AirMagnet Enterprise Version 6.1 Table of Contents: Introduction, page 1 Special Notes, page 1 Warning, page 2 New Features, page 2 Known Issues, page 5 Release Notes Technical Support, page 7 Release History, page 7 Introduction January 24, 2006 This Release Notes highlights the major new features and enhancements that have been made to AirMagnet Enterprise in this 6.1 FCS release as well as some known issues. Special Notes 1. Important!!! Customers, who are currently using AirMagnet Distributed 4.X and wish to upgrade to Enterprise 6.X, must upgrade to Enterprise 5.X first before upgrading to Enterprise 6.X. Customers who are currently using AirMagnet Distributed 3.X and wish to upgrade to Enterprise 6.X, must upgrade to Distributed 4.X and then to Enterprise 5.X before upgrading to Enterprise 6.X. Direct upgrade from Distributed 3.X or 4.X to Enterprise 6.X may result in the SmartEdge Sensor losing the shared secret key, causing failure in logging in or configuration of the SmartEdge Sensor. Contact AirMagnet Technical Support if you need a copy of AirMagnet Distributed 4.X or AirMagnet Enterprise 5.X. 2. When upgrading your AirMagnet Enterprise system you must select REPAIR from the installation program. a. After the upgrade is complete you MUST make sure that all sensors complete upgrading before attempting a second upgrade. b. Lastly login to the AirMagnet Enterprise Server WebPage and download the new Console application. (You must select the REPAIR option) Page 1 of 9 AirMagnet Enterprise 6.1
3. When upgrading from Distributed 3.X/4.X or Enterprise 5.X to Enterprise 6.X, make sure to note down the user names in 3.X/4.X/5.X. Existing uses may need to be recreated and their roles or privileges reassigned. Enterprise 6.X comes with the Users and Roles feature, which lets you assign different privileges to users. 4. Enterprise 6.X introduces more alarm and notification options. When upgrading from Distributed 3.X/4.X or Enterprise 5.X, make sure that all necessary alarms are enabled and notifications assigned. Some existing alarms may have been renamed in Enterprise 6.X. 5. When updating from Distributed 4.X to Enterprise 5.X, uninstall the existing Distributed Console using Start>Control Panel>Add/Remove Programs and then install the new Enterprise Console after downloading it from the AirMagnet Enterprise Server Web page. 6. If your AirMagnet Enterprise Console has Microsoft patch #832894, security update (MS04-004) or hot-fix #821814, you may receive a version mismatch error message when connecting the Console to the Server. You need to install patch #831167 from the Microsoft Web site to resolve this issue. 7. Cisco AP names that are more than 16 characters long will be automatically truncated. However, this will have no negative effect on the operation of AirMagnet Enterprise system. 8. When conducting Rogue Triangulation operations, be sure to set your screen resolution to 32 bit (highest) for the best viewing results. 9. If you are currently using the ACL Groups Feature you will need to re-assign all your AP s to their respective groups. You will also need to go through your policy profiles and set the correct ACL groups again. Warning If you have AirMagnet Sensors loaded with an earlier version (e.g., 4.x) of the firmware that have never been used on the network, make sure you upgrade the Sensors first before you plug them in the network running AirMagnet Enterprise Server 6.x. The upgrade must be done one step at a time, i.e., first from 4.x to 5.x, and then from 5.x to 6.x. Make sure that the upgrade from 4.x to 5.x is completed before you upgrade from 5.x to 6.x. Failure to heed to this message may result in Sensors that are not functioning at all. New Features The AirMagnet Enterprise 6.1 release has the following new features. Descriptions of the features will follow after the list. The A5023 SmartEdge Sensors SmartEdge Sensor Zero Configuration The A5023 SmartEdge Sensors The AirMagnet Enterprise 6.1 release marks the introduction of the A5023 Sensor a new generation of AirMagnet SmartEdge Sensors. It features the new Intel xscale 425 533 MHz Page 2 of 9 AirMagnet Enterprise 6.1
processor, a standard 10/100 MB Ethernet Base-T port with IEEE 802.3af Power over Ethernet compliance, and zero configuration. The new Sensor hardware platform more than doubles the processing speed of any existing AirMagnet SmartEdge Sensor and offers unprecedented ease and efficiency in Sensor deployment and maintenance. Unlike any of the other wireless Sensors, the AirMagnet A5023 Sensor is an outdoor sensor that comes with a ruggedized, weather-proof case and antennas. It can operate normally in temperatures ranging from -20ºC to +65ºC with humidity of 95% (non-condensing) meeting NEMA 6 rating, and is the first of its kind outdoor sensor the industry has ever seen. Figures 1 through 4 show the view of the A5023 Senor. Figure 1: A5023 LEDs Figure 2: A5023 case (with antenna connectors facing downward) Reboot/Reset Button WLAN 1 (2.4 G) WLAN 2 (5.0 G) LAN Port Figure 4: A5023 N-Type RF Connectors Page 3 of 9 AirMagnet Enterprise 6.1
Figure 3: A5023 Buttom View Note that holding down the Reboot/Reset button for one (1) second will reboot the Sensor and holding it donw for five (5) seconds will reset the Sensor to its factory default settings. AirMagnet SmartEdge Sensor Zero Configuration The Sensor Zero Configuration feature applies to all models of the AirMagnet SmartEdge Sensors, including AM-5010, AM-5012, and A5023. Sensor Zero Configuration enables an un-configured Sensor, when deployed on a network, to automatically find and connect to an AirMagnet Enterprise Server already installed on the network. Using this feature, network administrators can alleviate the extra steps of manually configuring and managing the AirMagnet SmartEdge Sensors during deployment and also reduce the overhead during regular maintenance cycles. To reap the benefit of Sensor Zero Configuration, the user must enable all the settings related to Sensor Zero Configuration on the Enterprise Server before plugging in the Sensor. In this way, the Sensors will start using the Zero Configuration mechanism to locate an Enterprise Server as soon as they are plugged in. Once the Enterprise Server is found, the Sensors will get the network settings to be used along with the IP address of the Enterprise Server, and then start communicating with the Enterprise Server in a secure way using the shared secret key. The Enterprise Server keeps receiving the heart beats from the Sensors, which indicates that the Sensors are up and running. On the Enterprise Console, all the Sensors that are plugged in on the network will show up marked Not Approved in the Sensor Tree. None of these Sensors will be sending any alarm or ACL data because they are basically not licensed yet at this time. They can only send heartbeats to the Server to indicate their existence on the network. When the user sees the Sensors on the Console screen, he/she can approve them and drag them to their respective locations in the Sensor Tree. They can also relocate or edit the Sensors using the Manage Sensors Dialog. This method is suitable for large or small scale deployments A Quick Start on Sensor Zero Configuration In order to set up or use the Sensor Zero Configuration feature, the following conditions must be met: You must have a DHCP server on your network that the Sensor can access. You must have an AirMagnet Enterprise Server and Console already installed on a system on your network. You must have the Sensor and the Server installed on the same subnet. To enable Sensor Zero Configuration: 1. From the AirMagnet Enterprise Console, click Manage>Configuration. The Manage Server Configuration dialog box appears. 2. Select the Zero Configuration tab and check the Enterprise Zero Configuration check box. The screen refreshes. See Figure 5. Page 4 of 9 AirMagnet Enterprise 6.1
Figure 5: Enabling Sensor Zero Configuration 3. Where it says Provide sensor with, select the Server IP address radio button. 4. Select the Sensors set to request IP address from DHCP server radio button. 5. Click OK to exit t the Manage Server Configuration dialog box. 6. Plug in the Sensors on the same network (subnet) where the AirMagnet Enterprise Server and the DHCP server are installed. 7. Power on the Sensors, (which should be able to automatically find the Enterprise Server). 8. From the Enterprise Console screen, right-click each of the Sensors and select Approve from the pop-up menu. 9. Drag and drop the Sensors to their respective locations in the Sensor Tree. Note: The above instructions do not involve the use of a DNS server. Therefore, when the Sensor fails to find the Enterprise Server via DNS resolution, it will broadcast a UDP packet. If the Enterprise Server is on the same local network (subnet), then it will respond to the UDP packet. And the Sensor and the Server will exchange information which allows the Sensor to be set up to access the Server. If the network is a simple single-layered network, the UDP method will suffice. However, most networks do require the DNS entry to properly enable the Zero Configuration. Known Issues 1. The user may need to set her or his switch to a fixed duplex mode when getting a packet error message, and force switch port to 100Mbps full duplex if excessive errors are observed on the port that the sensor is connected to. 2. User may not be prompted if the mandatory read string is left blank when entering a switch into the Manual Switch List. (4738) Page 5 of 9 AirMagnet Enterprise 6.1
3. Sensor Management: The Static IP section of the Zero Configuration is not functioning. Using the UDP packet for server discovery will require a Sensor reboot to complete. (8062) 4. Sensors may be unable to recover from a reboot if there is a serial cable longer then the standard cable that is not terminated. (8096) 5. Channel Focusing does not work with the Cisco Scanning APs, so the Remote Analyzer s Channel and Infrastructure pages are not fully functional when using Cisco Scanning APs. (8245) 6. AirWISE Agent Sensors will not run wired/wireless traces or wired/wireless blocks. (8251) 7. AirMagnet Enterprise Management Server is currently running OpenSSL version 0.9.7a. This version may trigger vulnerabilities in a vulnerability assessment. (8316) 8. Using multiple SSID groups in a Policy Profile, and downgrading from 6.X to 5.2, may prevent the SSID groups from changing back to the previous version, possible causing confusing behavior. (8457) 9. Some reports may have trouble loading with large deployments of sensors. (8481) 10. For large deployments of sensors, deleting a sensor may not remove it from the sensor tree. The sensor will disappear for a while then may come back. (8532) 11. When launching the Remote Analyzer of a Sensor behind a firewall, the proxy IP address may not show in the Remote Sensor Login window that pops up when you double-click a Sensor. The solution to this problem is, when the connection fails, to type in the proxy IP address in the Sensor Name field. 12. Devices that are marked as Neighbors may still be generating Rogue AP by MAC (ACL) alarms. 13. Users may still be able to add a second policy rule or threshold to Rogue AP by MAC (ACL) and Rogue Station by MAC (ACL) alarms actions that are not supposed to happen according product design. The users are advised not to configure more than one policy rule or threshold to these two alarms. 14. The total value in the bubble help for the Performance Intrusion Policy by Hour on the Start page may not be correct. 15. Filter by Location for Reports on Alarms and Devices may not work properly. 16. Sometimes, hub correlation (wire listener) may show some unexpected distant nodes. 17. The application may be unable to associate with certain APs using WEP 128 with hidden SSIDs. (9165) 18. Sometimes the Ping tool may not be working smoothly on all platforms. (9309) 19. Certain Sensors may send out urgent DoS: De-Auth Flood Attack alarms when there is no Urgent threshold set in the policy profile. (9400) 20. The Sarbanes-Oxley report may have mislabled or missing compliance categories. (10351, 10353) Page 6 of 9 AirMagnet Enterprise 6.1
21. Placing multiple AP into an ACL group at the same time from the IDS/Rogue page does not always work for all APs. (10221) 22. Some compliance reports may show a total number of devices that differs from the total number of devices shown on the Console. (10361) 23. The Unauthorized Association Detected alarm description may not show the ACL groups of the devices involved. (10362) 24. AM5020 and AM5023 model sensors may show many not available frames on the Remote UI Decodes page. These frames are extra zero length frames that can be ignored. (8515) 25. The Device Specific Compliance Reports may not show the correct number of failing devices for each section of the DoD, HIPAA, GLBA, and SOX Compliance Reports. (9709) Technical Support Technical support for registered products is available from the following sources: Phone: (Toll-free) 1-877- MAGNET5 (624-6385); or (408) 400-0200 (Option 3), Fax: (408) 744-1250 Monday through Friday, 6:00 AM - 6:00 PM, Pacific Standard Time. Email: Support@AirMagnet.com Web: www.airmagnet.com Release History This Section Summarizes the release history of AirMagnet Enterprise 1/23/2006 AirMagnet Enterprise Version 6.1 (build 4700). 1. Profile download The fix for this area fixed the empty profile on the sensor web page as well as on the Console, also unexpected event get generated by sensor. 2. Database Fixed bogus characters for the SSID name which was causing the server to keep trying to write into the database where the info is rejected by SQL; also the change in format of the UserName field in the Audit log this shorten the data to not more than 64 bytes length. This fix reduces the resources used by SQL as well as AME 3. Empty Notification/Occurrences field in the AirWISE page Fixed the empty information in these two fields on alarm aging. 4. Adhoc blocking New AirMagnet Patented AD-HOC blocking mechanism. 1/09/2006 AirMagnet Enterprise Version 6.1 (build 4694). 1. Triangulation now loads and configures floor plans quicker and without needing to close out of the triangulation window before the floor plan is shown. Page 7 of 9 AirMagnet Enterprise 6.1
2. Rogue devices are now successfully removed from the console after the user configured age out period. 3. Accessing the Remote UI of a sensor behind a NAT Firewall will no longer cause the sensor to reboot. 4. Improvements were made to the Hot Swap mechanism. 12/09/2005 AirMagnet Enterprise Version 6.1 (build 4681). 1. Wireless tracing now working correctly with the AM5010 hardware sensors. 2. Profile names have been added to the policy alarms on the AirWISE page 3. Database SSID fields have been increased in size to allow for the storage of longer SSIDs per device 4. Reporter now ignores invalid or default dates in the database 5. Data that is too long to fit in the fields of the database are now truncated instead of ignored. 11/15/2005 AirMagnet Enterprise Version 6.1 (build 4667). 1. Reporter Issue with Time Filter using custom times or anything other than past 24 hours and device filter getting ignored 2. Filtering reports on AP with encryption-disabled alarm showing wrong alarm fixed the problem. 3. Chinese character in reports fixed. 10/28/2005 AirMagnet Enterprise Version 6.1 (build 4651). 1. Adding ACL groups will no longer cause ACL groups to switch order or change settings on the Infrastructure screen. 2. Sensors will now upgrade with the zero configuration feature on the AirMagnet Enterprise Server turned off. 3. New sensors or sensors set to factory defaults, and using zero-config to connect to a server, will no longer wait ten minutes before upgrading. 4. The Rogue Devices by SSID report no longer shows SSIDs that are not used by any device. 5. The reports show the correct information when using the Device filter or the AirWISE filter. 6. Charts Page now showing the correct counts for each alarm threshold. Page 8 of 9 AirMagnet Enterprise 6.1
7. Sensors are no longer generating false Rogue AP by MAC Address alarms due to the sensor ACL and server ACL mismatch. 10/04/2005: AirMagnet Enterprise Version 6.1 (build 4620). 09/23/2005: AirMagnet Enterprise Version 6.1 FCS release (build 4615). 07/18/2005: AirMagnet Enterprise Version 6.1 beta release (build 4531). Page 9 of 9 AirMagnet Enterprise 6.1