Network and Security Manager (NSM) Release Notes DMI Schema

Transcription

1 Network and Security Manager (NSM) Release Notes DMI Schema Release version 280 ver , Sept 30, 2013 Juniper Networks, Inc North Mathilda Avenue Sunnyvale, CA USA

2 Version Summary Juniper Networks Network and Security Manager (NSM) is a software application that centralizes control and management of your Juniper Networks devices. With Network and Security Manager, Juniper Networks delivers integrated, policy-based security and network management for all security devices and other Juniper Networks devices in your networks. Network and Security Manager uses the technology developed for Juniper Networks ScreenOS to enable and simplify management support for previous and current versions of ScreenOS and now for Junos Software. By integrating management of all Juniper Networks devices, Network and Security Manager enhances the overall security and manageability of the Internet gateway Addressed Issues: None Known Issues: In the NSM UI, the group selector panels titled Members/Non-Members map to the panels titled Available/Selected or Available List/Selected List in the SA or Infranet Controller admin UI. (55674) Identifier names (names of key fields) in the SA and Infranet Controller configuration, such as the names or realms, roles, sign-in URLS, sign-in pages and so forth, cannot be changed through the NSM UI. This is correct NSM behavior. However, identifier names can be changed through the SSL VPN SA and Infranet Controller Web UI. (57104) Selection of multiple objects is not available through the NSM UI, even though this capability is available on the SA and Infranet Controller admin UI in multiple places. (57190) The SA and Infranet Controller admin UI allows duplication of objects such as roles or resource profiles. This capability does not exist in the NSM UI. (55527) The default value of Network Connect option in the SA template's User role is not validated to its correct default value by NSM.(570650) After a device reboot, NSM status may change to "Device Changed". The workaround is to execute "Import Device" from NSM after the device reboot. (722250) If the administrator configures virtual ports for the external interface when the external interface is disabled, NSM accepts the configuration without any validation errors. However, when the configuration is pushed to the device, device-side validation fails and the device throws an error, resulting in a failed config update from NSM. (58625) When configuring IP address for virtual ports, no validation check is performed on the NSM side. When the configuration is updated to the SA device, an error will be generated if the IP address is invalid. (58627) In NSM, administrators are allowed to edit virtual ports settings from the Passive node, provided the Cluster license is installed on that node. (59215) When configuring Host Checker registry check rule types via NSM, the input type validation is not completed for DWORD and binary registry values. (384845) DMI Schema Release 2

3 If an SA 7.0R1 device is added to NSM r1 or , after first import, they will see a configuration validation error at Resource policies > General > Kerberos Intermediation. The workaround is to create a dummy realm under Kerberos realm definition and attach it to Kerberos intermediation, but this workaround can only be applied if Kerberos SSO is not employed in the customer s deployment. (485829) Through NSM, User is able to update Secure Meeting configuration on SA service successfully even if SMTP Login and SMTP Password are invalid. (59632) Discrepancy between NSM UI and IVE admin UI : On the NSM UI, if the admin performs the following steps: - Edit configuration, Go to Users->Resource Policies->Web->General->Kerberos->Kerberos Intermediation and enable 'Fallback to NTLM V2' option. - Go to Users->Resource Policies->Web->Basic Auth/NTLM SSO. - Create a new policy with Authentication type as Kerberos. - Then: 'Default' value is not present for the Label option. However, a similar workflow when performed on the IVE admin UI results in the 'Default' value being present in the dropdown. To work around this issue, the NSM administrator needs to manually enter the value for the Label field. (464103) Through NSM, if user selects Sequential room number with prefix option, and leaving a blank value, an error is thrown Meeting room number prefix cannot by empty. In spite of this error, if the configuration is pushed to the SA through update device, then the following results may happen depends on the configuration of the IVE: (384371) - In the Admin UI, if the Meeting Name is set to User, then update device will fail with the error Please specify a Room for the Meeting Name. This is the expected behaviour, as described in the bug description. - In the Admin UI, if the Meeting Name is set to Expression, then the update device will succeed. But the result is wrong, as described in the comment 5. The Meeting Name will be set to Sequential Room with prefix, but the value of the prefix will be incorrect. NSM does not support the EGA license version of the Access Control Service. (525179) When the X-auth server setting in a ScreenOS Infranet Enforcer is changed from NSM and updated, during IPSec resource access from the endpoint, IPSec access might not resume just by Refreshing policy Actions from the Admin UI. Issue the exec infranet controller disconnect/exec infranet controller connect command from the ScreenOS Firewall CLI to regain access. (516799) When creating a new or modifying an existing sign-in policy from NSM, a trailing '/' must be appended to the sign-in URL. For example, '/test-url/' instead of '/test-url' as would be entered in the web admin UI. (442853) The user expiration field should come after the password field for Local authentication of new users in NSM UI. (411366) When creating new Sign In pages from NSM for IC Series device, the Default Portal name is "Secure Access SSL VPN" instead of " IC Series device ". (440128) When configuring a sensor from NSM, you must assign a One Time Password. (417136) When importing an IC Series device Active/Active cluster into NSM, log synchronization should be enabled to ensure logs are properly sent. (386132) DMI Schema Release 3

4 Using NSM, applying a template promoted from one cluster to another might fail if the Sensor OTP field is left blank. (385985) No validation exists in the NSM client when entering a value for System->Configuration- >Global security->settings->lockout period. As a result, updating the device fails if you enter an invalid value. Valid range is minutes. (384524) The default NSM Agent configuration port should be set to This setting is found on the Configuration > NSM Agent > NSM Settings > Primary port page. (380220) If a device is added to NSM and the platform is not specified correctly (e.g. adding an IC4000 as an IC4500), the device could cause high CPU utilization. The workaround is to specify the correct platform when adding the device to NSM. (385121) Host Checker Statement of Health rule types are visible within NSM client even if SOH license not installed on IC. (384841) When configuring RADIUS Parameters within NSM, there is no option for creating "Custom challenge expressions". (383475) When configuring RADIUS Attribute Policies within NSM, it is not possible to modify the values of existing attributes. Attributes should be deleted and re-created if changing the value within NSM is required. (406154) Management of 'Active Directory' mode AD auth server configuration from NSM is not supported. (747864) In NSM, the error page "java.lang.nullpointerexception" might be displayed when you are editing the IC Series device configuration. This happens in rare scenarios. The workaround is to load schema manually after applying it. (810435) PR EX devices loaded with 11.2 and above is unable to configure server-reject-vlan option under Dot1x properly. PR Serial Number is not displayed for SRX110 device under Hardware inventory Chassis information. PR Firmware upgrade though NSM for 11.4R7.5, 12.1R2, 12.2R1 from specific releases are failing is failing on EX. This is a regression issue due to fix of device side PR , which is applicable only for ex devices. Unlink option while image update is removed on ex devices due to which ex devices throws an error while performing image update option from NSM, since NSM sends unlink option by default for common Junos platforms. The unlink option is removed from 11.4R3, 12.1R2, 12.2R1 build onwards, so the image upgrade will not work from NSM, if one of these images are loaded on ex box, e.g; image upgrade from NSM for 11.4R5.5 to 11.4R7.5 will fail, but it will pass for 11.4R2.14 to 11.4R7.5, similarly image upgrade for 11.4R6.6 to 12.2R3.5 will fail, but it will pass for 11.4R1.6 to 12.2R3.5. Device team has reverted this code which will reflect from next junos version for i.e; 12.1R6, 12.2R4 and 12.3R2 as per mentioned in AT#126 in PR [Workaround : Perform image upgrade through CLI and Adjust OS through NSM.] PR character n in full-name field under system->login->user is giving validation errors [Workaround :- Avoid using alphabet n for m/mx 12.1 and 12.2 series, also ex 12.x series.] PR : Device version is shown as 12.1X44.4 instead of 12.1X44-D10.4. Workaround - Immediate import is required after firmware upgrade to 12.1X44-D10.4 from NSM else diff will be observed. PR After successful completion of Summarize config on SRX5600 Cluster shows DMI Schema Release 4

5 Description as "connecting to Device server", Completion as 50% & in summary "Reached limit, more lines are truncated." PR NSM shows wrong Port range under Nat-pool PR NSM shows wrong defaults values in device editor for SRX devices PR unable to add Ex4300 series devices PR [NSM]Device update fails on J-series device when using ICMPv6 predefined service on NSM rules Added Support: Junos R15.1, 11.4R9.4 Junos-es R15.1, 11.4R9.4 Junos-ex R15.1, 11.4R9.4 Removed Support: None DMI Schema Release 5

6 Supported releases This DMI schema update supports the following device code releases: Note: Junos 10.4R2 will not be supported. Junos 11.2R2 will not be supported. Junos Service Releases have limited support in NSM. Junos Service Release device CLI changes will not be supported in NSM. SA 7.0r7 and 7.1r3 do not have published schema and will not be supported from NSM. Please refer to the SA release notes for more details. Device Family J/SRX family JunOS version Release R1.9, 12.1R2.9, 12.1R3.5,12.1R3.6,12.1R4.7, 12.1R4.8,12.1X44-D10.4, 12.1R5.5, 12.1X44-D15.5, 12.1R6.5, 12.1X45-D10, 12.1R7.9, 12.1X44-D20.3 Release R1.6, 11.4R2.14, 11.4R2.15, 11.4R3.7, 11.4R4.4, 11.4R4-S1.2,11.4R4-S2, 11.4R5.5, 11.4R6.5,11.4R6.6, 11.4R7.5, 11.4R8.4, 11.4R9.4 Release R1.10, 11.2R3.3, 11.2R4.3, 11.2R5.4, 11.2R6.3, 11.2R7.4 Release R1.14, 11.1R2.3, 11.1R3.5, 11.1R4.4, 11.1R6.4 Release R1.9, 10.4R3.4, 10.4R4.5, 10.4R5.5, 10.4R6.5, 10.4R7.5, 10.4R8.5, 10.4R9.2, 10.4R10.7, 10.4R11.4, 10.4R12.1, 10.4R13.4, 10.4R14.2, 10.4R15.1 Release R1.9, 10.3R2.11, 10.3R3.7, 10.3R4.4 Release R2.11, 10.2R4.8 Release R1.8, 10.1R2.8, 10.1R3, 10.1R4.4 Release R1, 10.0R2, 10.0R3, 10.0R4 Release R1, 9.3R2, 9.3R3, 9.3R4 DMI Schema Release 6

7 M/MX Release X50-D10.2 Release R1.7, 12.3R2.5, 12.3R3.4 Release R1.8, 12.2R2.4, 12.2R2.5, 12.2R3.5, 12.2R4.5, 12.2R5.3 Release R1.9, 12.1R2.9, 12.1R3.5, 12.1R3.6, 12.1R4.7, 12.1R4.8, 12.1R5.5, 12.1R6.5, 12.1R7.7 Release R1.6, 11.4R2.14, 11.4R2.15, 11.4R3.7, 11.4R4.4, 11.4R5.5, 11.4R6.5,11.4R6.6, 11.4R7.5, 11.4R8.4, 11.4R9.4 Release R1.10, 11.2R3.3, 11.2R4.3, 11.2R5.4, 11.2R6.3, 11.2R7.4 Release R1.14, 11.1R2.3, 11.1R3.5, 11.1R4.4, 11.R6.4 Release R1.9, 10.4R3.4, 10.4R4.5, 10.4R5.5, 10.4R6.5, 10.4R7.5, 10.4R8.5, 10.4R9.2, 10.4R10.7, 10.4R11.4, 10.4R12.1, 10.4R13.4, 10.4R14.2, 10.4R15.1 Release R1.9, 10.3R2.11, 10.3R3.7, 10.3R4.4 Release R2.11, 10.2R4.8 Release R1.11, 10.1R1.8, 10.1R2.8, 10.1R3, 10.1R4.4Release 10.1 Release R1, 10.0R2, 10.0R3, 10.0R4 Release R1, 9.3R2, 9.3R3, 9.3R4 DMI Schema Release 7

8 Device Family EX Junos-QFX Release X50-D10.2 JunOS version Release R1.7, 12.3R2.5, 12.3R3.4 Release R1.8, 12.2R2.4, 12.2R2.5, 12.2R3.5, 12.2R4.5, 12.2R5.3 Release R1.9, 12.1R2.9, 12.1R3.5, 12.1R3.6, 12.1R4.7, 12.1R4.8, 12.1R5.5, 12.1R6.6, 12.1R7.7 Release R1.6, 11.4R2.14, 11.4R2.15, 11.4R3.7, 11.4R4.4, 11.4R5.5, 11.4R5.7, 11.4R6.5, 11.4R6.6, 11.4R7.5, 11.4R8.5, 11.4R9.4 Release R1.7,11.3R2.4, 11.3R3.2, 11.3R4.2, 11.3R5.3, 11.3R6.2, 11.3R7.1 Release R1.2, 11.2R3.3, 11.2R4.3, 11.2R5.4, 11.2R6.3, 11.2R7.4 Release R1.14, 11.1R2.3, 11.1R3.5, 11.1R4.4, 11.1R6.4 Release R1.9, 10.4R3.4, 10.4R4.5, 10.4R5.5, 10.4R6.5, 10.4R7.5, 10.4R8.5, 10.4R8.6, 10.4R9.2, 10.4R10.7, 10.4R11.4, 10.4R11.5, 10.4R12.1, 10.4R12.4, 10.4R13.4, 10.4R14.2, 10.4R15.1 Release R1.9, 10.3R2.11, 10.3R3.7, 10.3R4.4 Release R2.11, 10.2R4.8 Release R1.8, 10.1R2.8, 10.1R3, 10.1R4.4 Release R1, 10.0R2, 10.0R3, 10.0R4 Release R1, 9.3R2, 9.3R3, 9.3R4 Release R1.7 Device Family Secure Access JunOS version Release R1->7.4R3 Release R1, 7.3R3 Release R1.1, 7.2R3 Release R1, 7.1R2, 7.1R4,7.1R6 Release R1, 7.0R3, 7.0R6 Release R1, 6.5R2, 6.5R3, 6.5R4, 6.5R5, Release R7, 6.5R9, 6.5R10, 6.5R11 Release R1, 6.4R2, 6.4R3, 6.4R4, 6.4R5 Release R1,6.3R2, 6.3R3, 6.3R5, 6.3R6, 6.3R7 DMI Schema Release 8

9 Infranet Controller Junos - MAG Release R1, 4.4R3 Release R1, 4.3R3 Release R1.1 Release R1, 4.1R2, 4.1R6 Release R1, 4.0R3 Release R1, 3.1R2, 3.1R3, 3.1R4, 3.1R5, 3.1R7 Release R1, 3.0R2, 3.0R3 Release R1, 2.2R2, 2.2R3, 2.2R4 Release R2.8 Release R1.2, 11.1R1.14 DMI Schema Release 9

10 NSM releases are bundled with specific versions of Schema. All listed versions of NSM can be upgraded to the latest schema. NSM Release Bundled Schema version NSM Version 256 NSM Version 233 NSM Version 222 NSM Version 166 NSM Version 158 NSM Version 143 NSM Version 134 NSM Version 119 NSM r1 Version 87 NSM r2 Version 66 DMI Schema Release 10

11 Schema Update considerations Online Schema update KB12561 Offline Schema update KB12756 Before the Schema is applied on the NSM servers, the below changes may need to be performed. These changes are required on and versions of NSM. These changes may also be required when upgrading to a later NSM version. 1. Login to the NSM GUI Server & edit the /usr/netscreen/guisvr/var/guisvr.cfg Modify the line that looks as below guisvrdirectivehandler.max.heap to guisvrdirectivehandler.max.heap Login to the NSM Device Server & edit the /usr/netscreen/devsvr/var/devsvr.cfg Modify the line that looks as below devsvrdirectivehandler.max.heap to devsvrdirectivehandler.max.heap Login to the NSM Dev Server & edit the file /usr/netscreen/devsvr/var/be/cfg/swrpcinfo.prop Modify the below parameters to new values as shown below: get-re-info.response.retry=60 request-package-add.response.retry=10 request-reboot.response.retry=10 file-put.response.timeout=120 file-put.response.retry=10 (may be set as high as 40 if upgrade is timing out) These changes are required due to the increased JUNOS image sizes. 4. Stop all the NSM processes Non-HA environment HA environment /etc/init.d/hasvr stop /etc/init.d/guisvr stop /etc/init.d/devsvr stop /etc/init.d/hasvr stop DMI Schema Release 11

12 5. Start all the processes Non-HA environment HA environment /etc/init.d/guisvr start /etc/init.d/devsvr start /etc/init.d/hasvr start /etc/init.d/hasvr start 6. On the client we need to update the heap size Go to C:\Program Files\Network and Security Manager/ Edit NSM.lax file & modify the heap size to the below values lax.nl.java.option.java.heap.size.initial=48m to lax.nl.java.option.java.heap.size.initial=64m lax.nl.java.option.java.heap.size.max=768m to lax.nl.java.option.java.heap.size.max=1280m Getting Help For more assistance with Juniper Networks products, visit: Juniper Networks provides maintenance releases (updates and upgrades) for NSM software. To have access to these releases, you must register your NetScreen devices and NSM application with Juniper Networks at the above web address. Copyright 2007 Juniper Networks, Inc. All rights reserved. Juniper Networks and the Juniper Networks logo are registered trademarks of Juniper Networks, Inc. in the United States and other countries. All other trademarks, service marks, registered trademarks, or registered service marks in this document are the property of Juniper Networks or their respective owners. All specifications are subject to change without notice. Juniper Networks assumes no responsibility for any inaccuracies in this document or for any obligation to update information in this document. Juniper Networks reserves the right to change, modify, transfer, or otherwise revise this publication without notice. No part of this document may be reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose, without receiving written permission from: Juniper Networks, Inc. ATTN: General Counsel 1194 N. Mathilda Ave. Sunnyvale, CA U.S.A. DMI Schema Release 12