StoneGate SSL VPN Release Notes for Version 1.3.2

Transcription

1 StoneGate SSL VPN Release Notes for Version Created: September 29, 2009

2 Table of Contents What s New... 3 System Requirements... 5 Build Version... 5 Product Binary Checksums... 5 Compatibility... 6 Upgrade Instructions... 8 Known Issues... 9

3 What s New Enhancements The enhancements introduced in StoneGate SSL VPN v1.3.2 are described in the table below. The following table lists the features briefly. Please consult the product documentation for more details. Feature Configurable StoneGate Monitoring Agent OWA 2007 added to Standard Resources HW Assessment Plug-in v2.0 OATH Feature activation from the Web Console MobileID software for authentication downloadable from StoneGate SSL VPN Administrator interface Description It is now possible to customize the configuration of StoneGate Monitoring Agent running in StoneGate SSL VPN system. For more information on implementing the configuration, refer to Technical Note 4931 To ease the configuration of Microsoft Outlook Web Access 2007, a new wizard has been defined among Standard Resources in Manage Resource Access tab within StoneGate SSL VPN Administrator interface. New 2.0 version of Hardware Assessment Plug-in supports uploading the data file in.csv format. OATH activation can now easily be done from the SSL VPN Web Console. It is now possible to download the StoneGate SSL VPN MobileID software for multiple platforms as a.zip file. Fixes Problems described in the table below have been fixed since StoneGate SSL VPN v A workaround solution is presented for earlier versions where available. Synopsis Virtual IP: Disabling virtual IP on a running system leaves the Access Point in an uncommunicative state. (#51097) File upgrade.zip of about 100M is left on device after failed upgrade. (#46516) Access Point service cannot be stopped after the upgrade. (#49864) Upgrade with Web Console within the Web Portal fails with error '403 Access Denied. The request data is too large.' (#50029) Default route is not completely restored at boot time on virtual interface eth0:1. (#50157) Internal LDAP sleep file is not handled correctly on backup restore. (#50202) Description Disabling the IP Address Pool configuration on a running system causes the Access Point to restart in a state, in which it cannot communicate with the driver. After a failed upgrade, the file upgrade.zip file is left by the process in /spool directory After an upgrade, the Access Point cannot be stopped from the Web Console Due to a hardcoded limit, it is not possible to transfer over 100M via the Access Client. Therefore upgrading the system in Web Console through the Web Portal fails. Configuration of a default route on interface for eth0:1 is not preserved at reboot. The /data/config/minit/slapd/sleep file is used in mirroring mode to prevent the start of slapd (internal LDAP). This file is not removed when another single mode backup is restored, thus preventing the use of internal LDAP. Workaround for previous versions Remove the file manually. 3 StoneGate SSL VPN Release Notes for version 1.3.2

4 Browsing for Abolishment settings returns an error. (#51621) OATH backup should not be scheduled by default unless configured. (#51935) It is not possible to use DNS names when Microsoft AD is used as Authentication Method. (#31881) DNS may stop working with TrendMicro OfficeScan firewall. (#44962) Backups retrieved from Web Console are truncated to 2MB. (#52286) Abolishment page gives an error "Failed to load Abolishment settings, save settings for Abolishment to work properly". When you click "Save", it shows that abolishment settings were successfully saved. After publishing the changes and returning back to Abolishment page, the error message is shown again. With default settings, automatic OATH backup with incomplete configuration was enabled, which caused errors in logs. When changing a working AD authentication to use hostname (defined in hosts) instead of IP, error message "403 Access Denied, No permission to access resource" is displayed and the communication failure system log entries are generated. When a resource that uses the SSL VPN Access Client is accessed from a machine running Windows Vista SP1 with TrendMicro OfficeScan 8.0 firewall enabled, DNS lookups may stop working. When the backup is bigger than 2MB, saving it seems to keep only the 2 first MBs. Activate and configure OATH support by StoneGate SSL VPN Administrator interface, or disable automatic OATH backup scheduling in StoneGate SSL VPN Administrator interface. 4 StoneGate SSL VPN Release Notes for version 1.3.2

5 System Requirements StoneGate Appliances StoneGate SSL VPN v1.3.2 is supported on the StoneGate SSL-400, SSL-1030, SSL-2000, and SSL-6000 appliances. Administration Requirements StoneGate SSL VPN v1.3.2 administration requires the use of a workstation with a TCP/IP network configured and a Web browser installed. The supported Web browsers are listed in the table below: Operating System Microsoft Windows XP Home Edition (SP 1, SP 2, SP 3) Microsoft Windows XP Professional (SP 1, SP 2, SP 3) Microsoft Windows 2003 Server (SP 2) Microsoft Windows Vista Enterprise 32/64 bit (SP 1) Microsoft Windows Vista Business 32/64 bit (SP 1) Microsoft Windows Vista Home-premium 32/64 bit (SP 1) Apple Mac OS X Apple Mac OS X 10.4 (Tiger) Apple Mac OS X 10.5 Red Hat Enterprise Linux 5.0 SUSE Linux Enterprise Server 10 Microsoft Internet Explorer 6.0 Microsoft Internet Explorer 7.0 Safari (Mac OS X ) Safari (Mac OS X ) Safari (Mac OS X 10.5) Web Browser Build Version The StoneGate SSL VPN v1.3.2 build version is Product Binary Checksums sslgw_engine_ _i386.iso MD5SUM 1153e0049d7466dfc9258f410f72bff2 SHA1SUM a3791ecbb258ece3ab32c6fcf4f7dde060b860c4 sslgw_engine_ _i386.zip MD5SUM c843a2a b40f69faab46a29fd SHA1SUM 24b174262a75a31034b8deef2ae8088e3a128ea6 5 StoneGate SSL VPN Release Notes for version 1.3.2

6 Compatibility Directory Services User information can be stored in an internal user directory, or one of the following external directory services can be used: Microsoft Active Directory 2003 Novell edirectory OpenLDAP Sun Java System Directory Server Oracle Internet Directory (authentication only) Tivoli Directory Server (authentication only) IBM RACF LDAP (authentication only) NOTE - When using mirrored pair configuration, external directory service is required. Application Portal The supported Web browsers for the StoneGate Application Portal are listed in the table below: Operating System Microsoft Windows XP Home Edition (SP 1, SP 2, SP 3) Microsoft Windows XP Professional (SP 1, SP 2, SP 3) Microsoft Windows 2003 Server (SP 2) Microsoft Windows Vista Enterprise 32/64 bit (SP 1) Microsoft Windows Vista Business 32/64 bit (SP 1) Microsoft Windows Vista Home-premium 32/64 bit (SP 1) Apple Mac OS X Apple Mac OS X 10.4 (Tiger) Apple Mac OS X 10.5 Red Hat Enterprise Linux 5.0 SUSE Linux Enterprise Server 10 Microsoft Internet Explorer 6.0 Microsoft Internet Explorer 7.0 Safari (Mac OS X ) Safari (Mac OS X ) Safari (Mac OS X 10.5) Web Browser 6 StoneGate SSL VPN Release Notes for version 1.3.2

7 Access Client The runtime requirements for the StoneGate Access Client are listed in the table below: Operating System Microsoft Windows XP Home Edition (SP 1, SP 2, SP 3) Microsoft Windows XP Professional (SP 1, SP 2, SP 3) Microsoft Windows 2003 Server (SP 2) Microsoft Windows Vista Enterprise 32/64 bit (SP 1) Microsoft Windows Vista Business 32/64 bit (SP 1) Microsoft Windows Vista Home-premium 32/64 bit (SP 1) Apple Mac OS X Apple Mac OS X 10.4 Apple Mac OS X 10.5 Runtime Requirements Sun Java Runtime Environment 1.4 or later, or ActiveX support Java, included in Mac OS X Red Hat Enterprise Linux 5 SUSE Linux Enterprise Server 10 Sun Java Runtime Environment 1.4 or later Sun Java Runtime Environment 1.4 or later Additionally, when using the Access Client on Windows Vista, the following requirements apply: Requirement Access Client on Microsoft Windows Vista requires administrator rights. StoneGate ActiveX Client Loader requirements. Drive letter mapping in Windows Vista. Details The Access Client requires administrator rights to run properly on Windows Vista. To run the ActiveX Access Client loader successfully with Windows Vista UAC, you must add the Access Point server https address to the list of trusted sites in Internet Explorer. A single drive letter (for example, F :) cannot be used as a startup command in Windows Vista. All commands must be executed using runas to elevate to administrator mode since the mapping is done in administrator mode, and F: is not a valid executable. Use the following startup command instead: explorer /root, F: Remove AES cipher suites from Access Point configuration. Java Runtime Environment. This works on both Windows XP and Windows Vista. The AES ciphers in Vista are not compatible with the SSL engine used in Access Point. You must remove the AES ciphers from Cipher Suites for your Access Point under Manage Global Access Point Settings. Remove the following ciphers: RSA_AES_128_CBC_SHA and RSA_AES_256_CBC_SHA. To run the PortWise Java Access Client, use Sun Java 1.6 Update 2 or later. 7 StoneGate SSL VPN Release Notes for version 1.3.2

8 Upgrade Instructions Starting from SSL VPN maintenance release 1.3.2, upgrading is only possible from StoneGate SSL VPN version When upgrading mirrored systems, refer also to upgrade instructions in SSL VPN Administrator's Guide, which is available from It is recommended to publish the configuration after successful upgrade. Upgrade from previous versions Upgrading the StoneGate SSL VPN from versions 1.2.0, and to is normally done through the Web Console Remote Upgrade functionality. After upgrade, log on to the StoneGate SSL VPN Administrator interface and accept the modified configuration in the dialog that is presented and then publish the updated configuration. Upgrade from version or prior versions If upgrading the StoneGate SSL VPN from version or prior versions to version 1.3.2, you must first upgrade to version then to move to version as a later step. To upgrade to StoneGate SSL VPN version to 1.2.0, please refer to appropriate Release Notes. 8 StoneGate SSL VPN Release Notes for version 1.3.2

9 Known Issues The current known issues of StoneGate SSL VPN v1.3.2 are described in the table below. For an updated list of known issues, consult our Web site at Synopsis Description Workaround In mirrored configuration, OATH database must be configured as an external db. (#50490) WINS Forwarding in Tunnel Set does not work. (#33675) Client Firewall does not work on Windows Vista clients (#40657) Configuring Directory Service as MS AD setting RootDN with a container class object is not accepted.(#50034) Use of IP pool address with Active FTP does not work on a Vista system. (#50028) Web Console used through Application Portal: switching to mirror mode does not generate mirror.conf file for replication. (#47252) Abolishment fails on a path containing special characters. (#48653) In case of mirrored configuration with OATH activated, adding secondary Authentication Service causes the error message: "To validate if OATH is used on the configured Authentication Service-node (i.e. tokens are imported), it has to be started. A system with more than one Authentication Service-node cannot use a local database; it would result in data inconsistency." to appear. Even if configuration of WINS forwarding is allowed in Administration Service, settings are not applied. When a Client Firewall is configured for a resource, the Access Client stops working on Windows Vista. This is a Microsoft Active Directory-specific problem. Organizational Unit is not an allowed child object of the class "containers" within the Active Directory default schema. "ou=accounts,..." is an Organizational Unit. Hence "ou=accounts" can't be added to "cn=users,..." since "cn=users,..." is a container (objectclass=container,objectcategory="cn=cont ainer,cn=schema,cn=configuration,..." RootDN should start with an Organizational Unit ( OU="...",... ). Using an SSL VPN resource for active FTP with an IP Address Pool from a Windows Vista machine fails when the server starts the transfer. When Web Console is accessed through the Application Portal, switching to mirror mode does not generate the mirror.conf file needed for replication. Using special characters like Cyrillic alphabet characters in Abolishment causes the functionality to fail. Configure OATH in SSL VPN Administrator (Manage System - OATH Configuration - Database Connection) to point to an external URL (for example: jdbc:hsqldb:hsql:// :9001/:shutdown=tru e ) Alternatively, you can disable OATH in the Web Console. None. Add the following three "Outgoing" rules for the Client Firewall: W.X.Y.Z-W.X.Y.Z 443 TCP Any Accept TCP Any Accept UDP Any Accept Where W.X.Y.Z is the IP address of your access point. If using multiple APs, add a corresponding rule for each. In SSL VPN Administration interface, configure RootDN to set Organizational Unit as not part of a container. For example, OU=Accounts,DC=DOMAIN,DC=COM or OU=Accounts,OU=SSLVPN,DC=DOMAIN,DC=C OM Use Passive FTP. Perform "Switching to mirror mode" operation from direct connection to Web Console and not through the Application Portal. Verify that no special characters are used in Abolishment configured paths. 9 StoneGate SSL VPN Release Notes for version 1.3.2

10 Copyright and Disclaimer Stonesoft Corporation. All rights reserved. These materials, Stonesoft products, and related documentation are protected by copyright and other laws, international treaties and conventions. All rights, title and interest in the materials, Stonesoft products and related documentation shall remain with Stonesoft and its licensors. All registered or unregistered trademarks in these materials are the sole property of their respective owners. No part of this document or related Stonesoft products may be reproduced in any form, or by any means without written authorization of Stonesoft Corporation. Stonesoft provides these materials for informational purposes only. They are subject to change without notice and do not represent a commitment on the part of Stonesoft. Stonesoft assumes no liability for any errors or inaccuracies that may appear in these materials or for incompatibility between different hardware components, required BIOS settings, NIC drivers, or any NIC configuration issues. Use these materials at your own risk. Stonesoft does not warrant or endorse any third party products described herein. THESE MATERIALS ARE PROVIDED "AS-IS." STONESOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, AS TO, THE INFORMATION CONTAINED HEREIN. IN ADDITION, STONESOFT MAKES NO EXPRESS OR IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE OR USE WITH RESPECT THE INFORMATION CONTAINED IN THESE MATERIALS. IN NO EVENT SHALL STONESOFT BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL OR INCIDENTAL DAMAGES, INCLUDING, BUT NOT LIMITED TO, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING FROM THE USE OF THESE MATERIALS, EVEN IF ADVISED IN ADVANCE OF THE POSSIBILITY OF SUCH DAMAGES. Trademarks and Patents Stonesoft, the Stonesoft logo and StoneGate are all trademarks or registered trademarks of Stonesoft Corporation. Multi-Link technology, Multi-Link VPN, and the StoneGate clustering technology-as well as other technologies included in StoneGateare protected by patents or pending patent applications in the U.S. and other countries. All other trademarks or registered trademarks are property of their respective owners. Stonesoft Corporation Itälahdenkatu 22A FI Helsinki Finland Tel Fax Stonesoft Inc Crown Pointe Parkway Suite 900 Atlanta, GA USA Tel Fax Copyright 2009 Stonesoft Corporation. All rights reserved. All specifications are subject to change.