ArrayOS SPX Build 15 Release Note March 15, 2011

Transcription

1 ArrayOS SPX Build 15 Release Note March 15, 2011 When upgrading, before launching the WebUI for the first time, administrators should always clean the browser s cache. New Features and Enhancements Speed Tunneling Support ArrayOS x now supports UDP protocol tunneling with Array proprietary encryption for L3 VPN clients that uses fewer CPU cycles on the SPX. Speed Tunneling is best suited for applications that can tolerate packet losses and out of order receptions such as VoIP. This new tunneling support allows administrators to switch between TCP and UDP tunneling based on network requirements and traffic. Only Windows clients support Speed Tunneling for this release and VPN on turbo cannot be used in conjunction with Speed Tunneling at this time. Clients running on other platforms will still establish TCP tunnels only to virtual sites even with Speed Tunneling enabled. New DesktopDirect Features VDI Integration allows DesktopDirect to provide users with access to virtual desktops that exists in different virtualized environments. VDI support integrates with the existing DesktopDirect functionality seamlessly whether the desktop they are accessing is a virtual or real one. Users on a DesktopDirect Access Portal simply view the virtual desktops the same way they view a real desktop. VDI integration works in conjunction with the ART database, so that users can have access to desktops stored in the ART database as well as desktops provided by VDI. This release of DesktopDirect integrates with VMware s VMView 4 and XenDesktop 4 and 5. Application Publishing is introduced to replace and enhance the functionality of the existing Published Applications and Citrix thin-client including: Streamlining the deployment by eliminating separate thin-clients Support for non-ie browsers (FireFox and Chrome) Easier configuration with the CLI (instead of the concept of Configuration Strings ) Granular policies that can be applied at the instance, group or user level Misc. Enhancements: Non-default RDP port Administrators can configure DesktopDirect to use ports other than port 3389 to communicate with desktops. This setting is per-virtual portal and applies to all users who login to the portal. Improved configuration information The information provided by the show tech and show art tech commands now includes the actual CLI commands that represents the current configuration. Administrators may now cut and paste information directly from the output of these commands. Configuration import and export Administrators may now import and export ART configuration to a local or remote (via TFTP) files. The data includes all current ART configuration elements, excluding desktop and device IDs. Data Protection Policies In previous releases the RDP redirection options where controlled on a per virtual portal basis, providing little flexibility. This release introduces the concept of Data Protection Policies (DPP). These policies allow administrators to define various policies and assign them to user, groups or instances. As a result of the introduction of this capability the older redirection configuration options (configured per virtual portal) are now ignored.

2 Client Machine Based Authorization (HardwareID) HardwareID is a powerful and flexible feature that collects client machine signatures automatically when users log in. Administrator can configure the SPX to auto approve requests or manually approve them after an auditing process. HardwareID authorizes users based on the client hardware (MAC address or a combination of the MAC address and hard drive ID, CPU ID or OS UUID referred to as the MachineID). CMHC works with LocalDB as well as third party authentication servers, like LDAP, AD and RADIUS. The following client platforms are supported: Windows XP(32)/Vista(32)/7(32/64)/2003(32) with IE6/7/8, FireFox 3.6, and standalone clients MacOS 10.4(32)/10.5(32)/10.6(32/64) with Safari Linux distributions (32/64) with FireFox 3.6 SSL Certificate Enhancements SSL Certificate enhancements for the SPX provide the mechanism to forward certificates to the backend web applications. Several enhancements have added to the strength, ability and flexibility for when the SPX works with web applications. The enhanced functionality includes: forward certificate or field to backend, forward IP address, group mapping based on client certificate, CRL etc. ArrayOS X corrects JavaScript rewrite issue to now support session storage and local storage of objects that are part of HTML5 [27285] and Client Security issues with 32 bit browsers [27516] There are changes the behavior of 'clear config secondary' feature. Instead of clearing and restoring fully to default values, the SPX will preserve existing/current values of the WebUI port, WebUI IP, enable password and all admin user account passwords. After 'clear config sec' command is issued, if customer expects the corresponding 'config file...' (load) command to overwrite these values, this may not happen [27836] Local user database capacity has been increased from users to users for the high end SPX models (models with 4GB of RAM). Added L3 support for Linux 64bit (Red Hat, Fedora, Ubuntu, etc.) [26910, 27574] Added SSH setting for idle timeout for improved security [27344] Improved iphone support for SSL connections [27871] Client certificate subjects that contain BMPString are now supported in the basic SSL handshake [27168] An enhancement in Clustering, with preempt disabled, now assigns a former Master as a Backup within the cluster if it continues to go off line [27332] Alias Welcome message will not be displayed until the user completes the login process successfully [27283]. User browser will now close automatically when the L3VPN client is upgraded from a pre-8.0 version [27331] Network Separation supports different VLAN static routes on the same subnet [27868] L3 Standalone now supports anonymous certificate authentication [27771] Client PC might experience an issue completing the booting process if the PC has installed Array Networks L4 (Windows Redirector) + some anti-virus software (such as MacAfee Antivirus) and administrators perform an software PUSH with Microsoft GPO method [27495]

3 The L3VPN client stays enabled even if the session is closed. For example, user A logs in Windows and logs in L3 through standalone client; then A logs out L3 and out of Windows before user B logs in Windows and tries to log in L3 through standalone client but this would fail previously. Now this is not an issue [27645] Updated Client Security SDK to support additional products [27462] Enhancement added to SPX in order to monitor the internal UI process and restart this process allowing the administrator to login after an issue [27183] QuickLink no longer cuts the URL after the & character [27502] The Rewrite URL Mask Filename now correctly hides the value of the base hostname [27084] SPX now processes many static routes more efficiently during boot up [26094] Fixed a WebUI issue with encrypted passwords being longer than 32 characters [27375] Introduced a configurable switch to avoid zero window probe style attacks [24015] Improved session statistics for Active-active clustering [27510] and dispatcher configuration retention [27490] Improved the SPX Web Resource Mapping capabilities [26982, 27149, 27561, 27384, 26457] Improved DNS support for MacOS L3VPN [27427] Active-active clustering correctly syncs configuration when switching between node join and node disjoin [27489] There is no longer a system panic if SNMP trap SSL fail is enabled [27935]. Corrected an issue where LDAP authentication would use the incorrect LDAP configured domain [25256]. When SiteDirect encounters an abnormal packet, the packet is now dropped to maintain optimum performance of the feature [27974]. QuickLink may now configure up to 51 ports [28196]. DesktopDirect now supports the apostrophe ( ) character in a desktop description. The DesktopDirect upgrade process will apply the new TCS components and portal themes where deployed.

4 Limitations 64 bit browsers are not supported in this release. For users who don t wish to use any 32 bit browsers, please download and use the standalone VPN package. NTLM authentication of proxy is not supported on Safari for MacOS 10.4, 10.5 and 10.6 due to a MacOS issue (bug in Apple bug database) [27864]. If the first request for a QuickLink resource (hostname mode) is HTTP POST, then the virtual site hostname & QuickLink virtual hostname must have the same parent domain. [25999] For example: virtual site host "a.sp.com.cn" virtual site quicklink hostname "b.sp.com.cn" With MacOSX, L3 VPN users will encounter problems verifying client certificates after updating to or using the JRE for MacOS X Update 5 or above. This is a limitation of Mac OS X. Users are recommended using or downgrading to JRE to Java for Mac OS X Update 4 to avoid the problem. [26613] Client Security CacheCleaner does not support Safari 5 [26594] Is an existing deployment uses the SSL CRL settings, the interval parameter has been changed from hours to minutes. After upgrading to this software version, administrators will have to reset this time interval (ssl settings crl). For example, if the previous setting was 3 (for 3 hours), it would have to be reset to 180 for (3 hours) [27476]. When using Portal Themes, if a CSS file is used in a HTML page and the image files are used in this CSS file, then SPX cannot import those image files [26745] Due to a limitation with MacOS, if users configure the "Clientapp autolaunch", please make certain that the Safari setting of "Security >Block pop-up windows" is not enabled [26757] When using two AAA methods, where one is RADIUS and the other is LocalDB, RADIUS uses authorization of group mapping and sets ACLS accordingly. When using RADIUS accounts to login, the ACL will be invalid [26815] For URLs in web apps post targets, administrators cannot configure the urlpolicy external at the same time; administrators will have to use content rewrite i.e. urlpolicy external "sso.sh.cmcc" HTML code: <form name="loginform" action= method="post"> [26836] If URLs within web pages are encoded as format of "HTML Character References ( WRM and QuickLink will fail to handle such pages correctly. Custom Rewrite rules should be used to work around this problem. For example, Microsoft Dynamics CRM is a known application that uses this format to encode URLs. After encoding, / becomes &#47 and that causes WRM or QuickLink to fail [27064] Localized language CIFS link labels are not supported on native Japanese and Chinese Windows machines [27268]

5 Installed L3VPN/L4 client would fail if McAfee VirusScan Enterprise V8.7i is installed and turned set to "Max". To work around this issue, please set the Max option to Standard. [28058] The importing or exporting of user files for DesktopDirect may take differing amounts of time, depending on the size of the files being imported and exported. In order to mitigate the risk of a vulnerability that exists in the Transport Layer Security (TLS) protocol, we have disabled the SSL re-negotiation since For details of this vulnerability please refer to: WebSSH Limitations: - ACL rules for WebSSH only support HTTP and HTTPS. For example, use " to block the SSH connection to There is no navbar when using WebSSH. - Supports only username/password mode for SSH server. - To paste from outside to WebSSH may encounter line terminator difference between source and destination. - May not be compatible with some SSH servers or web browsers. - Supports up to 255 concurrent users. When configuring fileshare, if the IP address is used to config the backend sever, such as: file cifs link "aaa" "// /333" then please add a static DNS rule in the global shell, for above case, this rule should be: ip dns host " " When using the certificate field to mapping to LocalDB accounts, administrators may configure the field of subject.cn, issuer.cn and subject.ou, etc. But only the subject.ou field supports multi value entries [27693]. SPX cannot completely support client certificate that use BMPString as inter string format [27966]. If administrators wants to switch the aggregation mode from "off" to "on", and wants to clean up some old HardwareID records, this has to be done manually [27820]. Linux standalone is not supported by HardwareID in this release [27886] When using HardwareID with Linux, network interfaces with no assigned IP address will not be collected [28592]. A large number of HardwareID accounts could cause a significant change in the time it take to startup or reboot the SPX. When the user enables ClientSecurity and uses Cert-Anonymous with access via Firefox on Win7/Vista systems, if the Windows profile has had successful access (ClientSecurity + Cert- Anonymous) before, it won't encounter any issue. Otherwise, there could be an issue on Firefox on the Win7/Vista system. This is a Firefox related issue. If users want to work in this environment, please access the portal once using IE to validate the anonymous certificate, after that, Firefox will work [27993].

6 Java Limitation: When using JRE 1.6 update 10 or higher, for Client Security, ClientApp or L3 VPN Java support, disable "Next generation java Plug-in" (known Sun issue ). To disable "Next generation java Plug-in", open Control panel -> Java -> Advanced -> Java Plugin, uncheck the option. Restart the browser. Client Security Limitations: - When upgrading to client security 8.4.4, administrators will need to reconfigure all client security settings. Please refer to Comparing Client Security to SODA on the following page for the configuration difference between the old and new client security. - Client Security client components are only available in English. - The AntiVirus list format has been changed from Upgrading from older builds ( ) to and above will require re-populating the AntiVirus selection list [28841] AAA Certificate LDAP Limitation: - When authentication uses client certificates with the subject.ou containing multi values and more than one field client cert, the feature "AAA Certificate LDAP" fails [27724]. When deploying SPX device in an intranet without being directly accessible from the Internet, and running VPN UDP tunnel for outside connection, the VPN UDP tunnel port should be opened in firewall or other boundary device so that the SPX can get the connecting packet for accessing VPN UDP tunnel from outside or the VPN UDP tunnel will fail to establish [27885]. When deploying the System Component Update URL feature via the WebUI, and the update is unsuccessful, the WebUI may not display the correct message as to the reason for the failure or that the update failed [28452]. In hostname mode QuickLink, the QuickLink domain name level must be the same as the backend server's. For example, if the backend server's domain name is a third-level domain name, then a third-level QuickLink domain name must be used such as the backend server's domain name is app.yourcompany.com and the QuickLink domain name appvpn.yourcompany.com [28575]. When using split tunnel mode, there are two scenarios that should be taken under consideration. First, when a netzone is configured for a network containing the local network, split tunneling cannot be deployed. For example, if a configured a zone is /8 and the local network is /16, packets cannot be sent through SSL VPN tunnel because they are being routed through local network. Secondly, when a configured netzone is the local network, such as where the zone is /16 while local network is /16, there is no way of determining whether packets are sent through local network or the SSL VPN tunnel.

7 Published Applications may only be accessed via the Windows thin-client (IE, FireFox and Chrome) and custom portal theme. On other devices the applications will not show be visible or accessible. When using the registration portal for the first time on Windows 7 some users may need to refresh the screen after login for the registration process to capture the hostname of the desktop. XenDesktop VDI providers names must match the Xen Desktop Controller NT domain name. For example if the domain name of the Xen Desktop Controller is (in NT format) ARRAYNET the provider name must be ARRAYNET. Some of the WebUI pages in this release are supported for English only (if another language is used, these pages will operate normally but will be presented information in English). These pages may not provide all of the utilities that other pages offer (such as saving the configuration, integrated help content and the utilities menu which is accessible from the top right corner of the WebUI screen). The pages in question are: Configure User Groups Configure VDI Integration Configure Published Applications Configure Data Protection Policies Configure Device Based Identification

8 New Feature WebUI Pages There are new WebUI configuration pages that need to be accessed for the implementation of the new HardwareID feature. To access these pages, make sure you are in the virtual portal configuration pages and in config mode. Click on the Login Authorization feature link and select the Hardware ID tab. From this page you may enable the HardwareID feature; set the administrator address, set the limit for how many machines a client may use as well as manage individual groups. By selecting the Authorization Requests sub tab, you manage individual users as far as approving or denying their access requests or assigning a single Machine ID to an entire group.

9 Array Networks Product Registration Starting with the release of ArrayOS 8.4.4, Array Networks invites you to register your product and to activate your warranty. Activation is simple; and by doing so you will be able to receive such benefits as: Access to the Array Networks Customer Support Portal Notifications of important Array product and software updates Reminders regarding support license expirations and extensions Personalized and expedient technical support responses Registration The first time you log onto the Array product you will be prompted to register. By clicking on the Register Now button you will be presented with a short questionnaire. Please take a moment to supply this important information. Once you ve filled out the form, simply click the Signup button. That s it! Your Array product is registered. Should you wish to register later, simply click on the Register Later button and you will continue the login process arriving to the configuration management homepage. Each time you login, you will be asked if you would like to register. If you wish never to register, simply click on the Never Register button and you will be directed to the configuration management homepage. However, should you choose at a later time to register your Array product, you will be able to do so from the configuration home page by clicking on the Register Now link located next to the model number.

10 The Array Pilot and DesktopDirect The SPX licensed for DesktopDirect will be presented landing page upon the first new session with this feature. This page will ask administrators to select a desired management interface before proceeding. By selecting Go to Traditional Management Interface, you will be directed to the global home page Advanced WebUI typically used for system configuration (unless the system has not been register previously at which point the automated registration process will occur as described previously.) If you select Go to Array Pilot, then you will be directed to the global home page of the Array Pilot interface to begin configuring DesktopDirect (unless the system has not been register previously at which point the automated registration process will occur as described previously.) To use the Array Pilot for DesktopDirect configuration, please refer to the Array SPX Application Guide. The Array Pilot The Array Pilot configuration interface is designed to make the SPX simple and efficient to use and deploy. The Array Pilot is designed for easy navigation through the DesktopDirect configuration taskflow. Navigation through the Array Pilot is achieved by using these common tools listed below. You will see the item throughout the Array Pilot help pages. Roll the pointer over this item to see where on the Array Pilot Interface a specific item is located. The Virtual Portal Selector is used to choose a virtual portal you wish to configure or manage. The Virtual Portal Selector is only enabled once a virtual portal is configured. The Options Selector is used to access Troubleshooting Tools, to access the Array Pilot Resource Guide or to choose the language for the Array Pilot interface. Click the Help link to see overview topics relating to the specific feature or task. Click on for specific information relating to configuration requirements.

11 Click on the DesktopDirect Setup link to begin the configuration process. Once completed, click on the Done or Save link as required, and the new configuration settings are instantly written into memory and saved. If the Array is part of a cluster configuration, all newly entered configuration settings will be synchronized throughout the cluster. To log out of the Array, click on the log out icon. Make certain you have clicked any Save or Done links on any task or configuration pages before logging out to make certain that all changes to the configuration are saved and written to memory.