Modifications according to new functionalities of the NCP Secure Enterprise Server 10.0.

Transcription

1 NCP Secure Enterprise HA Server Major Release 10.0 rev (Windows 64) August 2015 Windows Server 2008 R2 64 bit Windows Server 2012 R2 64 bit for Management by Secure Enterprise Management (SEM) Secure Enterprise Management Server: Version 3.02 Management Plugin - Server Configuration: NCP_MgmPlugin_SrvCfg_Win32_811_051 or later Modifications according to new functionalities of the NCP Secure Enterprise Server Improvements / Problems Resolved Page 1 of 13

2 Service Release 3.04 Build 029 (Windows 64) October 2014 Windows Server 2008 R2 64 bit Windows Server bit Windows Server 2012 R2 64 bit for management by Secure Enterprise Management Secure Enterprise Management server: version or later Management Plugin - Server Configuration: NCP_MgmPlugin_SrvCfg_Win32_811_051 or later 2. Improvements / Problems Resolved CVE / "POODLE" issue SSL v2.0 and v3.0 withdrawn from this product. The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain clear-text data via a paddingoracle attack, aka the "POODLE" issue. For this reason the SSL v2.0 and v3.0 protocols are no longer incorporated in this product. The TLS protocol now provides all underlying secure web service (HTTPS) encryption and authentication services. Page 2 of 13

3 Service Release 3.04 Build 028 (Windows 64) July 2014 Windows Server 2008 R2 64 bit Windows Server bit Windows Server 2012 R2 64 bit for management by Secure Enterprise Management Secure Enterprise Management server: version or later Management Plugin - Server Configuration: NCP_MgmPlugin_SrvCfg_Win32_811_051 or later 2. Improvements / Problems Resolved Open SSL H after expert assessment of 5. June 2014 The 5. June 2014 expert assessment of the security breach resulted in the release of Open SSL H and this version has been implemented in the latest version of the NCP Secure Enterprise HA Server. (See Page 3 of 13

4 Service Release 3.04 Build 027 (Windows 32/64) May 2014 Windows Server 2003 R2 Enterprise Edition 32/64 bit Windows Server 2008 Enterprise 32/64 bit Windows Server 2008 R2 Enterprise 64 bit Windows Server 2012 Datacenter 64 bit Windows Server 2012 R2 Datacenter 64 bit for management by Secure Enterprise Management Secure Enterprise Management server: version or later Management Plugin - Server Configuration: NCP_MgmPlugin_SrvCfg_Win32_811_051 or later 4. New Features and Enhancements 5. Improvements / Problems Resolved Sporadic Deadlock Sporadically a deadlock occurred; the only way to recover was to restart the HA server. This problem has been resolved. 6. Known Issues Page 4 of 13

5 Service Release 3.04 Build 024 (Windows 32/64) April 2014 Windows Server 2003 R2 Enterprise Edition 32/64 bit Windows Server 2008 Enterprise 32/64 bit Windows Server 2008 R2 Enterprise 64 bit Windows Server 2012 Datacenter 64 bit Windows Server 2012 R2 Datacenter 64 bit for management by Secure Enterprise Management Secure Enterprise Management server: version or later Management Plugin - Server Configuration: NCP_MgmPlugin_SrvCfg_Win32_811_051 or later 2. Improvements / Problems Resolved OpenSSL Heartbleed-Bugs (CVE ) OpenSSL Heartbleed Bug - cryptographic library - problem resolved Page 5 of 13

6 Service Release 3.04 Build 023 (Windows 32/64) April 2014 Windows Server 2003 R2 Enterprise Edition 32/64 bit Windows Server 2008 Enterprise 32/64 bit Windows Server 2008 R2 Enterprise 64 bit Windows Server 2012 Datacenter 64 bit Windows Server 2012 R2 Datacenter 64 bit for management by Secure Enterprise Management Secure Enterprise Management server: version or later Management Plugin - Server Configuration: NCP_MgmPlugin_SrvCfg_Win32_811_051 or later 4. New Features and Enhancements 5. Improvements / Problems Resolved 6. Known Issues Page 6 of 13

7 Service Release 3.04 Build 022 (Windows 32/64) March 2014 Windows Server 2003 R2 Enterprise Edition 32/64 bit Windows Server 2008 Enterprise 32/64 bit Windows Server 2008 R2 Enterprise 64 bit Windows Server 2012 Datacenter 64 bit Windows Server 2012 R2 Datacenter 64 bit for management by Secure Enterprise Management Secure Enterprise Management server: version or later Management Plugin - Server Configuration: NCP_MgmPlugin_SrvCfg_Win32_811_051 or later Windows Internet Explorer version 11 Support From this revision onwards Windows Internet Explorer version 11 can be used as the browser for running the VPN Server configuration web interface. 2. Improvements / Problems Resolved Page 7 of 13

8 Service Release 3.04 Build 020 (Windows 32/64) Date: August 2013 Windows Server 2003 R2 Enterprise Edition 32/64 bit Windows Server 2008 Enterprise 32/64 bit Windows Server 2008 R2 Enterprise 64 bit for management by Secure Enterprise Management Secure Enterprise Management server: version or later Management Plugin - Server Configuration: NCP_MgmPlugin_SrvCfg_Win32_811_051 or later Accessing the Gateway The Secure Enterprise VPN Server can be accessed from an NCP HA Server using IPv6 addressing. Pre-requisites: HA Server (Win): Version 3.04 build 020 or later Secure Enterprise Server (Win): Version 8.11 build 168 or later Server Plug-in (SEM): Version 8.11 build 48 or later Prioritization of clients NCP Secure Enterprise VPN Server, operating in Load Balancing Mode of an HA Server environment enables the HA Server to prioritize VPN access by Clients. This is particularly important when the HA Server is overloaded or when there are insufficient licenses available for all Clients; in such circumstances, only users with a high priority are allowed access. Setting the Priority in the Server Configuration: User priority is defined at the server in the HA Server configuration, in the template of the respective HA Server and is effective for all gateways connected to it. The User Priority, defined there for the users of a Domain Group, defines the priority Clients must have been assigned, in order to be allowed access. Highest priority is "1", lowest is "255", and access is allowed for users with the highest priority. The default setting, "0" means that priority based access is switched off and all VPN users are allowed access. If User Priority functionality is in use, all VPN users with priority less than the priority value configured here will be blocked from establishing VPN connections. Highest priority is "1". For example, if User Priority "5" is defined at the Server, all users with a lower priority, i.e. 6 to 255, will be blocked. This happens immediately on setting the parameter. VPN tunnels from Clients which, at this point in time, have been assigned a lower priority, will be disconnected, and renewed attempts to establish a connection will be rejected. Disconnections and rejections of VPN connection establishment attempts are logged with a corresponding message. Page 8 of 13

9 Assigning User Priority in the Client Configuration: The priority allocated to a specific user can only be defined in the RADIUS or LDAP configuration of the respective Client. Highest priority is "1", lowest is "255", and access is allowed for users with the highest priority. Important: at the Client, "0" is the default value for User Priority, and the centrally applied priority-based restriction of Client access does not apply to Clients with User Priority "0". Such Clients are ALWAYS allowed access. Text in the GUI (Domain-Groups): As soon as User Priority functionality is in switched on, all VPN users with priority less than the priority value configured here will be blocked from establishing VPN connections. Highest priority is "1", lowest is "255". VPN tunnels already established from Clients with a lower priority are immediately disconnected. "0" switches off the prioritized tunnel-use functionality. 2. Changes Made and Problems Resolved The following problems have been resolved in this release: Page 9 of 13

10 Service Release 3.03 Build 7 (Windows 32/64) Date: June 2012 The following describes the new feature introduced in this release: Seamless Roaming Force Single VPN Connection This switch prevents multiple VPN connections, from a single NCP Secure Client, remaining open when Seamless Roaming is in operation. When set (the default state) and a VPN connection request is received at a gateway, that gateway sends a message to all other gateways in the load balancing/ha group, indicating that this user is now connected to gateway x and all other connections for this user must be terminated. : HA Server (Win) : Version 3.03 build 004 or later Secure Enterprise Server (Win): Version 8.10 build 051 or later Server Plug-in (SEM): build 15 or later 2. Changes Made and Problems Resolved The following problems have been resolved in this release: 4. Getting Help for the NCP Secure Enterprise HA Server To ensure that you always have the latest information about NCP s products, always check the NCP website at: For further assistance with the NCP Secure Enterprise Server, visit: Mail: helpdesk@ncp-e.com Page 10 of 13

11 5. Features The NCP Secure Enterprise High Availability Services are reliable software components of the holistic NCP Enterprise solution. They can be configured to ensure either: a) high availability of one or more NCP Secure Enterprise VPN Servers by means of a backup server, thereby ensuring the continuous availability of a company s entire virtual private network, or b) equal distribution of load between multiple NCP Secure Enterprise VPN Servers (VPN gateways). Functionality The HA Server handles the automatic switchover between the VPN gateways of a HA system, dependent on either load or type of error. To ensure continuous availability, redundancy is configured into the system, with each component requiring its own official IP address. In a Failsafe configuration, each system is informed which has active and which has backup status. In a Load Balancing configuration, the system knows which server is loaded the least. Operating Modes Failsafe In Failsafe mode, only one VPN gateway is active. The second is installed as a backup system (hot standby backup), ready to take over in the event that the active gateway is stopped or fails. Load Balancing Load Balancing (LB) mode is used to distribute the load from tunneled connections evenly over a number of active VPN gateways. VRRP In addition to Failsafe and Load Balancing, NCP HA Servers also support VRRP operating mode. This mode is a component part of the HA license and is used when, in parallel to native VPN tunneled connections, the HA system must also support establishment of SSL VPN tunneled connections. Central Management NCP provides a web interface for configuring and administering the HA server, and configuration changes or enhancements can be carried out either locally or remotely. For more the complex configurations the Secure Enterprise Management Server Plug-in enables server configurations to be tailored centrally and then transferred to the corresponding members of an HA system. Licensing Model The HA license is always valid for the primary and the backup HA server in either FS or LB mode with the desired number of VPN tunnels. The software is fully licensed when the same serial number and the same license key is entered on both servers. After those license details have been entered, the operating mode can be changed. Note: in Load Balancing mode the number of tunnel licenses for IPsec clients at the HA server must be equal to or greater than the sum of tunnel licenses entered at the VPN gateways making up the LB configuration. Tunnel reservation is not allowed in Load Balancing mode. The HA server autonomously calculates the number of tunnels that are to be allocated to the VPN gateway. In addition a second gateway license is required. Page 11 of 13

12 Should there be an alternative or additional requirement to manage a number of SSL VPN tunnel connections, the required number (Concurrent Users) must be licensed via an individual activation key entered via the web interface. Note that it is not possible to use an SSL VPN license for a native VPN connection. Optionally additional IPsec or SSL VPN client tunnel licenses can be purchased in any quantity and at any time. HA Server Operating Systems See prerequisites on page 1 CPU Intel x86, 32 or 64 bit, dual core recommended Main Memory min. 1 G Hard Drives up to 400 MB free space on the drive Web Interface Web Browsers Use one of the newer versions of these web browsers: Internet Explorer Firefox or other Mozilla based browser Safari Chrome Page 12 of 13

13 Page 13 of 13