SUPERSTACK 3 FIREWALL FIRMWARE VERSION RELEASE NOTES

Transcription

1 SUPERSTACK 3 FIREWALL FIRMWARE VERSION RELEASE NOTES Please use these notes in conjunction with the following documents: SuperStack 3 Firewall User Guide Part number: DUA1611-0AAA02 SuperStack 3 Firewall Quick Reference Guide Part number: DQA1611-0AAA01 Software License Agreements Before you use the firmware on the SuperStack 3 Firewall, please ensure that you read the license agreement text. This text is supplied in the file license.txt on the CD-ROM. Upgrading the Firmware to Version If you are upgrading from a previous release of firmware, please note that you cannot import the configuration from firmware version of the SuperStack 3 Firewall. Take a note of the current configuration before upgrading. To upgrade the firmware to version 6.0.2, do the following: 1 Access the Management Interface as described in the User Guide. 2 Click Tools and then select the Upgrade tab. 3 Click Upload Firmware Now. 4 Click Yes if you have saved the settings. 5 Click Browse... and select the software file you have downloaded from the 3Com ftp site to a local hard drive or server on the LAN. 6 Click Upload to begin the upload. Make sure that your Web browser supports HTTP uploads. 7 When uploading the firmware to a SuperStack 3 Firewall, it is important not to interrupt the Web browser by closing the window, clicking a link, loading a new page, or removing the power to the Firewall. If the Firewall is interrupted this way, it may result in the Firewall not responding to attempts to log in. 8 Restart the SuperStack 3 Firewall for the changes to take effect. Part No. DNA1611-0AAA01 Published August 2001

2 2 SUPERSTACK 3 FIREWALL FIRMWARE VERSION RELEASE NOTES After Upgrading to Version After upgrading to version of the firmware, 3Com recommends that you configure the unit as follows: Note: This procedure must be performed from a machine on the Firewall s LAN. 1 Reset admin password to "password". Click the general label and then the Set Password tab to set the password. Resetting the password allows you to use the new install wizard for initial configuration. 2 Restore factory default settings. Click the Tools label, the Configuration tab and then the Restore button. 3 Restart the unit. 4 The unit will display the Firewall Installation Wizard. Perform initial configuration. 5 After the unit has restarted, enter any additional configuration using the Web interface. Failure to follow this procedure may result in an invalid configuration. New Features in This Release Version provides support for the following: SuperStack 3 Firewall (3CR ). SuperStack 3 Firewall (3CR ) SuperStack 3 Firewall Web Site Filter (3C16111) This section lists new features and enhancements between firmware version and firmware version A new Installation Wizard can be used to set up the Firewall quickly. A Group VPN feature for simplified VPN client deployment has been added. A new VPN Routing feature allows easy setup of secure traffic in a "hub and spoke" configuration between remote offices. A new High Availability feature eliminates network downtime by enabling the use of a backup Firewall for failover. It is now possible to perform one touch VPN client configuration file creation using the GroupVPN export function. The Firewall is shipped with 56-bit encryption for wider distribution; this can be web-upgraded to 168-bit. Changing VPN security associations no longer requires a restart. Enhanced logging of VPN IKE negotiations is now available. TFTP LAN clients behind the Firewall are now supported. Netscape 6.0 can now be used to access the Web interface. To provide compatibility with more ISPs, the PPPoE user name and password can contain up to 63 characters. IMAP, NetBIOS, and PC Anywhere have been added as known services.

3 Known Problems with this Release 3 A new logging category - Denied LAN IP - has been added to the Log Settings page. When enabled, all access attempts to the Firewall LAN IP address which are not allowed by the firewall configuration are logged. A log message for fragmented packets dropped has been added. TCP FIN, XMAS and NULL scans are now logged. A new menu selection allows users to select either WebTrends or Default formats on the Log Settings page. The default Syslog data now contains port information in addition to standard WebTrends formatted data. Services can now be defined using ranges of ports. Multiple subnets can now be accessed through VPN tunnels. Individual rules can now be edited and disabled. Rules can also be enforced by time of day. A restart is no longer required after adding, deleting or changing rules. Fragmented IPSEC and PPTP packets can now pass through the Firewall. WINS server addresses can now be assigned to LAN clients by the Firewall DHCP Server. Hyperlinks displayed in the log now provide definitions of attacks. A PPPoE inactivity time-out has been added. The date can now be displayed in an International format (DD/MM/YYYY). The Syslog Individual Event Rate feature enables control over the time period between similar events being reported to the Syslog. Napster is now a pre-defined service. The current status of DHCP leases are now shown on the DHCP/Status page. Known Problems with this Release VPN Operation You may need to reconfigure VPN clients to use the new GroupVPN feature. The GroupVPN security association must be used for multiple VPN clients. When configuring a VPN security association, the encryption method must be specified. The AH-MD5 encryption method does not function correctly when interoperating with version of SuperStack 3 Firewall or version of OfficeConnect Firewall. Note the following if you have configured the Firewall to be a PPPoE client and wish to establish a VPN tunnel through the firewall using PPTP protocol. When using Microsoft Dial up Networking V1.3 on Windows 95/98, the client PC must have the IP packet size set to medium in Dial up Networking. Windows 2000 is not affected as it automatically adjusts the packet size.

4 4 SUPERSTACK 3 FIREWALL FIRMWARE VERSION RELEASE NOTES NETBIOS Pass Through Facility The NETBIOS pass through facility does not function correctly, so it is not possible to find computers on the DMZ port from the LAN using Network Neighborhood or Find Computer. Policy Creation If you create a policy that allows traffic into specific IP addresses on the LAN, the Firewall should show a "!" in the Network Policy Rules screen to indicate a potential security hole. The Firewall does not display the "!". Using Microsoft Exchange Server For users of Microsoft Exchange Server, 3Com recommends that Exchange Server is deployed on the LAN and not the DMZ. Bugs Fixed in this Release This section lists the major bug fixes between firmware version and firmware version A bug that caused VPN problems when 100 SA's were entered has been fixed. An interoperability issue with the Lucent Brick has been addressed. In rare instances, flash corruption occurred and caused the unit to resort to factory default settings. This bug has been fixed. A bug which caused cache full errors was fixed. TFTP traffic now passes correctly from the WAN to the LAN. A bug that caused VPN tunnels using IKE to remain disabled until the Firewall was restarted has been fixed. A bug that caused the re-negotiate button to intermittently stop functioning until the Firewall was restarted has been fixed. A bug which caused a delay in loading the management login screen when using Microsoft Internet Explorer was resolved. To avoid this delay, check the new "Manage using IE" box on the Access/Management page. H.323/NetMeeting support has been enhanced to allow full audio and video between a SuperStack 3 and non-superstack 3 endpoint. Multicast packets are no longer cached. A bug which caused automatically created rules to be lost upon a restore to factory defaults has been fixed. A bug which caused IP Spoof alerts to be generated when using NetBIOS between the LAN and the DMZ has been fixed. A bug which caused PPPoE sessions to be disconnected has been fixed. A bug which caused the DHCP server to assign invalid leases to LAN users has been fixed. Problems which caused fragmented PPTP and IPSec packets to break the VPN tunnel have been resolved. A bug which prevented Stealth mode from working in standard mode has been fixed.

5 Documentation Errors and Omissions 5 The format for s sent by Firewall has been modified to comply with RFC 822. Documentation Errors and Omissions This section should be used in conjunction with the SuperStack 3 Firewall User Guide (part number DUA1611-0AAA02). Chapter 9 - The section Configuring the IRE VPN Client is incomplete. After importing the security policy, the following steps are required: 1 Click the + sign next to Group VPN to reveal two sections. 2 Select My Identity to view the settings. 3 Click Pre-Shared Key to enter the Pre-Shared Secret. Click OK. 4 In the Internet Interface box, select the adapter used to access the Internet. Select PPP Adapter in the Name menu if you have a dial-up Internet account. Select your Ethernet adapter if you have a dedicated Cable, ISDN, or DSL line. 5 Click File, then Save Changes to save the settings to the security policy. The MAC Address of the Firewall is printed on its base. Do not include dashes or spaces when entering the MAC Address. 3Com Network Supervisor The CD-ROM contains 3Com Network Supervisor. 3Com Network Supervisor provides powerful yet easy-to-use network management. Focused on the needs of small to medium enterprises, it enables you to manage your network more efficiently. To download the latest 3Com Network Supervisor and Service Pack please visit: 3Com World Wide Web Site Access the latest information on the 3Com Corporation World Wide Web site by entering the following URL into your Web browser: Chapter 10 - Configuring High Availability This chapter states that serial numbers are used for configuring High Availability. This is incorrect - MAC Addresses are used. Where "serial number" is stated in the instructions, use "MAC Address" instead.

6 6 SUPERSTACK 3 FIREWALL FIRMWARE VERSION RELEASE NOTES Copyright 2001, 3Com Technologies. All rights reserved. Unless otherwise indicated, 3Com registered trademarks are registered in the United States and may or may not be registered in other countries. 3Com and SuperStack are registered trademarks of 3Com Corporation. The 3Com logo and CoreBuilder are trademarks of 3Com Corporation. Windows is a registered trademark of Microsoft Corporation. Other brand and product names may be registered trademarks or trademarks of their respective holders.