Aruba VIA Windows Edition

Transcription

1 Aruba VIA Windows Edition a Hewlett Packard Enterprise company Release Notes

2 Copyright Information Copyright 2018 Hewlett Packard Enterprise Development LP. Open Source Code This product includes code licensed under the GNU General Public License, the GNU Lesser General Public License, and/or certain other open source licenses. A complete machine-readable copy of the source code corresponding to such code is available upon request. This offer is valid to anyone in receipt of this information and shall expire three years following the date of the final distribution of this product version by Hewlett Packard Enterprise Company. To obtain such source code, send a check or money order in the amount of US $10.00 to: Hewlett Packard Enterprise Company Attn: General Counsel 3000 Hanover Street Palo Alto, CA USA 2 Aruba VIA Windows Edition Release Notes

3 Contents Contents 3 Revision History 5 Release Overview 6 About VIA 6 Chapter Overview 6 Contacting Support 6 What s New in This Release 7 Features Introduced in VIA GUI Displays Enhanced Certificate Store Data 7 Resolved Issues in VIA Features Introduced in Previous Releases 9 Features Introduced in VIA Access to local resources are differentiated in full tunnel mode 9 Features Introduced in VIA Importing connection profiles offline 9 Certificate-based authentication for profile downloads 9 Connection and failover in a restricted environment 10 Certificate filtering for profile download 10 Certificate filtering criteria for connection 10 Pre-provision VIA with multiple VPN Gateway info 10 Marking outgoing packets with ToS bits 10 Features Introduced in VIA Multi-Profile Support 10 Features Introduced in VIA VIA User Interface 11 Aruba VIA Windows Edition Release Notes Contents 3

4 Issues Fixed in Previous Releases 11 Resolved Issues in VIA Resolved Issues in VIA Resolved Issues in VIA Issues Resolved in VIA Issues Resolved in VIA Issues Resolved in VIA Issues Resolved in VIA Issues Resolved in VIA Issues Resolved in VIA Known Issues in Previous Releases 20 Known Issues in VIA Contents Aruba VIA Windows Edition Release Notes

5 Revision History The following table lists the revisions for this document. Table 1: Revision History Revision Date Change Revision 01 February 2018 Initial Release Aruba VIA Windows Edition Release Notes Contents 5

6 Release Overview Aruba VIA is software patch release that introduces fixes to issues identified in previous releases of Aruba VIA Windows Edition. For more details on the features supported in this release, see the Aruba VIA Windows Edition User Guide. About VIA Virtual Intranet Access (VIA) is part of the Aruba remote networks solution targeted for teleworkers and mobile users. VIA detects the network environment (trusted and untrusted) of the user and automatically connects the user to the enterprise network. A trusted network refers to a protected office network that allows users direct access to the corporate intranet. Untrusted networks are public Wi-Fi hotspots such as airports, cafes, or home networks. Chapter Overview What s New in This Release on page 1 describes the new fixes and enhancements introduced in VIA Features Introduced in Previous Releases on page 9 describes new features introduced in previous releases. Issues Fixed in Previous Releases on page 11 describes the known issues that were resolved in previous releases. Known Issues in Previous Releases on page 20 describes known issues identified in previous releases. Contacting Support Table 2: Contact Information Main Site Support Site Airheads Social Forums and Knowledge Base North American Telephone International Telephone Software Licensing Site End-of-life Information Security Incident Response Team arubanetworks.com support.arubanetworks.com community.arubanetworks.com (Toll Free) arubanetworks.com/support-services/contact-support/ hpe.com/networking/support arubanetworks.com/support-services/end-of-life/ Site: arubanetworks.com/support-services/security-bulletins/ sirt@arubanetworks.com Aruba VIA Windows Edition Release Notes Release Overview 6

7 What s New in This Release Features Introduced in VIA GUI Displays Enhanced Certificate Store Data In the VIA Client GUI, the Certificate section of the VPN Profile tab displays additional information for certificates, and now indicates whether a certificate is in the machine certificate store and globally available to all users on the device. Figure 1 Certificate List Showing Certificate Store Data Resolved Issues in VIA The following issues are resolved in VIA Table 3: VIA Fixed Issues Symptom: When a VIA VPN client attempted to send traceroute messages, the controller did not respond to traceroute diagnostics with the expected ICMP expired in transit message. Scenario: The issue occurred when a controller failed to properly handle packets with a lower time- tolive (TTL) value when processing them through a VIA VPN, dropping packets with a TTL value equal to or lesser than 2. This issue and resolved by improvements to how VIA manages the TTL value of outgoing Encapsulating Security Payload (ESP) packets. Symptom: In previous releases of VIA, VIA clients connected in full-tunnel mode could incorrectly send and receive traffic from the local default gateway or other devices in the same subnet as the default gateway. Scenario: Improvements in VIA ensure that all local subnet traffic to and from a client using fulltunnel mode is securely routed through the VPN tunnel. Aruba VIA Windows Edition Release Notes What s New in This Release 7

8 Table 3: VIA Fixed Issues Symptom: Clients were not able to authenticate to the network with VIA smart card authentication using a certificate with a PIN. Scenario: Improvements to VIA certificate selection resolves an issue identified in an earlier release of VIA, where clients were unable to authenticate to network using a smart card with a certificate and a PIN, causing the transaction to fail. Symptom: When a client attempted to download a VIA profile using RSA SecurID next token authentication, the profile failed to download. Scenario: Improvements in VIA ensures that the VIA client sends the correct VIA authentication profile information during the connection attempt, ensuring that the correct authentication server and server group verifies the password generated by the RSA token. 8 What s New in This Release Aruba VIA Windows Edition Release Notes

9 Features Introduced in Previous Releases This chapter describes the new features and enhancements introduced in previous releases of VIA Windows Edition. Features Introduced in VIA This section describes the features and enhancements introduced in VIA Windows Edition. Access to local resources are differentiated in full tunnel mode VIA clients can now access resources over the tunnel that are in the same network addressing range as the local network in full tunnel mode. If a VIA client and another machine are connected to the same router, the second machine was preventing access to similar addressed devices in the enterprise. The change in application behavior now ensures all network access requests go through the tunnel mode setup. Features Introduced in VIA This section describes the features and enhancements introduced in VIA Windows Edition. Importing connection profiles offline Clients can now import connection profiles offline by downloading an.xml file containing a valid VIA connection profile. To import a connection profile while offline: 1. Navigate to and log in using your VIA credentials. 2. After successfully logging in, navigate to 3. Save the XML file returned by the controller to the following location: %appdata%aruba Networks\VIA\. 4. Rename the file as profile.xml. 5. Upon startup, if the connection profile has not already been provisioned, VIA will load it from profile.xml. If auto-login is enabled in the new profile, the device will automatically connect to VIA after installation is complete. Certificate-based authentication for profile downloads In versions prior to VIA 3.2.0, the client must provide their user credentials as part of the https communication with the controller in order to download a VIA profile. This feature allows the client to authenticate automatically when a valid certificate is presented to the controller with standard ssl/tls key exchange and certificate validation rules. When a certificate-based profile is configured on a controller, VIA will attempt to authenticate the client certificate, while downloading the initial connection profile from the controller. A client certificate used to download a VIA profile can also be used during IKE connections. When enabled through the save credential settings in the VPN connection profile, the prompt for certificate selection is skipped. Instead the certificate associated with the connection profile is used to authenticate the client. Aruba VIA Windows Edition Release Notes Features Introduced in Previous Releases 9

10 This feature is supported in ArubaOS 8.1 onwards. Connection and failover in a restricted environment In versions prior to VIA 3.2.0, a connection with the VPN can not be establish if external port 443 is blocked. A VPN tunnel can be established from port 4500 when port 443 is blocked and allows the controller to failover to another configured controller if port 4500 is accessible. Certificate filtering for profile download In VIA 3.2.0, when a client attempts to download a profile using the certificate as authentication (this can be achieved by enabling the certificate-based authentication for profile downloads feature introduced in this release), instead of displaying all of the available certificates for the end user to select, VIA will display only those certificates that are filtered by administrator. The filtering criteria shall be defined in the XML file. If the filter results in a single certificate, VIA uses the certificate without any further user intervention. Certificate filtering criteria for connection In versions prior to VIA 3.2.0, when clients attempt to connect with a profile using a certificate for authentication, it displays all the available certificates for the end user to select. This approach does not allow the administrator control over which certificates are presented to the client. In VIA 3.2.0, the administrator can edit this criteria to manage which certificates a client is allowed to view/select. This criteria shall be configured in the Certificate Criteria entry under the connection profiles in the controller. This feature is supported in ArubaOS 8.1 onwards. Pre-provision VIA with multiple VPN Gateway info This feature allows an administrator to preload the VIA Installer with preselected controller addresses. Upon installation, VIA will automatically have the list of controller addresses from which it can download the profiles. Refer to user guide for more details. Marking outgoing packets with ToS bits This feature provides the ability to mark outgoing IKE and ESP packets with custom DSCP. This can be configured on controller under the VIA connection profile. A new knob tos_dscp can be used to mark custom DSCP, supporting values from 0 to 63. When a VIA client downloads the connection-profile, this value will also get pushed out. VIA will set the configured DSCP value to outer IP header's ToS byte. Please note that this feature is supported in ArubaOS onwards, however, it is unavailable for ArubaOS 8.x versions. Features Introduced in VIA This section describes the features and enhancements introduced in VIA Windows Edition. Multi-Profile Support VIA introduces multi-profile support, which allows users to select a VPN profile from the list of existing profiles during VPN profile download. Upon installing and launching VIA, users can either select an existing profile from the VPN Server list or download a new VPN profile manually. If the user downloads a profile manually, the new profile is automatically added to the VPN Server list. 10 Features Introduced in Previous Releases Aruba VIA Windows Edition Release Notes

11 Features Introduced in VIA This section describes the features and enhancements introduced in VIA Windows Edition. VIA User Interface VIA introduces a new User Interface (UI). For more details, see the ArubaVIA Windows Edition User Guide. Ensure the.net Framework 4 or later version is installed before installing or upgrading to VIA Chapter 3 Issues Fixed in Previous Releases The following issues were fixed in the previous releases of VIA: Resolved Issues in VIA The following issues are resolved in VIA Table 4: VIA Fixed Issues Symptom: VIA did not display an appropriate message when a new token is needed for authentication. Scenario: If a user enters three consecutive incorrect passwords, the RSA token/duo requires that the user enter the correct token code twice for authentication to succeed. Starting with VIA 3.2.1, the GUI displays the following text message informing users about this issue: Wait for token to change, then enter the new token code Symptom: VIA Smartcard authentication fails to admit users with valid certificate and PIN credentials. Scenario: This issue was observed in VIA when users attempted to sign in using Smartcard authentication. Resolved Issues in VIA The following issues are resolved in VIA Aruba VIA Windows Edition Release Notes Issues Fixed in Previous Releases 11

12 Table 5: VIA Fixed Issues Symptom: Clients were unable to use the following CLI commands to connect, disconnect, and exit from VIA: connect disconnect exit Scenario: This issue was observed in all versions prior to Symptom: When a client attempts to login from a non-domain device, VIA becomes stuck in the connection phase. During this time, the Connect/Disconnect button appears gray and is inactive when the user selects it. Scenario: This issue was observed in VIA Symptom: Clients running a 64-bit version of Windows 7 were randomly unable to connect to VIA after selecting a certificate during authentication. In rare cases, the certificate selection prompt might reoccur until the window was closed. Scenario: This issue was observed in VIA Symptom: Clients running Windows 7 or 10 experience random spikes in memory usage from the process arubantsvc.exe while disconnected from VIA. Scenario: This issue was observed in VIA Resolved Issues in VIA The following issues are resolved in VIA Table 6: VIA Fixed Issues Symptom: VIA was unable to download VPN profiles while connecting to a Dell controller image. Scenario: This issue was observed in VIA Symptom: VIA UI logs displayed the incorrect time format between the hours of 1200 and Scenario: This issue was observed in VIA Symptom: Domain Pre-Connect (DPC) failed to initiate when users rebooted or logged off their devices after establishing an IPsec connection. Scenario: This issue was observed in VIA Symptom: VIA crashed during VPN profile download. Scenario: This issue was observed in VIA when users attempted to establish a VPN connection using a server URL (FQDN) on devices running Windows 7 or Windows Issues Fixed in Previous Releases Aruba VIA Windows Edition Release Notes

13 Issues Resolved in VIA The following issues are resolved in VIA : Table 7: VIA Fixed Issues Symptom: After VIA was upgraded and if network was not reachable, the Expected status code , got 404 error was displayed. Changes to the internal code resolves this issue. Scenario: This issue was observed when VIA is upgraded with a profile where Client Auto Login was enabled. This issue was observed in VIA Symptom: The structure of VIA logs was complex. This issue was resolved by simplifying the structure of the logs. Scenario: This issue was observed in VIA or later Symptom: VIA failed to refresh the connection profile configuration after changes were made. Changes to the internal code resolves this issue. Scenario: This issue was observed when changes were made to the configuration in the connection profile and failed to refresh although disconnect and connect was performed on the profile. This issue was observed in VIA Symptom: The macviainstaller.pkg file failed to install VIA on Mac OS X machines. Changes to the internal code resolves this issue. Scenario: This issue was observed when the user moved the VIA application folder from the Application directory to another location. This issue was observed in VIA Symptom: The Disconnect button established a VIA connection instead of disconnecting. Changes to the internal code resolves this issue. Scenario: This issue was observed when the Client Auto Login parameter was enabled in the controller. This issue was observed in VIA Symptom: Slow network trust detection was observed. Changes to the internal code resolves this issue. Scenario: This issue was observed when VIA performed network trust detection after a profile download or on a network event. This issue was observed in VIA Symptom: VIA failed to rekey and dropped the tunnel after the expiry of the configured lifetime value. Changes to the internal code resolves this issue. Scenario: This issue occurred when IKE and IPSec lifetime were set in the profile. This issue was not limited to a specific Mac OS X version Symptom: The 802.1X authentication dialog is different for different profiles. Changes to the internal code ensures consistency in the dialog for all profiles. Scenario: This issue was observed when the 802.1X authentication dialog displayed on the IKEV1 PSK/RSA was different from the dialog displayed on the IKEV2 MSCHAP profile. This issue was observed in VIA Symptom:VIA failed to connect to EAP-TLS profile when connected in SSL-fallback mode Changes to the internal code ensures that VIA connection is successful. Scenario: This issue was observed when the port 4300 was blocked on the client machine or controller that tried to connect through EAP-TLS. This issue was observed in VIA Symptom: The Diagnostic tab of VIA GUI showed the message Configuration download failed even after VIA connection was successful. Changes to the internal code ensures that this message does not appear. Scenario: This issue occurred because the Configuration Refresh feature failed to work correctly. This issue was observed in VIA Aruba VIA Windows Edition Release Notes Issues Fixed in Previous Releases 13

14 Table 7: VIA Fixed Issues Symptom:VIA deleted the unused connection profiles. Changes to the internal code resolves this issue. Scenario: This issue was observed when a profile with multiple connection profiles was downloaded but only one connection profile was used to connect and the remaining unused connection profiles were deleted. This issue was observed in VIA Symptom:VIA uninstallation failed on Mac OS X machines. Changes to the internal code resolves this issue. Scenario:This issue was observed when running macviauninstaller.sh for uninstalling VIA. This issue was observed in VIA Symptom:VIA performed trust detection even when VIA connection was disconnected. Changes to the internal code fixed this issue. Scenario:This issue was observed when the Network Trust Detection process was triggered after the Disconnect button was clicked in VIA. This issue was observed in VIA Symptom: VIA connection failed for credential mismatch when Save Password was enabled in the controller. This issue is resolved by prompting the user to reenter the credentials if a credential mismatch occurrs even when Save Password is enabled in the controller. Scenario: This issue was observed when the saved credentials were different from the ones required for authentication. This issue was observed in VIA Symptom:VIA client rejected a server certificate as bad_certificate in EAP-TLS authentication. This issue is resolved by removing the key usage check for CA certificate validation and by adding the digital signature check instead of key-agreement or key-encipherment check for key usage extension of server certificate validation. Scenario: This issue was observed when the CA certificate did not have a key usage extension or when the server certificate did not contain key-agreement or key-encipherment flag in the key usage extension. This issue was observed in VIA Symptom: VIA prompted for user credentials when connect or disconnect action was performed. Changes to the internal code resolves this issue. Scenario: This issue was observed in VIA Issues Fixed in Previous Releases Aruba VIA Windows Edition Release Notes

15 Issues Resolved in VIA The following issue is resolved in VIA : Table 8: VIA Fixed Issues Symptom: EC certificate import functionality through VIA on Mac OS X clients failed to work correctly. This issue is resolved by updating the security command used to import an EC certificate. Scenario: This issue was observed on Mac OS X , , and clients Symptom: VIA connectivity was lost after 5 minutes of inactivity. This issue is resolved by making internal code changes. Scenario: This issue was observed when VIA tunnel was inactive for more than 5 minutes. Inactivity occurred when no traffic passed through the VIA tunnel. This issue is not limited to a specific Mac OS X or VIA version Symptom: The VIA GUI displayed Detecting Network category status message even after clicking the Disconnect button in the Connection Details tab. This issue is fixed by detecting VIA connection events and displaying the appropriate status message. Scenario: This issue was observed on Mac OS X clients with VIA Aruba VIA Windows Edition Release Notes Issues Fixed in Previous Releases 15

16 Issues Resolved in VIA The following issues are resolved in VIA : Table 9: VIA Fixed Issues Symptom: When a user installed VIA the Unidentified Error message was displayed. This issue is resolved by making code level changes to the VIA installer and the VIA app to override the warning message. Scenario: This issue was observed in systems running Mac OS X 10.8 and 10.9 with VIA Symptom: Users found it difficult to update Access Control List (ACL) for certificates already present in the Keychain Access application. This issue is resolved by adding a shortcut for the VPN agent and a home folder to enable users to easily update the ACL for certificates. Scenario: This issue was observed in systems running Mac OS X 10.8 and 10.9 with VIA Symptom: VIA 2.0 edition did not support SSL fallback option with IKEv1 communication. This issue is fixed in the latest release of VIA 2.0 that supports SSL fallback functionality. Scenario: This issue was observed in Mac VIA 2.0 edition. The client did not support SSL fallback option with IKEv1 communication. This issue was observed on controllers running ArubaOS 6.2 and Issues Fixed in Previous Releases Aruba VIA Windows Edition Release Notes

17 Issues Resolved in VIA The following issues were fixed in VIA : Table 10: VIA Fixed Issues Symptom: VIA client requested authentication password every time the VIA configuration was changed and the VIA user interface cames up. This issue is resolved by not requesting for the authentication password when the VIA configuration is changed. Scenario: This issue was observed in VIA 2.0 client running on Mac OS X 10.7.x and 10.8 and was not limited to a specific controller model Symptom: The assigned IP address and Packet sent/received options under Connection Details tab were blank even after successful VIA connection when the client resumed from sleep mode. This issue is resolved by updating the IP address and Packet Sent/Received fields when the client resumes from sleep mode. Scenario: The issue was observed when client resumed from its sleep mode. The VIA connection was successful but the IP address and status options were shown blank. The issue occurred in Mac VIA 2.0 client version and it not limited to a controller specific model Symptom: The Mac user interface crashed when the client resumed from the sleep mode. Checks to the null string resolves the issue. Scenario: The issue was observed when client resumed from sleep mode and the VIA profile was not available. Due to this, the Mac user interface crashed. The issue occurred in VIA 2.0 client version and it was not limited to a specific controller model. Aruba VIA Windows Edition Release Notes Issues Fixed in Previous Releases 17

18 Issues Resolved in VIA The following issue was fixed in VIA : Table 11: VIA Fixed Issues Symptom: After resuming from sleep mode, the VIA status showed as connected but the internal network was not reachable. This issue is resolved by modifying the internal VPN services, where-in VIA automatically disconnects when it enters the sleep mode and reconnects when it resumes from the sleep mode. Scenario: After connecting to VIA 2.0 Mac edition if it was put in the sleep mode and when VIA comes back from this mode the status is showed as connected. But the users were unable to access the internal network. This was a rare issue and is not specific to any controller model or software version. 18 Issues Fixed in Previous Releases Aruba VIA Windows Edition Release Notes

19 Issues Resolved in VIA The following issues were fixed in VIA : Table 12: VIA Fixed Issues Symptom: VIA was not able to create a secure connection in an untrusted network. Scenario: This issue occurred when upgrading the VIA client to 2.0. VIA performs a check for trusted and untrusted network and though the network is untrustworthy, it does not establish an IPSec connection Symptom: The VIA client did not respond during disconnection phase. Scenario: This issue occurred when the user clicked Disconnect and VIA took a long time to disconnect. Aruba VIA Windows Edition Release Notes Issues Fixed in Previous Releases 19

20 Known Issues in Previous Releases The following table describes known issues and limitations observed in previous releases of VIA Windows Edition. Applicable workarounds are included, when available. Known Issues in VIA The following issues are observed in VIA Applicable workaround is included. Table 13: VIA Known Issues Symptom: The old VIA app icon fails to change to the new VIA app icon. Scenario: This issue is observed even after uninstalling an older version of VIA and installing VIA or upgrading from an older version of VIA to VIA Workaround: In Windows 7, issue the ie4uinit.exe ClearIconCache command in the command prompt. In Windows 10, navigate to C:\Program Files\Aruba Networks\Virtual Internet Agent, rename anuacui.exe to a name of your choice, right-click the file and select Send to Desktop. The client must reboot the device for this change to take effect Symptom: The keep VIA window minimized feature fails to work in VIA Scenario: This issue is observed even after enabling the Keep VIA window minimized parameter in the controller. This is a limitation in VIA Workaround: None Symptom: The following CLI commands are not supported on the VIA installer: gateway authprofile getconfig user password nocertwarn Scenario: This issue is observed in VIA Workaround: None Symptom: Proxy settings are not available in VIA Scenario: This issue is observed in VIA Workaround:VIA uses proxy settings from Internet Explorer to connect to the network. Aruba VIA Windows Edition Release Notes Known Issues in Previous Releases 20