Dell SonicWALL SonicOS

Transcription

1 Complete Product Name with Trademarks Version Dell SonicWALL September 2015 These release notes provide information about the Dell SonicWALL release. About Supported platforms New Features Resolved issues s System compatibility Product licensing Upgrading information Technical support resources About Dell About is an early release that introduces several new features and fixes a number of known issues in earlier 6.1 releases. This release provides all the features and contains all the resolved issues that were included in previous releases of SonicOS x. For more information, see the previous release notes on MySonicWALL at or on the Support portal at IMPORTANT: SonicOS and include a design change for the treatment of traffic over VPN tunnel interfaces. By default, NAT policies are now applied to this traffic. In SonicOS and earlier x releases, traffic over VPN tunnel interfaces was exempt from NAT policies. Upgrading from one of these earlier releases to may require configuration changes if you are using VPN tunnel interfaces. 1

2 Supported platforms The release is supported on the following Dell SonicWALL network security appliances: SuperMassive 9600 SuperMassive 9400 SuperMassive 9200 NSA 6600 NSA 5600 NSA 4600 NSA 3600 New Features This section describes the new features in the release. Disable DPI Option for Firewall Access Rules Gateway Anti-Virus Detection Only Mode Shutdown Port Option Change Auditor Support in AppFlow Suffix Option for HA/Clustered Firewalls Control Plane Flood Protection Source/Destination IP Address Binding for Round Robin/Spillover Load Balancing Botnet Source Identification in AppFlow Monitor Disable Source Port Remapping option for NAT Enforce Google SafeSearch Firewall Sandwich support User Session Enhancements Disable DPI Option for Firewall Access Rules A new Disable DPI checkbox is provided on the Advanced tab when creating an access rule from the Firewall > Access Rules page. This allows the administrator to disable Deep Packet Inspection on a per-rule basis. Gateway Anti-Virus Detection Only Mode A new Enable detection-only mode checkbox is available under Gateway AV Settings. When selected, this option causes traffic containing viruses to be logged, but not blocked. 2

3 Shutdown Port Option A new Shutdown Port option is available in the Advanced tab when editing an interface on the Network > Interfaces page. You can select the Shutdown Port checkbox to temporarily take the interface offline for maintenance or other reasons. If connected, the link will go down. Clear the checkbox to activate the interface and allow the link to come back up. You cannot shut down the management interface or the interface you are currently using. You can also shut down an interface by clicking the green checkmark icon in the Enabled column for the interface in the Interface Settings table. A confirmation message displays, such as Do you wish to administratively shut down port X4? If you click OK, the checkmark icon turns to a red x icon (Disabled icon). To enable the interface, click the Disabled icon and click OK when the confirmation message displays. Change Auditor Support in AppFlow AppFlow now includes support for Dell Change Auditor for SonicWALL, the automated auditing module that allows you to collect data on Internet web site and cloud activity. For more information about using Change Auditor with SonicOS appliances, see the Change Auditor for SonicWALL User Guide, available at Suffix Option for HA/Clustered Firewalls A new Auto-Append HA/Clustering suffix to Firewall Name checkbox is provided on the System > Administration page under Firewall Name. When enabled, this option automatically appends an appropriate suffix to the firewall name in the Dashboard > Log Monitor: - Primary - Secondary - Primary Node <n> - Secondary Node <n> This option facilitates recognition of the primary/secondary firewalls in the log. Control Plane Flood Protection The Control Plane Flood Protection section of the Firewall Settings > Flood Protection page provides a new Enable Control Plane Flood Protection checkbox together with a Control Plane Flood Protection threshold (CPU %) field in which you can enter a percentage of CPU capacity (default 75%). When the Enable Control Plane Flood Protection option is enabled, if traffic on the Control Plane (Core 0) exceeds the threshold specified in Control Plane Flood Protection threshold (CPU %), the firewall forwards only control traffic destined to the firewall to the system Control Plane core. To give precedence to legitimate control traffic, excess data traffic is dropped. This restriction prevents too much data traffic from reaching the Control Plane core, which can cause slow system response and potential network connection drops. The percentage configured for control traffic is guaranteed. 3

4 Source/Destination IP Address Binding for Round Robin/Spillover Load Balancing When configuring a load balancing group from the Network > Failover & LB page, the Use source and destination IP address binding checkbox is now available for the Round Robin and Spillover load balancing types. In previous releases, this was only available when Type was set to Ratio. The option is especially useful when using HTTP/HTTPS redirection or in a similar situation. For example, connection A and connection B need to be on the same WAN interface, the source and destination IP addresses in Connection A are the same as those for connection B, but a different service is being used. In this case, source and destination IP address binding is required to keep both the connections on the same WAN interface so that the transactions do not fail. Botnet Source Identification in AppFlow Monitor A Botnet filtering option and Botnet reporting columns are added to the AppFlow Monitor and AppFlow Reports pages to allow the administrator to filter for botnet traffic and view the individual user or IP address and associated detected applications. In Dashboard > AppFlow Monitor (and AppFlow > AppFlow Monitor), Botnet can now be selected for the Group option on the Threats tab. In Dashboard > AppFlow Reports (and AppFlow > AppFlow Reports), new Botnet columns are added to the User and IP tabs. Disable Source Port Remapping option for NAT The new Disable Source Port Remap checkbox provides a way to disable source port remapping on selected NAT policies. When this option is selected, SonicOS preserves the source port of the connection while executing other NAT mapping. This option is available on the Advanced tab when adding a NAT policy if the source IP address is being translated. The checkbox cannot be selected if the Translated Source is set to Original. Enforce Google SafeSearch supports Google Safe Search using the latest functionality provided by Google. When the Enforce Google Safe Search option is enabled in the Security Services > Content Filter page, SonicOS will rewrite DNS responses for Google domains to the Google SafeSearch Virtual IP address. A new FQDN Address Object called forcesafesearch.google.com is automatically added to the SonicOS configuration and clients will always be forced to this site for Google Safe Browsing. NOTE: Dell SonicWALL recommends that users clear their browser cache and do a DNS flush before using this feature. Firewall Sandwich support Dell SonicWALL firewalls running are compatible with Dell Force 10 switches in a configuration known as a firewall sandwich. 4

5 User Session Enhancements provides new User Level Authentication (ULA) related CGI parameters for appliance management by Dell SonicWALL Global Management System (GMS). On the Enforcement tab of the Single Sign-On (SSO) configuration window, new bypass rules replace the old SSO bypass settings. New parameters for User Name Logging on the Users > Settings page under User Session Settings: Also, the Enforcement tab of the SSO configuration window includes a checkbox and user name field related to the For connections that bypass SSO row, above. New parameters for cleaning up user connections at logout in the Users > Settings page under User Session Settings: New parameters for SSO Agents in the SSO configuration dialog, SSO Agents tab, General Settings subtab: New parameters for user inactivity in the Users > Settings page under User Session Settings: 5

6 Resolved issues The following is a list of resolved issues in this release. Firewall Resolved issue The Clear Statistics button on the Firewall Settings > Flood Protection page does not clear the UDP or ICMP statistics, and there are no separate buttons to clear the UDP or ICMP statistics. Occurs when trying to clear the UDP or ICMP statistics from the Traffic Statistics panel list Networking Resolved issue The WAN (X1) interface in L2TP mode is disconnected from L2TP and the firewall must be restarted to recover. Occurs after enabling the L2TP server feature in the VPN > L2TP server page SSL VPN Resolved issue Adding a VNC bookmark does not work. Occurs when attempting to add the bookmark on the SSL VPN > Virtual Office page with settings for the IP address port number and desktop number User Interface Resolved issue The Mirror LDAP user groups locally checkbox label has an incorrect line break on the Users & Groups tab of the LDAP User Settings page. Occurs when configuring LDAP using Internet Explorer Users Resolved issue Adding a Terminal Services Agent displays Error: Host name/ip address. Occurs when the host name begins with a number. In a Terminal Services Agent environment, users are not logged out of the firewall automatically. Occurs when users log in to a Terminal Server using the Remote Desktop Protocol (RDP), and then log out via RDP

7 s The following is a list of known issues in this release. AppFlow A JavaScript error is shown in a popup with the heading, Errors on this webpage might cause it to work incorrectly, and no URLs can be displayed on the URLs tab of the AppFlow > AppFlow Monitor page in SonicOS. Occurs when the Enable AppFlow To Local Collector option is fully enabled for AppFlow > Flow Reporting, users have accessed web pages from the LAN, and Internet Explorer 9 is used to view the AppFlow > AppFlow Monitor page in SonicOS Application Control The Ultrasurf browser plugin is not blocked by an App Rule or App Control Advanced. Occurs when using the Chrome browser plugin for Ultrasurf. App Control does not block access to Google Play app store from a smartphone app, but play.google.com is blocked from a browser on a personal computer. Occurs when DPI-SSL is not enabled and an App Rule is configured on the firewall to block the Google Play application and signatures, then an Android smartphone connects to the firewall via a wireless access point and can download or update apps from the Google Play store. The Firewall Settings > BWM link in an App Rule does not display the correct page. Occurs when configuring a new policy in the App Rules page and clicking the Firewall Settings > BWM link Log Intrusions are not reported in the external collector and Scrutinizer shows that no report is generated. Occurs when Client DPI-SSL and IPS are enabled, and the Send Flows and Real-Time Data To External Collector option is selected and the External Flow Reporting Format is set to IPFIX with extensions, under the External Collector Settings tab on the AppFlow > Flow Reporting page

8 Networking BGP routes are still shown in the Network Routing table after the BGP neighbor is down. Occurs when BGP routes are established and listed in the Network > Routing page, but after SonicOS shows that the BGP router is no longer available, the page still displays the BGP routes until the firewall is restarted. OSPF routes are still shown in the Network Routing table after the OSPF router is down. Occurs when OSPF routes are established and listed in the Network > Routing page, but after SonicOS shows that the OSPF router is no longer available, the page still displays the OSPF routes until the firewall is restarted. A final backup interface and non-default WAN group interfaces are left without an IP address and appear to be unassigned after rebooting the firewall. Occurs when multiple WAN interfaces are configured using DHCP mode. All receive IP addresses initially, but those that are configured either as the final backup interface or are part of a WAN load balancing group, but not designated as the Selected interface, do not receive renewed DHCP IP addresses after the firewall restarts. All mirrored packets received on a WAN zone interface in Tap mode are dropped with a message including, "bounce same link pkt", preventing deep packet inspection (DPI) on the traffic to that interface. Attack traffic is not detected and logged. Occurs when an interface is configured in the WAN zone using Tap mode, Intrusion Prevention is enabled to detect Low Priority Attacks and then pings and low priority attack traffic are sent to the interface. Bandwidth management on link aggregated interfaces does not provide the total aggregated bandwidth. Occurs when multiple interfaces are configured for link aggregation (as a LAG), and then bandwidth management values are configured on the Advanced tab of the Edit Interface dialog. The maximum bandwidth limitation is equal to the bandwidth of a single interface, 1 Gbps. Cannot ping a client device on the WAN from a client connected to the LAN, and the firewall must be restarted to recover. Occurs when the LAN (X0) interface has no link when it is configured in Wire Mode and paired with the WAN (X1) interface, and then the link is restored. Link state propagation does not work with Wire Mode over link aggregation (LAG). Occurs when High Availability is enabled, a LAN interface is set to Wire Mode (Inspect Mode) and paired with a second LAN interface for link propagation. A third interface is aggregated with the first interface, and then a fourth interface is aggregated with the second interface. When the first interface loses connectivity to the external switch, the link status is not propagated to the second interface which unexpectedly remains up Security Services Anti-Spyware is still active after it is disabled on a zone, and spyware continues to be blocked. Occurs when Anti-Spyware has been enabled globally on the Security Services > Anti-Spyware page and then is disabled for a zone by clearing the Enable Anti- Spyware Service checkbox when editing a zone from the Network > Zones page

9 SSL VPN A Java error message is displayed, 'Sorry, Could not connect: java.security.accesscontrolexception: access denied.... Occurs when accessing an SSHv1 bookmark and logging into the SSL VPN portal using Firefox from a Linux computer with Java version JRE1.8.0_ System The firewall does not block the connection and log the event. It only logs the event. Occurs when the Block the connection and log the event option is selected on the Firewall Settings > SSL Control page, and the Stateful Firewall Security button is clicked on the System > Settings page, and the firewall is rebooted. On the Firewall Settings > Advanced Page, in the Connections panel, DPI Connections is selected instead of Maximum DPI Connections as expected. Occurs when the DPI and Stateful Firewall Security" button is clicked on the System > Settings page, in the One-Touch Configuration Overrides panel, and the firewall is rebooted. On the Firewall > Access Rules page, under the Advanced tab of the Edit Rule dialog, the Enable connection limit for each Source IP Address option is not set as expected. It should be selected and set to 128 as specified in item 18 of the DPI and Stateful Firewall Security" settings list on System > Settings. Occurs when the DPI and Stateful Firewall Security" button is clicked on the System > Settings page, in the One-Touch Configuration Overrides panel, and the firewall is rebooted. A Java Script error is displayed. Occurs when renewing or activating a license with the manual upgrade key, then clicking the Submit button on the System > Licenses page VPN A VPN policy cannot be created and SonicOS reports the error, Peer ID value is not valid for Peer ID Type. Occurs when the Authentication Method is configured as IKE using 3 rd Party Certificates and the Local IKE ID Type and Peer IKE ID Type are set to Distinguished name (DN)

10 System compatibility This section provides additional information about hardware and software compatibility with this release. Dell SonicWALL WXA support The Dell SonicWALL WXA series appliances (WXA 6000 Software, WXA 500 Live CD, WXA 5000 Virtual Appliance, WXA 2000/4000 Appliances) are supported for use with Dell SonicWALL NSA appliances running The recommended WXA firmware version is WXA Browser support SonicOS uses advanced browser technologies such as HTML5, which are supported in most recent browsers. Dell SonicWALL recommends using the latest Chrome, Firefox, Internet Explorer, or Safari browsers for administration of SonicOS. This release supports the following Web browsers: Chrome 18.0 and higher (recommended browser for dashboard real-time graphics display) Firefox 16.0 and higher Internet Explorer 8.0 and higher (do not use compatibility mode) Safari 5.0 and highermobile device browsers are not recommended for Dell SonicWALL appliance system administration. NOTE: On Windows machines, Safari is not supported for SonicOS management. NOTE: Mobile device browsers are not recommended for Dell SonicWALL appliance system administration. Product licensing Dell SonicWALL network security appliances must be registered on MySonicWALL to enable full functionality and the benefits of Dell SonicWALL security services, firmware updates, and technical support. Log in or register for a MySonicWALL account at Upgrading information For information about obtaining the latest firmware, upgrading the firmware image on your Dell SonicWALL appliance, and importing configuration settings from another appliance, see the SonicOS 6.1 Upgrade Guide available on MySonicWALL at or on the Support portal at 10

11 Technical support resources Technical support is available to customers who have purchased Dell software with a valid maintenance contract and to customers who have trial versions. The Support Portal provides self-help tools you can use to solve problems quickly and independently, 24 hours a day, 365 days a year. In addition, the portal provides direct access to product support engineers through an online Service Request system. To access the Support Portal, go to The site enables you to: View Knowledge Base articles at: View instructional videos at: Engage in community discussions Chat with a support engineer Create, update, and manage Service Requests (cases) Obtain product notifications SonicOS Administration Guides and related documents are available on the Dell Software Support site at About Dell Dell listens to customers and delivers worldwide innovative technology, business solutions and services they trust and value. For more information, visit Contacting Dell Technical support: Online support Product questions and sales: (800) info@software.dell.com 11

12 2015 Dell Inc. ALL RIGHTS RESERVED. This guide contains proprietary information protected by copyright. The software described in this guide is furnished under a software license or nondisclosure agreement. This software may be used or copied only in accordance with the terms of the applicable agreement. No part of this guide may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying and recording for any purpose other than the purchaser s personal use without the written permission of Dell Inc. The information in this document is provided in connection with Dell products. No license, express or implied, by estoppel or otherwise, to any intellectual property right is granted by this document or in connection with the sale of Dell products. EXCEPT AS SET FORTH IN THE TERMS AND CONDITIONS AS SPECIFIED IN THE LICENSE AGREEMENT FOR THIS PRODUCT, DELL ASSUMES NO LIABILITY WHATSOEVER AND DISCLAIMS ANY EXPRESS, IMPLIED OR STATUTORY WARRANTY RELATING TO ITS PRODUCTS INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT. IN NO EVENT SHALL DELL BE LIABLE FOR ANY DIRECT, INDIRECT, CONSEQUENTIAL, PUNITIVE, SPECIAL OR INCIDENTAL DAMAGES (INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF PROFITS, BUSINESS INTERRUPTION OR LOSS OF INFORMATION) ARISING OUT OF THE USE OR INABILITY TO USE THIS DOCUMENT, EVEN IF DELL HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. Dell makes no representations or warranties with respect to the accuracy or completeness of the contents of this document and reserves the right to make changes to specifications and product descriptions at any time without notice. Dell does not make any commitment to update the information contained in this document. If you have any questions regarding your potential use of this material, contact: Dell Inc. Attn: LEGAL Dept 5 Polaris Way Aliso Viejo, CA Refer to our web site (software.dell.com) for regional and international office information. Patents For more information about applicable patents, refer to Trademarks Dell, the Dell logo, and SonicWALL are trademarks of Dell Inc. Other trademarks and trade names may be used in this document to refer to either the entities claiming the marks and names or their products. Dell disclaims any proprietary interest in the marks and names of others. Legend CAUTION: A CAUTION icon indicates potential damage to hardware or loss of data if instructions are not followed. WARNING: A WARNING icon indicates a potential for property damage, personal injury, or death. IMPORTANT NOTE, NOTE, TIP, MOBILE, or VIDEO: An information icon indicates supporting information. Last updated: 9/11/ Rev A 12