Dell SonicWALL SonicOS

Transcription

1 Dell SonicWALL SonicOS October 2015 These release notes provide information about the Dell SonicWALL SonicOS release. Topics: About SonicOS Supported platforms New Features s Known issues System compatibility Product licensing Upgrading information Technical support resources About Dell About SonicOS SonicOS introduces several new features and fixes a number of known issues in earlier 6.1 releases. See New Features and s. This release provides all the features and contains all the resolved issues that were included in previous releases of SonicOS x. For more information, see the previous release notes on MySonicWALL at or on the Support portal at Supported platforms The SonicOS release is supported on the following Dell SonicWALL network security appliance: NSA 2600 SonicOS

2 New Features This section describes the new features in the SonicOS release. Disable DPI Option for Firewall Access Rules Gateway Anti-Virus Detection Only Mode Shutdown Port Option Change Auditor Support in AppFlow Suffix Option for HA/Clustered Firewalls Control Plane Flood Protection Source/Destination IP Address Binding for Round Robin/Spillover Load Balancing Botnet Source Identification in AppFlow Monitor Disable Source Port Remapping option for NAT DNS Rewrite for Google SafeSearch User Session Enhancements Disable DPI Option for Firewall Access Rules A new Disable DPI checkbox is provided on the Advanced tab when creating an access rule from the Firewall > Access Rules page. This allows the administrator to disable Deep Packet Inspection on a per-rule basis. Disable DPI option SonicOS

3 Gateway Anti-Virus Detection Only Mode A new Enable detection-only mode checkbox is available in the Gateway AV settings. Click the Configure Gateway AV Settings button to access this option. When selected, this option causes traffic containing viruses to be logged, but not blocked. Enable detection-only mode option Shutdown Port Option A new Shutdown Port option is available in the Advanced tab when editing an interface on the Network > Interfaces page. You can select the Shutdown Port checkbox to temporarily take the interface offline for maintenance or other reasons. If connected, the link will go down. Clear the checkbox to activate the interface and allow the link to come back up. SonicOS

4 Shutdown Port option You cannot shut down the management interface or the interface you are currently using. You can also shut down an interface by clicking the green checkmark icon in the Enabled column for the interface in the Interface Settings table. A confirmation message displays, such as Do you wish to administratively shut down port X4? If you click OK, the checkmark icon turns to a red x icon (Disabled icon). To enable the interface, click the Disabled icon and click OK when the confirmation message displays. Change Auditor Support in AppFlow AppFlow now includes support for Dell Change Auditor for SonicWALL, the automated auditing module that allows you to collect data on Internet web site and cloud activity. For more information about using Change Auditor with SonicOS appliances, see the Change Auditor for SonicWALL User Guide, available at SonicOS

5 Suffix Option for HA/Clustered Firewalls A new Auto-Append HA/Clustering suffix to Firewall Name checkbox is provided on the System > Administration page under Firewall Name. Auto-Append HA/Clustering suffix to Firewall Name option When enabled, this option automatically appends an appropriate suffix to the firewall name in the Dashboard > Log Monitor: - Primary - Secondary - Primary Node <n> - Secondary Node <n> This option facilitates recognition of the primary/secondary firewalls in the log. SonicOS

6 Control Plane Flood Protection The Control Plane Flood Protection section of the Firewall Settings > Flood Protection page provides a new Enable Control Plane Flood Protection checkbox together with a Control Plane Flood Protection threshold (CPU %) field in which you can enter a percentage of CPU capacity (default 75%). Enable Control Plane Flood Protection option When the Enable Control Plane Flood Protection option is enabled, if traffic on the Control Plane (Core 0) exceeds the threshold specified in Control Plane Flood Protection threshold (CPU %), the firewall forwards only control traffic destined to the firewall to the system Control Plane core. To give precedence to legitimate control traffic, excess data traffic is dropped. This restriction prevents too much data traffic from reaching the Control Plane core, which can cause slow system response and potential network connection drops. The percentage configured for control traffic is guaranteed. SonicOS

7 Source/Destination IP Address Binding for Round Robin/Spillover Load Balancing When configuring a load balancing group from the Network > Failover & LB page, the Use source and destination IP address binding checkbox is now available for the Round Robin and Spillover load balancing types. In previous releases, this was only available when Type was set to Ratio. Use source and destination IP address binding option The option is especially useful when using HTTP/HTTPS redirection or in a similar situation. For example, connection A and connection B need to be on the same WAN interface, the source and destination IP addresses in Connection A are the same as those for connection B, but a different service is being used. In this case, source and destination IP address binding is required to keep both the connections on the same WAN interface so that the transactions do not fail. SonicOS

8 Botnet Source Identification in AppFlow Monitor A Botnet filtering option and Botnet reporting columns are added to the AppFlow Monitor and AppFlow Reports pages to allow the administrator to filter for botnet traffic and view the individual user or IP address and associated detected applications. In Dashboard > AppFlow Monitor (and AppFlow > AppFlow Monitor), Botnet can now be selected for the Group option on the Threats tab. Botnet option for Group In Dashboard > AppFlow Reports (and AppFlow > AppFlow Reports), new Botnet columns are added to the User and IP tabs. Botnet column in reports SonicOS

9 Disable Source Port Remapping option for NAT When editing a NAT policy from the Network > NAT Policies page, a new Disable Source Port Remap checkbox on the Advanced tab of the Add/Edit dialog provides a way to disable source port remapping on the policy. Disable Source Port Remap option When this option is selected, SonicOS preserves the source port of the connection while executing other NAT mapping. This option is available when adding or editing a NAT policy if the source IP address is being translated. The checkbox cannot be selected if the Translated Source is set to Original. DNS Rewrite for Google SafeSearch SonicOS supports Google Safe Search using the latest functionality provided by Google. When the Enforce Google Safe Search option is enabled in the Security Services > Content Filter page, SonicOS will rewrite DNS responses for Google domains to the Google SafeSearch Virtual IP address. A new FQDN Address Object called forcesafesearch.google.com is automatically added to the SonicOS configuration and clients will always be forced to this site for Google Safe Browsing. NOTE: Dell SonicWALL recommends that users clear their browser cache and do a DNS flush before using this feature. SonicOS

10 User Session Enhancements SonicOS provides new User Level Authentication (ULA) related CGI parameters for appliance management by Dell SonicWALL Global Management System (GMS). On the Enforcement tab of the Single Sign-On (SSO) configuration window, new bypass rules replace the old SSO bypass settings. Also, the Enforcement tab of the SSO configuration window includes a checkbox and user name field related to connections that bypass SSO. New parameters for User Name Logging on the Users > Settings page under User Session Settings: New parameters for cleaning up user connections at logout in the Users > Settings page under User Session Settings: New parameters for SSO Agents in the SSO configuration dialog, SSO Agents tab, General Settings subtab: New parameters for user inactivity in the Users > Settings page under User Session Settings: SonicOS

11 s The following is a list of resolved issues in this release. Firewall The Clear Statistics button on the Firewall Settings > Flood Protection page does not clear the UDP or ICMP statistics, and there are no separate buttons to clear the UDP or ICMP statistics. Occurs when trying to clear the UDP or ICMP statistics from the Traffic Statistics panel list GMS Management LDAP user testing fails from the SonicOS user interface while being accessed through Dell SonicWALL GMS. Occurs when an administrator logs into a managed firewall from the GMS TreeControl Login to Unit right-click menu Networking The WAN (X1) interface in L2TP mode is disconnected from L2TP and the firewall must be restarted to recover. Occurs after enabling the L2TP server feature in the VPN > L2TP server page. OSPF comes up in a disabled state on a VPN Tunnel Interface after a restart. Occurs when a Site-to-Site VPN Tunnel Interface is configured and advanced routing is enabled with OSPF configured, and then the firewall is restarted. DHCP ACK packets are dropped as Invalid DHCP discovery pkt. Occurs when an IP helper policy is configured to relay DHCP requests from one VLAN to another, and some clients use extended DHCP option # 244 or #160, and then the DHCP server replies to the client s IP address instead of the relay agent IP address. The firewall does not learn and propagate routes for OSPF. Occurs when inconsistent bandwidth values cause the WAN interface to repeatedly go down and come back up Security Services Content Filtering Service custom policies are intermittently applied and sometimes revert to the more restrictive Default policy while the user is logged in and memberships/policies are displayed in the Users > Status page. Occurs when a user s CFS policies are not properly set up during login, for both local users/groups and LDAP users/groups SSL VPN Adding a VNC bookmark does not work. Occurs when attempting to add the bookmark on the SSL VPN > Virtual Office page with settings for the IP address port number and desktop number SonicOS

12 System The firewall can restart unexpectedly while checking user groups. Occurs when the user group list is cleared during user logout, then accessed by another function. The firewall can restart unexpectedly during user processing. Occurs when Single Sign-On is enabled and the user cache is accessed within SonicOS. The firewall can restart unexpectedly with tracelog messages for userconnremove and sw_cvmx_spinlock_rec_lock. The TSR shows SSL proxied connection count (cur/highwater/max): 3061/3069/350, indicating that the number of current DPI- SSL connections is greater than the supported maximum. Occurs when SonicOS is using DPI-SSL and Single Sign-On (SSO), and is processing user information under heavy load. Both firewalls in an HA Pair restart simultaneously, causing loss of Internet connectivity. Occurs when various user related internal functions result in some functions being locked out waiting for others, resulting in a traffic spike causing all 32 cores in the SM 9600 pair to reach 100% of capacity. The primary unit in an HA Pair restarts frequently with the control plane and some data plane core utilization showing 100% capacity. Occurs when the primary unit is configured from the CLI, which causes some of the configurations to not synchronize to the secondary unit, and when Enable Geo-IP Resolution is selected on the AppFlow > Flow Reporting > Settings page. The primary unit in an HA Pair stops responding and does not fail over to the secondary unit until power is disconnected from the primary. Occurs when both units in the HA Pair are online. A POW_ECC_ERROR on the secondary unit can cause it to enter a bad state where it is not processing heartbeats, thus causing the continuous toggling of the primary unit from Active state to Election state User Interface The Mirror LDAP user groups locally checkbox label has an incorrect line break on the Users & Groups tab of the LDAP User Settings page. Occurs when configuring LDAP using Internet Explorer Users Terminal Services Agent (TSA) users are authenticated twice, causing all TSA users to lose the connection upon the second authentication. Occurs when Single Sign-On (SSO) and the TSA correctly authenticate one or more users, and then the SSO Agent authenticates the IP address of the TSA server, even though it is included in the SSO Bypass list. SSL-VPN users are randomly disconnected from NetExtender. The logs show logout reported by SSO agent and Session ID mismatch every time. Occurs when using Single Sign-On and the SSO Agent is configured to include DC Security Logs in the query source and the Windows server generates both local IP and remote IP entries in the security log with the user login name, causing the SSO Agent to report an extra user login notification to the firewall. Often occurs when using RDP to connect to a LAN PC via the domain name. Adding a Terminal Services Agent displays Error: Host name/ip address. Occurs when the host name begins with a number SonicOS

13 In a Terminal Services Agent environment, users are not logged out of the firewall automatically. Occurs when users log in to a Terminal Server using the Remote Desktop Protocol (RDP), and then log out via RDP Vulnerability A Trustwave Inc. PCI compliance scan reports SSL/TLS weak encryption algorithms matching CVE and CVE Occurs when PCI compliance scans are done on the SonicOS HTTPS server via the WAN, finding use of the TLSv1.0 protocol Known issues The following is a list of known issues in this release. AppFlow Known issue A JavaScript error is shown in a popup with the heading, Errors on this webpage might cause it to work incorrectly, and no URLs can be displayed on the URLs tab of the AppFlow > AppFlow Monitor page in SonicOS. Occurs when the Enable AppFlow To Local Collector option is fully enabled for AppFlow > Flow Reporting, users have accessed web pages from the LAN, and Internet Explorer 9 is used to view the AppFlow > AppFlow Monitor page in SonicOS Application Control Known issue The Ultrasurf browser plugin is not blocked by an App Rule or App Control Advanced. Occurs when using the Chrome browser plugin for Ultrasurf. App Control does not block access to Google Play app store from a smartphone app, but play.google.com is blocked from a browser on a personal computer. Occurs when DPI-SSL is not enabled and an App Rule is configured on the firewall to block the Google Play application and signatures, then an Android smartphone connects to the firewall via a wireless access point and can download or update apps from the Google Play store. The Firewall Settings > BWM link in an App Rule does not display the correct page. Occurs when configuring a new policy in the App Rules page and clicking the Firewall Settings > BWM link Log Known issue Intrusions are not reported in the external collector and Scrutinizer shows that no report is generated. Occurs when Client DPI-SSL and IPS are enabled, and the Send Flows and Real-Time Data To External Collector option is selected and the External Flow Reporting Format is set to IPFIX with extensions, under the External Collector Settings tab on the AppFlow > Flow Reporting page SonicOS

14 Networking Known issue BGP routes are still shown in the Network Routing table after the BGP neighbor is down. Occurs when BGP routes are established and listed in the Network > Routing page, but after SonicOS shows that the BGP router is no longer available, the page still displays the BGP routes until the firewall is restarted. OSPF routes are still shown in the Network Routing table after the OSPF router is down. Occurs when OSPF routes are established and listed in the Network > Routing page, but after SonicOS shows that the OSPF router is no longer available, the page still displays the OSPF routes until the firewall is restarted. A final backup interface and non-default WAN group interfaces are left without an IP address and appear to be unassigned after rebooting the firewall. Occurs when multiple WAN interfaces are configured using DHCP mode. All receive IP addresses initially, but those that are configured either as the final backup interface or are part of a WAN load balancing group, but not designated as the Selected interface, do not receive renewed DHCP IP addresses after the firewall restarts. All mirrored packets received on a WAN zone interface in Tap mode are dropped with a message including, "bounce same link pkt", preventing deep packet inspection (DPI) on the traffic to that interface. Attack traffic is not detected and logged. Occurs when an interface is configured in the WAN zone using Tap mode, Intrusion Prevention is enabled to detect Low Priority Attacks and then pings and low priority attack traffic are sent to the interface. Bandwidth management on link aggregated interfaces does not provide the total aggregated bandwidth. Occurs when multiple interfaces are configured for link aggregation (as a LAG), and then bandwidth management values are configured on the Advanced tab of the Edit Interface dialog. The maximum bandwidth limitation is equal to the bandwidth of a single interface, 1 Gbps. Cannot ping a client device on the WAN from a client connected to the LAN, and the firewall must be restarted to recover. Occurs when the LAN (X0) interface has no link when it is configured in Wire Mode and paired with the WAN (X1) interface, and then the link is restored. Link state propagation does not work with Wire Mode over link aggregation (LAG). Occurs when High Availability is enabled, a LAN interface is set to Wire Mode (Inspect Mode) and paired with a second LAN interface for link propagation. A third interface is aggregated with the first interface, and then a fourth interface is aggregated with the second interface. When the first interface loses connectivity to the external switch, the link status is not propagated to the second interface which unexpectedly remains up Security Services Known issue Anti-Spyware is still active after it is disabled on a zone, and spyware continues to be blocked. Occurs when Anti-Spyware has been enabled globally on the Security Services > Anti-Spyware page and then is disabled for a zone by clearing the Enable Anti- Spyware Service checkbox when editing a zone from the Network > Zones page SonicOS

15 SSL VPN Known issue A Java error message is displayed, 'Sorry, Could not connect: java.security.accesscontrolexception: access denied.... Occurs when accessing an SSHv1 bookmark and logging into the SSL VPN portal using Firefox from a Linux computer with Java version JRE1.8.0_ System Known issue The firewall does not block the connection and log the event. It only logs the event. Occurs when the Block the connection and log the event option is selected on the Firewall Settings > SSL Control page, and the Stateful Firewall Security button is clicked on the System > Settings page, and the firewall is rebooted. On the Firewall Settings > Advanced Page, in the Connections panel, DPI Connections is selected instead of Maximum DPI Connections as expected. Occurs when the DPI and Stateful Firewall Security" button is clicked on the System > Settings page, in the One-Touch Configuration Overrides panel, and the firewall is rebooted. On the Firewall > Access Rules page, under the Advanced tab of the Edit Rule dialog, the Enable connection limit for each Source IP Address option is not set as expected. It should be selected and set to 128 as specified in item 18 of the DPI and Stateful Firewall Security" settings list on System > Settings. Occurs when the DPI and Stateful Firewall Security" button is clicked on the System > Settings page, in the One-Touch Configuration Overrides panel, and the firewall is rebooted VPN Known issue A VPN policy cannot be created and SonicOS reports the error, Peer ID value is not valid for Peer ID Type. Occurs when the Authentication Method is configured as IKE using 3 rd Party Certificates and the Local IKE ID Type and Peer IKE ID Type are set to Distinguished name (DN) SonicOS

16 System compatibility This section provides additional information about hardware and software compatibility with this release. Dell SonicWALL WXA support The Dell SonicWALL WXA series appliances (WXA 6000 Software, WXA 500 Live CD, WXA 5000 Virtual Appliance, WXA 2000/4000 Appliances) are supported for use with Dell SonicWALL NSA appliances running The recommended WXA firmware version is WXA Browser support SonicOS uses advanced browser technologies such as HTML5, which are supported in most recent browsers. Dell SonicWALL recommends using the latest Chrome, Firefox, Internet Explorer, or Safari browsers for administration of SonicOS. This release supports the following Web browsers: Chrome 18.0 and higher (recommended browser for dashboard real-time graphics display) Firefox 16.0 and higher Internet Explorer 8.0 and higher (do not use compatibility mode) Safari 5.0 and higher NOTE: On Windows machines, Safari is not supported for SonicOS management. NOTE: Mobile device browsers are not recommended for Dell SonicWALL appliance system administration. Product licensing Dell SonicWALL network security appliances must be registered on MySonicWALL to enable full functionality and the benefits of Dell SonicWALL security services, firmware updates, and technical support. Log in or register for a MySonicWALL account at Upgrading information For information about obtaining the latest firmware, upgrading the firmware image on your Dell SonicWALL appliance, and importing configuration settings from another appliance, see the SonicOS 6.1 Upgrade Guide available on MySonicWALL at or on the Support portal at SonicOS

17 Technical support resources Technical support is available to customers who have purchased Dell software with a valid maintenance contract and to customers who have trial versions. The Support Portal provides self-help tools you can use to solve problems quickly and independently, 24 hours a day, 365 days a year. In addition, the portal provides direct access to product support engineers through an online Service Request system. To access the Support Portal, go to The site enables you to: View Knowledge Base articles at: View instructional videos at: Engage in community discussions Chat with a support engineer Create, update, and manage Service Requests (cases) Obtain product notifications SonicOS Administration Guides and related documents are available on the Dell Software Support site at About Dell Dell listens to customers and delivers worldwide innovative technology, business solutions and services they trust and value. For more information, visit Contacting Dell For sales or other inquiries, visit or call Copyright 2015 Dell Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. Dell and the Dell logo are trademarks of Dell Inc. in the United States and/or other jurisdictions. All other marks and names mentioned herein may be trademarks of their respective companies. Legend CAUTION: A CAUTION icon indicates potential damage to hardware or loss of data if instructions are not followed. WARNING: A WARNING icon indicates a potential for property damage, personal injury, or death. IMPORTANT, NOTE, TIP, MOBILE, or VIDEO: An information icon indicates supporting information. Last updated: 10/22/ Rev A SonicOS