RELEASE NOTES. StoneGate Firewall/VPN v for IBM zseries

Transcription

1 RELEASE NOTES StoneGate Firewall/VPN v for IBM zseries Copyright 2006 Stonesoft Corp. All rights reserved. All trademarks or registered trademarks are property of their respective owners. Disclaimer: Although every precaution has been taken to prepare this document, Stonesoft assumes no responsibility for errors, omissions, or resulting damages from the use of the information contained in this document. All information contained in this document is subject to changes at any time.

2 TABLE OF CONTENTS What s New page 3 System Requirements page 4 Build Version page 5 Compatibility page 5 Installation Instructions page 6 Upgrade Instructions page 6 Known Limitations page 7 Known Issues page 8 RELEASE NOTES 2

3 WHAT S NEW Fixes Problems described in the table below have been fixed since StoneGate Firewall/VPN v A workaround solution is presented for earlier versions where available. Synopsis IKE Vulnerabilities in StoneGate Firewall/VPN (CERT-FI: 7710; / NISCC/ISAKMP) Description CERT-FI and NISCC published a joint vulnerability advisory on 14 Nov 2005 about several vulnerabilities in various IKEv1 protocol implementations. StoneGate Firewall/ VPN engine versions and earlier use a vulnerable version of IKEv1 implementation. Crafted IKE packets may cause the vulnerable IKE daemon to malfunction, thus causing a denial-of-service condition for the VPN tunnels or the firewall functionality. For more infromation, see the Security Advisory available on our Web site at Security_Advisories/7244.html Workaround for previous versions The default security policy template allows IKE traffic (UDP/500) to the firewall/vpn gateway from any source address. When the IP addresses of the remote VPN gateways and clients are known, the access rule could be more strict to prevent connection attempts from other IP addresses. RELEASE NOTES 3

4 SYSTEM REQUIREMENTS Hardware Requirements StoneGate Firewall/VPN engine can run either as a z/vm guest or natively on a Logical Partition (LPAR) on the following mainframe platforms: zseries 990 (all models) ( G8 ) zseries 890 (all models) ( G8 ) zseries 900 (all models) ("G7") zseries 800 (all models) ("G7") 9672 Ri6 and 9672 Ri7 ("G5" and "G6") Multiprise 3000 Each StoneGate Firewall/VPN instance requires the following hardware resources: at least one shared control processor. Symmetric multiprocessing (SMP) is supported. IFL processors are supported. allocated memory depending on usage; 128 megabytes recommended minimum. two CMS minidisks (1 gigabyte recommended for each dependent upon memory allocation) or two dedicated DASD block devices (2,3 gigabytes each) For more information about StoneGate for IBM zseries mainframe platform please see: Supported Interface Types OSA express Fast Ethernet (OSAX-FE) OSA express Gigabit Ethernet (OSAX-GE) OSA2 Fast Ethernet (OSA2-FE) Hipersockets Channel-to-Channel (CTC)* z/vm Inter-User Communication Vehicle (IUCV)* z/vm QDIO Guest LAN RELEASE NOTES 4

5 z/vm Virtual HiperSockets z/vm Virtual Switch (VSWITCH) *)Clustering is not supported. Supported z/vm Versions z/vm 4.3 z/vm 4.4 z/vm 5.1* *) Does not include qeth-support for z/vm 5.1 Layer 2 support for OSA-Express. BUILD VERSION The StoneGate Firewall/VPN v for IBM zseries build version is COMPATIBILITY Caution StoneGate Firewall/VPN v for IBM zseries is not compatible with SMC v3.2.x or later. StoneGate Firewall/VPN v is recommended to be used with the following StoneGate component versions: StoneGate Management System v3.1.3 StoneGate VPN Client v2.6.1 StoneGate Server Pool Monitoring Agent v2.6.2 RELEASE NOTES 5

6 INSTALLATION INSTRUCTIONS The main installation steps for StoneGate Firewall/VPN are as follows: 1. Install the Management Server, the Log Server(s), and the Administration Client. The Monitoring Server needs to be installed if Monitoring Clients are used. 2. Add the following line into SGClientConfiguration.txt in user home directory on the Administration client machine: GUI_FWPropertiesForS390=True 3. Configure the firewall element with the Administration Client using the Configuration View. 4. Generate an initial configuration for the engines by right-clicking on the firewall and selecting Save Initial Configuration from the context menu. 5. Prepare the StoneGate VM guest user or LPAR for native installation. 6. Install the firewall engine by running the SGINST EXEC script 7. Make the initial connection from the engines to the Management Server and enter the onetime password provided during step Create and upload a policy on the engine with the Administration Client using the Configuration View. 9. Command the nodes online by right-clicking on the firewall and selecting Commands Go Online from the context menu. The detailed installation instructions can be found in the StoneGate Installation Guide. For more thorough explanation on using StoneGate, please refer to the StoneGate Administrator s Guide and the Reference Guide. UPGRADE INSTRUCTIONS StoneGate Firewall/VPN v requires an updated license, if upgrading from StoneGate v2.1.x. The license upgrade can be requested on our Web site at Activate the new license in the Administration Client before upgrading the software. To upgrade the firewall engine from version 2.x, use the remote upgrade feature. Detailed instructions can be found in the StoneGate Administrator s Guide. RELEASE NOTES 6

7 KNOWN LIMITATIONS Known limitations and restrictions of StoneGate Firewall and VPN v are described in the table below. Synopsis Description Workaround New IPsec certificate not immediately used. (#2543) VLAN tagged interface cannot be used for heartbeat. (#4044) Connections are not dropped when validity time has elapsed. (#4251) Only first eight characters of the root password are effective. (#5171) User authentication does not work for user names that contain an accentuated character. (#6230) Failover may take a long time when using dedicated OSA express cards (#8821) After creating or changing Security Gateway IPsec certificates, firewall nodes need to be rebooted to start using the certificates. VLAN tagged interface cannot be configured as primary or secondary heartbeat interface. New connections are not accepted after validity time of the rule has elapsed but old connections remain active. The sg-reconfigure firewall engine configuration wizard allows entering a long password for root but only the first eight characters are effective. If user name contains accentuated characters (for example: å, ä, ö), user authentication will fail. When using dedicated OSA cards for the firewall cluster nodes instead of one shared OSA card, the cluster MAC address changes in failover. After the failover, StoneGate notifies the surrounding network devices of the changed MAC address by sending a gratuitous ARP message. However, an OSA card sends the ARP messages very slowly (5 sec interval) and this may result in a long failover time if many proxy ARP entries are used, for example, for NATing purposes. Reboot the firewall node after creating or changing its certificate. Use a native (non-vlan tagged) interface for heartbeat. Operative traffic interfaces can be used for heartbeat. RELEASE NOTES 7

8 Synopsis Description Workaround Standby is the only supported clustering mode (#12659) The current StoneGate version does not support load balancing cluster mode in an S/ 390 environment. KNOWN ISSUES The current known issues of StoneGate v are described in the table below. For an updated list of known issues, please consult our Web site at Known_Issues/. Synopsis Description Workaround Firewall engine drops the first packet of an RPC connection (#2856) Related connections do not update the control connection's timeout. (#3633) System clock is not saved (#5653) Firewall engine discards the opening packet of an incoming RPC connection if the availability of the RPC service on the destination host is unknown. This can cause a noticeable delay in the RPC application (e.g. NFS), because the application will recover only after the client retransmits the packet. Whenever an FTP data connection takes longer than the defined idle timeout for FTP, the FTP control connection dies due to the timeout. If the management server and the firewall have different times, the management server synchronizes the firewall clock automatically with the management server time. This updated time is lost if the firewall is rebooted, because the firewall sets its time based on the mainframe hardware clock during each bootup. This may cause inconsistent log timestamps and problems with certificates. Increase the connection timeout. RELEASE NOTES 8

9 Synopsis Description Workaround Incorrect logging when authentication fails because a CRL cannot be fetched. (#6032) Policy reload may cause heartbeat to fail (#6495) Link-status test does not work with OSA express in QDIO mode on IBM zseries. (#6703) Policy install fails due to invalid FTP protocol agent configuration. (#7913) VPN may not work correctly if both AH and ESP are used in IPsec proposal. (#8408) When Certificate Revocation List (CRL) checking is configured, authentication fails (correctly) if the CRL cannot be fetched. But logging is incorrect, current log message is: " :35:13","158303"," ","IPsec","Di agnostic","ipsec info","","","","","","","","","","","","16392","","","","","","","","","","","","","","","","92","c ertificate not found (Searching for remote peer's public key)" The heartbeat traffic is cut off for a couple of seconds during policy reload if qeth-interface is used. This may generate heartbeat failover messages in the log, and nodes may also go to offline state. Link-status test does not work with qeth driver. The following error message appears during policy installation and the installation fails: [Firewall error: Error code 208 (P) "Invalid configuration: FATAL: error sending kernel configuration"] Policy installation aborted for FIREWALL VPN may not work correctly if both AH and ESP are used in IPsec proposal. Increase the heartbeat failover time from 5000 to in the advanced settings of the firewall cluster properties. Use e.g. multi-ping test to detect a link failure. Invalid FTP protocol agent configuration causes an error situation where the firewall rejects the configuration. For example, if "Highest allowed nonstandard source port number of active mode data connection from server" is defined, but lowest is still zero, the error occurs. To solve the problem, use either default values (zeroes in both settings) or define both values. Use ESP only. RELEASE NOTES 9

10 Synopsis Description Workaround Oracle PA handles a fragmented TNS packet incorrectly. (#8508) Backup heartbeat may not work (#12449) Old management connections may stay open and prevent policy installation (#13493) Only the first authentication service is used (#17427) When the Oracle Protocol Agent recognizes a response (from a listener) divided into two TCP segments, it calculates the length of the TNS message incorrectly. Thus, the PA destroys the latter sequence and does not allow the database connection through the firewall. StoneGate may not receive any heartbeat messages from the other nodes over the backup heartbeat link. Management connections may not be closed properly. This may lead into a situation that the firewall refuses new management connections, and the following policy installation attempts fail with an error message: "Error in communication between the management server and firewall node." Only the first authentication service is used even if multiple authentication services are defined for the user and in the access rule. The firewall log shows that the authentication fails because the (first) authentication server does not respond. Restart the mgmtd daemon with the following commands: msvc -d mgmtd msvc -u mgmtd RELEASE NOTES 10

11 Trademarks and Patents Stonesoft, the Stonesoft logo and StoneGate are all trademarks or registered trademarks of Stonesoft Corporation. Multi-link technology, multi-link VPN, and the StoneGate clustering technology-as well as other technologies included in StoneGate-are protected by patents or pending patent applications in the U.S. and other countries. All other trademarks or registered trademarks are property of their respective owners. Copyright and Disclaimer Copyright Stonesoft Corporation. All rights reserved. These materials, Stonesoft products and related documentation are protected by copyright and other laws, international treaties and conventions. All rights, title and interest in the materials, Stonesoft products and related documentation shall remain with Stonesoft and its licensors. All registered or unregistered trademarks in these materials are the sole property of their respective owners. No part of this document or related Stonesoft products may be reproduced in any form, or by any means without written authorization of Stonesoft Corporation. Stonesoft provides these materials for informational purposes only. They are subject to change without notice and do not represent a commitment on the part of Stonesoft. Stonesoft assumes no liability for any errors or inaccuracies that may appear in these materials or for incompatibility between different hardware components, required BIOS settings, NIC drivers, or any NIC configuration issues. Use these materials at your own risk. Stonesoft does not warrant or endorse any third party products described herein. THESE MATERIALS ARE PROVIDED "AS-IS." STONESOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, AS TO, THE INFORMATION CONTAINED HEREIN. IN ADDITION, STONESOFT MAKES NO EXPRESS OR IMPLIED WAR- RANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE OR USE WITH RESPECT THE INFOR- MATION CONTAINED IN THESE MATERIALS. IN NO EVENT SHALL STONESOFT BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL OR INCIDENTAL DAMAGES, INCLUDING, BUT NOT LIMITED TO, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING FROM THE USE OF THESE MATERIALS, EVEN IF ADVISED IN ADVANCE OF THE POSSIBILITY OF SUCH DAMAGES. Revision: RLNT-SG International Headquarters Stonesoft Corp. Itälahdenkatu 22a FIN Helsinki, Finland tel fax. info.emea@stonesoft.com Business ID: VAT number: FI Americas Headquarters Stonesoft Inc Crown Pointe Parkway Suite 900 Atlanta, GA USA tel fax. info.americas@stonesoft.com Asia Pacific Headquarters Stonesoft Corp. 90 Cecil Street # Singapore tel fax. info.asiapacific@stonesoft.com