PolicyCenter Release Notes

Transcription

1 PolicyCenter Release Notes Version September, 2015 P/N Revision A

2 2015 Blue Coat Systems, Inc. All rights reserved. BLUE COAT, PROXYSG, PACKETSHAPER, CACHEFLOW, INTELLIGENCECENTER, CACHEOS, CACHEPULSE, CROSSBEAM, K9, DRTR, MACH5, PACKETWISE, POLICYCENTER, PROXYAV, PROXYCLIENT, SGOS, WEBPULSE, SOLERA NETWORKS, DEEPSEE, DS APPLIANCE, SEE EVERYTHING. KNOW EVERYTHING., SECURITY EMPOWERS BUSINESS, BLUETOUCH, the Blue Coat shield, K9, and Solera Networks logos and other Blue Coat logos are registered trademarks or trademarks of Blue Coat Systems, Inc. or its affiliates in the U.S. and certain other countries. This list may not be complete, and the absence of a trademark from this list does not mean it is not a trademark of Blue Coat or that Blue Coat has stopped using the trademark. All other trademarks mentioned in this document owned by third parties are the property of their respective owners. This document is for informational purposes only. BLUE COAT MAKES NO WARRANTIES, EXPRESS, IMPLIED, OR STATUTORY, AS TO THE INFORMATION IN THIS DOCUMENT. BLUE COAT PRODUCTS, technical services, and any other technical data referenced in this document are subject to U.S. export control AND SANCTIONS LAWS, REGULATIONS AND REQUIREMENTS, AND MAY BE SUBJECT TO EXPORT OR IMPORT REGULATIONS IN OTHER COUNTRIES. YOU AGREE TO COMPLY STRICTLY WITH THESE LAWS, REGULATIONS AND REQUIREMENTS, AND ACKNOWLEDGE THAT YOU HAVE THE RESPONSIBILITY TO OBTAIN ANY LICENSES, PERMITS OR OTHER APPROVALS THAT MAY BE REQUIRED IN ORDER TO EXPORT, RE-EXPORT, TRANSFER IN COUNTRY OR IMPORT AFTER DELIVERY TO YOU. Sun, Sun Microsystems, the Sun Logo and any other Sun trademarks included in this product are trademarks or registered trademarks of Oracle, Inc. in the United States and other countries ActionScript Library 3.0 (as3corelib v0.9) BSD 2.0 Copyright 2008, Regents of the University of California. All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. Neither the name of the University of California, Berkeley nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. U.S. Government Restricted Rights Blue Coat software comprises commercial computer software and commercial computer software documentation as such terms are used in 48 C.F.R (SEPT 1995) and is provided to the United States Government (i) for acquisition by or on behalf of civilian agencies, consistent with the policy set forth in 48 C.F.R ; or (ii) for acquisition by or on behalf of units of the Department of Defense, consistent with the policies set forth in 48 C.F.R (JUN 1995) and (JUN 1995). Blue Coat software is provided with RESTRICTED RIGHTS. Use, duplication, or disclosure by the U.S. Government is subject to restrictions as set forth in FAR and DFAR et seq. or their successors. Use of Blue Coat products or software by the U.S. Government constitutes acknowledgment of Blue Coat s proprietary rights in them and to the maximum extent possible under federal law, the U.S. Government shall be bound by the terms and conditions set forth in Blue Coat s end user agreement. Blue Coat Systems, Inc. 420 N. Mary Avenue Sunnyvale, CA Revision History November, 2012 PolicyCenter July, 2013 PolicyCenter August, 2013 PolicyCenter February, 2014 PolicyCenter April, 2014 PolicyCenter June, 2014 PolicyCenter July, 2014 PolicyCenter September, 2014 PolicyCenter December, 2014 PolicyCenter February, 2015 PolicyCenter May, 2015 PolicyCenter September, 2015 PolicyCenter

3 Introduction These release notes document the changes to PolicyCenter version only. If you are upgrading from an earlier version of PolicyCenter, you can learn about other new features and software changes by consulting the release notes for the versions between your current software and v Acrobat PDF files of all versions of release notes are available for download at See the following sections for specific information: What s New in PolicyCenter page 3 Resolved Issues in PolicyCenter page 4 Upgrade to PolicyCenter Version page 5 Upgrade Shared Mode Units to PacketWise page 8 Migrate the PolicyCenter Configuration from Windows 2000/2003 to Windows page 10 Known Issues in PC page 12 Additional Information...page 18 PolicyCenter Release Notes 1

4 Automatic Notification of New Software Releases To be automatically notified when new PolicyCenter software releases are available, you can subscribe to the PolicyCenter RSS feed. Note: The following instructions send the RSS feed to Outlook. However, you can send the feed to Yahoo or standalone readers as well. 1. Go to: 2. Select PolicyCenter from the Products list. 3. Copy the URL. 4. Go to Outlook and right-click the RSS Feeds folder. 5. Select Add a New RSS Feed. 6. Paste in the URL and click Add. 7. Click Yes. A new folder is created in RSS Feeds called knowledgebase - datacategory - PolicyCenter. When new PolicyCenter knowledge base articles are published, Blue Coat will send an notification to the PolicyCenter RSS Feeds folder. The will contain a link to the article. Release announcements will provide you with the following types of information for the new release: the release number, a link to the Downloads page on BTO, highlights of the release, and links to related documentation and training materials. 2 PolicyCenter Release Notes

5 What s New in PolicyCenter What s New in PolicyCenter Inheritance Behavior Changes Unlike in PC 8.x versions, the six default classes in PC 9.x cannot be inherited. For example, if you have a partition set on Inbound/Default in the parent configuration, the units assigned to that configuration will not inherit the partition setting. Workaround: Create the partition in one of the unit configurations and then publish it to the parent configuration.! Important: After upgrading to PolicyCenter , you must upgrade all shared mode PacketShaper units to PacketWise before making any configuration changes in PolicyCenter (including moving configurations). Modifying configurations in PC before upgrading the PacketShapers to can cause inheritance issues. See Upgrade Shared Mode Units to PacketWise on page 8. Notice Added to PolicyCenter Login Page Because of the importance of upgrading PacketShaper units to PacketWise before making configuration changes in PolicyCenter , the following message has been added to the PolicyCenter login page. New Backup and Restore Scripts The pcbackup.bat and pcrestore.bat scripts have been modified to address reported issues. These files are part of the pc9.2.12g1.zip file. Before upgrading to PC , be sure to extract the pcbackup.bat file from the ZIP file and back up your PolicyCenter configuration with the new script. See Back Up Configurations Before Upgrading on page 5. Limitation The pcbackup.bat and pcrestore.bat scripts should not be used to back up an older PolicyCenter configuration (such as or ) and restore it to a newer version (9.2.12). The scripts should be used to back up and restore to the same version. This limitation does not apply to PolicyCenter versions and higher; for example, in the future, you will be able to back up a configuration and restore it to PC PolicyCenter Release Notes 3

6 Resolved Issues in PolicyCenter Resolved Issues in PolicyCenter PolicyCenter contains the following resolved issues. For details on PacketWise resolved issues, see PacketShaper Release Notes for PacketWise The correct PolicyCenter version number now displays in the Control Panel Add/Remove Programs utility. Settings of system variables were sometimes cached in the browser, making it appear as if settings were not taking effect. This issue has been fixed in PolicyCenter PacketShapers are now able to inherit link size from PolicyCenter after upgrading from 8.7.x to Note: There are some limitations with link size inheritance depending on the version of software running on subscribed PacketShapers; see Link and Partition Size Inheritance Issues on page 12. When securing an inside or outside interface for a configuration, the list option now accepts all valid IP:Subnet, IP/CIDR entries. 4 PolicyCenter Release Notes

7 Upgrade to PolicyCenter Version Upgrade to PolicyCenter Version ! Important: After upgrading to PolicyCenter , you must upgrade all shared mode PacketShaper units to PacketWise before making any configuration changes in PolicyCenter (including moving configurations). Modifying configurations in PC before upgrading the PacketShapers to can cause inheritance issues. You must also address any PolicyCenter configuration errors on the Info tab before upgrading. See Upgrade Shared Mode Units to PacketWise on page 8. Back Up Configurations Before Upgrading Always back up your configuration file(s) to the server before upgrading. This allows you to restore the configuration if you downgrade back to the version the backup was created in. Note: The pcbackup.bat and pcrestore.bat scripts should not be used to back up an older PolicyCenter configuration (such as or ) and restore it to a newer version (9.2.12). The scripts should be used to back up and restore to the same version. This limitation does not apply to PolicyCenter versions and higher; for example, in the future, you will be able to back up a configuration and restore it to PC PolicyCenter provides an easy way to perform backup and restore of PolicyCenter configurations using the pcbackup.bat and pcrestore.bat tools. These batch files run a Java utility that in turn runs Sun LDAP commands and uses the Java ldapsdk to read and write configuration data from the directory servers.! Important: You must use the new pcbackup.bat file in the zip file and back up your PolicyCenter configuration with this script. Do not use the old pcbackup.bat file on your system. Note: If your upgrade to PolicyCenter requires that you also upgrade your directory server software, do not use the default location to save your backup file, as the file may be lost. Copy the backup file to the root of your install directory or to your desktop instead. Because pcbackup.bat depends on the Sun DS Java files and LDAP utilities, you must run pcbackup.bat on a Windows server where you have already installed PolicyCenter (the core directory server). To create a backup of all PolicyCenter configurations: 1. You must use the new backup script included in the zip file. Extract the pcbackup.bat file from the zip file and place the file in the pcbackup folder located on the target system (typically C:\Blue Coat Systems\pcbackup). 2. Open a command window. 3. Navigate to the pcbackup folder located on the target system (typically C:\Blue Coat Systems\pcbackup). 4. To back up your PolicyCenter DS servers, type pcbackup <core_host> where <core_host> is the IP address of the core directory server. The pcbackup utility retrieves the edge DS addresses from the core server and backs up all core/edge configuration data to LDIF files stored at C:\Blue Coat Systems\PcBackupData, in a sub-folder named with the current date and time. PolicyCenter Release Notes 5

8 Upgrade to PolicyCenter Version Upgrade PolicyCenter After you have backed up your PolicyCenter configurations, use the following process to upgrade to PolicyCenter Note: See Link and Partition Size Inheritance Issues on page 12 for known issues after upgrading to PolicyCenter 9.2. To upgrade to PolicyCenter : 1. Log in to the Blue Coat download site ( and download the PolicyCenter zip file (for example, PolicyCenter_9.2.12_Windows.zip). 2. Unzip the file contents to your Windows server. 3. On the Windows server, navigate to the PolicyCenter\Windows folder, and launch the installation wizard by running the setup.exe file. 4. Select the Update option. The Installation Wizard will stop the existing PolicyCenter service, upgrade the PolicyCenter software, then restart the PolicyCenter service again. 5. Log in to the PolicyCenter UI, go to the Info tab, and address any configuration errors that may be displayed. 6. Remove cookies and temporary Internet files in your browser after installing the upgrade. See Clear Browser Cache on page Back up your PolicyCenter configuration before distributing images to PacketShapers. See Back Up Configurations Before Upgrading on page Make sure all subscribed PacketShapers are running bootloader 7.0. See Verify Bootloader Version on page Distribute the PacketWise image to all PacketShapers in shared mode. Do not prescribe pre images. See Upgrade Shared Mode Units to PacketWise on page 8.! Important: Do not make any configuration changes in PolicyCenter before upgrading shared mode PacketShapers to Regenerate SSL Certificates for Edge and Core Servers If your PolicyCenter deployment replicates data between edge and core directory servers, you will need to regenerate SSL certificates for both the edge and core servers, and load the new certificate on the edge server. 1. From the core PolicyCenter directory server, navigate to the folder PolicyCenter\dsssl. 2. Double-click the program file certificates.exe to launch that utility. 3. The utility opens in a new window and displays the following options: d - display certificate information g - generate a new certificate i - initialize the certificate database l - load a certificate r - remove a certificate q - quit 4. To generate a new SSL certificate, type g then press Enter. 5. You will be prompted to enter the hostname of the edge directory server that needs a certificate. Note that this command requires the hostname, and not the IP address of the server, for example, myservergx PolicyCenter Release Notes

9 Upgrade to PolicyCenter Version A new folder named after the hostname of your edge server will appear in the PolicyCenter\dsssl directory. Open this folder. 7. If the SSL certificate was generated correctly, there should be three files in the PolicyCenter\dsssl\<edge_hostname> folder: ca.crt, ssl.crt, and key3.db. 8. Copy these three individual files (but not the folder itself), and place the files directly in the PolicyCenter\dsssl folder on the edge directory server. 9. Navigate to the PolicyCenter\dsssl folder on the edge directory server, and double-click the program file certificates.exe to launch that utility. 10. The utility opens in a new window and displays the following options: d - display certificate information g - generate a new certificate i - initialize the certificate database l - load a certificate r - remove a certificate q - quit 11. To load a new SSL certificate, type L then press Enter. The certificates.exe utility will load the new certificates. If the edge server already had an SSL certificate in this location, the old certificate will be replaced with the new one. 12. If necessary, repeat this process to generate, copy, and load SSL certificates for any additional edge servers that require secure replication. Clear Browser Cache After upgrading to PolicyCenter 9.2, you must clear the browser cache to see the new functionality. To clear the cache: Firefox: Tools > Clear Recent History > Cache Internet Explorer: Tools > Internet Options > General > Browsing History > Delete > Temporary Internet files Chrome: History > Clear browsing data > Empty the cache The steps for clearing the cache may vary, depending on which browser version you are using. Note: You should also clear the cache after downgrading. Tested Browsers Blue Coat has tested the PolicyCenter browser user interface with the English version of Microsoft Internet Explorer 11 on Windows 7, Google Chrome 45, and Mozilla Firefox 40. Other browsers and versions may be compatible, but have not been tested with PolicyCenter Note: Chrome may fail to complete HTTPS requests to the PolicyCenter UI; in such cases, an alternate browser should be used. PolicyCenter Release Notes 7

10 Upgrade to PolicyCenter Version Upgrade Shared Mode Units to PacketWise After you have upgraded PolicyCenter to , upgrade all your shared mode PacketShapers to PacketWise ! Follow the important guidelines below. Back up the PolicyCenter configuration before distributing the v images to PacketShapers. Be sure to use the new pcbackup.bat utility included in the PC ZIP file. Make sure you have fixed any configuration errors displayed on the PolicyCenter Info tab before you upgrade the PacketShapers to PacketWise DO NOT make any configuration changes before distributing the PacketWise image to PacketShapers. For example, do not modify the link or partition sizes and do not move configurations to a different parent. DO NOT prescribe older, pre images when running PolicyCenter Prescribe the image to parent configurations, which will distribute the image to all units assigned to each configuration. DO NOT upgrade a single unit in a configuration to as this can potentially cause issues with other units in the configuration. Verify Bootloader Version Before prescribing the PacketWise v9.2 image, you need to make sure your PacketShapers are using bootloader version 7 or higher.! Warning: Do NOT load the image on a unit with an earlier bootloader because the PacketShaper will not be able to boot. To verify the bootloader version: 1. Log in to each PacketShaper. 2. Select Setup > image. 3. Use PolicyCenter s plug-in file distribution feature to load the Bootloader Update plug-in (bootupdt.plg) on all units in a configuration. See Distribute Plug-In Files to PacketShapers in PacketGuide. After you have verified that all PacketShapers are using bootloader v7 or higher, you can safely distribute the image. Upgrade Units via File Distribution Once you have upgraded to PolicyCenter , you can use PolicyCenter s file distribution feature to obtain the latest software image from the Blue Coat download website, then install the new image on PacketShapers subscribed to PolicyCenter. For additional details, see PacketGuide. Note that this feature requires a valid support service contract. 8 PolicyCenter Release Notes

11 Upgrade to PolicyCenter Version Configure the File Distribution Server Before you start distributing files to individual PacketShapers, you must first configure the PolicyCenter file distribution server to retrieve the required image files. 1. Click the Setup tab. 2. From the Setup Page list, select File Distribution Server. 3. On the File Distribution Server setup page, click fetch executables, images and plug-ins from Blue Coat. PolicyCenter will contact the Blue Coat website and download any available new image files. Update Units with New PacketWise Image Once the new PacketWise images have been downloaded to your PolicyCenter server, you must prescribe them to PolicyCenter configurations. 1. Choose the PolicyCenter configuration for the units you want to upgrade by clicking the desired configuration in the configuration tree. 2. Click the Configurations tab. The Configurations window opens. 3. Click the Setup tab on the right side of the Configurations window. 4. From the Setup Page list, select Image. 5. Click the Prescribed Image drop-down list, and select the PacketWise image. If you are upgrading standard PacketShapers, be sure to select a standard (STD) image. Select an ISP image to upgrade PacketShaper ISP. 6. Click apply changes. A warning message about the required bootloader version will appear. 7. Read the warning message screen, and follow the instructions. See Verify Bootloader Version on page 8. If the image subscribe policy for the configuration is set to asap, (the default setting), the units assigned to that configuration will download the new image right away. If the image subscription policy is set to scheduled, the units will download the image at the scheduled time. Note: On rare occasions, an upgraded PacketShaper may not immediately reconnect to the directory server. If a recently upgraded unit displays an error stating that it cannot connect to the directory server, reboot the PacketShaper to reset the connection. PolicyCenter Release Notes 9

12 Migrate the PolicyCenter Configuration from Windows 2000/2003 to Windows 2008 Migrate the PolicyCenter Configuration from Windows 2000/2003 to Windows 2008 When replacing your Windows 2000/2003 PolicyCenter server with a Windows 2008 server, you will want to ensure that your PolicyCenter configuration gets migrated over to the new PolicyCenter deployment. This section describes the tasks that you need to perform on both servers: the Windows 2000/2003 server that is currently running PolicyCenter and the new Windows 2008 server to which you want to migrate. Tasks to Perform on the Windows 2000/2003 Server You need to upgrade the Windows 2000/2003 server to PolicyCenter , upgrade all PacketShapers to PacketWise , and back up your configuration using the new pcbackup utility. 1. On the core Windows 2000/2003 server, upgrade to the PolicyCenter image. See Upgrade PolicyCenter on page Upgrade all shared mode PacketShapers to PacketWise See Upgrade Shared Mode Units to PacketWise on page 8.! Important: Do not make any configuration changes in PolicyCenter before upgrading shared mode PacketShapers to In a command window, navigate to the C:\Blue Coat Systems\pcbackup folder. 4. To back up your PolicyCenter configuration, type pcbackup <core_host> where <core_host> is the IP address of the core directory server. This will store a time-stamped backup folder and its contents at the location \Blue Coat Systems\PcBackupData. In a multiple directory server deployment, the backup script automatically retrieves the edge DS addresses from the core server and backs up all core/edge configuration data. 5. Copy the folder of the newly backed up data to a location that the new Windows 2008 server can access. 6. Shut down the Windows 2000/2003 server, and ping the IP address to verify it doesn t respond. Tasks to Perform on the Windows 2008 Server On the new Windows 2008 server, you need to install Sun Directory Server 7.0, install PolicyCenter , and restore the configuration. 1. Install Sun Directory Server 7.0 and PolicyCenter on the core Windows 2008 server. Note: Refer to the PolicyCenter 9.2 Getting Started Guide for detailed instructions. 2. Copy the backup folder (from step 4 in the previous section) to the following location: \Blue Coat Systems\PcBackupData Create the PcBackupData folder if it does not yet exist. 3. Stop the PolicyCenter service on the Windows server, as described in the following steps. a. Access the Windows services panel on your PolicyCenter server. (Settings > Control Panel > Administrative Services > Services) b. Select the PolicyCenter service from the list of services. 10 PolicyCenter Release Notes

13 Migrate the PolicyCenter Configuration from Windows 2000/2003 to Windows 2008 c. Click the stop icon to stop the PolicyCenter service. 4. Change the Windows 2008 server to the same IP address, primary DNS suffix, and gateway as the Windows 2000/2003 server it is replacing. This will ensure that the PacketShapers will be attached to the new server. Ping the IP address and verify the new server responds. 5. Restore the backup configuration: a. Open a command window, and navigate to the \Blue Coat Systems\pcbackup folder. b. Type pcrestore <core_host> where <core_host> is the IP address of the core directory server. The pcrestore script restores the most recent backup in the PcBackupData folder. 6. Restart the PolicyCenter service. a. In the Windows services panel, select the PolicyCenter service from the list of services. b. Click the restart icon. 7. Access the PolicyCenter Client command-line interface and issue the command config reset to discard PolicyCenter s connection to the directory server. 8. Log in to the PolicyCenter browser interface and enter the old directory server password (for example, admin) to change the password. 9. Verify that PolicyCenter can communicate to the directory server and that the PolicyCenter configuration has been restored correctly. PolicyCenter Release Notes 11

14 Known Issues in PC Known Issues in PC Limitations The setup traffic show CLI command will only display output for the PolicyCenter default configuration; all other configurations will display an error message that you can t modify the configuration unless you edit a draft. The fetch operation will download PacketWise images but because the filenames exceed eight characters, they will not be displayed in the PolicyCenter UI and cannot be used on PacketShapers. Long filenames must be renamed to eight characters or less before they can be prescribed to configurations and distributed to PacketShapers. Follow these steps: 1. Go to Windows Explorer on the PolicyCenter server. 2. Rename the file to 8 characters or less, for PacketWise images v and higher. 3. Prescribe the image to the applicable configurations. Configuration errors are not currently displaying in the output of the banner show CLI command in the PolicyCenter Client; to see configuration error messages, go to the Info tab in the PolicyCenter UI. Browser SSL Certificate Key Size Modified After Upgrading After upgrading to PolicyCenter or higher, the browser s SSL certificate RSA key changes to 2048 bit, overwriting the existing certificate (which may have been a customer-provided SSL certificate). Workaround The following steps will preserve and restore the current SSL certificate in a PolicyCenter install. 1. On the PolicyCenter server, locate the file https.pem, typically under C:\BlueCoat Systems\PolicyCenter\cfg. 2. Copy the https.pem file to a safe location (such as the Desktop). 3. Upgrade PolicyCenter to desired version. 4. Copy the https.pem file saved in step #2, overwriting the https.pem file in the cfg directory. 5. Select Start > Administrative Tools > Services. 6. Right-click Blue Coat PolicyCenter and select Restart. Link and Partition Size Inheritance Issues After upgrading to PC , the flag on link size value on the unit configuration may be set to local instead of inherited. In this condition, future link size changes at the parent are not inherited automatically. Workarounds: After upgrading to PC , you can force inheritance by manually marking the link size as inherited and apply the changes. When PolicyCenter is upgraded from PC to , some partitions in sharable configurations do not get pushed to subscribed PacketShapers running 8.7.x. Workaround: Reconfigure all partitions created in earlier 9.2.x releases. Note that this issue does not occur if the partitions were created in PC 8.x and then PC is upgraded to or above. 12 PolicyCenter Release Notes

15 Known Issues in PC If a configuration has the link set to a size smaller than the total of all fixed partition sizes, the affected classes with corresponding partitions will have config errors and the partitions will be removed. These errors are displayed on the Info tab in the PolicyCenter UI. Workaround: Fix the partition sizes to comply with the configured link size. Directory Server Not Accessible after Upgrading The Directory Server (DS) may not be accessible after backing up the configuration on PC 8.7.x running DS 5.2, upgrading to PC running DS 7.0, and then restoring the configuration using pcrestore.bat. This occurs because the default password for DS is different between DS 5.2 and 7.0. To restore DS access, perform the following steps: 1. In the PolicyCenter Client, at the /default prompt, type config reset and press Enter. 2. Log in to the PolicyCenter browser UI and enter the password that was used in pcbackup.bat. BCAAA Connection Issue PolicyCenter is connected to BCAAA only while users have an active PolicyCenter session. When a user logs out of a PolicyCenter session, the PolicyCenter connection to BCAAA is also terminated. When a user logs back in to PolicyCenter, the connection to BCAAA automatically gets re-established after a short delay. Until PolicyCenter reconnects to BCAAA, you may briefly see a message that user awareness is not configured. User Awareness Issue User lists that are inherited from another PolicyCenter configuration do not show the (I) designation. However, this is just a cosmetic display issue; the list is inherited and can t be edited or deleted. [B#181933] GUI Allows Classes with Duplicate Names The PolicyCenter GUI allows the creation of classes with the same name as long as the matching rules are different. This is not an issue in the PolicyCenter CLI. Large Configurations are Slow to Subscribe The larger and more complex the traffic tree, the longer it takes to subscribe the PacketShaper to PolicyCenter using the convert option. With configurations that contain lots of partitions and matching rules, the telnet session may appear to hang until the subscription process is complete. Locked File during Uninstall When using the PolicyCenter uninstall utility, you may encounter a Locked File Detected message. If you see this message, use the Ignore option and then manually delete the Blue Coat Systems folder and its contents after the uninstall utility completes. Error Displayed when Creating Reports When saving a report in PolicyCenter s Reports tab, the following message appears: Error occurred. Failed to load graphs. Despite this message, the report is actually created and can be viewed on the PacketShaper. Matching Rule Issue After you have edited a matching rule and applied the change, you may see Error This typically happens after you have attempted to edit the rule with an invalid specification (such as duplicate matching rule). If this happens, switch to another configuration and then back to the one you were editing; this action forces PolicyCenter to read the configuration again, loading the matching rule back in memory. PolicyCenter Release Notes 13

16 Known Issues in PC SSL Cipher Strength Inheritance Cipher strength re-inheritance does not always work properly. Although the Minimum SSL Cipher Strength setting indicates that the PacketShaper is inheriting the strength setting from the parent configuration, the unit is still using the override setting. The output of the setup ssl cipherstrength show CLI command does not indicate whether the setting is inherited or overridden from the parent configuration. Duplicate IDs after Copying Classes After copying classes in a parent configuration and applying it to a child configuration, you may see an error that a class ID is already in use. If this happens, you can manually assign a different ID to the class using the class ID CLI command. Make sure to select an ID that is not already being used; the class services id lists the IDs that are used for built-in services. Inability to Delete Backup Configuration Backup configurations can be deleted only if the original unit configuration has not been changed. If the original unit config is changed, the backup configuration become unresponsive; you will need to log out and log back into PolicyCenter to delete the backup configuration. This situation can be avoided if the unit configurations are placed as child configurations under a non-unit parent configuration. [SR ] Configuration Issues Occasionally PolicyCenter displays the configuration before an operation is completed. For example, this might happen when modifying service group or URL categorization settings. If the configuration doesn t look correct, try refreshing the browser. If you remove an override from a draft configuration, you will not see the setting reinherited from the parent configuration until you commit the draft. Service Group Configuration Errors After editing a child configuration, you may see configuration errors that indicate a service appears in more than one group. (This can happen when a group is inherited from a parent configuration, and services have been moved into other local groups.) 14 PolicyCenter Release Notes

17 Known Issues in PC If you mouse over the error icon, the message indicates the name of the group(s) containing the conflicting services. (Unassigned in this example.) If you open up the Unassigned group, each conflicting service is marked with a configuration error. Moving the conflicting service back to the indicated group and applying the change may fix the errors. However, if you have multiple configuration errors in the child configuration and are unable to fix all of them, you can use the re-inherit all button to re-inherit all service groups from the parent configuration. This operation will delete all existing groups from the current configuration, including local custom groups, before inheriting the parent's service groups. Service Group Issues After you reset groups to their default settings, in certain situations a custom group may not be marked as overridden when it should be. Services may not move to the Unassigned group after you delete an overridden group or check the Inherit checkbox for an overridden group. Blue Coat recommends that you use the re-inherit all command when you want to re-inherit service groups. Inherited Passwords When a PacketShaper is subscribed to PolicyCenter, you cannot change the PacketShaper s passwords from inherited to local on the Security setup page. The workaround is to change the look and touch passwords and then apply the change. Although you may see an error message, the status of the touch and look passwords do change from inherited to local. Browser Issues Chrome may fail to complete HTTPS requests to the PolicyCenter UI; in such cases, an alternate browser should be used. When using Internet Explorer, you may need to turn on Compatibility View if any of the UI screens don t render properly. When you open PolicyCenter with a secure connection (https), the browser indicates that there is an issue with the security certificate; this is because PolicyCenter uses a self-signing certificate. If you get this message, you should choose the option to continue (such as Continue to this website in Internet Explorer or I understand the risks in Firefox). When you upgrade to PolicyCenter , the screen to configure PolicyCenter may not automatically appear if you are using Firefox as your default browser. If the configuration screen does not appear after installing PolicyCenter , open the configuration screen by opening a Firefox browser window on the PolicyCenter server, and entering localhost in the address bar. At times, when you access PolicyCenter through a secure connection, the Internet Explorer browser may unnecessarily display a dialog box with the following message: This page contains both secure and nonsecure items. Do you want to display the nonsecure items? Clicking either Yes or No on this dialog box PolicyCenter Release Notes 15

18 Known Issues in PC will reload the page, but will not disable or compromise your PolicyCenter security settings. All traffic will continue to be encrypted. Auto-Deployed Units May Not Display Full Config Path If you successfully auto-deploy a unit running PacketWise and then issue the command unit show, the Configuration Name column in the output of this command may incorrectly display only the unit s parent configuration, rather than displaying the unit's full configuration path. The Units table in the PolicyCenter browser interface may also display just the unit s parent configuration in the Configuration table column. Reassign the unit to another sharable configuration to correctly display the full configuration path for the unit, including the parent configuration and the unit s individual serial-number configuration. Units May Display Errors After Migrating Between Directory Servers When you migrate a unit from the core directory server to an edge directory server, the unit may display a timed out error message until it updates its status entry, even though the unit has successfully changed directory servers. Avoid Duplicate Class IDs by Autodiscovering Classes in Unique Locations PacketShapers generate class IDs based on the full path of the class name. When multiple units assigned to a single PolicyCenter configuration each autodiscover or create the same Inbound or Outbound traffic class (i.e. /Inbound/<discoveredclass>, Inbound/<createdclass>, or Inbound/<pathname>/<class>), these units will each create the same class ID for that traffic class. Although neither PolicyCenter nor the PacketShapers involved will report errors, if IntelligenceCenter finds the same class ID more than once on the same PacketShaper, these multiple class IDs could cause IntelligenceCenter to report incorrect data. Either delete and recreate this traffic class, or assign it a different class ID with the CLI command class id. To avoid this problem, you need to configure each individual PacketShaper so that the unit s autodiscovered traffic classes all have unique class names. This can be done by creating a traffic class based on the IP address or physical location of the unit at the configuration root, configuring the class service to match service:any, and then turning on autodiscovery within the traffic class. For example, if you had two PacketShapers named Los_Angeles and New_York that you wanted to manage via PolicyCenter, you could create the class Inbound/Los_Angeles on one unit and Inbound/New_York on the other, then turn on traffic class autodiscovery. When both units autodiscover Inbound FTP, HTTP, DNS and WINS classes, these classes would have unique class names, and therefore unique class IDs. PacketShaper 1 /Inbound Los_Angeles FTP HTTP DNS WINS PacketShaper 2 /Inbound New_York FTP HTTP DNS WINS 16 PolicyCenter Release Notes

19 Known Issues in PC Once these traffic classes have been uniquely discovered, they can be copied or moved to another location within their PolicyCenter configuration without causing duplicate class IDs. For example, the classes /Inbound/Los_Angeles/FTP and /Inbound/Los_Angeles/HTTP could be copied to the configuration root, and the autodiscovered FTP and HTTP classes deleted, resulting in the following traffic tree on both units: /Inbound FTP HTTP Los_Angeles DNS WINS New_York DNS WINS The /Inbound/FTP and Inbound/HTTP classes for both PacketShapers can now be managed together, and those classes will each have a unique class ID. PolicyCenter Release Notes 17

20 Additional Information Additional Information PolicyCenter Should Not be Installed on Server with Team Interface If you have configured your server with team interfaces, you must un-team them and use a single interface setup before installing PolicyCenter on this server. Prepare PacketShapers for Data Replication When migrating PacketShapers attached to a core directory server to be under an edge directory server, use the pc replication prepare command to prepare PacketShaper units for data replication before you configure the edge directory server. If your units are not correctly prepared for a multiple directory server deployment using this command, any units that remain attached to the core directory server may generate excessive replication traffic, leading to large log files, excessive network utilization, and possible directory server failure. Downgraded Units May Not Support Secure Connections to the Directory Server If you connect a PacketShaper to the directory server via a secure connection and later downgrade that unit to a version of PacketWise that does not support secure LDAP, the unit may temporarily lose its connection to the directory server. To avoid this problem, first revert the unit to local mode, add the unit back to PolicyCenter without the secure connection option, and then downgrade the unit. Reinherit Settings from Parent Configurations by Deleting Overrides or Setting Local Values to Default If a configuration setting is defined on both a parent configuration and a child configuration, the setting on the child configuration will override the value inherited from the parent. However, if you clear a configuration setting on a child draft configuration, that blank setting will still override the values configured on its parent configuration. To completely remove an overriding value so the child configuration can reinherit that setting from its parent configuration, you must create a draft version of the child configuration and use the PolicyCenter command-line interface to either return the setting to its default value or delete the configuration object altogether. For example, if you configure flow detail records (FDR) collectors on a child configuration then later clear those settings via the PolicyCenter browser interface, the child configuration will not inherit any FDR collectors defined on its parent configuration. To remove the overriding blank settings from the child configuration, create a draft of the child configuration, issue the CLI command setup flowrecords id <ID> default, then commit the draft. Once the child configuration s FDR collector settings are reset to their default values, that child can again inherit FDR collector settings from its parent configuration. If a child configuration has different configuration settings than its parent and you want the child to reinherit a value from its parent configuration, simply delete the overriding object. As an example, suppose a PolicyCenter parent configuration has the TACACS+ accounting host and one of its child configurations has the accounting host If you no longer wanted a different accounting host on that child configuration, and would like the child configuration to reinherit the host from its parent, you would have to create a draft of the child configuration and then issue the command setup tacacs auth primary secondary delete from the PolicyCenter CLI. 18 PolicyCenter Release Notes

21 Additional Information Xpress Tunnels are not Propagated from Parent to Child Configurations Xpress tunnels defined on a PolicyCenter sharable configuration will not be propagated to any individual unit configurations assigned to the sharable configuration. Therefore, you must create Xpress tunnels directly on your unit configurations. Use PolicyCenter to configure Xpress tunnels by accessing the unit s individual serial-number configuration and creating the tunnel there. You can also configure Xpress tunnels via the unit s own command-line or browser interfaces. PacketShaper Login Page Does Not Display When Unit Configuration Is Missing When a PacketShaper is missing its configuration (possibly because the unit s configuration was inadvertently deleted from PolicyCenter) the PacketShaper login page will not display correctly. To resolve this problem, log in to the PolicyCenter CLI, and issue the command config show to display the name of the configuration to which the unit is assigned. Next, recreate a new PolicyCenter configuration with the same name as the missing configuration. PolicyCenter Release Notes 19

22 Additional Information 20 PolicyCenter Release Notes