ArrayOS AG Release Note

Transcription

1 Introduction Release Date: September 30, 2018 This release note summarizes the general enhancements, resolved issues and known limitations for ArrayOS AG release. Contacting Customer Support To contact Array Networks Customer Support, please call or the team at Additional Information: Array Networks, Inc McCarthy Blvd. Milpitas, CA Phone: (408) Toll Free: (1-866-MY-ARRAY) Fax: (408) Telephone access to Array Networks is available Monday - Friday, 9 A.M. to 5 P.M. PST Array Networks, Inc. All Rights Reserved. 1

2 Table of Contents ENHANCEMENTS... 3 AccessDirect... 3 Virtual Site... 3 AAA... 3 Access Method... 5 Client Security... 5 Admin Tools... 5 MotionPro... 6 MotionPro-Server... 6 MotionPro-Client... 6 RESOLVED ISSUES... 7 AccessDirect... 7 Access Method... 7 Admin Tools... 7 MotionPro... 8 MotionPro-Server... 8 DesktopDirect... 9 DesktopDirect-Server... 9 KNOWN LIMITATIONS AccessDirect Access Method Admin Tools Array Networks, Inc. All Rights Reserved. 2

3 ENHANCEMENTS AccessDirect Virtual Site [SSL] Software SSL supporting Elliptic Curve Cryptography (ECC) for SSL connections with backend servers (ID: 76313) To enhance the security of the connections with backend servers, the software SSL implementation has been improved to allow the AG Series to use ECC cipher suites to establish SSL connections with backend servers. The following table displays the newly supported ECC cipher suites in red in the descending order of priority and their collaborated SSL protocols. Cipher Suite Bits SSLv3 TLSv1 TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA x x ECDHE-ECDSA-AES128-GCM-SHA x x ECDHE-RSA-AES256-GCM-SHA x x ECDHE-RSA-AES128-GCM-SHA x x ECDHE-ECDSA-AES256-SHA x x ECDHE-ECDSA-AES128-SHA x x ECDHE-RSA-AES256-SHA x x ECDHE-RSA-AES128-SHA x x ECDHE-ECDSA-AES256-SHA 256 ECDHE-ECDSA-AES128-SHA 128 ECDHE-RSA-AES256-SHA 256 ECDHE-RSA-AES128-SHA 128 AES256-SHA x x AES128-SHA x x AES256-SHA 256 AES128-SHA 128 DES_CBC3_SHA 192 RC4_SHA 128 RC4_MD5 128 AAA Supporting Federated Identity Management (FIdM) scheme (ID: 79374&68363) FIdM, also called identity federation, links a user s identity across multiple security domains, each supporting its own identity management system. When two domains are federated, the user can authenticate to one domain and then access resources in 2018 Array Networks, Inc. All Rights Reserved. 3

4 the other domain without having to perform a separate login process. Examples of FIdM systems include OpenID, OAuth and Security Assertion Markup Language (SAML). Currently, only the SAML FIdM system is supported. By default, the FIdM scheme is disabled for the virtual site. To employ the SAML FIdM system, you need to enable the SAML FIdM function for the virtual site. When this function is enabled, a SAML Identity Provider (IdP) will be enabled for the virtual site. By default, this function is disabled for the virtual site. When the FIdM scheme is enabled, the system automatically enables this function. In addition, you need to correctly configure the Service Providers (SPs) that this IdP can serve and define them for the virtual site. New CLI commands: To support these enhancements, the following commands are added: aaa federation enable This command is used to enable the FIdM scheme for the virtual site. aaa federation disable This command is used to disable the FIdM scheme for the virtual site. aaa federation samlidp enable This command is used to enable the SAML FIdM function for the virtual site. When this function is enabled, a SAML IdP will be enabled for the virtual site. By default, this function is disabled for the virtual site. When the FIdM scheme is enabled, the system automatically enables this function. aaa federation samlidp disable This command is used to disable the SAML FIdM function for the virtual site. When this function is disabled, a SAML IdP will be disabled for the virtual site. aaa federation samlidp metadata This command is used to list the URLs from which to download the metadata of the virtual site s SAML IdP. aaa federation samlidp sp name <sp_name> This command is used to add a SAML SP that the virtual site s SAML IdP can serve. A maximum of 24 SAML SPs can be configured. no aaa federation samlidp sp name <sp_name> This command is used to delete a SAML SP that the virtual site s SAML IdP can serve. aaa federation samlidp sp metadata <sp_name> <url> This command is used to import the metadata of the specified SP to the SAML IdP. show aaa federation samlsp metadata <sp_name> This command is used to display the metadata of an existing SAML SP. show aaa federation config This command is used to display the configuration related to the FIdM scheme. clear aaa federation config 2018 Array Networks, Inc. All Rights Reserved. 4

5 This command is used to clear the configuration related to the FIdM scheme. For details, please refer to the AG 9.4 CLI Handbook and User Guide. Access Method [Web Access] Inserting the Strict-Transport-Security header to HTTP response to increase security (ID: 76662) AG now inserts the Strict-Transport-Security header into every HTTP response to inform the browser to use the HTTPS protocol for communication, instead of HTTP. [Array Client] Inside proxy script download enhancement (ID: 77198) Windows VPN clients integrated with the AG now support at most three retries of inside proxy script download at 10-second intervals before establishing the VPN connection. If the SSL VPN client still fails to download the script after three retries, it will ask the end user whether to continue to try to establish the VPN connection or not. Client Security Allowing administrators to add unsupported MacOS antivirus/antispyware/firewall software using the Client Security Tool via WebUI (ID: 79023) Now, the AG appliance provides a MacOS Client Security Tool. With this tool, the administrator can collect the information of currently unsupported MacOS antivirus/antispyware/firewall software and add support for them on WebUI. For details on how to download the MacOS Client Security Tool and add support for new MacOS software, please refer to the AG 9.4 User Guide. Admin Tools [Logging] Optimizing the syslog messages to record the client source IP and port as well as AG source port for DesktopDirect (ID: 77902&69665&68492) The syslog messages for DesktopDirect have been optimized to record the client source IP and port as well as the AG internal source port. [Configuration Management] Supporting executing a configuration script file through WebUI (ID: 77776) 2018 Array Networks, Inc. All Rights Reserved. 5

6 Beginning with ArrayOS AG , the system allows the administrator to execute a configuration script file through WebUI. Only the first 1000 lines of the configuration script file will be executed. Please do not include any shell switching, mode switching or interactive CLI commands in the configuration script file; otherwise, the WebUI may hang during the command execution. [Monitoring] WebUI graph supporting monitoring the traffic statistics of system interfaces (ID: 69154) When WebUI graph is enabled by selecting the Statmon Enable check box in the Statmon Enable area of Admin Tools > Monitoring > Graph under the global scope, the administrator can view the traffic statistics of system interfaces as a whole or separately in the View Graph area. MotionPro MotionPro-Server Changing the default display mode of the Web tab page on the MotionPro portal to not_display (ID: 77565) The default display mode of the Web tab page on the MotionPro portal has been changed to not_display, that is motionpro portal tabpage web not_display. MotionPro-Client Supporting disabling the function of verifying the server certificate for MotionPro clients (ID: 79277) Now, the function of verifying the server certificate can be disabled for MotionPro clients. Disabling this function may degrade security, but provide a better user experience. New CLI command: To support this command, the following command has been added: motionpro client certverify {on off} This command is used to enable or disable the function of verifying the server certificate for MotionPro clients. By default, this function is disabled Array Networks, Inc. All Rights Reserved. 6

7 RESOLVED ISSUES AccessDirect Access Method [Web Access] Access to WRM resources being slow due to connection handler leak (ID: 73800) In some cases, the access to WRM resources was slow due to a connection handler leak. This issue has now been resolved. [Network Access] VPN client being assigned an IP address not from the dynamic IP range (ID: 78413) The IP address bound to a LocalDB account was not released when the end user disconnected the L3 VPN. As a result, this account IP address might be assigned to a VPN client like an IP address in the dynamic IP range. This issue has now been resolved. [File Share] Failing to access CIFS resources with URL addresses containing FQDNs in versions from AG to AG (ID: 79533&75628) When the system was upgraded from an earlier version to a version between AG and AG , CIFS resources with URL addresses containing FQDNs could not be accessed. This issue has now been resolved. Affected releases: ArrayOS AG release to ArrayOS AG release Admin Tools Search Keyword parameter being case sensitive when the administrator needed to view the previously configured Hardware ID records (ID: 78930) Previously, on WebUI, the administrator needed to enter the exact account name to view the Hardware ID records previously configured using the localdb hardwareid account command because the Search Keyword parameter in the area of Local Database > Login Authorization > Hardware ID > Authorization Requests > Authorization Requests was case sensitive. This issue has now been resolved Array Networks, Inc. All Rights Reserved. 7

8 CLI commands that could not be synchronized under the shared virtual site being incorrectly displayed (ID: 78804) When the administrator executed the synconfig to command to synchronize running configurations from a local node with shared and alias virtual sites, CLI commands that could not be synchronized under the shared virtual site were incorrectly displayed. This issue has now been resolved. Disk being filled up when the administrator updated the system by uploading the system update package via WebUI (ID: 78738) When the administrator updated the system by uploading the system update package in the area of Admin Tools > System Management > Update > System Update > Using: Local Host File under the global scope via WebUI, the system update package might not be cleared and the disk became full. This issue has now been resolved. The output message of the show synconfig diff command being incorrect when the localdb autobackup command was configured (ID: 78610) After the running configurations including localdb autobackup were synchronized from one AG appliance to another, the output message of the show synconfig diff command was incorrect. This issue has now been resolved. Failing to generate system log messages when the administrator logged into WebUI (ID: 78550) The system failed to generate system log messages indicating whether the login was successful or not when the administrator logged into WebUI. This issue has now been resolved. MotionPro MotionPro-Server Web applications failing to be displayed correctly if the values of the description and folder parameters in the motionpro webapp define command contained spaces (ID: 78628) 2018 Array Networks, Inc. All Rights Reserved. 8

9 If the administrator set the values of the description and folder parameters in the motionpro webapp define <url> <description> [sso] [folder] command to strings that contained spaces, the configured Web applications would not be correctly displayed in the area of Site Settings > Authorized Resources > Web Resources > Web App > Web App on MotionPro pilot. This issue has now been resolved. DesktopDirect DesktopDirect-Server DD Pilot applied unsaved client settings to a wrong client-settings set (ID: 78339&76482) If client settings were added for one client-settings set but not saved on DD Pilot, a prompt would be displayed to ask the administrator to save the changes when switching to another set. After the administrator clicked the Yes button, unsaved client settings were incorrectly applied to the new set. This issue has now been resolved Array Networks, Inc. All Rights Reserved. 9

10 KNOWN LIMITATIONS AccessDirect Access Method [Network Access] DTLS tunnel not working when an ECC certificate is activated for the virtual site (ID: 79860) When an ECC certificate is activated for the virtual site, the DTLS tunnel fails to work. Admin Tools System reboot required after a new license applied (ID: 78611) After a new license is applied, when the administrator executes the show session count command, the value of the Licensed Maximum Session in HA domain output message might be lower than that of Licensed Maximum Session in local output message. The administrator should reboot the system to solve this issue Array Networks, Inc. All Rights Reserved. 10