Check Point Connectra NGX (R60) HFA_R60_01 Release Notes and What s New September 26, 2005

Transcription

1 Check Point Connectra NGX (R60) HFA_R60_01 Release Notes and What s New September 26, 2005 Introduction This document provides an overview of the new features in this release and contains important information not included in the documentation. Review this information before setting up Connectra. This release does not include portal localization. For setup and configuration instructions, refer to the Connectra Administration Guide. IMPORTANT Before you begin, read the latest available version of these release notes at: What's New in HFA_R60_01 Extended Endpoint Security 1) ICS Custom Rules - Starting with this HFA, Connectra supports adding custom rules to the Integrity Clientless Security scan. The administrator can now check for virtually any item on the endpoint machine by configuring customized rules for these items and adding them to the scan policy. The rules are easily configured using a simple configuration tool, which can be downloaded from CheckPoint Download Center. For more details, check the Endpoint Security section in the Administration Guide. Extended Application Support 1) Native Citrix Support - Starting with this HFA, Citrix MPS 3.0 and below, clients 8.x and below are supported by Connectra s Citrix Services. Connectra NGX R60 delivers native support for Citrix environments. This includes access to an existing Citrix nfuse server as well as support for Citrix ICA Web and Java "thin" clients. Connectra performs SSL termination, ticketing, authentication, authorization, logging.

2 2) Native Lotus inotes Support - Starting with this HFA, Connectra supports Domino Web Access (inotes) for Domino server versions through Connectra NGX R60 delivers native support for Lotus inotes environments. This includes secure web-based access to and calendaring through Connectra. Language Pack Installation A Language Pack has been added to HFA_R60_01. The supported languages include: French Italian German Spanish Japanese Simplified Chinese Traditional Chinese English continues to be the default language. For detailed installation information about either the appliance or the software please refer to the corresponding version of the Connectra NGX (R60) GettingStarted Guide. Upgrading to Connectra HFA_R60_01 To upgrade Connectra: 1 On the navigation tree of the Administration Portal, select Settings > Device > Upgrade. The Upgrade page appears. 2 Download an upgrade package, as directed. 3 Select the upgrade package file. 4 Click Upload package to device. 5 Click Start Upgrade. The Upgrade Status pane provides information such as Action, Start Time, Status and Details. Connectra Limitations The Connectra Limitations have been divided into the following categories: General Web Applications File Shares Check Point Connectra Release Notes. Last Update September 26,

3 General Webmail SSL Network Extender 1) When two or more overlapping web or file applications are defined, for example, the first application for any path, and the second application for a specific path on the same host, and each of the applications has been assigned a different protection level, it is undefined, which of the protection levels will be enforced. (This is true for requests that match more than one application definition.) 2) By default, a new SSL server certificate is only installed for the Connectra portal, and not for the administration server. To use the new certificate for the administration server, as well, you can run: cp $CVPNDIR/var/ssl/server.p12 $WEBISDIR/servcert/ servcert.p12 ; service CPwebis restart, from the SecurePlatform expert shell. A password-protected certificate cannot be used for the administration web server. 3) Connectra does not provide remote users with a mechanism to change their portalpassword. Therefore, remote users, whose accounts have a must change password on next login flag, cannot use the Connectra portal before they change their password by some other means. 4) Client certificates, issued by a Microsoft Windows-2000 Advanced-Server Active- Directory cannot be used to authenticate users that are listed in the Connectra internal users database, unless they are entered into the internal users database, with their full DN as the user name. 5) Webmail and File Share applications have a credential setting called Reuse my portal username and password. This is not supported for users logging in with a client certificate. When a user logs in to the portal with a client certificate, accesses Webmail, or a File Share, and chooses the Reuse my portal username and password, an empty password is sent. Workaround, either by setting the application credential setting to Prompt user for credentials, or by using a username and password to login. 6) Connectra supports the Microsoft Outlook-Web-Access web interface. When using this web interface with some non-english localized interface, requests may be blocked by Connectra's Web-Intelligence Enforce ASCII only Form Fields. A workaround is to disable this protection. 7) With some browsers, after an attempt to login using a client certificate fails, it is impossible to login again without first closing and reopening the browser or by clicking Clear SSL State in the Certificate section of the Content tab in the Internet Options window of the browser. 8) The SecurePlatform shell command lockout enable is not supported. To adjust the lockout settings use the Administrators > Settings page, in the administration GUI. Check Point Connectra Release Notes. Last Update September 26,

4 9) The ntpstat command does not work in the normal SecurePlatform shell. Use expertmode instead. 10) Working with the SSL Network Extender and the admin GUI from the same client machine, at the same time, is not supported. 11) With early versions of OWA 2003 it is possible that clicking the Check Names button will cause Internet Explorer to open an authentication popup. This issue can be resolved by upgrading to Exchange Server 2003 SP1. 12) The management GUI is not operational when eth0 is down. 13) When using client-certificate authentication with LDAP, the DN of each usercertificate must be identical to the user's DN in LDAP. 14) There is a bug in Internet Explorer that may cause problems with POST requests in an SSL keepalive connection. If necessary, it is possible to disable keepalives entirely. This can be done by changing the line KeepAlive On to KeepAlive Off in $CVPNDIR/conf/ httpd.conf. 15) Unlike in FW-1, the FTP bounce protection does not send an RST packet when an FTP attack is detected. The FTP attack is blocked nonetheless. 16) In the Licenses page of the Connectra appliance admin-gui, the license is displayed with an IP address eval. This is normal and does not mean that the license is an evaluation license. 17) If when browsing to an OWA 2003 account, the user clicks the logoff button of OWA 2003, he is also logged out of the portal. When using Connectra, there is no need to use this button, since the access is protected by the Connectra session. 18) After adding a new license, it is necessary to restart Connectra. This can be done by going to Settings > Device > Control and selecting Restart Connectra Processes. 19) Hours configuration is restricted, when using sysconfig to perform initial configuration. 20) After upgrading from Connectra 1.1 to Connectra 2.0, restore functionality is not supported. 21) Deleting licenses via the admin GUI is not supported. The cplic CLI command can be used. 22) Various pop-up blockers may interfere with various aspects of portal functionality. It is recommended to configure pop-up blockers to allow pop-ups generated from the Connectra gateway. 23) After performing an upgrade, via Settings > Device > Upgrade, and after the machine reboots, the administrator may be required to close the browser and reopen it in order to reconnect to the admin-gui. Check Point Connectra Release Notes. Last Update September 26,

5 24) Some hardware-tokens, used to authenticate to Connectra via the Certificate Sign-in option, are not supported when the user browses using ISB. 25) The Security > SmartDefense Service page allows the administrator to check for updated security protections and download them to Connectra. This option works by issuing secure HTTP requests to dedicated Check Point servers. If an HTTP-proxy is required to create this connection, proceed as follows: In expert mode run: export http_proxy=<proxy-server-name>:<proxy-server-port> cpadmin restart The download will now work through the proxy. 26) Administrator passwords with more than 15 characters are not supported. 27) The "Attempt to disable detected malware processes" option in the End-point Security section, may not always succeed in killing the detected malware processes. In that case the malware is displayed to the user, and is reported as "detected" by the scan. 28) When users are authenticated against an LDAP server Connectra may cache authentication results for up to 15 minutes. 29) User names in foreign languages are not supported in the Connectra login page. 30) When activating the "Send Logs to Smart Center Server" feature in Connectra - The Connectra machine must be rebooted for this to take effect. 31) The "upgrade all packages" operation of SmartUpdate is not supported for Connectra. 32) Using encrypted connections (e.g. https) in FireFox browser might alert an error message of the format: "<server name> has received an incorrect or unexpected message". In this case try to close all FireFox windows and open a new one or check whether Connectra is configured to require a client certificate from the browser and if a valid client certificate is installed in FireFox. 33) In Firefox, the favorite editing pages in the portal may show all the favorites in one line with a scroll bar, instead of in a table. 34) When there is a SIC connection between the SmartCenter and Connectra, and then the SmartCenter disconnects, there is no indication of this in the Connectra status screen. 35) Web-pages that require authentication are not supported when browsing using Opera. 36) An error might be displayed when the apply button is pressed on the Log Settings Page, if Connectra has been upgraded from an earlier release, and remote log servers were configured. It is possible to solve this by deleting all of the remote log servers and reestablishing trust between them and the Connectra machine. Check Point Connectra Release Notes. Last Update September 26,

6 37) After upgrading Connectra from version 2.0 to NGX (R60), the SNX on clients that have older versions will not be updated. To fix this, please edit the file $FWDIR/conf/ slim_ver.txt to contain "54,1,6000,32", and run cprestart. 38) When upgrading Connectra from an earlier release during the 15 days plug-and-play license, the plug-and-play license expires immediately. 39) When using windows "File Explorer" to access SNX applications through the Connectra portal, the SNX window reverts to the portal login page. The SNX connect window causes Windows Explorer to open a new Internet Explorer process, but windows doesn't pass the session cookies to the new window, therefore Connectra denies access to portal pages. 40) When trying to upgrade Connectra from a CD through the "Patch add CD" option, the upgrade will fail with the error: "The patch is not found on this CD". Upgrade from CD is not supported. 41) Web, web-mail and file-share applications have a credential setting called "Force portal credentials". This is not supported for users that use a client-certificate to login. Either set the application credential setting to "Prompt user for credentials" or use a username and password to login. 42) When the /var partition is full, the administrator is unable to perform any task. FWM fails every change to the database in those cases because it fails to send an audit log. The log cannot be sent because /var (the partition where logs are saved) is full. By default, the log system will remove old log files to preserve the minimal disk space defined in the log settings (the default minimal disk space is 45 megabytes). If the default is preserved, the disk space will not be exceeded. 43) In order to delete Users Settings (favorite, credentials of Web File Network app.) there is a script under $CVPNDIR/bin/ named deleteusersettings. All you need is to run deleteuserserttings UserName1 UserName2 UserName3. The script then: Backs up the file UserSettings.sql to UserSettings.bak (under the dir $CVPNDIR/var/ db/) Creates a temp file SqlCmdFile.txt with the SQL commands Injects SqlCmdFile.txt (SQL commands) to cpsql_shell (which preform the SQL's command) 44) By default, all the favorites configured by the administrator for different applications, and the user configured favorites, appear in the user's portal. That also includes client applications links configured for Network Applications (SSL Network Extender). However, if more than one favorite has the same name (case insensitive), only one of them will be shown in the portal. Check Point Connectra Release Notes. Last Update September 26,

7 45) When using characters from character sets other than english in DN fields of the LDAP account unit definition screen, the administrator will receive an error rejecting the DN value. The administration GUI currently supports only english letters in DN fields. 46) When the SNMP services are activated on a Connectra machine, a connection can be made to the SNMP ports from any IP address. For this reason, it is recommended that the Connectra will be protected by a firewall which will restrict SNMP connections to the Connectra machine. Only a specific list of approved IP addresses should be allowed to access the Connectra machine through SNMP. 47) If a Connectra machine is run with a Plug & Play license and is upgraded, the license will be removed during the upgrade process causing the administration GUI to display a message regarding the matter. After the upgrade the administrator must install a valid license and restart all processes (cpstop & cpstart) for the Connectra machine to resume normal activity. 48) The display of time zones in the command line is in Posix convention. For example, for a region located two hours to the East of the GMT region, the time zone will show "GMT-2" (and not "GMT+2" as it is in the webui). 49) The administrator may not use XML escape characters (e.g. ampersand (&), quotes ("), greater than (>) etc.) in the following places since they render the ICS scan inoperable: 1 Settings > Portal Look and Feel > Portal Title 2 Endpoint Security > General Settings > Integrity Firewall Client (both text boxes) 3 Endpoint Security > Anti Virus Rules > Solution (both text boxes) 50) The Admin GUI is not fully supported by FireFox and Mozilla. 51) When a RADIUS server is disabled during an upgrade from Connectra version 2.0 to Connectra version NGX (R60), the server cannot be enabled from the Admin GUI. Workaround: Do not upgrade while RADIUS server is disabled. Check the use radius checkbox before the upgrade, and if this RADIUS server is not needed, delete it after the upgrade. In the event that the RADIUS server was disabled during the upgrade, manually change the RADIUS server name in the $FWDIR/conf/objects_5_0.C file from DisabledRadiusServer to CVPN_RadiusServer and then run cprestart. 52) The HTTP specification of Set-Cookie HTTP Response Header allows domain=domain_name to include only one internal dot (i.e., yourcomany.com) only if it is a global top level domain. If it is not a top level domain, two internal dots are required. A new attribute was added to cvpnd.c named cookiecustomdomains. This attribute enables an administrator to define a list of custom domains with only one Check Point Connectra Release Notes. Last Update September 26,

8 interal dot that will be accepted by Connectra even though it does not adhere to the formal HTTP specification. For example, if domain=.yourcomany.com, this needs to be defined as a custom domain as follows: :cookiecustomdomains( :(.yourcomany.com) ) 53) Connectra supports Domino Web Access running with Domino server versions 6.0 and through and design template version inotes 6. 54) When activating the "Send Logs to Smart Center Server" feature in Connectra - the Connectra machine must be rebooted for this to take effect. 55) In order to delete the data of a user, use the script deleteusersettings: deleteusersettings <username1> <username2>... <usernamen> This way we make sure that the DataBase will clean the user settings of the desired users. 56) If the admin tries to delete an LDAP account unit that was upgraded from Connectra 2.0 to Connectra NGX, the GUI stops responding. Possible workarounds to this problem: To prevent the problem - Re-save the LDAP users group after the upgrade. If the account unit was already deleted and the GUI is stuck: redefine an account named CVPN_AccountUnit_0, then Re-save the LDAP users group. 57) On rare occasions, the double safe upgrade may fail and revert to the prior state (before the upgrade). In any such case a second upgrade should succeed. Web Applications 1) Connectra supports browsing to web applications that use HTML and JavaScript. Browsing to web applications that use VBScript, Java, or Flash elements containing embedded links, is not supported. 2) For specific cases, in which the server requests authentication for a POST request, using either digest or NTLM, and in which the server does not support the sending of 100 Continue responses, HTTP-authentication to internal web servers is not supported. 3) Web pages are handled according to their content-type. Connectra identifies the content-type in one of two ways: Using the content-type HTTP header, or using the context from which the file is loaded (e.g. <script src=script.js type=text/script>). A missing or erroneous content-type may cause web pages to malfunction. Check Point Connectra Release Notes. Last Update September 26,

9 4) When browsing to web applications, in some cases, a new window that is opened from a modal or modeless HTML dialog box displays the Connectra login-page, instead of the intended content. For example, in Outlook Web Access when the user tries to open an appointment from a reminder dialog. This is caused by a feature of Internet Explorer that does not pass cookies to the newly opened window. This is described in Microsoft's Knowledge-Base article One possible workaround is to make sure that only one Internet Explorer process is running while connecting to Connectra. Another workaround is to change the web-site design, as described in the aforementioned Knowledge-Base article. 5) Requests for web-applications are listed in the Traffic Log (including their internal and external URLs). The internal URL listed, does not display the query string of the URL. 6) Attempts to delete a meeting from Outlook Web Access (OWA) Calendar will cause a "400 bad request" error. File Shares 1) In the File Shares interface, Connectra does not currently support access to files, or folders, in non-english character sets. 2) MS Office files can be opened via the Connectra File Shares interface by setting the Connectra session-cookie to be persistent. (Set the line SetEnv CVPN_PERSISTENT_SESSION_COOKIE On in the file /opt/cpcvpn-r55/conf/httpd.conf.) Persistent session cookies should not be utilized, however, when remote users access Connectra from workstations, not under their full control. Instead, they can copy the desired MS Office file to their desktop. 3) When a user's session time-out elapses, while the user is browsing a File Share, Internet Explorer displays the following popup message: The current operation cannot be completed because an unexpected error has occurred. To reconnect, the user must browse to the portal and login again. 4) A user may try to access a File Share that does not exist on a specific file server. Connectra will not always be able to distinguish between this situation and an accessdenied situation. The user may be presented with the credentials input-form, or receive an access-denied error. 5) In order to prevent a single malicious user from filling Connectra s internal-storage, credentials for only 1000 File Shares are saved per user. If a user reaches the 1000 File Shares credentials limit, the credentials for an arbitrary File Share of this user will be deleted, and he/she will be prompted for them the next time he/she accesses that File Share. Note that this restriction is per-user. There is no restriction on the total number of file-credentials in the system. Check Point Connectra Release Notes. Last Update September 26,

10 6) All connections between the browser and the Connectra server are performed, over a secure connection (SSL). However, when an Internet Explorer browser changes context, from web browsing to file browsing, it may warn about using a non-secure connection. This warning can be ignored in this case. 7) Connectra may not identify "invalid username or password" errors from file-shares that do not require the user to enter a domain (i.e. for which the user enters an empty domain string). In this case, a user who has entered an incorrect username and password pair for such a file-share may receive an access-denied error instead of a usernamepassword prompt. The user is then required to select Settings > Organize File Favorites and delete, or change the incorrect username and password, manually. 8) A new file-shares client has been integrated in Connectra 2.0. There may be rare cases, in which the new client does not work properly. To re-enable the old client, execute the following commands, in expert mode: rm $CVPNDIR/bin/Mount ln -s $CVPNDIR/bin/MountSmb $CVPNDIR/bin/Mount 9) When accessing files via Connectra it is possible to view them with different client applications. Some file types are typically configured to be opened by a browser application (e.g. jpg files). In some client configurations, the result of opening such a file might be the login page of Connectra instead of the requested file. A possible solution can be verifying the client uses the latest recommended browser version including all the patches and fixes. Specifically Internet Explorer's Q patch should be installed on the client. 10) The file share feature supports two separated protocols: CIFS and SMB. Connectra could only be configured to one of them. There are some Solaris machines that support SMB and others CIFS. If Connectra is configured to work with CIFS and there is a specific Solaris that works with SMB, trying to access file shares on this machine will fail. The default is CIFS; however you can switch it by executing the following commands, in expert mode: rm $CVPNDIR/bin/Mount For SMB - ln -s $CVPNDIR/bin/MountSmb $CVPNDIR/bin/Mount For CIFS - ln -s $CVPNDIR/bin/MountCifs $CVPNDIR/bin/Mount Once configured, all file shares will work with this protocol. 11) When browsing through file shares in Connectra, they are shown in a file-explorer window. This window has several types of views: Details, List, Icons, Tiles and Thumbnails. The "Thumbnails" view may not work on some client machines. Check Point Connectra Release Notes. Last Update September 26,

11 12) If an administrator upgrades from Connectra 2.0 to Connectra NGX (R60) and then rolls back the installation back to Connectra 2.0, the folder /mnt/cvpn_mnt/ will not be recreated and file shares will not work. Workaround: Create the directory in the command line independently: mkdir /mnt/cvpn_mnt/. Webmail 1) The internal Webmail interface, in Connectra, uses IMAP to communicate with internal IMAP mail servers. IMAP mail servers that require NTLM authentication are not supported. 2) Very large attachments (>8MB) to Webmail are rejected, and an error page is displayed by the browser. 3) The Traffic Log does not list actions performed by the user via the Webmail interface. 4) The Connectra Web-Mail interface supports the following languages: English, Japanese, Italian, Spanish, German, French, and Chinese. Other languages may not work. 5) Webmail users may receive an error when trying to save drafts. To resolve this problem the user must perform these steps: 1. In the section, click the Options link. 2. Click the Folder Preferences link. 3. Under Special Folder Options, configure the Draft Folder to Drafts. 4. Click Submit. 6) Defining an OWA mail-service application and another mail-service application with the same name will cause an error in the group web-access tab. A workaround is to change the name of one of the applications. 7) The Webmail attachments directory is not cleared automatically. The directory can be cleared manually by deleting old files from the $CVPNDIR\htdocs\Mail\attachments directory. 8) Usually when accessing sites that require HTTP authentication, an authentication window appears for entering credentials. However, in some specific combinations of IE versions and Windows platforms, this window might lack some controls and cannot be used. Check Point Connectra Release Notes. Last Update September 26,

12 SSL Network Extender 1) SSL Network Extender is not supported in a Fast User Switch environment. 2) If the user does not approve the installation of the SSL Network Extender ActiveX, he/ she will not be able to use the SSL Network Extender during the same session, even if he/she tries to activate it again. A workaround is to logout from the portal and login again. 3) The SSL Network Extender does not work on the Win2k and Windows 2003 Server unless you disable the routing and remote access service. 4) The field named Gateway ID in the SSL Network Extender window refers to the CN of the SSL server-certificate, used by the SSL Network Extender server. The default certificate that comes with Connectra has a CN, based on the default Connectra IP. This CN will continue to be displayed in this field regardless of the IP that is actually configured, until another server-certificate is installed. 5) When the SSL Network Extender client connects to Connectra, no CRL verification is performed. 6) If a user's group may access the SSL Network Extender, but the SSL Network Extender-protection level requirements for the specific user's session are not met, the SSL Network Extender Connect button is displayed. However, when the button is clicked, an "access denied" error is displayed. 7) If a client computer: has SecuRemote/SecureClient software installed and is configured to work in transparent mode and has its encryption domain contains SSL Network Extender Gateway or overlaps with the SSL Network Extender encryption domain, the SSL Network Extender will not function properly. 8) Remote-admin is not supported through the SNX Application Mode on Windows ) Not all Java platforms from the and releases are supported with SNX. 10) Authorization of user connections through the SNX application and application modes is based on the IP and port that the user is accessing or trying to access. Each user is allowed access to certain IPs and ports, based on the applications defined for his usergroups. No enforcement is done for the applications the user is running to access these IPs and ports. 11) PC-Anywhere is not supported using SNX Application mode. Check Point Connectra Release Notes. Last Update September 26,

13 12) The SNX client for Linux requires the TUN network module in order to work. In early releases of Red Hat Enterprise Linux 3, this module has been mistakenly left out. Installing Red Hat Enterprise Linux 3 Update 4 solves this problem. 13) SNX Network mode is based on Microsoft's ActiveX technology. In some situations, when installing the ActiveX component of SNX, the Windows OS requires access to Microsoft's web-site. This may cause problems for client computer which are not connected to the WWW. 14) When a proxy is configured in Internet Explorer, surfing the admin portal in conjunction with using SNX on the same machine can cause the admin page to get stuck after the SNX client is connected. Since Internet Explorer generates errors when replacing the proxy settings while surfing a site, after connecting with SNX the same behavior will occur because the SNX client changes the proxy settings on the browser. 15) When trying to launch Lotus Notes 6.0 and 6.5 client with SNX Application mode without having the Lotus server configured on the DNS server - connection will not be established. It is required to have the server configured on the organization's DNS server or in the "hosts" file on the user's machine. 16) The fingerprint approval popup window that is displayed when the first application is launched through SNX Application mode may not popup to the foreground. The user may be required to search for it beneath other windows. 17) Running Firefox through SNX Application mode, when another instance of Firefox is already running is not supported. The user must close all other instances of Firefox before launching it through SNX Application mode. 18) Normally when signing out of the portal when SNX is connected, the client will disconnect and will display a disconnect message. However, when using IBM Java , when a user signs out of the portal, the following error will be displayed "unknown message #457". 19) The SNX-AC puts a special title on console applications run through it. Applications that change the console-window's title may overwrite this. This includes the Windowstelnet application. 20) The SNX auto-launch mode is not compatible with the Firefox popup blocker. To use this feature the Firefox popup blocker must be disabled. 21) On some SUSE releases, when trying to connect via SNX, it is possible that the SNX Java applet will not load correctly. This is cause due to a problem in the Java applet confirmation process. A workaround is to choose "Always" in the Java confirmation prompt, so the next time the page loads Java is already approved. 22) On Linux SUSE, only manual uninstall of SNX works. Check Point Connectra Release Notes. Last Update September 26,

14 23) In SNX Application mode, when trying to launch an application from another application, for example, a web browser from an application or a web browser from Word (clicking on links), in case the application that is launched was already open and was not launched by SNX Application mode, this application will not be encrypted. A way to overcome it, is to make sure the application is not already open when launching it from another application. 24) Some anti-virus applications will not scan mails when outlook is launched with SNX application mode. This is due to the fact the mail is encrypted in SSL before the scanning takes place. 25) There is no framing in Lotus Notes 6.0 and 6.5 when launching it via SNX Application Mode. 26) When MacAfee anti-virus is installed and "on-access scanner" is enabled, launching mail applications with SNX application mode might not work. Workaround - disable the "on-access scanner" MacAfee feature. 27) IP lock feature is not enforced for SNX application and network mode. 28) When working with Outlook 2003 with IMAP account in SNX Application Mode, the application sometimes gets stuck after reconnect. Workaround: Close Outlook and launch it again from the portal. Note - Outlook with IMAP accounts do not deal well with reconnect scenarios even without SNX Application Mode. 29) When using SNX network mode in IE and trying to launch URLs from the connection window, a popup might appear. This is because "Reuse windows for launching shortcuts" is set and the new URL is being opened in the connection window and prompts before disconnecting. Workaround: From the browse: Tools > Internet Options > Advanced - remove the checkbox from the option: Reuse windows for launching shortcuts. 30) When a DNS suffix is defined on Connectra, and the user's /etc/resolv.conf file includes a "search line" resolving according to the new SNX DNS suffix might not work. Workaround: After the connection, add the new DNS suffix to the original search line. 31) Since SNX is route based, it ignores the services defined by the network applications in Connectra. Any port/service which falls under the IP range defined for SNX, will go out to Connectra encrypted, and will get dropped by Connectra. 32) When the user switches to hibernate state while having an open SNX network mode connection, the connection is not immediately terminated. The termination relies on the inactivity timeout in the gateway which will cause the session to expire and upon Check Point Connectra Release Notes. Last Update September 26,

15 returning from hibernation the user will have to reconnect. If however the hibernation is short enough the user may return to his open BB session. The inactivity timeout is about 5 minutes. 33) SNX does not detect the proxy when "automatically detect settings" is configured. You can use instead the manual settings or automatic configuration script. You can also manually configure the proxy to be used by SNX by creating the file %APPDATA%/Check Point\CShell\proxy.ini where the first line is the proxy IP/DNS and the second line is the proxy port. 34) SNX support automatic proxy detection and authentication when using JVM 1.3 and up. If you must configure proxy on lower versions you can use the file: %APPDATA%\Check Point\CShell\proxy.ini where the first line is the proxy IP/DNS and the second line is the proxy port. 35) SNX requires an Internet connection to microsoft.com when using Microsoft JVM 5, releases and ) Siebel 7 client does not work properly through SNX Application mode when connecting to SQL or Oracle database. After launching the client through SNX Application mode and passing the login details in the login window, the web browser is launched but a "page cannot be displayed" message appears. Refreshing the browser solves the problem. 37) In SNX network mode, when users are configured to uninstall SNX upon disconnect, the uninstall will occur when the user clicks "logout" button on Portal GUI without being asked whether to uninstall SNX. Workaround: Disconnect by clicking "disconnect" or simply exit the "SNX connected window". 38) SNX application mode does not currently support applications that are trying to be servers on the client's machine. 39) When using windows "File Explorer" to access SNX applications through the Connectra portal, the SNX window reverts to the portal login page. The SNX connect window causes Windows Explorer to open a new Internet Explorer process, but windows doesn't pass the session cookies to the new window, therefore Connectra denies access to portal pages. Check Point Connectra Release Notes. Last Update September 26,

16 inotes 1) Connectra supports Domino Web Access (inotes) for Domino server versions 6.0 and through ) The inotes "work offline" feature is not supported. 3) Attaching in-line images to mail is not supported. 4) The "decline", propose new time and delegate" options in meeting notices are not supported. 5) The inotes online help is not fully supported. 6) inotes is fully supported by IE only. 7) When trying to insert a local picture to a new (new --> mail --> insert Image - -> browse) results in a request for user authentication.this difficulty arises because this feature is implemented using inner ActiveX logic. Workaround: You can add your local images as regular attachments. inotes gallery images Are supported. 8) When trying to insert a local image to a new 's body, (new --> message --> insert Image --> browse --> select image and 'open' --> next --> send the mail), the mail recipient will not see the image when opening the message. You cannot use the "Insert Image" option in the rich text mode of inotes mail composer, in order to insert local images to an . You can, however, use the inotes gallery pics. The difficulty arises because this feature is implemented using inner ActiveX logic. Workaround: You can send local images as regular attachments. 9) When opening a meeting notice (through calendar --> meeting notices'), if you select decline' --> 'delegate' from the upper menu, you won't be able to use the scrollbar menu and see the users list. Work Around: You can use the auto-complete option (green button to the left of the scrollbar). It is enough to type the first letter of the user in order for the auto-complete to be enabled, and suggest all the available users starting w/ that letter. 10) inotes is not fully supported by Connectra when accessed through FireFox, Mozilla or Netscape. Workaround: Use IE to access inotes through Connectra. Check Point Connectra Release Notes. Last Update September 26,

17 Citrix 1) Considering the diversity of Citrix products and product versions, it is possible that Connectra conforms to additional Citrix features & product versions. However, Connectra has undergone thorough testing with only the feature-set described in the user guide. Check Point is working to expand the feature-set. Note also that availing of SSL Network Extender (SNX) might effectively meet your needs with Citrix. 2) Citrix 3.0 and below, clients 8.x and below are supported by Citrix Services. Citrix 4.0 and client 9.x are supported by SNX. 3) Connectra administrator MUST change Connectra's default certificate to a different one, issued to FQDN in order for Citrix feature to work. This is due to a Citrix limitation - Citrix can only work with FQDN-based server certificates. 4) User must close Citrix applications before logout from the portal. Not doing so may cause ICA Clients to malfunction. Citrix applications may stall. 5) MF authorization will fail if its address identification (by IP or by hostname) is not identical to that of the Admin GUI. This limitation is only applicable if Citrix Service is configured to work against specified MetaFrame servers only. 6) The Citrix proxy requests authorization for every MF server address. Administrator encounters an authorization problem (in the debug output). Workaround option 1: Configure the MF server addresses in the alternative way (host name <--> IP). Workaround option 2: Allow all MF server addresses until the issue is solved. 7) Citrix client using SUN Java version will not work with SNX network mode. Using other versions of java will solve this. 8) Pressing the "logout" button of the FNB does not warn about Citrix client errors that will come when the session is disconnected. 9) When working with Citrix Program Neighborhood clients, do not use Checkpoint's Integrity Secure Browser (ISB) as ISB has a problem coping with this type of ICA client. 10) When a user logs out of Connectra without closing Citrix session windows, open session windows show the Connectra login window. Workaround: User should close all the Citrix windows before logging off Connectra. Check Point Connectra Release Notes. Last Update September 26,