Release Notes for Nokia IPSO-LX 7.2

Transcription

1 Release Notes for Nokia IPSO-LX 7.2 Build 13 Part No. N Rev 001 Published October 2008

2 COPYRIGHT 2008 Nokia. All rights reserved. Rights reserved under the copyright laws of the United States. RESTRICTED RIGHTS LEGEND Use, duplication, or disclosure by the United States Government is subject to restrictions as set forth in subparagraph (c)(1)(ii) of the Rights in Technical Data and Computer Software clause at DFARS Notwithstanding any other license agreement that may pertain to, or accompany the delivery of, this computer software, the rights of the United States Government regarding its use, reproduction, and disclosure are as set forth in the Commercial Computer Software-Restricted Rights clause at FAR IMPORTANT NOTE TO USERS This software and hardware is provided by Nokia Inc. as is and any express or implied warranties, including, but not limited to, implied warranties of merchantability and fitness for a particular purpose are disclaimed. In no event shall Nokia, or its affiliates, subsidiaries or suppliers be liable for any direct, indirect, incidental, special, exemplary, or consequential damages (including, but not limited to, procurement of substitute goods or services; loss of use, data, or profits; or business interruption) however caused and on any theory of liability, whether in contract, strict liability, or tort (including negligence or otherwise) arising in any way out of the use of this software, even if advised of the possibility of such damage. Nokia reserves the right to make changes without further notice to any products herein. TRADEMARKS Nokia is a registered trademark of Nokia Corporation. Other products mentioned in this document are trademarks or registered trademarks of their respective holders OPEN SOURCE SOFTWARE This product includes certain software originating from third parties that is subject to 1. the GNU Library/Lesser General Public License (LGPL), and 2. the GNU General Public License (GPL). Nokia offers to provide a complete corresponding machine-readable copy of the source code of such software under the LGPL and the GPL to you on CD-ROM for a charge covering the cost of performing such distribution, such as the cost of media, shipping and handling, upon written request to Nokia at Attn: IPSO-LX 7.2 Source Code request, 313 Fairchild Drive, Mountain View, CA, This offer is valid for a period of three (3) years from the date of the distribution of this product by Nokia. Please refer to the exact terms of the LGPL and the GPL regarding your rights under said licenses. THIRD PARTY COPYRIGHTS AND NOTICES You can find the complete text of third-party copyright notices and licenses for software that is used in Nokia IPSO-LX in the /etc/licenses directory of your Nokia appliance. 2 Release Notes for Nokia IPSO-LX 7.2

3 Nokia Contact Information Corporate Headquarters Web Site Telephone Mail Address Nokia Inc. 102 Corporate Park Drive White Plains, NY USA Regional Contact Information Americas Nokia Inc. 102 Corporate Park Drive White Plains, NY USA Tel: usa@nokiaforbusiness.com Europe, Middle East, and Africa Nokia House, Summit Avenue Southwood, Farnborough Hampshire GU14 ONG UK Tel: (UK) Tel: (France) Tel: (Middle East, Africa, Dubai) europe@nokiaforbusiness.com mea@nokiaforbusiness.com Asia-Pacific 438B Alexandra Road #07-00 Alexandra Technopark Singapore Tel: asia@nokiaforbusiness.com Nokia Global Technical Assistance Center Web Site Voice Americas Europe, Middle East, Africa Asia-Pacific International Non-Technical Support For non-technical support issues, including your Nokia Support Agreement, licensing, and Web site access, use the following contact information: es.service@nokia.com Release Notes for Nokia IPSO-LX 7.2 3

4 4 Release Notes for Nokia IPSO-LX 7.2

5 Contents 1 New Features of IPSO-LX Enhancements and Fixes in IPSO-LX 7.2 Build Support for Fail Open 10 Gigabit Ethernet Fiber-Optic NIC Performance Improvement for Multiple DRs per DE Support for Setting Maximum Transmission Unit (MTU) Change to Default Shell for Admin User Fix for SNMPv3 Security Vulnerability Fix for Image Upgrade and File System Space Issue Enhancements and Fixes in Previous Builds of IPSO-LX Fix for Host Name in System Log Messages Support for Nokia IP2450 Intrusion Prevention with Sourcefire Support for Increased Physical Memory New Linux Kernel Version IPSO-LX Differences from IPSO Supported Platforms Supported Applications Performing the Initial Configuration Upgrading to Nokia IPSO-LX 7.2 Build Upgrading from a Previous Build of IPSO-LX Upgrading from IPSO-LX Obtaining the Required Software Performing the Upgrade Installing the Boot Manager Upgrade Package Upgrading from IPSO-LX Upgrading to a New IPSO-LX Image Downgrading to a Previous IPSO-LX Image Performing a Fresh Installation of IPSO-LX Limitations Limitations Relating to the 10 Gigabit Ethernet Fiber-Optic NIC Limit on Number of 10 Gigabit Ethernet NICs Limitations Related to Sourcefire Sensor on Nokia Do Not Delete Sourcefire 3D Users or Groups Release Notes for Nokia IPSO-LX 7.2 5

6 tcpdump on Sensing Interfaces Version Information Not Updated for Package Warning Messages on Nokia IP690 IPS Console Console Errors When Sourcefire Package Is Installed Use Correct Defense Center Host Name in Host Address Assignment Boot Manager and Initial Configuration Limitations Double Characters on IP2450 IPS Console Bootmgr Handling of Special Characters in Passwords Power Outage During Initial Configuration New Image and Package Management Limitations Internet Explorer and Uploading Packages Installing a Package from a Local Directory Handling Package Information in Environmental Variables Network Voyager or CLI Limitations Changing Monitor User Password with CLI Truncated DNS Configuration Error Message Problems Using Internet Explorer or Opera Browsers Disable Network Voyager Only from CLI IP Addresses Cannot be Deleted with Opera ncftp Commands after Entering Shell Through the CLI Step Numbering in IPSO-LX Documentation Unable to Add Interface Comments with CLI Unable to Delete.rpm Files with CLI Disabling Auditing of Configuration Changes SNMP Limitations Admin User Not Added to USM Users Table Viewing SNMP Configuration Details Missing SNMP MIB Functionality Remote Requests to Alias IP Address Issue Other Limitations No SSH Idle Session Timeout Cron Job Scheduling Issue Logging Does Not Resume After Errors Cleared Info Messages Not Sent to Remote Log Server Neighbor Table Overflow Error Message Obtaining More Information on Temperature Alerts No Log Message When Interface Is Disabled Release Notes for Nokia IPSO-LX 7.2

7 1 New Features of IPSO-LX 7.2 Nokia is pleased to introduce a new version of the Nokia IPSO-LX operating system. Nokia IPSO-LX 7.2 Build 13 is available on select Nokia security platforms and is targeted specifically for Nokia Intrusion Prevention with Sourcefire. The following enhancements and fixes have been introduced with Build 13 of IPSO-LX 7.2: Support for Fail Open 10 Gigabit Ethernet Fiber-Optic NIC Performance Improvement for Multiple DRs per DE Support for Setting Maximum Transmission Unit (MTU) Change to Default Shell for Admin User Fix for SNMPv3 Security Vulnerability Fix for Image Upgrade and File System Space Issue This chapter also provides information on: Enhancements and Fixes in Previous Builds of IPSO-LX 7.2 IPSO-LX Differences from IPSO Supported Platforms Supported Applications Enhancements and Fixes in IPSO-LX 7.2 Build 13 This section describes new features and enhancements introduced with IPSO-LX 7.2 Build 13. Support for Fail Open 10 Gigabit Ethernet Fiber-Optic NIC IPSO-LX 7.2 Build 13 introduces support for a two-port fail open 10 Gigabit Ethernet fiberoptic NIC. This NIC is supported only in a Nokia IP2450 IPS that is running Sourcefire Sensor on Nokia version 4.8 or later. For more information about the fail open 10 Gigabit Ethernet NIC, see the Nokia IP2450 Intrusion Prevention with Sourcefire Installation Guide, part number N Release Notes for Nokia IPSO-LX 7.2 7

8 1 New Features of IPSO-LX 7.2 Performance Improvement for Multiple DRs per DE Sourcefire 3D System for Nokia version 4.8 introduced the ability to assign multiple detection resources (DRs) to an inline IPS detection engine (DE). In previous builds of IPSO-LX 7.2, the DR processes assigned to a DE run in the same core in multi-core appliances. In Build 13, the DR processes are distributed across different cores, improving performance for customers who are taking advantage of the Sourcefire 4.8 enhancement. (PR79568) Support for Setting Maximum Transmission Unit (MTU) To support jumbo frames, Build 13 introduces the capacity to set the Maximum Transmission Unit (MTU) for Ethernet interfaces using either Network Voyager or the CLI. By default, the MTU is set to 1500: you can increase the MTU to up to bytes. You cannot change the MTU value after the interface has been locked by the Sourcefire application. Note The latest version of the Sourcefire Sensor on Nokia application available at the time of this document s publication (version ) does not support jumbo frames. Change to Default Shell for Admin User In previous builds of IPSO-LX 7.2, the default shell for the admin user is the IPSO-LX CLI. To provide consistency with Nokia IPSO, to support central management integration, and to allow the admin user to use SCP and SFTP to access the appliance, the default shell for the admin user in Build 13 has been changed to the bash shell. Beginning with Build 13, if you log into the appliance as the admin user, you will be placed in the bash shell. To enter the IPSO CLI, type clish at the bash shell prompt. To return to bash, type exit at the CLI prompt. The default shell for all other users remains the IPSO CLI (clish). Fix for SNMPv3 Security Vulnerability If you use SNMP Version 3 with a previous build of IPSO-LX 7.2, the system is vulnerable to the issue identified at Build 13 fixes this vulnerability. (PR78818) 8 Release Notes for Nokia IPSO-LX 7.2

9 Enhancements and Fixes in Previous Builds of IPSO-LX 7.2 Fix for Image Upgrade and File System Space Issue In previous builds of IPSO-LX 7.2, it is possible that you could run out of space on the root file system when using Network Voyager to install a new IPSO-LX image. If this happens, you do not receive any warning and you will be unable to log into Network Voyager again. Build 13 fixes this issue. If there is not enough space on the root file system for the ipso-lx.tgz file, IPSO-LX will not download the package and will report the error. (PR70234) Enhancements and Fixes in Previous Builds of IPSO-LX 7.2 This section describes new features and enhancements introduced in builds of IPSO-LX 7.2 prior to Build 13. Fix for Host Name in System Log Messages In builds of IPSO-LX 7.2 previous to Build 09, the host name in system log messages always appears as localhost, regardless of whether the message is received from a remote system or is being sent to a remote log server. If the system administrator manually stops and restarts the syslog-ng daemon, however, the systems messages show the host name configured in Network Voyager. Build 09 and later fixes this problem and the correct host name now appears in system log messages. (PR76527) Support for Nokia IP2450 Intrusion Prevention with Sourcefire IPSO-LX 7.2 supports the new Nokia IP2450 Intrusion Prevention with Sourcefire appliance (also referred to as Nokia IP2450 IPS). Designed for very large enterprises and service providers, Nokia IP2450 IPS is a security appliance optimized for the Sourcefire Intrusion Prevention System (IPS) and Sourcefire Realtime Network Awareness (RNA). Both IPS and RNA come pre-installed on the appliance and can be run simultaneously. Nokia IP2450 IPS features two quad-core CPUs and six forwardfacing PMC slots for network interface cards. With in-line performance up to 4 Gbps, Nokia IP2450 IPS offers extensive flexibility to support the threat prevention needs of very high performance segments of the enterprise network. Support for Increased Physical Memory IPSO 7.2 now support 8 or 16 Gigabytes of physical memory on a Nokia IP2450 IPS. Release Notes for Nokia IPSO-LX 7.2 9

10 1 New Features of IPSO-LX 7.2 New Linux Kernel Version IPSO 7.2 is now based on the Linux kernel. IPSO-LX Differences from IPSO The following list describes some changes introduced in Nokia IPSO-LX of which users familiar with Nokia IPSO 6.x or earlier might want to be aware: IPSO-LX is based on Linux. IPSO-LX does not include all of the functionality of IPSO versions. Refer to the Administrator s Guide for Nokia IPSO-LX for descriptions of functionality that is included. The admin user is assigned UID 100 and does not have superuser (root) permissions for the underlying operating system. Because the admin belongs by default to the Wheel group, the Admin can, however, become the root user. Nokia recommends that you limit the activity of the root account on the system. All configuration should be done through the CLI or Network Voyager and by a user other than root. Configuration done by the root user using a system shell is not supported and does not persist after reboot. The newpkg and newimage commands are not supported. Use the CLI or Network Voyager for package and image installation. Telnet and FTP servers are not supported because they are not secure. You must use SSH, not Telnet, to connect to the system. (Remote terminal connections to the system are limited to SSH v2; SSH v1 is not supported). Similarly, you must use SCP rather than FTP for backup and restore operations. Package management includes the following features and limitations: Packages should be installed and managed through the Network Voyager and CLI interfaces or through the Sourcefire Defense Center for Nokia. If the RPM command is used, the package may install, but Nokia IPSO-LX package management has no knowledge of it. Package dependencies are not checked when you install packages using Network Voyager or the CLI. You do not have to install the Network Voyager documentation as a separate package. It is part of the system image. Logical Ethernet interfaces are not supported. Out-of-band management of Nokia appliances is not supported. Use of external flash PC cards with Nokia appliances is not supported. Note You cannot upgrade to IPSO-LX from IPSO releases 6.x and earlier. 10 Release Notes for Nokia IPSO-LX 7.2

11 Supported Platforms Supported Platforms Nokia IPSO-LX 7.2 supports the following platforms: Nokia IP290 IPS Nokia IP390 IPS Nokia IP690 IPS Nokia IP2450 IPS For more information on these platforms and their features, see the Nokia IPxxx Intrusion Prevention with Sourcefire Installation Guide for the platform you are interested in. Supported Applications As of the publication of this document, Nokia IPSO-LX 7.2 supports the following applications: Sourcefire Sensor on Nokia v4.7 Sourcefire Sensor on Nokia v4.8 For the most recent information on applications supported by IPSO-LX 7.2, see the Nokia Support Web site. For information on setting up a Sourcefire 3D Sensor on Nokia, see the Nokia Intrusion Prevention with Sourcefire Appliance Quick Setup Guide. Release Notes for Nokia IPSO-LX

12 1 New Features of IPSO-LX Release Notes for Nokia IPSO-LX 7.2

13 2 Performing the Initial Configuration When you turn on a Nokia appliance for the first time, you must provide it with some initial configuration information. A console wizard automatically runs to prompt you for the information. The information you need to supply includes: The local host name for the appliance. The name you choose can include alphanumeric characters, dashes (-), and periods (.). The case-sensitive password for the admin user account. The admin user has complete read/ write privileges for all IPSO-LX features that can be configured through Network Voyager and the CLI. The case-sensitive password for the root user account. The physical interface to be used for the management interface, its IP address, and network mask length. The IP address of the default gateway for the appliance. To perform the initial configuration 1. Establish a console connection to the sensor, using a terminal or terminal emulation program with the following port settings: 9600 bps 8 data bits No parity 1 stop bit 2. The initial configuration begins with the following prompt: Hostname? If the Hostname? prompt does not appear on the console, see the Installation Guide for your security platform for troubleshooting suggestions. 3. Answer the prompts for hostname, user admin password, and user root password. Release Notes for Nokia IPSO-LX

14 2 Performing the Initial Configuration 4. When you see the following message, type 1. You can configure your system in two ways: 1) configure an interface and use our Web-based Voyager via a remote browser 2) configure an interface using CLI after reboot Please enter a choice [ 1-2, q ]: 5. Select the physical interface that will be used for the management interface: Select an interface from the following for configuration: 1) eth1 2) eth2 3) eth3 4) eth4 5) quit this menu Enter choice [1-5] The list of interfaces that you see depends on the NICs that are installed. Built-in port names take the form ethn, while ports on NICs take the form eth-snpn. For example, eth-s4p1 is the ethernet port in chassis slot 4, port 1. Type the number for the interface you want to configure. This interface should be the same interface as you connected the management cable to. 6. When prompted, enter the IP address and subnetwork mask length. 7. When you see the following message, type y (the default option). Do you wish to set the default route [ y ]? 8. When prompted, enter the IP address of the default router for this interface. 9. When prompted to configure speed and duplex mode, you can either: Configure speed and duplex mode, thereby turning off autonegotiation. Do this if you do not want to use Ethernet autonegotiation. Enter Return to bypass this step. Do this if you want to leave autonegotiation on. 10. When asked to confirm the interface parameters, type y. The system continues to boot. When it is done, the login prompt appears. See the Nokia Intrusion Prevention with Sourcefire User s Guide for more information on how to further configure your appliance as a Sourcefire 3D Sensor on Nokia. 14 Release Notes for Nokia IPSO-LX 7.2

15 3 Upgrading to Nokia IPSO-LX 7.2 Build 13 This section describes how to upgrade to Nokia IPSO-LX 7.2 Build 13 while retaining your current configuration. It also describes how to perform a fresh installation of IPSO-LX 7.2, which will delete your current configuration. How you upgrade to IPSO-LX 7.2 Build 13 depends on what you are currently running. If you are currently running: IPSO-LX 7.2 upgrade to this build as described in Upgrading from a Previous Build of IPSO-LX 7.2 below. IPSO-LX 7.1 upgrade to version 7.2 as described in Upgrading from IPSO-LX 7.1 on page 15. IPSO-LX 7.0 upgrade to version 7.2 as described in Upgrading from IPSO-LX 7.0 on page 19. Upgrading from a Previous Build of IPSO-LX 7.2 To upgrade to Build 13 from a previous build of IPSO-LX 7.2, follow the instructions in Upgrading to a New IPSO-LX Image on page 19. You do not need to upgrade your Sourcefire Sensor on Nokia software. However, if you want support for the 10 Gigabit Ethernet NIC in a Nokia IP2450 IPS, you must upgrade your Sourcefire Defense Center for Nokia and Sourcefire Sensor on Nokia to version 4.8. If you are not already running or later, you must upgrade to at least that version on your Defense Center and sensor before upgrading to 4.8. For more information, consult the Sourcefire 3D System for Nokia Release Notes for version You can obtain the latest versions of IPSO-LX and the Sourcefire 3D System software by downloading the software from the Nokia support Web site at The release notes are also available for download with the software. Upgrading from IPSO-LX 7.1 This section describes how to upgrade from IPSO-LX 7.1 to IPSO-LX 7.2. Please note the following: Release Notes for Nokia IPSO-LX

16 3 Upgrading to Nokia IPSO-LX 7.2 Build 13 Sourcefire 3D System version 4.6 is not supported with IPSO-LX 7.2. If you are currently running version 4.6, you need to upgrade to 4.7 or 4.8. To upgrade to version 4.8 of the Source Sensor on Nokia, you must upgrade first to IPSO- LX 7.2 and at least version of the Sourcefire Sensor on Nokia. To upgrade from IPSO-LX 7.1 to IPSO-LX 7.2, you must upgrade your IPSO-LX boot manager first, as described in Performing the Upgrade and Installing the Boot Manager Upgrade Package below. Obtaining the Required Software You can obtain the latest versions of IPSO-LX and the Sourcefire 3D System software by downloading the software from the Nokia support Web site at The release notes are also available for download with the software. Refer to Table 1, Table 2, and Table 3 for information on the software you need to upgrade the Defense Center, Sourcefire Sensor on Nokia, and IPSO-LX, respectively. Unless otherwise noted, place the required software on a local disk or network drive attached to your workstation. Table 1 Software Required for Upgrading the Defense Center Current Version Upgading to Version 4.7 Upgrading to Version 4.8 Earlier than Sourcefire 3D DC Upgrade, Sourcefire 3D DC Upgrade, Sourcefire 3D DC Patch, (or later patch) Earlier than Sourcefire 3D DC Upgrade, Sourcefire 3D DC Patch, (or later patch) Earlier than Sourcefire 3D DC Patch, (or later patch) Earlier than Sourcefire 3D DC Patch, (or later patch) Sourcefire 3D DC Upgrade, Sourcefire 3D DC Upgrade, Sourcefire 3D DC Patch, Sourcefire 3D DC Upgrade, Sourcefire 3D DC Patch, (or later patch) Sourcefire 3D DC Upgrade, Sourcefire 3D DC Patch, Sourcefire 3D DC Upgrade, Sourcefire 3D DC Patch, (or later patch) Sourcefire 3D DC Patch, Sourcefire 3D DC Upgrade, Sourcefire 3D DC Patch, (or later patch) Sourcefire 3D DC Upgrade, Sourcefire 3D DC Patch, (or later patch) 16 Release Notes for Nokia IPSO-LX 7.2

17 Upgrading from IPSO-LX 7.1 Table 2 Software Required for Upgrading the Sourcefire Sensor on Nokia Current Version Upgrading to Version 4.7 Upgrading to Version 4.8 Earlier than Earlier than Earlier than Sourcefire 3D Nokia Sensor Patch, Sourcefire 3D Nokia Sensor Upgrade, Sourcefire 3D Nokia Sensor Patch, (or later patch) Sourcefire 3D Nokia Sensor Upgrade, Sourcefire 3D Nokia Sensor Patch, (or later patch) Sourcefire 3D Nokia Sensor Patch, (or later patch) Sourcefire 3D Nokia Sensor Patch, Sourcefire 3D Nokia Sensor Upgrade, Sourcefire 3D Nokia Sensor Patch, Sourcefire 3D Nokia Sensor Upgrade, Sourcefire 3D Nokia Sensor Patch, (or later patch) Sourcefire 3D Nokia Sensor Upgrade, Sourcefire 3D Nokia Sensor Patch, Sourcefire 3D Nokia Sensor Upgrade, Sourcefire 3D Nokia Sensor Patch, (or later patch) Sourcefire 3D Nokia Sensor Patch, Sourcefire 3D Nokia Sensor Upgrade, Sourcefire 3D Nokia Sensor Patch, (or later patch) Sourcefire 3D Nokia Sensor Patch, (or later patch) Sourcefire 3D Nokia Sensor Upgrade, Sourcefire 3D Nokia Sensor Patch, (or later patch) Table 3 Required IPSO-LX Software Software Name and Version IPSO-LX 7.2 Build 13 (ipso-lx.tgz) Boot Manager Upgrade Package (BootManagerUpgrade tgz) Notes Place the.tgz file on an FTP or HTTP server that is reachable from the appliance you are upgrading or place it on the appliance local file system. Updates the IPSO-LX boot manager to 7.2. Must be installed before you perform the upgrade to 7.2. Release Notes for Nokia IPSO-LX

18 3 Upgrading to Nokia IPSO-LX 7.2 Build 13 Performing the Upgrade To upgrade to IPSO-LX 7.2 from IPSO-LX 7.1: 1. Upgrade your Defense Center to at least version or If you are currently running version 4.6 software, you will have to perform multiple upgrades. Consult Table 1 for the upgrade and patch versions required. You must be running at least to upgrade to 4.8. For instructions on performing the upgrades, consult the Sourcefire 3D System for Nokia Release Notes for each version you need to install as part of your upgrade path. 2. Upgrade your Sourcefire Sensor on Nokia package on your Nokia IPS appliance to version or later patch. Do not upgrade to version 4.8 yet. All upgrades are performed from the Defense Center. If you are currently running version 4.6 sensor software, you will have to perform multiple upgrades. Consult Table 2 for the upgrade and patch versions required. For instructions on performing the upgrades, consult the Sourcefire 3D System for Nokia Release Notes for each version you need to install as part of your upgrade path. 3. Install the IPSO-LX boot manager package on your Nokia IPS appliance, as described in Installing the Boot Manager Upgrade Package on page 18. Note You must install the boot manager package before you upgrade from IPSO-LX 7.1 to IPSO-LX Upgrade to IPSO-LX 7.2, as described in Upgrading to a New IPSO-LX Image on page 19. Note Make sure you re-enable the Sourcefire Sensor on Nokia package after the upgrade. 5. If you are upgrading to Sourcefire 3D System version 4.8, upgrade the Sourcefire Sensor on Nokia package to version and then to or later patch. Consult your Sourcefire 3D System for Nokia Release Notes for instructions. Installing the Boot Manager Upgrade Package You install the boot manager upgrade package on the appliance just like another package. However, you do not need to enable the package: the boot manager is upgraded whether the package is enabled or not. 18 Release Notes for Nokia IPSO-LX 7.2

19 Upgrading from IPSO-LX 7.0 Note You must install the boot manager upgrade package before you reboot your system to IPSO 7.2. To install the boot manager upgrade package 1. Log in to Network Voyager on the appliance. 2. From the navigation tree, select System Configuration > Packages > Install Packages. 3. Select either FTP to transfer the package from an FTP server or Upload to upload the package to the appliance from your workstation and then: Browse to the package if you selected Upload. Fill out the necessary server information if you selected FTP. 4. Press Submit. The package file name appears under Unpack Package. 5. Select the package and click Submit. 6. Click on the link: Click here to install/upgrade /opt/packages/bootmanagerupgrade tgz 7. Select the Install option on the Package Installation and Upgrade page and click Submit. When the package finishes installing, you can upgrade your image as described in Upgrading to a New IPSO-LX Image on page 19. Upgrading from IPSO-LX 7.0 To upgrade to IPSO-LX 7.2 from IPSO-LX 7.0: 1. Upgrade first to IPSO-LX 7.1 Build 12 or 14 as described in the Release Notes for Nokia IPSO-LX 7.1 for Build 12. As part of this upgrade, you should upgrade to Sourcefire version 4.7.0, as described in the Release Notes for Nokia IPSO-LX 7.1 for Build 12 and in the Sourcefire 3D System for Nokia Release Notes for version You can find the required software and release notes at the Nokia Support Web site. 2. Upgrade from IPSO-LX 7.1 to IPSO-LX 7.2, as described in Upgrading from IPSO-LX 7.1 on page 15 of this document. Upgrading to a New IPSO-LX Image When you upgrade your IPSO-LX image, you install a new image on your appliance, while maintaining previous images and your current configuration. You can then revert to a previous image if need be. Release Notes for Nokia IPSO-LX

20 3 Upgrading to Nokia IPSO-LX 7.2 Build 13 To upgrade, you: 1. Install the new IPSO-LX image on your appliance, as described in To install the system image on page After the image is installed, select it as the current image and then reboot, as described in To boot the new image on page Re-enable the Sourcefire Sensor on Nokia package, as described in To enable application packages on page 22. Note If you already have two IPSO-LX images installed on your appliance, consider deleting one of them before you install a new image. This will ensure that you have sufficient space for the new image. To install the system image 1. Place the image on an HTTP server, FTP server, or the appliance local file system. You can obtain the image from the Nokia support Web download site. 2. In Network Voyager, choose System Configuration > Images > Upgrade Image in the tree view. 3. Enter the HTTP, FTP, or file URL to the image location: Example of an HTTP URL: Example of an FTP URL that uses an absolute path: ftp://test.acme.com//tmp/ipso-lx.tgz For FTP URLs, if the path is absolute rather than relative to your home directory, it must contain a double slash (//) after the domain name. If you enter a path that is relative to the home directory of the user whose name and password you enter in step 4, use the standard URL format. Example of an FTP URL that uses a relative path: ftp://test.acme.com/admin/images/ipso-lx.tgz Example of a file URL: file:///tmp/ipso-lx.tgz Note If you enter a URL rather than an IP address, the system must be configured to use a valid DNS server on the DNS Configuration page. 4. If the server on which the IPSO-LX image is stored requires authentication, enter the user name and password in the Username and Password text boxes. 20 Release Notes for Nokia IPSO-LX 7.2

21 Upgrading to a New IPSO-LX Image Note To use an anonymous login, you might need to delete the user name and password if these fields are pre-filled. 5. Click Submit. 6. A message appears that tells you that the upgrade process might take a long time if the network is slow. Click the check box and click Submit again. The system begins to download the specified image file. 7. To view the status of the download and installation process, click New Image Installation Status. When you click this link, the first page of this process appears, and a message box is displayed that is periodically refreshed with new information as the download progresses. 8. The following message at the end of the list of messages indicates that the download and installation process is complete: Will use /image/<image> as root for next boot The image referred to in this message is the current one, not the new one. 9. To make the new image the current running image, you must select it and reboot as described in To boot the new image on page 21. To boot the new image Note If you are upgrading from IPSO-LX 7.1, make sure that you have installed boot manager upgrade package before you boot the new image. If you have not installed the boot manager upgrade package, do so now as described in Installing the Boot Manager Upgrade Package on page Choose System Configuration > Images > Manage Images in the tree view. 2. Click the button for the image you just installed. 3. From the System Boot drop-down list, select Reboot. 4. Click Submit to reboot the system. Note Nokia recommends that you delete the boot manager upgrade package after you have successfully rebooted to IPSO-LX 7.2. The package has served its purpose and is no longer needed. Release Notes for Nokia IPSO-LX

22 3 Upgrading to Nokia IPSO-LX 7.2 Build 13 To enable application packages 1. In Network Voyager, choose System Configuration > Manage Packages in the tree view. 2. Click the Enable check box for the package. 3. Click Submit. Communication between the Sourcefire 3D Sensor and the Defense Center is re-established when you enable the package. Note If you have the Sourcefire Sensor on Nokia package installed, your sensor configuration is maintained, even though the package is disabled after the reboot. However, until the package is enabled, traffic on the sensing interfaces is not inspected. Fail open interfaces are in bypass mode while the package is disabled. Downgrading to a Previous IPSO-LX Image The following procedure assumes that the previous image is still on the appliance and that you did not delete it after upgrading. To downgrade to a previous version of IPSO-LX 1. In Network Voyager, choose System Configuration > Images > Manage Images in the tree view. 2. Click the button for the image you want to downgrade to. 3. Select Reboot from the System Boot selection field. 4. Click Submit. 5. When you can log in again, verify that the Sourcefire Sensor on Nokia package is still enabled. You sensor configuration is maintained after the downgrade and communication with the Defense Center is re-established. Note If you do not enable the Sourcefire Sensor on Nokia package after upgrading to a new build of IPSO-LX and then fall back to the previous IPSO-LX build by rebooting it, the package is disabled on reboot and will need to be re-enabled. 22 Release Notes for Nokia IPSO-LX 7.2

23 Performing a Fresh Installation of IPSO-LX Performing a Fresh Installation of IPSO-LX You might have an occasion where you need to perform a fresh installation of IPSO-LX. A fresh installation deletes any existing images and configuration information. It also deletes any installed applications, log files, and user files. Make sure you back up any files you want to keep. For information on backing up and restoring files, see the Administrator s Guide for Nokia IPSO-LX. Before you begin a fresh installation: Download the IPSO-LX image and the lxinstaller file to an FTP server to which your platform has network connectivity. Make sure you know: The IP address or URL of the FTP server. The path to the lxinstaller file on the FTP server. The path to the ipso-lx.tgz file. The IP address of the default gateway for the platform. A host name to assign to the platform. An appropriate password to assign to the administrator and root accounts. A fresh installation is a three-step process: 1. Loading and configuring the boot manager install program. See To load and configure the boot manager install program on page Downloading and installing the IPSO-LX image. See To install the IPSO-LX image using the boot manager GUI on page 24 or To install the IPSO-LX image using the command line on page Performing the initial configuration of the new installation. See Chapter 2, Performing the Initial Configuration. 4. Installing the Sourcefire Sensor for Nokia package. See the Administrator s Guide for Nokia IPSO-LX for information on how to reinstall the application package and reconfigure your appliance. To load and configure the boot manager install program 1. Establish a console connection to the platform and then reboot the platform. 2. Type 2 when you see the following prompt: LILO ipso 2 bootmgr Press key '2' to enter BOOTMGR command mode boot: If you do not type 2 within 5 seconds after the prompt appears, the platform will continue the reboot instead of entering the boot manager. Release Notes for Nokia IPSO-LX

24 3 Upgrading to Nokia IPSO-LX 7.2 Build When the boot manager prompt appears, type install. 4. Enter the IP address for the management interface the boot manager will use. 5. Type y in response to the question about entering a default gateway and then provide the IP address for the gateway. 6. Choose the physical interface to be used for the management interface from the list of interfaces displayed. 7. Choose whether you want to download and install the IPSO-LX image by using the webbased boot manager GUI or by continuing in command-line mode. The default is to use the web-based GUI; if you want to use the command line, you must type n. If you chose to use the boot manager GUI to download and install the IPSO-LX image, continue with procedure To install the IPSO-LX image using the boot manager GUI on page 24. If you chose to use the boot manager command-line interface to download and install the IPSO-LX image, continue with procedure To install the IPSO-LX image using the command line on page 25. To install the IPSO-LX image using the boot manager GUI Skip to the next procedure if you chose to install the IPSO-LX image using the boot manager command line. 1. Confirm that the management interface information you have supplied the boot manager is correct. 2. Open a browser and enter the IP address of the management interface in the location or address field. 3. Fill in the fields on the initial boot manager page as follows: DNS Server IP Enter the IP address of a DNS server if you will be entering the FTP server address as a URL. Otherwise, leave blank. FTP Server Enter the IP address or URL of the FTP server on which the IPSO-LX image resides. User Name Enter the user name and password for the server. The boot manager GUI defaults to the anonymous user with a password of user@nokia.com. Installer File Enter the path to the lxinstaller file, including the lxinstaller name. For example: downloads/ipso-lx/lxinstaller The remaining fields are already filled in with the information you provided to the boot manager install program. 4. Click the Connect button. After a few moments, the installer screen appears. 24 Release Notes for Nokia IPSO-LX 7.2

25 Performing a Fresh Installation of IPSO-LX 5. Confirm that the FTP server and directory information is correct and then click the Show Files button. 6. From the pulldown list, select the IPSO-LX image file, usually called ipso-lx.tgz. 7. Click the Install button. 8. When you see the Installation completed message, reboot the appliance. You can do so from the boot manager command line prompt by entering the boot command. When the appliance finishes rebooting, you must perform the initial configuration from the console connection as described in Chapter 2, Performing the Initial Configuration. To install the IPSO-LX image using the command line Skip this procedure if you chose to download and install the IPSO-LX image using the webbased GUI. 1. Enter the FTP server IP address. 2. Enter the user name and password for your account on the FTP server. The defaults are for the anonymous account. 3. Enter the full pathname for the lxinstaller file on the FTP server. For example: /downloads/ipso-lx/lxinstaller 4. Confirm that the information you have given the boot manager so far is correct. The boot manager downloads and runs the lxinstaller. 5. Confirm that you want to continue with the installation process, which will destroy all existing files and data. If you do not want your existing files destroyed, enter n to stop the lxinstaller from proceeding with the installation process. 6. Confirm that the configuration for downloading the IPSO-LX image is correct. 7. Enter the path to the IPSO-LX image or accept the default path shown by pressing Enter. 8. Enter the name of the image file or accept the default name, ipso-lx.tgz, by pressing Enter. 9. Specify whether you want to retrieve and install any valid application packages that are in FTP directory. 10. Confirm the settings you have selected. The image download and install begins. 11. When prompted, reboot the appliance by pressing Enter. When the appliance finishes rebooting, you must perform the initial configuration from the console connection as described in Chapter 2, Performing the Initial Configuration. Release Notes for Nokia IPSO-LX

26 3 Upgrading to Nokia IPSO-LX 7.2 Build Release Notes for Nokia IPSO-LX 7.2

27 4 Limitations This chapter describes known limitations associated with Nokia IPSO-LX 7.2. Limitations Relating to the 10 Gigabit Ethernet Fiber-Optic NIC The following limitation applies to the 10 Gigabit Ethernet fiber-optic NIC supported in a Nokia IP2450 IPS. Limit on Number of 10 Gigabit Ethernet NICs Do not install more than two 10 Gigabit Ethernet NICs in a Nokia IP2450 IPS. (PR81151) Limitations Related to Sourcefire Sensor on Nokia The following sections describe limitations specific to running Sourcefire Sensor on Nokia software on IPSO-LX. Do Not Delete Sourcefire 3D Users or Groups The Sourcefire Sensor on Nokia software creates the following hidden users and groups on the Nokia appliance: Users: mysql, sfrna, and sfsnort Groups: dce, mysql, sfrna, and sfsnort Even though Network Voyager and the CLI allow you to delete these hidden users and groups, do not delete them. Make sure all users who have user administrative privileges on the appliance know not to delete the Sourcefire 3D users and groups. (PR56327) Release Notes for Nokia IPSO-LX

28 tcpdump on Sensing Interfaces When an interface is under control of the Sourcefire application (as indicated by its Locked status), you cannot run the IPSO-LX tcpdump on it. Instead, use the tcpdump provided with the Sourcefire Sensor on Nokia package. This version expects physical interface names to take a different form, where fp is substituted for eth. In other words, to run tcpdump on eth1, use fp1. For example, to run tcpdump on eth-s1p1 when it is under the Sourcefire application control, enter: /opt/sourcefire_sensor /usr/sbin/tcpdump -i fp-s1p1 Note that when you run tcpdump on inline interfaces, you might experience a delay or loss of traffic. Sourcefire recommends using the -w option unless you have a low data rate. (PR58179) Version Information Not Updated for Package When you upgrade your Sourcefire Sensor on Nokia package from the Defense Center, only the Description field for the package is updated in Network Voyager. The Package Name, Version, Release, and Directory fields still shows the older version information. In case of a patch update (for example, to ), the Description field will also not be updated. (PR58728) Warning Messages on Nokia IP690 IPS Console You might see warning messages similar to the following on the console of a Nokia IP690 IPS when you are running traffic through a fail open interface configured with an IPS or RNA detection engine: Sep 8 21:37:15 IP c12-2 [warning] EDAC e752x: Non-Fatal Error DRAM Controler Sep 8 21:37:15 IP c12-2 [warning] EDAC MC0: CE page 0x43869, offset 0x240, grain 4096, syndrome 0x124, row 2, channel 0, label "": e752x CE These messages are harmless and can be ignored. (PR80885) Console Errors When Sourcefire Package Is Installed When the Sourcefire Sensor on Nokia package is installed on the appliance, you might periodically see the following messages on the console: Feb 6 06:44:15 IP [err] SF-IMS[7055]: pm:tokenizer [ERROR] Unable to open '/opt/ Sourcefire_Sensor /etc/sf/sftunnel.conf': No such file or directory Feb 6 06:44:20 IP [err] SF-IMS[7089]: sfmb:sfutil [ERROR] Error getting interface address: No such device Feb 6 06:44:20 IP [err] SF-IMS[7089]: sfmb:sfutil [ERROR] Failed Release Notes for Nokia IPSO-LX

29 to get IP address for interface 'eth1': General error Feb 6 06:45:30 IP [err] SF-IMS[7089]: sfmb:sfutil [ERROR] Error getting interface address: No such device Feb 6 06:45:30 IP [err] SF-IMS[7089]: sfmb:sfutil [ERROR] Failed to get IP address for interface 'eth1': General error These messages are harmless and can be ignored. (PR58282) Use Correct Defense Center Host Name in Host Address Assignment IPSO-LX allows you to resolve host names to IP addresses by assigning host names to IP addresses in the Network Voyager Host Address Assignment page (System Configuration > Host Address). If you assign a host name to the Defense Center IP address and then use that host name to register the sensor with the Defense Center, you must use the real Defense Center host name. If you use some other name than the real host name in the Host Address Assignment page, you will be unable to register the sensor with the Defense Center. (PR58426) Boot Manager and Initial Configuration Limitations The following sections describe limitations related to the boot manager and initial configuration of IPSO-LX 7.2. Double Characters on IP2450 IPS Console On a Nokia IP2450 IPS, when the boot manager loads during the boot process, each character is printed twice on the screen. For example, instead of seeing this: LILO ipso 2 bootmgr Press key '2' to enter BOOTMGR command mode boot: Release Notes for Nokia IPSO-LX

30 you see this: LI LILLOO iippssoo 22 bboooottmmggrr PPrreessss kkeeyy ''22'' ttoo eenntteerr BBOOOOTTMMGGRR ccoommmmaanndd mmooddee bboooott:: (PR67214) Bootmgr Handling of Special Characters in Passwords When performing an installation from the boot manager, you cannot connect to an FTP site by using a password that contains special characters. The boot manager does not send these passwords correctly. Change the FTP server password to not contain special characters, or configure the FTP server for anonymous login. (PR3049) Power Outage During Initial Configuration If the appliance loses power during the initial configuration, the system will go directly to the login prompt when you turn the power back on. If this occurs, you must remove the file /config/ active and then reboot. (PR49344) New Image and Package Management Limitations The following sections describe limitations to new image and package management processes for IPSO-LX. Internet Explorer and Uploading Packages The Upload Packages feature on the Network Voyager Install Package page sometimes does not work when you are using Internet Explorer and attempting to upload a package from a network drive. To avoid this problem, move the package from the network drive to a local drive and then upload the package from there. (PR68077) Release Notes for Nokia IPSO-LX

31 Installing a Package from a Local Directory Using Network Voyager, you can install packages from the local file system only if the packages are located in the /opt/packages directory. To install packages from another local directory, you must use the CLI. (PR34062) Handling Package Information in Environmental Variables Currently, package information is included in global operating system variables. When a package is enabled, the system updates the global variables PATH to include the package /bin directory and LD_LIBRARY_PATH to include the package /lib directory. This can cause problems when more than one application is installed on the appliance or gateway for example, if the applications are using different versions of the same binary or library. (PR3754) Network Voyager or CLI Limitations The following sections describe limitations to the use of Network Voyager and the CLI. Changing Monitor User Password with CLI If you log in as the monitor user and use the set selfpasswd command to change your password, you will receive an Invalid Command error message. If you entered the command correctly, your password will be changed, despite the error message. (PR80884) Truncated DNS Configuration Error Message The error message displayed by the Network Voyager DNS Configuration page truncates once it reaches a certain length. When you enter an invalid DNS search list, the message repeats the search list and then describes the error. If the DNS search list is very long, the description of the error can be truncated. If you receive a truncated error message and are not sure what the actual error is, check your DNS search list to make sure that: You have entered a maximum of six domain names You haven t repeated a domain name The entire search list, including spaces, does not exceed 256 characters. (PR73469) Problems Using Internet Explorer or Opera Browsers Network Voyager pages might not display correctly or might cause browser errors when you use Internet Explorer or Opera. If you are having trouble using Internet Explorer or Opera with Network Voyager, use Netscape or Mozilla instead. (PR56323, PR56380) Release Notes for Nokia IPSO-LX