StoneOS 5.5R4P5. Release Overview. Platforms and Images

Transcription

1 StoneOS 5.5R4P5 Release Overview Release Date: Jan. 12 th, 2018 This release mainly supports to specify the IP address of the remote management host for the SNMPv3 user, enable or disable the alarm logs feature of ARP loops for the redundant interface by using the arp-loop-alarm-disable or no arp-loop-alarm-disable command respectively, and configure the IP address with 31-byte netmask for the interface in P2P link. Meanwhile, some important bugs are fixed in this release. All released information: Platforms and Images Platform Models SG-6000-E5960 SG-6000-E5760 SG-6000-E5660 SG-6000-E5568 SG-6000-E5568 SG-6000-E5560 SG-6000-E5268 SG-6000-E5260 SG-6000-E5168 SG-6000-E3965 SG-6000-E6368 SG-6000-E6360 SG-6000-E6168 SG-6000-E6160 SG-6000-E3968 SG-6000-E3960 SG-6000-E3668 SG-6000-E3662 SG-6000-E3660 SG-6000-E2868 SG-6000-E2860 SG-6000-E2800 SG-6000-E2300 SG-6000-E Images SG6000-M-2-5.5R4P5 SG6000-M-3-5.5R4P5

2 SG-6000-E1606 SG-6000-E1600 SG-6000-E1100(WLAN) SG-6000-E1100(WLAN+3G-WCDMA) SG-6000-X7180 SG-6000-VM01 SG-6000-VM02 SG6000-X R4P5 SG6000-VM01-5.5R4P5 SG6000-VM02-5.5R4P5 SG-6000-T5860 SG-6000-T5060 SG6000-T-5.5R4P5.iso SG-6000-T3860 SG-6000-T2860 SG-6000-T1860 SG6000-T-3-5.5R4P5.iso New Features ID Description Platform System Support to specify the IP address of the remote management host for the SNMPv3 user. Interface Support to configure the IP address with 31-byte netmask for the Logging interface in P2P link. Support to enable or disable the alarm logs feature of ARP loops for the redundant interface by using the arp-loop-alarm-disable or no arp-loop-alarm-disable command respectively. Cloud Edge Cloud Edge Fixed Bugs ID Description Platform WebUI Fix the problem that the channel speed configuration of the interface may be lost when configuring the 10G interface parameters in the WebUI Fix the problem that when the default browsers of the Huawei mobile phones EMUI4.1 and 5.0 versions are used, the Web authentication may fails, since the problem of system compatibility Fix the problem that when user configures the name of service or service group of service book on WebUI, if the name contains a comma, system will verify the comma as a separator, which may cause the user will not use the service or the service group. E,X E,X,T 2

3 Fix the problem that when you configure the idle interval of PPPoE interface as 0, system returns 0 after editing it and displays the default value 30 through WebUI. Optimize the WebUI upgrade version page. Fix the problem that the default version page of the backup versions is inconsistent with the current version page. Fix the problem that when you login the WebUI by Google Chrome, after the username and password is saved, the username and password will be automatically added to the default configuration of the AD server, while the display of samaccountname may be empty in the AAA server configuration display window Fix the problem that user logins to WebUI of X series device, the page is loaded slowly in rare situations. Interface Fix the problem that you may fail to ping the Internet from the device interface, since the device interface address is in the SNAT address pool and the SNAT rule is always matched Fix the problem that after configuring the interface IP and enabling Monitor the Local property, the MGT IP may be lost after system reboots, since the interface configuration is configured after MGT IP When you create or edit the user-defined monitor statistics in a large VPN traffic environment, if you configure one IP as the filter condition and there's created traffic when configurations are issued, the traffic of other IPs may be counted in a short time. Fix the problem that in the user details list of user monitor page, the display of the sum of the percentage of user traffic and the sum of the percentage of user concurrent connection may be abnormal Fix the problem that after the SSL proxy trust domain has been configured through system WebUI, the SSL proxy may fail because system does not update the certificate of trust domain Fix the problem that when using L2TP VPN to dial, if network is disconnected abnormally since it s unstable, you may fail to dial again in a period of time Fix the problem that after binding the IPSec VPN to the tunnel interface and configuring the next hop which can be a gateway address, some IP may not be configured as gateway address Fix the problem that the command and the certificate display appear in chaos because of the compatibility of the certificate theme information language with the terminal. Fix the problem that when the VPN peer parameters of IPSecVPN is configured, there may be a VPND process memory leakage since the authentication mode is the aggressive mode and the NAT traversal X 3

4 function is enabled. System Fix the problem that the packet serial number may be out of order after the TCP packets are forwarded through the device Fix the problem that when you upgrade the signature database, the error alarm may appear in the configuration log, since there s problem in system process After the managed device is registered on HSM or vhsm, the managed devices may be dropped irregularly since the abnormal adapter process of HSM or vhsm system. When you configure the user-defined administrator role, if the role name is configured with more than 7 Chinese characters and the role is specified for the administrator, the administrator may fail to login the WebUI. Fix the problem that the connection between the HSM and system may be interrupted since system redirects the device s own traffic via PBR. HA Fix the problem that in the HA environment, the configuration of the master device and the backup device may not synchronize after the BNAT references the address book In the HA environment,after configuring the timeout value of the persistent connection of the user-defined service, when you switch the backup device to the master device and the session is synchronized, the persistent connection timeout value of the backup device may be wrong since the session connection label of the master and backup device is different Fix the problem that in the HA peer mode of the unsymmetrical traffic, after enabling the HA traffic delay, the HA traffic delay may be invalid since the time is judged by mistake Fix the problem that in the twin-mode HA, after switching the backup device to the master device or manually shutdown/no shutdown the interface, the disabled rules may send gratuitous ARP packets since system doesn't judge whether the SNAT/DNAT rule is disabled or not Fix the problem that in Active-Passive mode, when user uses exec ha master switch-over command to conduct active switch between master and backup devices, the primary master device fails to switch to backup device normally, which may cause the user can't conduct the switch between the master and backup devices next time. Fix the problem that the switch between main and backup devices in HA is abnormal, since there s an issue during updating the APP signature database. Fix the problem that you may fail to ping the peer device by the backup device in HA, since the egress interface of packets is the HA E X 4

5 Network backup interface, by which the ARP packet will not be sent by default Fix the problem that in the transparent mode of system, users cannot access the network normally since the DNS proxy domain name is case sensitive Fix the problem that when you access the DNS server from intranet through the device, if the source port of packets is 3785, the packets may be dropped as BFD packets by mistake, since the source port is the same with BFD port In Virtual-Wire mode, since the SSM module abnormally handles multicast packets in rare situations, the OSPF routing between devices may fail to be established Fix the problem that system fails to update the MAC table, since the SSM module abnormally handles the message sent by the IOM module in rare situations Fix the problem that user may not be able to configure the MGT Policy interface of device as the source interface of NTP server. Fix the problem that after the configured SmartDNS link is interrupted, system cannot return the available IP address link to the user, which may cause the failure of accessing the Internet Fix the problem that when system uses IP address to filter the Route policies, the IP addresses that don t need to be filtered are filtered, since system uses names of address books to conduct fuzzy matching. After the configuration policy references the DNS server address book, when you update the DNS server address book, the policy may not take effect in time since system delays the operation, which may cause the failure of match between the initial traffic and the strategy. Fix the problem that when system cold synchronizes the policies in HA, policies may fail to synchronize, since the backup device creates a policy based on the relative position of the main device Fix the problem that the number of OSPF network interface reach the Log maximum number of restrictions after reconfiguring multiple same command. Fix the problem that after more than 16 IPSec VPN tunnels are configured, the interfaces out of the specified limit may fail to establish the OSPF neighbor since system limits the number of tunnel interfaces by which the multicasting packets are sent Fix the problem that user cannot log to WebUI since the event log has been configured to be sent to a non-existent address or the network connection is abnormal. 5 X X7180

6 Fix the problem that the application column of session log is displayed abnormal Fix the the problem that may fail to send NAT log or session log in the binary format to the log server Fix the problem that after configuring the address entry of iqos pipe match conditions, the IP address viewed through show configure may be wrong Fix the problem that the backup device may have a high CPU utilization in HA environment on Fix the problem that in the KVM environment, of some iqos releases may not be logged in normally Fix the problem that the traffic limitation based on IP may be invalid, since the number of IP per pipe is limited to Fix the problem that in the HA environment, when you edit the traffic Object matching conditions, all the traffics enter the pipe and the statistics of pipe monitor is wrong, since system creates empty matching conditions Fix the problem that the name of user group becomes garbled, since IPS the length of user group name is limited to 64 bytes. Fix the problem that user may fail to get the correct interface traffic data since the predefined statistical interface bandwidth is different from the interface session configuration VSYS. Fix the problem that after user fails to create a session, if you use the show session generic detail command to view the statistic of new sessions per second, the result may be double Fix the problem that part of DLL and exe files download failed after IPv6 enabling the Banner Protection function. Fix the problem that when the 5.5R1 version is updated to up to 5.5R5 version, the attack details of abnormal behavior detection may be empty in WebUI By default, FDDI interface configured with IPv6 unicast route will Report send RA packets automatically, and interfaces of other types will not send RA packets. The ND RA Packet function of other type interfaces on WebUI is disabled by default, which may cause the statuses of the RA packets are not consistent on WebUI and CLI. Fix the problem that when you query the custom report, the IP address may be displayed abnormally since you only query the IP 6 E6160,E61 68,E6360,E 6368 T T

7 address without querying the corresponding username. Fix the problem that when you view the generated report file in the report summary interface, the first address in the sending object column shows the FTP, since the user only enables mail to send the report file instead of FTP when creating the report task. E Known Issues ID Description Platform IPSec VPN When configuring multiple Phase 2 ID, recommend user enable the auto connect, otherwise the sub SA traffic cannot be communicated for a period of time. Solution: Please enable the auto mode. Alarm There is an error in the displayed the source zone of the Host profiling. Solution: When configuring the critical assets, please configure the T correct zone information. URL After the URL custom audit page is configured, the audit page generated by NBC will be modified at the same time. E WebUI Solution: No After IE9 enable the compatibility view function, When you log on the system via WebUI, the system will prompt: The current browser is not supported, please use IE 11 or Chrome. Solution: When using the IE9 browser, disable the compatibility view function. Twin-mode HA In twin-mode A/P mode or twin-mode A/A mode, if the HA cluster ID for the data center is different, there will be a failure of negotiation. Solution: In twin-mode A/P mode or twin-mode A/A mode, you must configure the same HA cluster ID for the data center If binding relationships exist in configuration information, configuration information may not be synchronized. Solution: When you synchronize the configuration information of the binding relationship, exec twin-mode sync configuration is executed multiple times until the configuration information is E,X 7

8 consistent In the twin-mode HA (gateway) mode, because the same virtual MAC on both sides of Device HA, it will cause the management interface report a MAC address conflict and cannot manage the device. Solution: Configure an editable Local property for management interface, use the command local to avoid the duplicate MAC address. System The AV/IPS/URL function may not enable properly when the device is installed with the AV/IPS/URL DB license and the system is upgraded from the 5.5R1 version to the new version. Solution: Run the command exec {av ips url-db} enable and reboot the device, thereby enabling the corresponding function The device cannot communicate after uploading version files continuously without restarting device. Solution: If you do not reboot the device to make the new StoneOS take effect after uploading StoneOS version files continuously, please do not switch the StoneOS version The virtual MAC prefix of virtual MAC address in HA can be configured, but the virtual MAC address will be changed after reboot. Solution: After configuring the virtual MAC prefix of virtual MAC address in HA, please reboot the device. Authentication If you select Radius server to authenticate the administrator and the status of retry-local is disabled, when system fails to authenticate though Radius server, you will fail to log in StoneOS though WebUI. Solution: Execute the command admin auth-server radius to enable the function of continuing to authenticate administrator through Local server after failing to authenticate through Radius server. T Explorer Compatibility The following browsers have passed compatibility tests: IE11 Chrome Getting Help Hillstone provides the following guides to help you understand our products: StoneOS WebUI User Guide 8

9 StoneOS CLI User Guide StoneOS Getting Started Guide StoneOS Cookbook StoneOS Log Messages Reference Guide StoneOS SNMP MIB Reference Guide Hillstone SG-6000 Hardware Reference Guides Hillstone SG-6000 Expansion Modules Reference Guides Website: Service Line: North American ( ) Asia Pacific ( ) Appendix: Upgrading Notes Upgrading Notes for Each Platform Upgrading Notes for E/X Platform For different versions of E/X platform, note the following matters: To upgrade the 5.0R4 or lower to 5.5R4, Hillstone recommends you to first upgrade to 5.5R1, and then upgrade to 5.5R4. For version 5.5R4 of X platform, note the following matters: To upgrade version 5.5R4 to 5.5R4P1, Hillstone recommends you to upgrade through Sysloader. Upgrading Notes for T Platform Upgrading T platform takes a long time and it will last dozens of minutes or several hours. During the upgrading, the device can normally forward the data in the data plane, but the WebUI of Dashboard, icenter, and Monitor cannot display normally. For more detailed upgrading guideline, contact Service Line. When the T platform is upgraded from other versions to 5.5R4P1, the abnormal behavior signature database and the association analysis signature database need to be re-upgraded. The abnormal behavior database can be upgraded through WebUI and CLI, and the command is exec cloud anomaly-detection update. The association analysis signature database only can be upgraded through CLI, and the command is exec cloud correlation-engin update. Upgrading Notes for Platform To upgrade from 5.5R1/5.5R2 to 5.5R3/5.5R4/5.5R4P1 is not available, but to upgrade 9

10 from 5.5R3 to 5.5R4/5.5R4P1 is supported. The reasons are as follows: o The default license in 5.5R1/5.5R2 is valid eternally, but only supports part of functions. However, the default license in 5.5R3/5.5R4/5.5R4P1 is only valid for 30 days and supports all functions. Therefore, errors may occur when upgrade is performed. o Due to the default license is not pre-installed in the.img system file, the validity period may not be 30 days any more after upgrade. From 5.5R4, the.img system files can be adapted to virtualization platforms automatically. From 5.5R4, the virtual MAC prefix of virtual MAC address in HA can be configured, but the virtual MAC address will be changed after reboot. From 5.5R3, the system files distinguish IPv4 and IPv6 versions. Upgrading Notes for Each Module Separating Applications from Services From 5.0R4 release, applications are separated from services. For example, the old Service FTP is divided into Service FTP and Application FTP. This change will affect these modules: policies, policy routes, NAT, QoS, session limits and statistics. If you update your system to versions that are higher than or equal to 5.0R4, there is no influence on your normal use (however, an unsupported command prompt may appear). Due to the separation, downgrading from 5.0R4 or higher will not restore the old categorization. Please back up your configuration before upgrading to versions that are equal to or higher than 5.0R4. Log Type Change From 5.0R4, StoneOS has moved alarm type logs to event logs (severity level higher than critical). If system is upgraded to 5.0R4, the commands related to alarm logs (logging alarm/logging syslog...type alarm) will be deleted. If a system is downgraded from 5.0R4, the event logs of (and higher than) critical severity will be lost. New Attribute for Address Books From 5.0R3, StoneOS has added an ID attribute for each address entry. When the system is upgraded to 5.0R3 or higher from prior versions, the existing address book configurations will be processed smoothly without any effect to users; when the system is downgraded to versions 5.0R3 or lower, all the existing address book configurations will be lost. 10

11 Policy Default Mode Change From 4.5R1, StoneOS changed its policy s default mode to the global configuration mode. When the system is upgraded to 4.5R1 or higher, the existing policy rule configurations will be processed smoothly without any effect to users; when the system is downgraded to versions below 4.5R1, all the existing policy rule configurations will be lost. Statistics Configuration Adjustment From 4.5R1, StoneOS has adjusted the configuration of statistics function. When the system is upgraded to 4.5R1 or higher, the existing statistics configurations will be processed smoothly without any effect to users; when the system is downgraded to versions below 4.5R1, all the existing statistics configurations may be lost. Interface Mirroring Configuration Change From 5.0R1, StoneOS changed CLI command for interface mirroring: Before 5.0R1 After 5.0R1 mirror to interface-name [both rx tx] mirror to interface-name mirror enable {both rx tx} When the system is upgraded to 5.0R1, the command will be upgraded smoothly without any effect to users; when the system is downgraded to versions lower than 5.0R1, all the interface mirroring configurations will be lost. Attack Defense Configuration Change From 5.0R2, StoneOS does not support layer 2 IP address spoofing attack defense any longer. When the system is upgraded to versions of 5.0R2 or higher, the configuration of ad ip-spoofing will be lost. New QoS: iqos Intelligent Quality of Service (iqos) is added from version 5.5R1. When the system is upgraded from older version to 5.5R1 or higher, you need to use the exec iqos enable command to enable iqos. iqos only supports CLI. When iqos is enabled, the old QoS configuration remains, but cannot be edited. If you need QoS, use the exec iqos disable command to disable iqos and reactivate QoS. Layer 2 Switching Layer 2 switching (VLAN, Super-VLAN and RSTP) is not supported in platforms of SG-6000-E2800, SG-6000-E2300, SG-6000-E1700, SG-6000-E1600 and SG-6000-E1100 (WLAN). 11

12 Upgrade notice for Abnormal Behavior Detection function Because of the abnormal behavior detection function CLI command is changed in 5.5R2 version, when the system is upgraded from 5.5R1 to 5.5R2 or higher, the system will automatically complete the configuration conversion. Upgrade notice for URL Filter function The URL Filter function for StoneOS 5.5R2 does not support to configure the Bypass domain and user exception, but when the system is upgraded from older version to 5.5R2 or higher, the configuration still take effect. Upgrade notice for load balancing function From StoneOS 5.5R4 release, llb outbound related command is no longer supported, with the new command llb rule instead. When the system is upgraded from older version to 5.5R4, the old configurations will be lost, you must configure it again. Upgrade notice for unsupported function From StoneOS 5.0R4P9 release, StoneCloud function will not be supported. In-Service Software Upgrade Preparation Upgrading Environment ISSU (In-Service Software Upgrade) can avoid network disconnection during the upgrading. To use ISSUE, deploy the following topo and make the HA function work: 12

13 Preparation Items No. Preparation Items Detailed Information 1 Prepare upgrading reference guide 2 Download new The upgrading reference guide has been printed or stored in your PC. Obtain the new version of the image from Hillstone. version of image 3 Check current version of image According to the model, current version, and the corresponding upgrading notes, selects proper upgrading operations. 4 Check running status of device Ensure the SCM and SSM work normally Record the running status of the modules in each slot. After the upgrading completes, you can use the records to verify the running status and perform the troubleshooting. 5 Deploy the upgrading environment via In the above HA topo, deploy the upgrading environment via TFTP or FTP. TFTP or FTP 6 Back up configuration file If the configurations after the upgrading differ from the previous one, you can compare them and re-configure the missed settings. 13

14 Upgrading Operations Upgrading E/X platform from 5.0R1 and subsequent versions to 5.5R4 a. See the upgrading notes for each platform first and then upgrade device B to 5.5R4. During the upgrading, users traffic will be forwarded through device A. b. After device B upgrades successfully, it will re-negotiate HA with device A. c. After the HA negotiation completes, upgrade device A to 5.5R4. During the upgrading, users traffic will be forwarded through device B. d. After device A upgrades successfully, it will re-negotiate HA with device B. e. Complete the upgrading. Upgrading T platform from 5.0R4 and subsequent versions to 5.5R4 T platform does not support the different versions of the negotiation between the HA, please upgrade a single independent. Verifying the Upgrading Verifying the Upgrading for E/X platform After the upgrading completes, use the show version command to verify whether the system has been upgraded to the new version successfully. Verifying the Upgrading for T platform After the upgrading completes, use the show version command to verify whether the system has been upgraded to the new version successfully, and use the show apm status command to verify the analysis plane is working properly. Verifying the Configurations After the upgrading completes, export the configuration file and compare it with the previous one. If some configurations miss, you can check whether the commands have changed in the new version and then re-configure the missed settings. Verifying Basic Business After the upgrading completes, perform some basic business to verify whether the device can work normally. 14