Release Date: July 29, 2016

Transcription

1 Introduction ArrayOS AG Release Note Release Date: July 29, 2016 This release note summarizes the general enhancements, resolved issues and known limitations for ArrayOS AG release. Contacting Customer Support To contact Array Networks Customer Support, please call or the team at Additional Information: Array Networks, Inc McCarthy Blvd. Milpitas, CA Phone: (408) Toll Free: (1-866-MY-ARRAY) Fax: (408) Telephone access to Array Networks is available Monday - Friday, 9 A.M. to 5 P.M. PST. Array Networks, Inc. All Rights Reserved. 1

2 Table of Contents ENHANCEMENTS... 3 AccessDirect... 3 General Settings and Networking... 3 User Policy... 5 Access Method... 5 Web Portal... 6 Client Security... 6 Admin Tools... 7 DesktopDirect... 7 DesktopDirect-Windows... 7 MotionPro... 8 MotionPro-Server... 8 RESOLVED ISSUES... 9 AccessDirect... 9 General Settings and Networking... 9 AAA... 9 Access Method Web Portal High Availability System Monitoring Admin Tools DesktopDirect DesktopDirect-Server MotionPro MotionPro-Server KNOWN LIMITATIONS AccessDirect General Settings and Networking Array Networks, Inc. All Rights Reserved. 2

3 ENHANCEMENTS AccessDirect General Settings and Networking Deleting the show system message command from the Config mode (ID: 62392) Now, the administrator is not allowed to execute the show system message command in Config mode. Supporting the MNET interface (ID: 60984) Now, the MNET interface is supported on the AG appliance. Multiple MNET interfaces can be created on one system interfaces or bond interfaces and each MNET interface can be assigned an IP address. In this way, one physical interface can be assigned multiple IP addresses. New CLI commands: To support this enhancement, the following commands are added: mnet {system_ifname bond_ifname} <mnet_interface_name> This command is used to create a Multi-Netting (MNET) interface on the specified system interface or bond interface. ArrayOS supports creating at most 32 MNET interfaces. no mnet <mnet_ifname> This command is used to delete a specified MNET interface. show mnet This command is used to display the configurations of all MNET interfaces. clear mnet This command is used to clear the configurations of all MNET interfaces. Modified CLI commands: To support this enhancement, the value of the interface_name parameter in the following commands can be a MNET interface: ip address {system_ifname vlan_ifname bond_ifname mnet_ifname} <ip_address> {netmask prefix} This command is used to set the IP address and netmask or prefix length for the specified system interface, VLAN interface, bond interface or MNET interface. no ip address <interface_name> [version] This command is used to delete the IP address from the specified interface. cluster virtual ifname <interface_name> <virtual_cluster_id> Array Networks, Inc. All Rights Reserved. 3

4 This command is used to add a virtual cluster to the specified interface. clear cluster virtual ifname <interface_name> <virtual_cluster_id> This command is used to clear a virtual cluster from the specified interface. cluster virtual vip <interface_name> <virtual_cluster_id> <virtual_ip> This command is used to add a virtual IP address to the specified virtual cluster. no cluster virtual vip <interface_name> <virtual_cluster_id> <virtual_ip> This command is used to delete the virtual IP address from the specified virtual cluster. cluster virtual auth <interface_name> <virtual_cluster_id> <auth_flag> <auth_password> This command is used to configure the authentication method for the specified virtual cluster. By default, the authentication is not required for a virtual cluster. no cluster virtual auth <interface_name> <virtual_cluster_id> This command is used to reset the configuration of authentication method to default for the specified virtual cluster. cluster virtual priority <interface_name> <virtual_cluster_id> <priority> [peer_host] This command is used to set the priority of the specified virtual cluster. By default, the priority of the virtual cluster is 100. no cluster virtual priority <interface_name> <virtual_cluster_id> [peer_host] This command is used to reset the configuration of the priority of to default for the specified virtual cluster. cluster virtual preempt <interface_name> <virtual_cluster_id> <preempt_value> This command is used to enable or disable the preemption mode for the specified virtual cluster. After the preemption mode is enabled, the status of the virtual cluster with a higher priority becomes the master. By default, the preemption mode is disabled. no cluster virtual preempt <interface_name> <virtual_cluster_id> This command is used to reset the preemption mode of the specified virtual cluster to default. cluster virtual interval <interface_name> <virtual_cluster_id> [advertisement_interval] This command is used to set the advertisement interval for the specified virtual cluster. By default the advertisement interval is 5 seconds. no cluster virtual interval <interface_name> <virtual_cluster_id> This command is used to reset the advertisement interval to default for the specified virtual cluster. cluster virtual {on off} [virtual_cluster_id] [interface_name] This command is used to enable or disable the virtual cluster on the specified interface. show cluster virtual status [interface_name] This command is used to display the status of the virtual cluster on the specified interface. show cluster virtual config [interface_name] This command is used to display configurations of the virtual cluster on the specified interface. Array Networks, Inc. All Rights Reserved. 4

5 show cluster virtual transition [interface_name] This command is used to display the last 10 transition logs of the virtual cluster on the specified interface. show statistics cluster virtual [interface_name] This command is used to display the statistics of the virtual cluster on the specified interface. For details, please refer to the ArrayOS AG 9.3 CLI Handbook. User Policy [Session Mangement] Supporting displaying the number of active sessions for every user (ID: 62860) Now, the administrator can view the number of active sessions for the specified user using show session count the command. Modified CLI command: To support this enhancement, the parameter username is added to the following command: show session count [username] This command is used to display the number of active sessions for the specified user. For details, please refer to the ArrayOS AG 9.3 CLI Handbook. [ACL] Supporting logging for access denied by ACL rules (ID: 61896) Now, the logging for access denied by ACL rules is supported. After this function is enabled, logs will be recorded if the access is denied by ACL rules. New CLI command: To support this enhancement, the following command is added: acl denylog {on off} This commad is used to enable or disable logging for access denied by ACL rules. By default, this function is disabled. For details, please refer to the ArrayOS AG 9.3 CLI Handbook. Access Method [Array Client] Supporting client certificate display selection (ID: 62486) Previously, if several client certificates with the same issuer name were configured for the client authentication, the Standalone Array Client for Windows would present only one certificate. Array Networks, Inc. All Rights Reserved. 5

6 Now, the Standalone Array Client for Windows allows end users to enable the display of all certificates or ignore the certificates with same issuer name by selecting VPN > Options > Certificates. [Array Client] Supporting L3VPN client information collection (ID: 61896) Now, L3VPN client information collection is supported. After this function is enabled, the Array Client integrated with Array SDK can obtain the public IP address that the Array Client uses to connect to VPN. For details on Array SDK, please contact Array Networks Customer Support. New CLI command: To support this enhancement, the following command is added: vpn clientinfocollect {on off} This command is used to enable or disable L3VPN client information collection. This function is used for Array SDK. By default, this function is disabled. For details on Array SDK, please contact Array Networks Customer Support. For details, please refer to the ArrayOS AG 9.3 CLI Handbook. Web Portal Adding the secure attribute to the HTTP response before the end user logs into the virtual portal (ID: 63543) Now, the secure attribute is added to the Set-Cookie header in the HTTP response returned to the browser to enhance the security before the end user logs into the virtual portal. Client Security [Host Integrity] Supporting viewing the software lists of Host Integrity checks (ID: 63423) Now, the administrator can view the supported software lists of Host Integrity checks by clicking the View button in the Client Security Documentation area of Site Configuration > Security Settings > Client Security > General Settings. [Host Integrity] Anti-virus software enhancements (ID: 62239&61322) Now, the following anti-virus softwares are supported for host integrity checks: (Kaspersky Labs) Kaspersky Endpoint Security (10.x) (Eset Software) ESET NOD32 Antivirus (7.x) Array Networks, Inc. All Rights Reserved. 6

7 (Eset Software) ESET NOD32 Antivirus (8.x) To add anti-virus rules for these softwares, click the Add action link in the Antivirus Rules area of Site Configuration > Security Settings > Client Security > Device Classes > Host Integrity > Antivirus under the site scope. Admin Tools [WebUI] Adding a MotionPro Alias Site Deployment configuration page (ID: 61805) Now, the administrator can quickly create an alias virtual site for MotionPro, configure AAA and configure L3VPN via the newly added MotionPro Alias Site Deployment configuration page by selecting the MotionPro Alias Site Deployment action link of Virtual Sites > Virtual Sites > Virtual Sites under the global scope. DesktopDirect DesktopDirect-Windows Supporting adjusting the window size of the published application (ID: 62372) Previously, when administrators set the window size of a published application to custom pixels by selecting ART Server > Terminal Service Applications > Applications on the DD pilot, the window size of the published application could not be adjusted. Now, a parameter validappsize is added to the art client settings custom command to control whether to allow users to adjust the window size of the published application. Modified CLI command: To support this enhancement, custom_parameter in the following command can be validappsize : art client settings custom <set_name> <platform> <custom_parameter> <custom_value> For details, please refer to the ArrayOS AG 9.3 CLI Handbook. Supporting redirecting the sound of remote host to the local host (ID: 61536) Now, the DesktopDirect Client for MacOS supports redirecting the sound of remote host to the local host. For details, please refer to the art client settings custom command in AG 9.3 CLI Handbook. Array Networks, Inc. All Rights Reserved. 7

8 MotionPro MotionPro-Server Supporting enabling both the application-level VPN tunnel for the remote desktop application and the SSL L3VPN tunnel (ID: 63784) Now, the administrator can enable both the application-level VPN tunnel for the remote desktop application and the SSL L3VPN tunnel at the same time. Modified CLI commands: To support this enhancement, the value of the mode parameter in the following command can be set to both : motionpro portal vpnpolicy <mode> This command is used to set the VPN tunnel mode to be enabled. If this command is not configured, when only the desktop resources are assigned to the end users, the applicationlevel VPN tunnel will be enabled; otherwise, the SSL L3VPN tunnel will be enabled. mode This parameter specifies the VPN tunnel mode to be enabled. Its value must be: tcpproxy: indicates that the application-level VPN tunnel will be enabled only for the remote desktop application. l3vpn: indicates that the SSL L3VPN tunnel will be enabled. both: indicate that both the application-level VPN tunnel for the remote desktop application and the SSL L3VPN tunnel will be enabled. disable: indicate that neither the application-level VPN tunnel nor the SSL L3VPN tunnel will be enabled. Array Networks, Inc. All Rights Reserved. 8

9 RESOLVED ISSUES AccessDirect General Settings and Networking CPU usage becoming too high as a result of the large size of the log file pg_server.log (ID: 63568) In some cases, the CPU usage became too high as a result of the large size of the pg_server.log log file that stored the LocalDB logs. This issue has now been resolved. Now, the pg_server.log log file is created and deleted by month. OS vulnerability (ID: 63164) ArrayOS AG has eliminated the operating system vulnerability reported by CVE System panic occurring if a role was deleted during Runtime Synconfig (ID: 62816) If a role was deleted during Runtime Synconfig, a system panic might occur due to the memory processing error. This issue has now been resolved. Failing to process UDP fragments of SIP 200 OK packets returned from the SIP server (ID: 62677) When receiving the UDP fragments of SIP 200 OK packets returned from the SIP server for the first time, AG processed these fragments properly. However, AG discarded such UDP fragments later. This issue has now been resolved. AAA [HardwareID] HWID_WIN.exe tool being not user-friendly (ID: 60850) Array Networks, Inc. All Rights Reserved. 9

10 After the HWID_WIN.exe tool was launched, several IDs were displayed. It was not user-friendly for users to obtain the Hardware ID value. This issue has now been resolved. Access Method [Web Access] HTTP 403 error received when the user accessed a QuickLink resource whose name contained spaces (ID: 63378) When the user accessed a QuickLink resource whose name contained spaces, HTTP 403 error was received. This issue has now been resolved. Web Portal [SSO] SSO post failing to work correctly if the cookie value in the response from the backend server was too long (ID: 61444) If the cookie value of the Set-Cookie header in the response from the backend server was too long, such as 2048 bytes, the SSO post function failed to work correctly. This issue has now been resolved. High Availability [HA] System memory leak occurring when the Runtime Synconfig function was used (ID: 63531) When Runtime Synconfig was synchronizing configurations from one unit to another unit, a system memory leak error occurred. This issue has now been resolved. System Monitoring [SNMP] Incorrect OID of the SNMP trap casyslog (ID: 63679) The OID of the SNMP trap casyslog was incorrect. This issue has now been resolved. Array Networks, Inc. All Rights Reserved. 10

11 Admin Tools Failing to assign the created system administrator role to the specified administrator account on vxag (ID: 64038) The administrator failed to assign the newly created system administrator role to the specified administrator account on the vxag appliance. This issue has now been resolved. [WebUI] Incorrect display of Windows administrator account (ID: 62875) If a Windows administrator account was configured for a Netpool by clicking the Add Administrator Account action link in the Windows Administrator Accounts area of Access Methods > VPN > Common Settings > Netpools > Advanced > Windows Administrator, this Windows administrator account would also be displayed in another Netpool. This issue has now been resolved. [WebUI] Incorrect display of parameter description for ARP interval (ID: 62497) seconds, means only sending gratuitous ARP when switching to ACTIVE was displayed in the ARP area of System Configuration > High Availability > General Settings. However, the ARP interval could not be set to This issue has now been resolved. OpenSSL vulnerabilities (ID: 62373&61316) ArrayOS AG 9.4 GA release has eliminated the OpenSSL vulnerabilities reported by CVE , CVE , CVE , CVE and CVE Model not being displayed in the output of the show version command (ID: 60934) If the license of the AG appliance expired, the model would not be displayed in the output of the show version command. This issue has now been resolved. DesktopDirect DesktopDirect-Server Array Networks, Inc. All Rights Reserved. 11

12 A desktop with no hostname or IP address being created (ID: 57571) A desktop with no hostname or IP address could be created or imported to the AG appliance. This issue has now been resolved. MotionPro MotionPro-Server Failing to delete the DeviceID rule configured for the LocalDB account whose name contained a two-byte character (ID: 61923) The administrator failed to delete the DeviceID rule configured for the LocalDB account whose name contained a two-byte character using the no localdb deviceid account <account_name> <device_id> command. This issue has now been resolved. Now the administrator can delete all DeviceID rules by setting the value of the account_name parameter to *. Array Networks, Inc. All Rights Reserved. 12

13 KNOWN LIMITATIONS AccessDirect General Settings and Networking SSLv3 and TLSv1.0 no longer supporting DES-CBC-SHA (ID: 62700) Due to the upgrade of OpenSSL, the SSL protocols SSLv3 and TLSv1.0 no longer support the weak cipher suite DES-CBC-SHA. MNET interface not supporting IPv6 (ID: 62687) The MNET interface does not support IPv6. Not supporting configuring MNET interface via WebUI For now, the MNET interface cannot be configured via WebUI. Array Networks, Inc. All Rights Reserved. 13