Release Notes. NCP Secure Enterprise VPN Server. 1. New Features and Enhancements. 2. Improvements / Problems Resolved

Transcription

1 NCP Secure Enterprise VPN Server Service Release 10.0 r29844 (Linux 64) May 2016 Prerequisites Linux Distributions This version is released only for 64 bit versions of the following distributions: SuSE Linux Enterprise Server 12 CentOS 7.1 Ubuntu Server Debian GNU/Linux Update Prerequisites Please read the instructions for updates of previous versions carefully! (See: Update and License Informations.PDF) Prerequisites for Configuration by Secure Enterprise Management (SEM) Secure Enterprise Management Server: Version 3.02 or later Management Plugin - Server Configuration: Version r26953 or later Please note: From version 10.0, a license key for the same version of Secure Enterprise VPN Server and the Secure Enterprise HA Server is required to use both products together. 1. New Features and Enhancements None 2. Improvements / Problems Resolved Changes to the Installation Routine Changes have been made to the installation routine for Linux platforms in this release. Denial of Service Vulnerability A denial of service vulnerability which under certain circumstances could have led to a server crash in earlier versions has been fixed. Improvements: IKEv2 Compatibility and Rekeying IKEv2 compatibility has been added in this release. If rekeying is used, please make sure that the client rekeying interval is set to the default and is less than the server rekeying interval. If the client rekeying interval is greater than the server rekeying interval, the connection may be interrupted. page 1 of 14

2 IP Address Assignment via DHCP If IKEv2 is used and IP addresses are assigned via DHCP, only the username of the VPN user will be transferred to the DHCP server rather than the hostname of the user's PC. 3. Known Issues None page 2 of 14

3 Service Release 10.0 r27571 (Linux 64) January 2016 Prerequisites Linux Distributions This version is released only for 64 bit versions of the following distributions: SuSE Linux Enterprise Server 12 CentOS 7.1 Ubuntu Server Debian GNU/Linux Update Prerequisites Please read the instructions for updates of previous versions carefully! (See: Update and License Informations.PDF) Prerequisites for Configuration by Secure Enterprise Management (SEM) Secure Enterprise Management Server: Version 3.02 or later Management Plugin - Server Configuration: Version r26953 or later Please note: From version 10.0, a license key for the same version of Secure Enterprise VPN Server and the Secure Enterprise HA Server is required to use both products together. To run this Secure Enterprise Server in combination with HA, you will need HA Server version from 10.0 r26952 or more. 1. New Features and Enhancements None 2. Improvements / Problems Resolved VRRP address of the server An error occured when the VVRP function was enabled if the VVRP address in SES was not in the same IP address range of the LAN adapter. This issue has now been resolved. 3. Known Issues None page 3 of 14

4 Service Release 10.0 r26968 (Linux 64) December 2015 Prerequisites Linux Distributions This version is released only for 64 bit versions of the following distributions: SuSE Linux Enterprise Server 12 CentOS 7.1 Ubuntu Server Debian GNU/Linux Update Prerequisites Please read the instructions for updates of previous versions carefully! (See: Update and License Informations.PDF) Prerequisites for Configuration by Secure Enterprise Management (SEM) Secure Enterprise Management Server: Version 3.02 or later Management Plugin - Server Configuration: Version r26953 or later Please note: From version 10.0, a license key for the same version of Secure Enterprise VPN Server and the Secure Enterprise HA Server is required to use both products together. To run this Secure Enterprise Server ( r26968) in combination with HA, you will need HA Server version 10.0 r New Features and Enhancements None 2. Improvements / Problems Resolved Sorting in the SES filter table SES The entries in the server filter table are now sorted alphabetically. This is resolved in the Server Configuration Plugin from version r Number of domain groups HA + SES The error which occurred in the management services for a large number of domain groups has been fixed. This is resolved in the Server Configuration Plugin from version r Known Issues None page 4 of 14

5 Major Release 10.0 r25102 (Linux 64) August 2015 Prerequisites Linux Distributions This version is released only for 64 bit versions of the following distributions: SuSE Linux Enterprise Server 12 CentOS 7.1 Ubuntu Server Debian GNU/Linux Update Prerequisites Please read the instructions for updates of previous versions carefully! (See: Update and License Informations.PDF) Prerequisites in Combination with Secure Enterprise Management Secure Enterprise Management Server: Management Plug-in Server Configuration: HA server (if used): v3.02 or later NCP_MgmPlugin_SrvCfg rev24663 or later v10.0 rev24099 or later 1. New Features and Enhancements Licensing of NCP Secure Enterprise VPN Server and NCP Secure Enterprise HA Server With version 10.0 a license key of the same version is required to use the software productively. Previous server versions 8.x or older updated to version 10.0 without updating the license key to version 10 will not work anymore. With version 10.0 and upcoming versions an according license key of the same version must be used. IPsec over L2TP is no longer supported IPsec over L2TP is not available anymore with version Compatibility with Built-in IPsec/IKEv2 Clients Built-in IPsec clients of Blackberry and Windows Phone 8.1 platforms are compatible with version 10.0 using IKEv2 key exchange in combination with one of the following authentication modes: User name and password certificate (EAP-TLS/EAP-MD5/EAP-OTP/EAP-MSCHAPv2) IP Address Assignment for Clients Version 10.0 now support external DHCP servers for client IP address assignment based on: MAC address host name or user name page 5 of 14

6 Support of Suite B Cryptography Algorithms The following algorithms are supported: AES-CTR/GCM Elliptic Curve Digital Signature Algorithm/Diffie-Hellman Secure Hash Algorithm 2 (SHA-256, SHA-384) Advanced Configuration Rules Within an NCP Secure Enterprise VPN Server s domain group different Active Directory/LDAP attributes (e.g. group membership) can be used to define the following client parameters: IP pool Filter-group User priority Policy name / filter group DHCP source IP address / network mask The Advanced Configuration Rules are part of the domain groups. IPv6 within the VPN Tunnel IPv6 is now supported within the VPN tunnel. The following parameters are IPv6 enabled: Link profile / routing Link profile / IPsec selectors Link profile / IPsec options Filter networks Filter Domain groups / RADIUS Domain groups / OTP Domain groups / Link profiles Currently not all functionalities are IPv6 enabled, e.g. IP address assignment. IPv6 support will be continuously enhanced with future service releases. Load Balancing Support for Apple ios Devices (with or without VRRP) The built-in VPN IPsec client of Apple ios is able to connect to NCP Secure Enterprise VPN Servers in load balancing mode. The client will automatically be redirected to the server with the least load. NCP VPN Path Finder II The NCP VPN Path Finder protocol being part of the NCP Secure Enterprise VPN Server provides a fallback mechanism in case regular IPsec connection attempts fail due to firewall or proxy servers blocking this kind of traffic. The NCP VPN Path Finder II protocol is an enhancement offering full TLS communication which will not be blocked by highly restrictive application level firewall/proxies. If a regular IPsec connection cannot be established the NCP Secure Client will automatically switch to NCP VPN Path Finder. If the client still cannot get through to the gateway it will enable NCP VPN Path Finder II using the full TLS negotiation. Performance Enhancements With version 10.0 the NCP Secure Enterprise VPN Server s multiprocessor support has been significantly improved providing a maximum of performance. page 6 of 14

7 Using the OpenSSL library in FIPS mode has a substantial effect on the performance of the NCP Secure Enterprise VPN Server. Therefore the FIPS mode is not in use by default since this version of the NCP Secure Enterprise VPN Server. To enable the FIPS mode the administrator has to configure the following: Within the config file /opt/ncp/ses/etc/cfg/ncpwsupd.conf add the entry EnableFipsMode 1. The NCP Secure Enterprise VPN Server s ncpwsupd daemon has to be restarted after this change. 2. Improvements / Problems Resolved SNMP Software The NCP Secure Enterprise VPN Server no longer ships with an integrated SNMP suite. In case SNMP support is required a third party SNMP software (e.g. Net-SNMP) must be installed. 3. Known Issues None 4. Getting Help for the NCP Secure Enterprise VPN Server To ensure that you always have the latest information about NCP s products, always check the NCP website. page 7 of 14

8 5. Features Operating System 64 bit Operating System Linux Kernel 2.6 from Linux Distributions Supported see Prerequisites, page 1 Recommended System Requirements Computer CPU: Pentium III (or higher) 150 MHz or comparable x86 processor, 512 MB RAM (minimum), per 250 concurrently useable tunnels 64 MB RAM. Clock speed: Data throughput of app. 4,5 mbit/s can be realized for each 150 MHz with a Single Core CPU (including encryption) Data throughput of app. 9 mbit/s can be realized for each 150 MHz with a Dual/Quad Core CPU (including encryption). System Requirements for Concurrent SSL VPN Sessions 10 Concurrent Users (CU) CPU: Intel Pentium III 700 MHz or comparable x86 processor, 512 MB RAM 50 Concurrent Users CPU: Intel Pentium III 1.5 MHz or comparable x86 processor, 512 MB RAM 100 Concurrent Users CPU: Intel Dual Core 1.83 GHz or comparable x86 processor, 1024 MB RAM 200 Concurrent Users CPU: Intel Dual Core 2.66 GHz or comparable x86 processor, 1024 MB RAM Dependent on the type of end-device. Mobile end-devices such as Tablet PCs (using ios or Android), Smartphones, PDAs and others have some restrictions. The above are approximate values that are significantly influenced by user activity profiles or applications. If a large number of concurrent file transfers (file upload and download) are anticipated then we recommend increasing the memory value by 50%. Network Protocols IP (Internet Protocol), VLAN support Management The NCP Secure Enterprise VPN Server is configured and managed either via an NCP Secure Enterprise Management using the Secure Server plug-in or directly via the Web Interface. Network Access Control (Endpoint Security) Endpoint Policy Enforcement for incoming data connections. Verification of predefined, security relevant Client parameters. Measures in the event of target/actual deviation in IPsec VPN: page 8 of 14

9 Disconnect or continue in the quarantine zone with instructions for action Message in Messagebox or start of external applications (e.g. virus scanner update), Logging in Logfiles (see the Secure Enterprise Management data sheet for more information). Measures in the event of attempts to perform other than just pre-defined activities in SSL VPN: Granular reduction in access authorization to certain applications in accordance with defined security levels. Dynamic Switching of Filter Rules dependent on Endpoint Security Requirements (8.10) Execute Endpoint Security only for NCP Clients (8.10) IF-MAP (Interface for Metadata Access Points) Support (8.10) Realtime Enforcement through the IF-MAP Protocol Dynamic DNS (DynDNS/DDNS) Connection establishment via Internet with dynamic IP addresses. Registration of each current IP address with an external Dynamic DNS provider. In this case the VPN tunnel is established via name assignment (prerequisite: The VPN client must support DNS resolution - NCP Secure Clients support this functionality) Extension of the Domain Name Server (DNS), reachability of the VPN client under a (permanent) name despite a varying IP address Periodic updating of DNS server with username and IP address of currently connected Client Multi Company Support Group capability, support of max. 256 domain groups (i.e. configuration of: authentication, forwarding, filter groups, IP pools, bandwidth limitation, etc.) User Administration Local user administration (up to 750 users), External authentication via OPT server RADIUS LDAP Support for LDAP over SSL Novell NDS MS Active Directory Services RADIUS, LDAP and SEM Forwarding Statistics and Logging Detailed statistics, Logging functionality, Sending SYSLOG messages Client/User Authentication Process OTP token, User and hardware certificates (IPsec) according to X.509 v.3, User name and password (XAUTH) External Authentication with LDAP Bind page 9 of 14

10 Certificates (X.509 v.3) Server Certificates Certificates can be used that are provided via the following interfaces: PKCS#11 interface for encryption tokens (USB and smart cards); PKCS#12 interface for private keys in soft certificates Creation and Distribution of Server Certificates with SEM PKI Enrollment Plug-in Transfer of SubCA Certificate Server Certificates can be queried via SNMP Revocation Lists Revocation: EPRL (End-entity Public-key Certificate Revocation List, formerly CRL), CARL (Certification Authority Revocation List, formerly ARL) Online check Automatic download of revocation lists from the CA at predefined intervals. Online check: Checking certificates via OCSP or OCSP relative to the CA over http IPsec VPN and SSL VPN Connections Transmission media LAN Direct operation on the WAN: Support of max. 120 ISDN B-channels (So, S) Line management DPD with configurable time interval Short Hold Mode Channel bundling (dynamic in ISDN) with freely configurable threshold value Timeout (controlled by time and charges) Point-to-Point protocols PPP over ISDN, PPP over GSM, PPP over PSTN, PPP over Ethernet, LCP, IPCP, MLP, CCP, PAP, CHAP, ECP Pool address management Reservation of an IP address from a pool for a defined period of time (lease time) Trigger call Direct dial of the distributed VPN gateway via ISDN, "knocking in the D-channel" page 10 of 14

11 Virtual Private Networking with IPsec Virtual Private Networking IPsec (Layer 3 tunneling), RFC-conformant MTU size fragmentation and reassembly DPD (Dead Peer Detection) NAT-Traversal (NAT-T) IPsec modes: Tunnel Mode, Transport Mode Seamless Rekeying; PFS (Perfect Forward Secrecy) Automatic Return Route Determination (ARRD) (8.10) Support for Seamless Roaming in NCP Secure Enterprise Clients Internet Society RFCs and Drafts RFC (IPsec) RFC 3947 (NAT-T negotiations) RFC 3948 (UDP encapsulation) IP Security Architecture ESP ISAKMP/Oakley IKE (v1 and v2) (8.10) IKEv2 including MobIKE. EAP protocols supported: EAP-MD5-Challenge EAP-TLS EAP-MSCHAP-V2 XAUTH IKECFG DPD NAT Traversal (NAT-T) UDP encapsulation IPCOMP (8.10) FIPS Inside The Secure Enterprise VPN Server incorporates cryptographic algorithms conformant to the FIPS standard. The embedded cryptographic module incorporating these algorithms has been validated as conformant to FIPS (certificate #1051). FIPS conformance will always be maintained when any of the following algorithms are used for establishment and encryption of the IPsec connection: Diffie Hellman Group: Group 2 or higher (DH starting from a length of 1024 Bit) Hash Algorithms: SHA1, SHA 256, SHA 384, or SHA 512 Bit Encryption Algorithms: AES with 128, 192 or 256 Bit or Triple DES Encryption Symmetric processes: AES 128,192,256 bits; Blowfish 128,448 bits; Triple-DES 112,168 bits; Dynamic processes for key exchange: RSA to 4096 bits; Diffie-Hellman Groups 1,2,5,14; Hash algorithm: MD5, SHA1, SHA 256, SHA 384, SHA 512 page 11 of 14

12 Firewall Stateful Packet Inspection IP-NAT (Network Address Translation) Port filtering LAN adapter protection VPN Path Finder NCP Path Finder Technology: Fallback IPsec/ HTTPS (port 443) if port 500 respectively UDP encapsulation is not possible. Authentication Processes IKEv1 (Aggressive and Main Mode), Quick Mode IKEv2 XAUTH for extended user authentication Support for certificates in a PKI: Soft certificates, smart cards, and USB tokens Pre-shared keys One-time passwords, and challenge response systems RSA SecurID ready. IP Address Allocation DHCP (Dynamic Host Control Protocol) over IPsec; DNS: Selection of the central gateway with changing public IP address by querying the IP address via a DNS server; IKE config mode for dynamic assignment of a virtual address to clients from the internal address range (private IP), or (8.10) IP address assignment by DHCP Data Compression IPCOMP (lzs), Deflate Other Features VPN via L2TP over IPsec for Android and IPsec for Apple ios SSL VPN Protocols SSLv1, SSLv2, TLSv1 (Application Layer Tunneling) Web Proxy (Web Applications) Access to internal web applications and Microsoft network drives via a web interface. Prerequisites for the end device: SSL-capable web browser with Java Script functionality (8.10) Single Sign-on (SSO) for SSL VPN Support for SSO in Web Proxy (Web Applications). page 12 of 14

13 Single Sign-on authentication: Web server application must require the same access data as the SSL VPN client; usernames and passwords can then be centrally managed by Active Directory, RADIUS or LDAP. Support for HTTP Authentication protocols (Basic (RFC2617), HTTP Digest (RFC2617) and NTLM (Microsoft)), or using the Post Form Method. Supported web applications: Predefined SSO configuration files for Outlook Web Access (OWA) 2003, 2007 and 2010, and CITRIX Webinterface 4.5 and 5.1. Customer specific application configurations. Secure Remote File Access (Network Sharings) Upload and download, creation and deletion of directories, corresponds approximately to the functionalities of the Windows Explorer under Windows. Prerequisites for the end device: See Web Proxy SSO functionality Network Sharing username and password can be instantiated from SSL username and password Port Forwarding Access to client/server applications (TCP/IP), including web applications. Prerequisites for the end device: SSL-capable web-browser with Java Script support, Java Runtime Environment (>= V5.0) or ActiveX, SSL Thin Client for Windows 7 (32/64 bit), Windows Vista (32/64 bit), Windows XP (32/64 bit) Support for Port Forwarding under Mac OS X (8.10) SSO Support application dependent. Support only for applications, such as RDP, which take username/password as command parameter. PortableLAN Transparent access to corporate network Prerequisites for the end device: SSL-capable web-browser with Java Script support, Java Runtime Environment (>= V5.0) or ActiveX control, PortableLAN Client for Windows 7 (32/64 bit), Windows Vista (32/64 bit), Windows XP (32/64 bit) (8.10) Virtual Private Desktop Work area (sandbox), decoupled from the underlying operating system and made available to the user by means of the SSL VPN session. Prerequisites for the end device: Microsoft Windows 7 (32/64 bit), Windows Vista (32/64 bit), Windows XP (32/64 bit) Applications tested under Virtual Private Desktop: Microsoft Word, Excel, Powerpoint, Outlook and Outlook Web Access, Adobe Acrobat Reader and Flashplayer, Foxit Reader, SSH (putty) and WinZip. Detailed OS / application support matrix available on request. page 13 of 14

14 Cache Protection for Internet Explorer V.6, 7 and 8 Required when using Internet Explorers. All transmitted data on the end device will be deleted automatically after the connection is disconnected. Prerequisites for the end device: SSL-capable web-browser with Java Script support Java Runtime Environment (>= V5.0), SSL Thin Client for Windows 7 (32/64 bit), Windows Vista (32/64 bit) or Windows XP (32/64 bit) Security Features Restriction of the Cipher Suite (only AES256-SHA or DES-CBC3-SHA or AES128-SHA) Prevention of Cross Site Scripting Other Features Extended SSL VPN Support for mobile end-user devices Configuration and User Interface (SSL VPN Start Page) The SSL service start page can be customized with company specific text and graphics Placeholders (%SSLVPNPARAMn%) simplify the customization of complex configurations page 14 of 14