virtual protocol" for a Standard Edition appliance Issue IDs , , , , : On a NetScaler SD-WAN Standard Edition appliance, enable EDT policy for MSI+MP for Win7 and Win2K12 XD 7.12 VDAs on ports 2598, 2599, 2600, 2601 and subsequently disable Session Reliability policy for Win7 VDA. Start sending internet traffic and check the monitoring flows in the Standard-Edition web management interface for Classes, Rule groups ICAUDP and ICACGPUDP, and Firewall. Check the Dashboard and Reporting page in SD-WAN Center web management interface. The results display Top Application Family as Standard and Top Applications as Unknown Virtual Protocol.

12 SD-WAN Center Issue ID : In the SD-WAN Center dashboard, configuration setup for monitoring 400 or more sites can take approximately 4 minutes to load. Issue ID : The clear connections/flows clears SD WAN connection table entries and subsequently all the ICA sessions The SD-WAN Center dashboard shows incorrect results for HDX TCP and EDT classification sessions and reports it as Not Classified. Issue ID : For HDX configuration, only UDP ICA sessions are classified by ICA classifier. The Frame Hawk ICA session are ignored. The SD-WAN DPI fails to classify the Frame Hawk sessions. Issue ID : NetScaler SD-WAN Center dashboard reports an MSI + MP session as single stream instead of multi stream. When you configure any of the default ICA/CGP ports, 1494 or 2598 as part of the DPI ICA Port range under the Global Application Settings, the ports will not be honored. Workaround: Do not use that port for the port range. Issue ID : In a network setup with 550 sites, if you perform any network level changes in the setup, it takes approximately ~5-8 mins for the information to be displayed in the SD- WAN center Dashboard. Limitations HDX o o o The number of users is equal to the total number of HDX sessions. The number of users is not based on distinct user names. That is, two sessions started by a single user on two different machines or the same machine is counted as two users. HDX sessions are not being negotiated as Multi Stream Sessions even though MSI is enabled on the appliance and MSI+MP policies are set on incoming ICA traffic. HTML5 receiver and ICA over SSL are not supported. ICA UDP o The audio over UDP ports; to for Real Time Transport traffic Classification and Reporting is not supported in release x. SD-WAN Center and Diagnostics Tool o o SD-WAN web GUI Diagnostic tool will not be supported on UNTRUSTED links and Dynamic Virtual Paths. In the SD-WAN Center Reporting page, the Application name, Application Family, and Site filter do not contain scrollable search drop-down menu.

13 o For SD-WAN Standard Edition, a connection with high latency is displayed as Poor Connection in the Citrix Quality Indicator (CQI) Tool. While, in SD-WAN Center the Network HDX QOE is still displayed as Good. Microsoft Azure o After a VM is created and booted in Azure, the interfaces cannot be added or deleted. The VM profile (RAM/HD/CPUs) can be changed. o Azure does not allow two network interfaces NIC on a VM to have IP address on same subnet. There is no L2 Support and bridging is not allowed. SE-VPX on Azure has to be deployed in Gateway mode. o There is no concept of MAC address spoofing in Azure Cloud. The LAN subnet of the SE-VPX and the LAN subnet of the Client/Server Host have to be different. This will require additional routing configuration to be done in two places. User Defined Routes (UDR) have to be added in Azure directing all Virtual WAN Data traffic from the Client/Server LAN Subnet to the LAN interface of the SE-VPX in Azure. Routes have to be added in the Virtual WAN Configuration File directing all Virtual WAN Data traffic coming from the WAN to the Client/Server LAN Subnet. PCI Enumeration causes the order of NICs in an Azure VM to get switched on reboots. This might cause Management Subnet unreachability.