HP ProCurve MSM313, MSM323 / MSC-3200, MSC Release Notes

Transcription

1 HP ProCurve MSM313, MSM323 / MSC-3200, MSC Release Notes Introduction These Release Notes apply to the HP ProCurve Integrated Services Access Points as follows: MSM313 / MSC-3200, MSM313-R / MSC-3200R, MSM323 / MSC-3300, MSM323-R / MSC-3300R. Note: There was no Release for this product. HP ProCurve Product Naming Release Release Release Release Release Copyright 2009 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice.

2 5.2.6 Release Notes: HP ProCurve MSM313, MSM323 / MSC-3200, MSC HP ProCurve Product Naming As of October 1st, 2008, Colubris Networks has been acquired by HP ProCurve. HP ProCurve has integrated the Colubris product line into its ProCurve Networking product portfolio ( Colubris product names have been changed to their equivalent HP ProCurve product names. In this release, the management tool user interface and online help use the new HP ProCurve product names. Some of the documentation continues to use the Colubris product names. Note: SOAP and SNMP MIBs retain the Colubris naming so you do not need to change your existing SOAP and MIB usage. The Colubris Networks product names and their corresponding new HP ProCurve product names are as follows: Colubris name MSC-5100 MultiService Controller MSC-5200 MultiService Controller MSC-5500 MultiService Controller MSC-3200 MultiService Controller MSC-3200R MultiService Controller MSC-3300 MultiService Controller MSC-3300R MultiService Controller MAP-320 MultiService Access Point MAP-320R MultiService Access Point MAP-330 MultiService Access Point MAP-330R MultiService Access Point MAP-330 AP+Sensor MultiService Access Point MAP-625 MultiService Access Point MAP-630 AP+Sensor MultiService Access Point WCB-200 Wireless Client Bridge Visitor Management Tool RF Manager 1500 Enterprise RF Manager 1300 Basic RF Planner HP ProCurve name MSM710 Controller MSM730 Controller MSM750 Controller MSM313 Access Point MSM313-R Access Point MSM323 Access Point MSM323-R Access Point MSM310 Access Point MSM310-R Access Point MSM320 Access Point MSM320-R Access Point MSM325 Access Point MSM422 Access Point MSM335 Access Point M111 Client Bridge Guest Management Software RF Manager 100 S/IPS system RF Manager 50 S/IPS system RF Planner

3 5.2.6 Release Notes: HP ProCurve MSM313, MSM323 / MSC-3200, MSC Release Contents General information Known issues General information Terminology The following terminology is used in these Release Notes and other 5.2.x documentation as follows: Term AP Service controller The term access point is generally abbreviated as AP. Refers to the HP ProCurve MSM313 and MSM323 integrated services access points / MSC-3000 series controllers. Specific references to MSM313 / MSC-3200 also apply to the MSM313-R / MSC-3200R. Specific references to MSM323 / MSC-3300 also apply to MSM323-R / MSC-3300R. Updating to software Update the service controller to as described in the Firmware updates section of the MSC-3000 Series Admin Guide. Note: All pre devices updated to or higher will use the new HP ProCurve product names in the management tool as identified in HP ProCurve Product Naming on page 2. Regulatory update REGULATORY NOTICE for European Union HP ProCurve MSM Controllers and MSM Access Points purchased after April 1, 2009 are subject to new ETSI radar interference requirements that limit the available channels in the 5 GHz band. The software version that is loaded on your device is compliant with these new requirements. The 5 GHz channels 120, 124, and 128 are excluded to prevent illegal operation in the 5600 to 5650 MHz band. Other regulatory information As of 5.2.6, the a Turbo mode (local mesh) is certified for use in the following countries: Argentina Australia Azerbaijan Belgium Belize Bolivia Brazil Brunei Canada China Colombia Costa Rica Cyprus Czech Republic Denmark Dominican Republic Egypt Estonia Finland France Georgia Germany Greece Guatemala Hong Kong Hungary Iceland India Iran Ireland Italy Liechtenstein Lithuania Luxembourg Macau Malaysia Mexico Monaco Netherlands New Zealand Norway Panama Philippines Poland Portugal Puerto Rico Singapore Slovakia Slovenia Sweden Switzerland Taiwan Turkey United Kingdom United States Venezuela

4 5.2.6 Release Notes: HP ProCurve MSM313, MSM323 / MSC-3200, MSC Documentation You can download documentation from the HP ProCurve Networking manuals Web page at: Known issues The following known issues are present in this release: 3944 The RIP2 MIB does not work in this release If accounting support is enabled on the Public Access > Access Control page after the service controller has authenticated itself to the RADIUS server, accounting is not started. To enable accounting, restart the service controller VLAN attributes returned by a RADIUS server are dropped when MAC authentication is enabled on a VSC The Security Filters default gateway option cannot be used when the service controller is configured as a PPPoE client x user cannot re-authenticate in the event the RADIUS accounting STOP message is not acknowledged by the RADIUS server On the Public Access > Access Control page, the Allow any IP address option is not supported when NAT is disabled on the Internet port Source NAT (Allow any IP address and to use Dynamic IP) does not work with the option to support clients using an HTTP proxy An 802.1x user logging out via the session page may not get redirected to the Goodbye page The Wireless > Neighborhood feature alters the beacon timestamps when it is executed. This can cause some wireless devices to lose connectivity and re-associate. The workaround is to turn off neighborhood scanning If the management IP address is defined to be on the same subnet as the LAN port, changing the LAN port addressing method may cause the management IP address to be lost. The management IP address is defined on the Network > Ports > LAN port page In certain cases, the APs may not appear in in the Satellite list. This occurs when the AP can only communicate with the service controller through a VLAN interface VLANs over local mesh are not supported The Firmware Distribution feature is not functional (Applies only to the MSM323 / MSC-3300.) Do not attempt to change the radio 1 channel and the radio 2 channel at the same time (error message "The same frequency exists on other radios" will appear). Instead, change the radio 2 channel first and Save. Then change the radio 1 channel and Save.

5 5.2.6 Release Notes: HP ProCurve MSM313, MSM323 / MSC-3200, MSC If you add or delete a static route or if you change the IP address of the LAN port, the RIP protocol will not announce the new routes until after the next restart Traffic on the management LAN is blocked. After a reboot, the management LAN is reachable When MAC address filters are set to Allow for an access-controlled VSC, the clients that match a MAC address in the list are not able to associate with the SS and login to access the network Static NAT mappings do not apply to VPN connections or VLANs on the Internet port.

6 5.2.6 Release Notes: HP ProCurve MSM313, MSM323 / MSC-3200, MSC Release Fixes The following issues have been fixed since the previous release: Password fields in the management tool are not protected against the auto-complete feature in web browsers, causing existing passwords to be overwritten with incorrect values The 802.1x supplicant time-out value fails to be applied to EAP Request Identity packets The CLI command mac authenticate radius profile <radiusprofile> is missing On APs operating in b/g mode, if the Allowed Wireless Rates options are modified for a VSC, all supported wireless rates will be advertised as BSS Basic, which can cause problems for b-only clients attempting to connect Setting up a firewall with an Accept rule followed by a Drop All rule drops all traffic, instead of preserving the data matched by the Accept rule The CLI command access control which disables access control on a VSC, does not work The CLI command to turn off the wireless security filters option for a VSC is missing on the service controller.

7 5.2.6 Release Notes: HP ProCurve MSM313, MSM323 / MSC-3200, MSC Release Fixes The following issues have been fixed since the previous release: The SOAP process crashes when calling GetSatelliteListStatus When using PPPoE and adding TCP NAT mappings on the service controller to reach a TCP server on the LAN side of the controller, the connection to the TCP server does not work due to large packets being dropped It is not possible to manage an AP on the management subnet through NAT mapping (Applies only to VPNs configured with PPTP client.) The auto-route discovery option is not working in this release The User Tracking feature does not output any logging packets When NAT is enabled on the Internet port (Network > Ports > Internet port) it is also possible to enable Allow any IP address > to use Dynamic IP on page Public access > Access control. The two options should be mutually exclusive It is not possible to configure Redirect-URL with local attributes because the choice is missing VPN connections fail when one-to-one NAT is enabled and no alternative IP address is defined The NAS is not displayed when using the %n placeholder with the Login-url= RADIUS attribute The MTU configuration of the Internet port is not properly adjusted when the path is lower than The Location-aware placeholder %G does not get assigned the Groupname value for wired users The CLI command no ingress interface wireless <name> does not work In the management tool, some address lists (NOC and others) are not wide enough to display the full IP address and Mask If the real user name is returned in the RADIUS Access Accept via the User name RADIUS attribute, we now use this user name in the RADIUS accounting frames (start/stop/interim) instead of the anonymous name Users cannot establish a PPTP connection through the service controller using the Microsoft PPTP VPN client The CLI command public forwarding is missing.

8 5.2.6 Release Notes: HP ProCurve MSM313, MSM323 / MSC-3200, MSC The following invalid error message is seen in the log when a DNS packet that is larger than 512 bytes is received by the service controller: assert: masquerade.c HandleMasqueradeTimeoutEvent 384 (MAX_DNS_PACKET_SIZE >= (masqueradeentry->mpacketlength + sizeof(struct CompressedResourceRecord)+ sizeof(in_addr)))

9 5.2.6 Release Notes: HP ProCurve MSM313, MSM323 / MSC-3200, MSC Release Fixes The following issues have been fixed since the previous release: When a VSC uses the Rate Limit feature and a user leaves the network before terminating their authentication, some rules are left in the access controller blocking the user from logging in again The same association could be used by two clients simultaneously, if one of them had been previously de-authenticated due to encryption errors. This could cause problems with the power saving mechanism and reporting discrepancies in the SNMP MIBS When DHCP is turned off on the service controller, the service controller is unable to route DHCP traffic, even if access lists are configured to permit this Traffic coming in on either an IPSec tunnel, or directly on the Internet port if NAT is turned off, is not allowed to reach the management subnet on the LAN port Initiating a TCP/UDP connection from the Internet port toward a station on the LAN side would fail The IGMP proxy feature, for multicast routing, is not working The DNAT polling url only supports port 80 and the polling does not work or go through the DNAT server polling when set to a different port An XML deserialization problem causes an interoperability problem with Microsoft.NET 2.0, and possibly all other versions of.net The service controller will never scan channels not available in the US, such as channels 12 and 13 (802.11b) or channels (802.11a). When using autochannel, these channels will therefore always be selection candidates regardless of their current usage. When using local mesh, a slave will never find a master using one of these channels Interim updates are not sent for access-list entries with accounting support Encrypted (TKIP only) static local mesh links are not always re-established correctly If you want to use an external DHCP server on the LAN side of the service controller, you must set the Address Allocation to None and define an access list to allow the traffic to be bridged from the wireless port to the LAN port With a dynamic local mesh link, performance would be low and the link could be lost in less-than-perfect RF conditions When the AP radio was set to local mesh it would continue scanning in the background on a regular basis, causing lost frames.

10 5.2.6 Release Notes: HP ProCurve MSM313, MSM323 / MSC-3200, MSC Using the web-management tool, it is not possible to replace the X.509 certificate with another certificate that has the same certificate subject or name (DN) IPSec interfaces were not available in the Network Trace tool A local mesh slave node may stop trying to connect to a master node if it had been previously refused Support for the Network EAP authentication method, allows Cisco client bridges to connect with WPA2 EAP-TLS Many consecutive 802.1X RADIUS requests from one user can cause RADIUS requests from other users to be ignored The RADIUS proxy can stop accepting RADIUS Authentication or Accounting requests after a large number of such requests go unanswered by the RADIUS server In access lists, a wildcard character can be used in front of a domain name, for example, * When this syntax is used, the access list will match the resolved IP address dynamically, instead of refreshing it upon every site authentication cycle If the default certificate was replaced by one signed by an intermediate certificate authority (CA), some browsers would complain that the site was not trusted when opening the login page In some rare cases, after login, a user could see a web page indicating "Attribute not found." The group name in the %G placeholder was truncated to 16 characters. The group name can now contain up to 64 characters Even though an AP could be configured to accept 255 associations, the maximum number of associated clients could only be 252. APs now accepts a maximum of 255 associations across all VSCs The HTML NOC Logout function sometimes fails with error: err webauth Cannot get peer certificate- denying access The default NTP time servers have been changed to 0.colubris.pool.ntp.org and 1.colubris.pool.ntp.org.

11 5.2.6 Release Notes: HP ProCurve MSM313, MSM323 / MSC-3200, MSC Release Contents New features and enhancements Fixes New features and enhancements Version contains new features and enhancements as described here: Access lists processing has been enhanced allowing for more rules to exist without compromising performance The Network trace interface has been improved to run more than one capture in parallel, on different ports The DHCP server is now configurable on a per-vsc basis, making it possible to serve different DHCP ranges or subnets for each VSC Local mesh profiles can now be added and removed. New CLI commands are introduced to support this, along with an updated interface in the management tool It is now possible to configure a different RADIUS server for authentication and for accounting, when using 802.1X or MAC based authentication ACCEPT rules have been added to the firewall. When a packet is accepted by the firewall, it must go through the access controller rules, if applicable A new option enables automatic logout of users upon receiving a DHCP Discover request. This is applicable only to HTML-based authentication. One possible use for this feature is to automatically logout a remote terminal or thin client user when the terminal session is closed. By default, this parameter is disabled. To enable it, select Network > Address allocation > DHCP server > Settings The public access interface Login page can now optionally be presented via HTTP instead of HTTPS, avoiding the client browser warning when using the default product certificate. For security purposes, HTTPS remains the default setting. To configure this option, select Public access > Access control > Service controller The NOC authentication mechanism has been enhanced to allow simultaneous use of HTML authentication and NOC authentication, provided that the [USER-SPACE].HMTL.noc-client-validation configuration setting is set to DISABLED Two new options have been added to the Network > DNS page: Logout host name and Logout IP address. These two options enable easy logout from the public access network. Users can logout by pointing their browsers to a host name or IP address. If a user that is logged in via HTML sends an HTTP request to the specified host name or IP address, the service controller will log the user out.

12 5.2.6 Release Notes: HP ProCurve MSM313, MSM323 / MSC-3200, MSC The access list DNAT feature has been enhanced to optionally allow all traffic to bypass the DNAT rule if the DNAT server is down, or to switch to an optional secondary DNAT server if the case the primary is down. This allows for building redundancy in the DNAT (proxy) service, with a failover mechanism or a bypass in case of a problem with the DNAT server(s) Additional authentication types have been added to the SOAP/XML interface. In addition to HTTPS X.509 certificate authentication, it is now possible to use HTTP authentication, with or without SSL The NOC HTTP API is now available under SOAP/XML as well The SMTP proxy has been enhanced to proceed without authentication with the SMTP server if it doesn't answer as expected to the initial EHLO request In an access controlled VSC, it is now possible to configure an egress VLAN on the LAN port. Such an egress used to be limited to the Internet port only Added a User Tracking feature, which allows for logging user activity, such as user name, real and public (NAT) IP addresses, MAC address, protocol. This information is sent in real time to an outside syslog server. n/a WMM PS (Wi-Fi Multimedia Power Save) support has been added. Wi-Fi-Power Save description from the Wi-Fi Alliance: Wi-Fi mobile devices require advanced power-save mechanisms to offer a rich user experience for voice, audio, and video applications. WMM (Wi-Fi Multimedia) Power Save extends the battery life of Wi-Fi devices by increasing the efficiency and flexibility of data transmission. It is an addition to WMM, the technology that enables Quality of Service (QoS) functionality in Wi-Fi networks by prioritizing traffic from different applications. WMM Power Save has been optimized for mobile devices running latency-sensitive applications such as voice, audio, or video, but can benefit any Wi-Fi device. WMM Power Save uses mechanisms included in the IEEE) e amendment and is an enhancement of IEEE legacy power save, which was designed for data applications. With WMM Power Save, the same amount of data can be transmitted in a shorter time and using fewer frames, while allowing the Wi-Fi device to remain longer in a low-power, dozing state. For additional information, see:

13 5.2.6 Release Notes: HP ProCurve MSM313, MSM323 / MSC-3200, MSC Fixes The following issues have been fixed since the previous release: 6212 With IPSec security, the Phase 1 IKE SA is deleted too quickly when the peer initiates a negotiation for a new IKE SA, confusing certain IPSec gateways, which then keep more than one tunnel (SAs) active between the peers When DHCP relay is configured on a VSC, wired users who are not assigned to a VLAN use the global DHCP relay setting and not the VSC settings. However, these users are assigned the circuit, remote, and subnet options configured in the VSC To obtain the best wireless performance (such as for voice applications) wireless neighborhood scanning should be kept disabled (the default) On the pages Status > Client stations and Status > AC authentications, the number of users in the list and the stated number of users did not match Switching between html and 802.1x failed with some third-party APs The RADIUS called-station-id attribute was still set to the LAN port MAC address, even if the configuration file token [ACCESS-CONTROLLER]/radius-called- station-id-port was set to Internet Customer Data Rate (receive) is not enforced when all authentication methods (including HTML) are is turned off in a VSC When the new Auto-Refresh feature is enabled, administrators are no longer automatically logged out when their session is idle for more than 10 minutes. They remain connected indefinitely Firmware distribution feature waited indefinitely for the license agreement to be accepted on the APs. Now, firmware distribution can be used without having to accept the license agreement on the APs Autochannel runs at 12-hour intervals even if the interval is disabled (Applies only to local mesh.) The security settings are not refreshed when a new radio is selected When the DNS relay feature is enabled, client stations that are running Windows Vista may cause the service controller to become inoperative Values for Signal, Noise, and SNR are not shown in the tables on the Wireless > Overview and Wireless > Neighborhood pages Two IP addresses are reserved for wireless client stations, instead of one, when the service controller is configured as follows: Public access > Access control page: "Allow any IP address" and "to use Dynamic IP" options are enabled. Network > Address allocation > DHCP relay page "Allow per VSC" is enabled When a client station uses 802.1x or MAC authentication, its browser must not be configured with an HTTP proxy. The HTTP proxy feature of the service controller works only for client stations authenticating using the HTML login page.

14 5.2.6 Release Notes: HP ProCurve MSM313, MSM323 / MSC-3200, MSC When the Internet port IP address is changed and NAT is enabled, current UDP and TCP connections still use the old IP address Access control: The wispr-logoff-url was not being taken into account when specified in the local site configuration If a device is configured with REDIRECT/DNAT/WARN rules and use-access-list is in the site profile, an HTTP proxy user is not be able to access the affected sites properly Some wireless users that stay idle for more than 5 minutes experience a long response delay on their subsequent communication MAC address authentication, using the access control attribute mac- address, would not always work when traffic would come in through a VLAN that is part of a predefined VLAN range User performance degrades when rate limit is turned on When using rate limit, the service controller may store and retrieve IP addresses inefficiently with certain customer IP address distributions In the HTTP proxy, when both the client & the server are set to keep- alive, the connection will fail if a "100 Continue" reply is being used An error occurs when clearing the "Retrieved attributes override configured attributes" option When GRE routes are defined, the management tool crashes when attempting to navigate to the IP routes page It is not possible to start a trace on a VLAN interface built over a local mesh link With a large number of users, performance issues related to login time and throughput could occur. With the fix, the improvement is most apparent when the rate limit and bandwidth control options are enabled Proxied SMTP does not count the bytes uploaded against the users APs can lose data from an Intel 3945 wireless client when WMM is enabled Time of Day scanning in auto-channel selection uses a 12 hour clock, resulting in two scans per day, 12 hours apart The HTTP proxy crashes and restarts after receiving certain HTTP packets The management tool authentication process (WEBAUTH) may crash in some situations When a user is logged out because of a duplicate IP address on the network, the cause in the system log is "Unknown cause". It has been fixed to PORT_ERROR (Applies to SNMP MIB.) A walk of MIB COLUBRIS-VIRTUAL-AP-MIB may fail when there was more than one VSC configured The Management IP address of the LAN port is being lost DNS replies of type AAAA without an answer record are not handled properly.

15 5.2.6 Release Notes: HP ProCurve MSM313, MSM323 / MSC-3200, MSC The NAT port range limit is not respected for proxy user traffic. A fixed limit of 50 is always used (Access controlled users.) At the end of a user access list, there is no implicit DENY all rule, causing the default action to redirect the user to the login page The 802.1x authentication fails in some cases When an IPSec tunnel is built over a PPPoE connection, the default route, in some cases, can start pointing to the IPsec tunnel interface, making the Internet port interface unusable for non-ipsec related traffic In the Bandwidth Control, if a level is set with a value lower than 80Kbits/sec, the traffic mapped to that level would instead get the full bandwidth available The page Status > IP connections does not display correctly with some Windows Vista installations The Access Control setting of the VSC is not available in the SNMP MIB COLUBRIS- VIRTUAL-AP Unable to upload firmware into firmware-distribution cache. When attempting, the service controller restarts. The firmware can now be uploaded, and a warning is now displayed indicating that a restart must be performed after the software distribution is finished (Applies only to the MSC-3300 concerning the COLUBRIS-IEEE802DOT11.my MIB.) A row is missing (for radio 2) in tables codot11phydssstable and codot11phyofdmtable when one radio is set to the 2.4GHz band and the other is set to the 5GHz band Lack of additional information in the log for sessions logged out as Port- Preempted Multiple sessions can be seen on RADIUS server even when the "Reauthenticate on location change" option is disabled. The RADIUS request is sent on a re-association, and this is sometimes undesirable. Enabling the "Reauthenticate on location change" option makes it possible for a RADIUS server to deny access based on user location With IPSec security, once a NAT gateway has been detected between the peers, the MSC no longer accepts a IKE negotiation from its peer.