SonicWALL Aventail README ST v /SSL VPN version 8.9.0

Transcription

1 SonicWALL Aventail SSL VPN README 1 SonicWALL Aventail README ST v /SSL VPN version Part No August 14, 2007 This README highlights new features and provides late-breaking information about the SonicWALL Aventail STv/SSL VPN appliances. It also lists known issues that are fixed in this release. This information supplements the printed and online documentation that accompanies the appliances. Review the README before installing and configuring your Aventail appliance. Upgrading from Earlier Versions If you are upgrading to SonicWALL Aventail STv/SSL VPN (version 8.9.0) from an earlier release, be sure to consult the upgrade instructions in the Installation Tech Note for detailed information. You ll find a copy of this document on the Aventail Assurance support site. What s New in this Release This version of the SonicWALL Aventail SSL VPN software includes the following new and enhanced features: Support for Windows Vista: The Connect tunnel client now supports the Microsoft Windows Vista operating system. The appliance automatically detects the Windows OS (Windows Vista, Windows XP, or Windows 2000) and provisions the correct version of the client the user does not need to choose it. This release also includes full support for Internet Explorer 7. Connect Mobile for Windows Mobile-powered devices: Smartphones running Windows Mobile 5 (and soon Windows Mobile 6) now include all of the networking capabilities of Pocket PC. SonicWALL Aventail supports full VPN connectivity for these devices using Connect Mobile. Distributing configuration data to multiple appliances: Aventail customers can now replicate configuration data from one appliance to a group of appliances. This is useful when you have more than one appliance configured behind a load-balancer, or when you have appliances at different physical locations that share nearly identical configurations (everything except the network settings). You can send configuration data to other SonicWALL Aventail appliances, or configure an appliance to receive data. Configuration migration: You can now export the policy from an older Aventail appliance and import it to a newer one; the older appliance must predate the newer one by no more than three versions. For example, if you own a version appliance and you decide to deploy an additional appliance today, the one you buy will be version With this new feature, you can export the policy configuration from your v8.6.1 appliance and import it to your new appliance. Saving and restoring configuration data: You can now save as many as 20 configuration data files on the appliance using the AMC interface, and later restore them. This is similar to the import/export functionality, except that the files are saved on the appliance (instead of being downloaded to a local computer). External and internal default network gateways: Administrators often need to define static routes on the SonicWALL Aventail appliance in order to reach resources on their internal networks, which can be a time-consuming effort. Customers who have configured a dual-homed environment, where both the internal and external interfaces of the appliance are enabled, can now direct network traffic destined for the Internet to an external gateway, and direct network traffic destined for internal resources to an internal gateway. Alternate start page for WorkPlace: You can direct users somewhere other than the default WorkPlace home page once they authenticate, provided that the realm they are logging in to offers only translated Web access. For example, if you have hired someone who will submit work using your content management system, you can configure AMC so that the contractor bypasses the WorkPlace home page and goes directly to the CMS application.

2 2 STv / version Blocking attachments and the display of sensitive information: In cases where End Point Control scanning cannot confirm that a user s device can be trusted, you generally want to restrict access. For example, you can grant users access to mail messages, but you may not want them to be able to download message attachments that can be seen by third parties, left behind, or printed in an untrusted environment. Or you may want to prevent a Web-based application from displaying restricted data on an untrusted device. Both of these examples involve using a new resource type called Matching URL. Windows Connect tunnel automatic software updating: You now have the option of installing client software updates without user intervention: the install process begins immediately and the user cannot cancel it. SonicWALL License Agent: A local license agent on the appliance periodically makes a secure HTTPS (TCP port 443) connection to the central SonicWALL licensing server to validate your license and appliance environment integrity. No sensitive or personal information is ever exchanged. The following describes the data that is reported: IP address MAC address Product code RAM size Disk size Software version License For a machine that is dual-homed, this is the external IP address The MAC address of eth1 The product code corresponds to the appliance model number (for example, EX-1600 or EX-2500) The total RAM in the appliance The hard drive size The appliance software version, including the build number The contents of the imported XML license file Known Issues This section describes the known issues for this release. The five-digit numbers in brackets are internal Aventail tracking IDs. Microsoft Vista Operating System Note: Previous versions of the Aventail software (releases prior to v8.9.0) will not work with the Vista operating system. Users cannot connect using a Web browser with SSL v3 protocol [34905/35311] Vista users will not be able to connect to the appliance using a Web browser if the protocol for encrypting traffic is set to Use SSL v3 protocol only. Change the protocol for encrypting traffic: on the Configure SSL Encryption page in AMC, select either TLS v1.0 protocol or Use both protocols. WorkPlace client provisioning fails with IE7 on Vista because Protected Mode is disabled [35003/35314] If IE7 is launched by right-clicking the IE icon and selecting Run as administrator, or if the browser is launched with administrative privileges from another application (which is what happens during client provisioning), Protected Mode is disabled. The result is that Aventail Access Manager is successfully installed, but the client is not.

3 SonicWALL Aventail SSL VPN README 3 OnDemand tunnel shows Interactive services dialog when proxy configuration file is specified [35098] If you configure OnDemand tunnel to run in split-tunnel mode, and you specify a proxy configuration file in the Web browser in order to set up an outbound proxy, launching OnDemand tunnel will display the Vista "Interactive services" dialog box. If you then click Show me the message in this dialog, you are transferred to another page running in the background. When you try to access resources, they are being routed through the proxy, instead of the tunnel. Web proxy service agents fail to activate if Kaspersky Internet security suite is running [35108/35315] On a Vista Ultimate computer using IE7, Aventail agents that use the Web proxy service (which manages HTTP and TCP/IP connects from Web browsers, Aventail OnDemand, and Connect Mobile) fail to activate if the Kaspersky Internet security suite is running. This antivirus program will not allow Aventail.jar files to be installed, resulting in exceptions in the Java Console. Connect tunnel: domain logon fails [35162] If you log in to a realm that requires Connect tunnel to be running in split-tunnel mode, and then you add that computer to a Windows domain that has been set up as a domain resource in AMC, you will not be able to log in to the domain after you restart your computer. The domain logon displays an error message ( Login request failed ). Suspect certificate prompts when Connect tunnel is installed from WorkPlace [35182] If you install Connect tunnel from WorkPlace on a computer running Vista, you will see a security alert ( The Certificate Issuer for this site is untrusted or unknown ). Click Yes to proceed with the installation. Initialization file settings not honored during upgrade using WorkPlace [35199] If OnDemand Tunnel is installed and you log in to a different realm in WorkPlace and upgrade Connect tunnel, the.ini file settings for Connect tunnel are ignored. For example, Create desktop icon may be configured for Connect tunnel in this realm, but no desktop icon will be visible to users. AAM does not install or run if UAC is disabled [35331] User Account Control (UAC) is a Windows Vista security component that enables users to perform common tasks as non-administrators. If UAC is disabled, Aventail Access Manager (which enables you to provision users with EPC and access agents when they log in to WorkPlace) cannot run properly, even if it is installed. This is a known issue that is scheduled to be fixed in the next service pack for Microsoft Vista. Network shares are not accessible using a virtual IP address [35358] If you run either of the tunnel clients in split tunnel mode (where traffic bound for resources defined in AMC is redirected through the tunnel), you will not have access to network file shares if you are running the Microsoft Vista operating system.

4 4 STv / version Platform/Operating System Windows XP SP2 users must install the KB update from Microsoft [34171] On a computer that is running Microsoft Windows XP SP2, programs that connect to IP addresses that are in the loopback address range may not work as expected. For example, you may receive an error message that says that you cannot establish a connection. The OnDemand access agent is in this category: it uses the local loopback address ( ) to redirect and secure traffic through the appliance. Customers should install this patch from the Microsoft site: Appliance Hardware LCD display is not updated after configuration changes [34064/34066] When you change an EX-1600 or EX-2500 appliance from dual- to single-homed (or vice versa), the LCD panel on the front of the appliance will not update to accurately display the current configuration. Connect Tunnel Appliance accessible from Connect tunnel even when not explicitly provisioned [31452/33337] If the appliance is configured with an IP address pool, a user with the Connect tunnel client is able to connect to the appliance, even if the tunnel client is not explicitly deployed to that user. For example, you might set up a realm with two communities: An Employees community that deploys the Connect tunnel A Partners community that uses translated Web access If a user in the Partners community manages to obtain the Connect tunnel client and provides valid authentication credentials, he could use the tunnel client to access resources. (Policy rules still control what resources the partner has access to, but the access method is not what the appliance administrator intended.) Cannot access the appliance using the FQDN/VIP for a WorkPlace site [32324] If the Connect tunnel client is configured (by an administrator or user) to access the appliance using the FQDN or virtual IP address for a custom WorkPlace site, it displays a message reading The device is not in a valid state to perform this request. (If you access protected resources directly using Connect tunnel in other words, without using WorkPlace this is not an issue.) Configure the client to access the appliance using the FQDN or IP address contained in the appliance s main certificate. Macintosh and Linux clients lack support for null authentication [32343] Specifying None as the authentication server for a realm allows unauthenticated, open access to the realm and its resources; it s used in the rare cases in which an administrator chooses to use alternate means (a client certificate, for example) to determine whether a device should be trusted. This feature is not supported on the Macintosh and Linux clients.

5 SonicWALL Aventail SSL VPN README 5 Cannot access the appliance if specified proxy server is unavailable [32355] If Internet Explorer is configured to use an outbound HTTP proxy server, Connect tunnel will attempt to access the appliance using that proxy server. If the proxy is available, the client connection will succeed. However, if the proxy server is unavailable, the client will not fall back to sending traffic through the default route, causing the connection to the appliance to fail. Remove the proxy setting from the browser. Connect tunnel fails to establish the connection when Sygate Personal Firewall is enabled. [32760] Using Sygate Personal Firewall 5.6 with default settings, Connect tunnel can establish a VPN tunnel, but then closes it with an error message ( The transport connection was aborted by the local system ). Add an Allow rule to Sygate Personal Firewall that allows connections to (a multicast address used by IGMP, the Internet Group Multicast Protocol). Once this rule is added, Connect tunnel can successfully establish the tunnel and connections are allowed. You must also configure Sygate Personal Firewall to allow the following processes to access the network when prompted during/after tunnel establishment: explorer.exe svchost.exe csrss.exe ngvpnmgr.exe Using dial-up and remote proxy for the connection to the Internet [33485] If you use a dial-up connection to the Internet, and the community to which you are assigned is configured for remote proxy, Internet browsing may not traverse the remote proxy (this applies regardless of whether the remote proxy was configured manually or using a.pac file). In Connect tunnel, make sure the dial-up connection is specified on the Properties page: select the Establish this connection first check box and specify a connection in the drop-down list. (If you use OnDemand tunnel, there is no equivalent way to specify the connection properties.) Desktop icon for Connect tunnel in WorkPlace not present for all Linux users [33591] When you provision Connect tunnel from WorkPlace and the user downloads and installs the client, an icon is normally created on the user s desktop. If the client device is a computer running a Linux operating system and a different person logs in to it, no desktop icon for Connect tunnel will be visible. One workaround is to bring up the command window (press ALT+F2), and then type the path to the Connect tunnel program. Alternatively, you could create an icon on the desktop for the Connect tunnel program. In Redhat or Fedora, for example, you would right-click on the desktop and select Create Launcher, and then browse to the Connect tunnel application. Internet is accessible using Firefox in redirect all mode if proxy settings are configured on both IE/Firefox browsers [34026] When configuring the tunnel clients, you must specify a redirection mode, which determines how client traffic is redirected to the appliance. In redirect all mode, traffic is redirected through the tunnel regardless of how resources are defined in AMC. This works in Internet Explorer, which honors the device's Windows Proxy Settings. Mozilla Firefox, on the other hand, ignores the interface-specific proxy settings and just sends all traffic out the proxy server.

6 6 STv / version Certificate selection dialog includes certificates that are not trusted by appliance [34088] The list of client certificates in Internet Explorer includes ones that are trusted and untrusted by the Aventail appliance. Tunnel clients unable to reconnect over an access point that requires authentication [34153] On a Macintosh device, the VPN tunnel cannot be re-established when you switch to a network that requires authentication. For example, if a user is connected to the appliance using a wired connection and changes to a wireless access point that requires authentication, the previous connection cannot be re-established; the user must manually log in to the appliance. Realm names with international characters must be selected from the Browse Login Groups dialog box [34159] A realm that you create in AMC can be given a name that includes extended ASCII or double-byte characters (for example, Berliner Bär ). When a user logs in to a WorkPlace realm that includes these characters, and then installs Connect tunnel, he or she will not be able to establish a VPN connection to the realm shown in the Properties dialog box (which is Berliner Bär in this case). Users must follow these steps to work around this issue: 1. Make sure you are not yet connected to the VPN using Connect tunnel. 2. In the Aventail Connect login dialog box, click Properties. 3. Click the General tab, and then click Change. The Browse Login Groups dialog box appears and displays the list of login groups. 4. Select the name of the login group (in this case, Berliner Bär ). Error message: An incompatible version of this product is already installed [34253] The setup programs for the Connect tunnel and OnDemand tunnel clients do not allow you to install software updates that use different language resources. If a localized release of the tunnel client is installed, for example, a subsequent upgrade to an English-only release will display an error message ( An incompatible version of this product is already installed. Please remove it using Add/Remove Programs in the Windows Control Panel, and then try again ). If you receive this error message while installing a release of one of the tunnel clients, use the Windows Add/Remove Programs utility to remove the current client, and then run setup again. Connect tunnel v fails after upgrade to Vista operating system [33650/35308] If a user has installed Connect tunnel v8.9.0 on Windows XP/SP2, and then upgrades the operating system to Windows Vista, Connect tunnel will not run. Manually uninstall Connect tunnel and then re-install it after you ve upgraded to Windows Vista. Forced software update in WorkPlace takes longer than expected [35319/35350] In version 8.7 and later, you can configure Connect tunnel to be automatically updated (if necessary) when it is provisioned from Aventail WorkPlace. Users connecting to a version appliance may report that the process takes longer than expected, especially on a computer running Windows Vista. This is normal (the signature with the trust authority is being verified) and will only occur during the first connection to the updated appliance.

7 SonicWALL Aventail SSL VPN README 7 OnDemand Tunnel Note: Issue above applies to both the Connect tunnel and OnDemand tunnel clients. HTTPS traffic routed through proxy in clustered configuration [33296] If a Firefox browser is configured to use an HTTP proxy, OnDemand tunnel (configured in redirect-all mode) incorrectly routes HTTPS traffic through the proxy when the appliance is running in a clustered configuration. When accessing a stand-alone appliance, the client ignores the HTTP proxy setting and properly routes HTTPS traffic based on the proxy settings configured in Firefox. Script error in WorkPlace when a remote proxy is manually configured for a community [33925] When an Internet Explorer user logs in to WorkPlace and is classified into a community that requires OnDemand tunnel, he or she will encounter a script error if a remote proxy server (for access to the Internet) has been manually configured for that community. Tunnel Clients and.pac Files (Linux Platform) When OnDemand tunnel or Connect tunnel is launched on the Linux platform in an environment where a proxy server is used for outbound access to the Internet, the Aventail appliance appends redirection settings to the browser s proxy auto-configuration (.pac) file. These modifications are made for the duration of the session only; the original browser settings are reinstated when the user logs out. There are some known issues involving this combination of platform and client: User is prompted to accept changes to browser proxy settings [32695] In the course of a user s session, one or more prompts may appear requesting approval for changes to the browser s.pac file. In order to log in to WorkPlace and ensure proper functionality, the user must accept these.pac file modifications. User must connect using a tunnel client to get server.pac file updates [32850] If the server.pac file is updated, the user must either connect using the OnDemand tunnel or Connect tunnel client to incorporate the changes, or manually revert to the original proxy settings. If Firefox is open when Connect tunnel is launched, the.pac file is not updated [32859] If a user has a Firefox browser window open when Connect tunnel is started, the modifications that the appliance needs to make to the browser s.pac file (for properly redirecting connections) are not applied to any open browser windows. The user must either close and then re-open Firefox, or manually reload the browser s proxy settings (go to Tools > Options > General > Connection Settings > Automatic proxy configuration URL, and then click Reload). Connect Mobile Important: A hotfix for version is required if you plan to run Connect Mobile in your environment. Install v8.8.0, download the hotfix (clt-hotfix-8_8_0-001) from the Assurance site, and then install it according to the instructions included with it.

8 8 STv / version Trend Micro Mobile Security real-time scanning prevents Connect Mobile installation [32601] Trend Micro Mobile Security performs automatic, real-time scanning and virus detection on handhelds. If real-time scanning is enabled, installing or uninstalling Connect Mobile will fail. Disable real-time scanning before installing or uninstalling Connect Mobile. Small form factor devices placed in a Quarantine zone must open a new browser window [33198] If a user logs in to WorkPlace with a small form factor device and his device profile is a match for a Quarantine zone, he cannot log in again by clicking the Return to login page button or the Web browser s Back button. To log in again, the user must re-enter the WorkPlace URL in the browser (Pocket Internet Explorer): You can also use AMC to place small form factor devices in a different kind of zone (the Default zone, or a Standard or Deny zone) using a device profile. OnDemand Proxy Standard URLs are not accessible after accessing port-mapped OnDemand URL [32309] After using OnDemand to access a port-mapped URL resource, standard WorkPlace URLs (that are not port-mapped) may be inaccessible for a few minutes. To work around the problem, define the local port-mapped listener using something other than port 80 (for example, port 8080). Alternatively, users can wait a few minutes before accessing the URL. Problems accessing network shares over OnDemand proxy [32798] When using OnDemand proxy to browse a Windows network, shared network resources are not visible. If network share access is required, use Connect tunnel, OnDemand tunnel, or Connect proxy. OnDemand proxy may not redirect all connections when DNS fails [32868] The first time a user installs OnDemand proxy, connections to unqualified names that are fewer than 16 characters in length are not redirected if DNS cannot resolve them. DNS might be unable to resolve them if, for example, no DNS suffix is configured on the system. When DNS fails, WINS or WINS Broadcast is used, but WINS cannot perform name resolution until the system has been rebooted. Unable to uninstall AAM from Windows if client switches between version and appliances [35176/35320] If you connect to a version appliance using a computer running Windows XP or Windows 2000, and then later connect to a version appliance, you will see an error message if you try to uninstall Aventail Access Manager ("Another application has exclusive access to the file C:\Documents and Settings\All Users\Application Data\Aventail\logfiles\odxsp.log. Please shut down all other applications, then click Retry."). Once you reboot your client computer you will be able to uninstall Aventail Access Manager.

9 SonicWALL Aventail SSL VPN README 9 Translated Web Localized content displayed in ASCII on mobile devices that don t support UTF-8 [32357] Mobile devices that don t support UTF-8 (such as the Sanyo W32SA handset) display localized content using illegible characters. To work around the problem, the appliance changes the display to use ASCII characters. To log in, the user must enter his or her credentials in ASCII format. Browser Back and Forward buttons are disabled [33758] Windows users accessing WorkPlace from Internet Explorer will not be able to use the browser s Back and Forward buttons for navigation if WorkPlace is configured with translated Web access. End Point Control EPC Quarantine zone classification fails after proxy server is specified in Internet Explorer [33347] If you create a community in which the fallback option for client devices that do not match any zones is a Quarantine zone, and you then specify a proxy server for outbound access to the Internet in Internet Explorer, subsequent connection requests that should be quarantined will fall through to the Default zone instead. EPC zone classification fails after remediation steps are taken [33374] If a user is running Firefox and his device is classified into a Quarantine zone, he may find the device placed in the Default zone (rather than a Standard zone) if he fails to close his original WorkPlace session after completing the remediation steps outlined in the Quarantine zone. To work around this issue, the user should close the Firefox browser window after taking the remediation steps and start a new session. Device profile specifying a client certificate in the machine store fails for non-privileged user [34170] A Windows device profile can be set up that checks for the presence of a certain client certificate on a user's device in either the machine or user store. The machine store cannot be opened, however, for a user who does not have Windows administrator rights. The search for the client certificate therefore fails and the user is classified into whatever you have configured as the fallback zone (a Quarantine zone or the Default zone). Zone classification fails on Traditional Chinese OS with AV PC-cillin 2006 [34471] If you are using a Traditional Chinese version of Windows XP Professional and you have a device profile that specifies the Chinese version of the antivirus program PC-cillin 2006 from Trend Micro, Inc., zone classification will fail. Aventail Cache Control/Aventail Secure Desktop Session-related URL not removed from cache in Safari [27673/30507] When a user logs out of WorkPlace using a Safari Web browser, Aventail Cache Control does not remove the session-related URL from the cache. Instead of clicking Log out in WorkPlace, the user should close the Safari Web browser window in which WorkPlace is running.

10 10 STv / version Aventail Cache Control does not work on Red Hat Enterprise Linux Workstation 4.0 [29301/30608] Aventail Cache Control does not load properly on Red Hat Enterprise Linux Workstation 4.0 systems using the Firefox browser. The system requirements for Linux include Linux Red Hat 9.0, Enterprise Server 3, Fedora (core 3), and Mozilla 1.2 or later. Installation on a Windows XP SP2 device fails when using Firefox [32238] On a computer running Windows XP Professional SP2, Aventail Cache Control fails to install using the Firefox browser. During the final installation phase, an error message appears indicating that the ACC module caused an exception and that its execution was aborted. Browser windows don t close properly when Aventail Cache Control is being installed on a Macintosh [32800] If multiple browser windows are open when a Macintosh user installs Aventail Cache Control, they remain active. (They should instead close during installation.) Incorrect error message is displayed if installation problems are encountered on Macintosh [32801] If Aventail Cache Control cannot install to the specified folder on a Macintosh system, it displays the message ACC is getting downloaded, please wait. Ensure that the folder /usr/bin exists on the Macintosh computer and then try again. Data is cleared when Aventail Cache Control is temporarily disabled [33216/33230] If a user logs in to a realm that requires Aventail Cache Control, accesses a Web site, and then disables cache control manually, all of his Web browser data (URLs, browser history, and cache) is deleted, even the data collected while Aventail Cache Control was disabled. Original Firefox browser settings not restored with proxy server [33348] If a Firefox browser has a proxy server configured for outbound access to the Internet, Aventail Cache Control fails to restore the browser s original profile after the user logs out of WorkPlace. The browser is reset to its defaults and will lose any configuration settings (for bookmarks, proxy settings, etc.). Inactivity timeout is not honored if the client is placed in standby mode [33670] You can specify a timeout period for the Aventail data protection agents (Aventail Cache Control or Aventail Secure Desktop), after which inactive user connections are automatically terminated and data is removed from the client. However, if the client is in standby mode, the inactivity period is not reached and the session remains active. Citrix ActiveX agent cannot be run together with Aventail Secure Desktop [33829] On Internet Explorer, the Aventail Secure Desktop blocks the ability to download and execute ActiveX controls. In this case, the Citrix Java applet is used instead, if it is has been uploaded through the Aventail Management Console.

11 SonicWALL Aventail SSL VPN README 11 Accessing WTS resource terminates ASD [34895/35310] After installing Aventail Access Manager, users who access a graphical terminal shortcut (using Windows Terminal Services) in a realm that requires Aventail Secure Desktop are prompted to accept a Java prompt in a new window. Once they do this, however, ASD terminates and all of the browser windows are closed. This problem occurs only with new installation of Aventail Access Manager. If a user has accessed the Aventail appliance and installed AAM from a realm that does not require ASD, graphical terminal shortcuts will work as expected. Microsoft Remote Assistance does not work with Aventail Secure Desktop [35333/35349] Aventail Secure Desktop is incompatible with Remote Assistance, a Microsoft Windows technology that enables Windows XP users to help each other over the Internet. Users who are running ASD and try to open Remote Assistance will see an error message ( A Program Could not Start ). Web pages inaccessible with combination of IE7, ASD, and Web-based clients [35417] Aventail Secure Desktop does not currently support Internet Explorer 7.0, but there is a workaround documented in knowledgebase article This workaround, however, is not a complete solution for Web-based clients. If you deploy ASD and log in to a community that includes Web proxy agent as an access method, your LAN proxy settings are blank: there is no redirect.pac file specified that determines which connections to send to the Web proxy agent. When you log out of WorkPlace and restart IE7, the.pac URL is specified, making all Web pages unreachable. Aventail WorkPlace Unable to access Web resources on Firefox browser with proxy server [32558] Neither OnDemand proxy (in dynamic mode) nor OnDemand tunnel is able to modify proxy settings in Firefox. As a result, Firefox tries to access WorkPlace links directly through its original proxy, which fails because the links are no longer translated. Use SSL v3 protocol only causes provisioning and WorkPlace session problems [33408] Setting traffic encryption on the Aventail appliance to Use SSL v3 protocol only has the following effect: The Connect tunnel client cannot be provisioned from Workplace and connections to an OnDemand port-mapped realm will fail. For access agents using Java, the WorkPlace Details link doesn t work. Users may see an SSLException message ( Received fatal alert: bad_record_mac ). Select Use TLS v1 protocol only or Use both protocols on the Configure SSL Encryption page in AMC. Note, however, that selecting Use TLS v1 protocol only prevents Aventail Connect proxy users from accessing the appliance. Certificate authentication process stalls during login to WorkPlace [33694] When you connect to WorkPlace using Internet Explorer on a PDA that is running Windows Mobile 5, and you attempt to log in to a realm that requires a client certificate, the session appears to stall. Click the Next button.

12 12 STv / version If downloading ActiveX controls is disabled in IE6, agent activation fails [33800] If both Run ActiveX controls and plug-ins and Script ActiveX controls marked safe for scripting are disabled in Internet Explorer 6, agent activation fails (you ll see JavaScript or Java errors). Enable ActiveX, or use a different browser (IE7 or Mozilla Firefox). Uninstalling AAM does not remove webifier folder [34915] On an XP computer, if you create a WorkPlace shortcut that references a terminal server resource, a folder named webifier is added to %appdata%\aventail. If you then uninstall Aventail Access Manager, the webifier folder is not removed; you must delete it manually. Graphical terminal shortcuts must be launched twice with Macintosh OS X v10.3 [34962/35312] If you have shortcuts for graphical terminal agents configured in WorkPlace (for access to terminal server resources), a Macintosh OS X version 10.3 user will see a blank window the first time he or she tries to launch the shortcut. On the second try the shortcut will work correctly. DNS servers that resolve only internal addresses cause login delays [35189/35191] During login, the Aventail appliance does a DNS lookup on IP addresses and subnets to determine whether a hostname matches (for example) an item in an access list rule. If your DNS server is not configured to resolve any external addresses, just internal ones, the login will succeed but can take a couple of minutes. Cannot cancel installation of Aventail Access Manager [35360] During installation of Aventail Access Manager (the provisioning and EPC component for Windows), a file download dialog opens. If the user clicks Cancel in this dialog box, the Aventail Access Manager Web page does not display any navigation buttons. User is logged out on first OnDemand Tunnel activation if JavaScript times out [35414] Using IE7, if you log in to a realm that uses OnDemand Tunnel, you are prompted to accept the provisioning of Aventail Access Manager. After accepting it (by clicking on the yellow bar at the top of the browser window), you are prompted again, this time to accept OnDemand Tunnel activation. If you allow this process to time out, which takes seconds, clicking on the yellow bar will cause the WorkPlace logout warning dialog to appear. Clicking OK in this dialog box will complete your logout. AMC Configuration WorkPlace site with Custom host name only retains its original domain name [33366] If you create a WorkPlace site and specify just a custom host name for it (rather than an FQDN), the site s FQDN uses the domain name of the appliance. If this configuration is later imported to an appliance with a different domain name using the Partial configuration option, the FQDN of your site remains the same (instead of adopting the new domain name). In AMC, click Save on the Configure WorkPlace Site page for the site and then apply your change. The new domain name is automatically used.

13 SonicWALL Aventail SSL VPN README 13 Searching for user/groups is limited to 1,000 or 1,500 entries [33760/34382] A search for users or groups on an external directory that results in more than 1,000 matches (on a Windows 2000 server) or 1,500 matches (on a Windows 2003 server) will display no results in AMC. Issues Fixed in This Release The following known issues from earlier versions of the appliance are fixed in this release. The numbers refer to internal Aventail tracking IDs. Appliance In August of 2005 the United States Congress passed the Energy Policy Act, which changes the dates for Daylight Saving Time (DST). When this law goes into effect in 2007, DST will start three weeks earlier (2:00 AM on March 11) and end one week later (2:00 AM on November 4). The time zone (tz) information database on the appliance is now updated with the new DST start/end times. Aventail WorkPlace Unresolvable host and workgroup names cause high CPU usage. Tunnel Clients 29904/35188 RDP Webifiers have limitations on Macintosh computers Password expiration notice not displayed Windows 2000 SP4 requires msvcp60.dll Issues when installing Flash plug-in during a WorkPlace session Windows Connect tunnel client Help states that specifying a login group is optional Do not use a disk imaging application to distribute the Aventail client The Japanese version of AhnLab V3 is not recognized in EPC device profiles Connect Mobile.cab file not extracted properly with Windows Mobile AMC Correct range for translated address pools LDAP authentication using a digital certificate with T61STRING encoding fails Directory browsing for nested groups is not supported with chained authentication Cannot add static route through AMC Installing the Apple Security Update causes the Install software link in WorkPlace to fail.