VPN-1 Power VSX VSX NGX R65 HFA 10 Release Notes 12 November, 2009
More Information To view the latest version of this document, see the User Center (http://supportcontent.checkpoint.com/documentation_download?=10363). For additional technical information about Check Point visit Check Point Support Center (http://support.checkpoint.com). Feedback Check Point is engaged in a continuous effort to improve its documentation. Please help us by sending your comments to us (mailto:cp_techpub_feedback@checkpoint.com?subject=feedback on VPN-1 Power VSX VSX NGX R65 HFA 10 Release Notes). 2003-2009 Check Point Software Technologies Ltd. All rights reserved. This product and related documentation are protected by copyright and distributed under licensing restricting their use, copying, distribution, and decompilation. No part of this product or related documentation may be reproduced in any form or by any means without prior written authorization of Check Point. While every precaution has been taken in the preparation of this book, Check Point assumes no responsibility for errors or omissions. This publication and features described herein are subject to change without notice. RESTRICTED RIGHTS LEGEND: Use, duplication, or disclosure by the government is subject to restrictions as set forth in subparagraph (c)(1)(ii) of the Rights in Technical Data and Computer Software clause at DFARS 252.227-7013 and FAR 52.227-19. TRADEMARKS: Please refer to our Copyright page (http://www.checkpoint.com/copyright.html) for a list of our trademarks. Please refer to our Third Party copyright notices (http://www.checkpoint.com/3rd_party_copyright.html) for a list of relevant copyrights.
Contents Introduction... 4 What's New... 4 Supported Versions, Platforms, and Builds... 5 Supported VSX Versions... 5 Supported Platforms... 5 Included Builds... 5 Known Limitations... 7 Installation... 7 Uninstallation... 7 Resolved Issues... 8 VSX... 8 ClusterXL... 9 GateD... 9 SecurePlatform... 9 SecureXL... 10 SmartDefense... 10 URL Filtering... 10 VoIP... 11 VPN... 11 Gateway Protection... 11
Introduction Thank you for updating your Check Point products with VPN-1 Power VSX NGX R65 HFA 10 (Hotfix Accumulator). This HFA is a recommended update that resolves various issues and contains improvements for VPN-1 Power VSX and other Check Point products on a variety of platforms. Please read this document carefully prior to installing this HFA. We also recommend that you refer to the appropriate Check Point user documentation and release notes, which contain hardware requirements, software requirements, and version recommendations. What's New New Web Filtering engine focusing on hazardous and malicious websites New comprehensive protection against the sockstress vulnerability. Multiple stability issues have been fixed Resolutions for customer reported issues Fixes for major issues in VSX NGX R65 Improved quality of SmartDefense protections Improved quality of SecureXL Improved quality of Dynamic Routing Improved quality of VOIP Fixes for Linux security issues Important - During installation of the new Web Filtering engine, no default database is installed; therefore, the Web Filtering policy is not enforced until a signature update is performed.the first update may take a long time, depending on your environment. Subsequent updates should take significantly less time, as only incremental information is downloaded. Page 4
Supported Versions, Platforms, and Builds Supported VSX Versions This HFA can be installed on top of the Check Point VPN-1 VSX NGX R65 versions shown in the following table. To verify the build installed, run: fw ver -k. Platform VPN-1 VSX NGX R65 on SecurePlatform Build Number Output of fw ver -k 610000517 This is Check Point VPN-1 VSX NGX R65 - Build 517 kernel: NGX R65 - Build 517 VPN-1 VSX NGX R65 on SecurePlatform VPN-1 VSX NGX R65 on SecurePlatform VPN-1 VSX NGX R65 on VSX-1 VPN-1 VSX NGX R65 on IPSO 610000550 This is Check Point VPN-1 VSX NGX R65 - Build 550 kernel: NGX R65 - Build 550 610005004 This is Check Point VPN-1 VSX NGX R65, Hotfix 005 - Build 004 kernel: NGX R65, Hotfix 005 - Build 004 884000008 This is Check Point VPN-1 VSX NGX R65 - Build 008 kernel: NGX R65 - Build 008 610002011 This is Check Point VPN-1 VSX NGX R65, Hotfix 002 - Build 011 kernel: NGX R65, Hotfix 002 - Build 011 Supported Platforms The following operating systems and hardware platforms are supported for HFA installation: Platform Version SecurePlatform 2.4.21-21cpsmp IPSO 5.0 VSX-1 3070, 9070, 9090 Crossbeam XOS 8.1+ Included Builds To verify that you have the HFA described in this document: From the HFA file you downloaded, open take_number.conf and make sure it contains: take_29 Take 29 of VSX NGX R65 HFA 10 consists of the following builds: Page 5
Component Build Number Verify Command and Output Firewall 884610037 The output of fw ver -k should be similar to: This is Check Point VPN-1 VSX NGX R65 HFA_10, Hotfix 610 - Build 027 kernel: NGX R65 HFA_10, Hotfix 610 - Build 037 SecurePlatform 884610028 The output of splat_ver should be similar to: ecu hfa 884610028 Performance Pack 884610004 The output of sim ver -k should be similar to: This is Check Point Performance Pack version: NGX R65 HFA_10, Hotfix 610 - Build 004 Kernel version: NGX R65 HFA_10, Hotfix 610 - Build 004 Dynamic Routing 884610006 The output of gated_ver is a list of information including: 884610006 Page 6
Known Limitations This HFA is intended for enforcement gateway installation only. Installing this HFA on a SmartCenter server or Provider-1 MDS is not supported and may cause unexpected behavior If you install this HFA and activate Web Filtering, and then want to uninstall the HFA, take the following precaution: Deactivate Web Filtering on every SmartDashboard object before uninstalling the HFA. Leaving the Web Filtering activated may cause HTTP traffic to be blocked. If you already had Web Filtering before installing this HFA, you do not need to take this precaution before uninstalling the HFA. Installation Install this HFA on supported VSX gateways. To install the HFA: Note - The Full Connectivity Upgrade Procedure (FCU) is not supported for VSX. 1. Download the HFA.tgz file to the VSX Gateway and extract the package. For SecurePlatform: Check_Point_VSX_NGX_R65_HFA_10.linux.tgz ('http://supportcenter.checkpoint.com/file_download?id=10345) For IPSO: Check_Point_VSX_NGX_R65_HFA_10.ipso.tgz (http://supportcenter.checkpoint.com/file_download?id=10344) 2. Run the installation script:./unixinstallscript 3. Follow the on-screen instructions to install all of the components. When the installation completes, it says succeeded for each component. 4. Follow the prompt to reboot the machine. Uninstallation To uninstall the HFA on SecurePlatform or IPSO: Important - Do not run the uninstall command twice in a row. This may cause unexpected behavior. If you need to run the uninstall command again, reboot the machine first. 1. From the command line, run: /opt/cpuninstall/vsx_ngx_r65_hfa_10/unixinstallscript -u 2. Reboot the machine. Note - If you reboot the machine from the /opt/cpuninstall/vsx_ngx_r65_hfa_10 directory, an error message appears that can be ignored. Page 7
Resolved Issues In This Section: VSX 8 ClusterXL 9 GateD 9 SecurePlatform 9 SecureXL 10 SmartDefense 10 URL Filtering 10 VoIP 11 VPN 11 Gateway Protection 11 VSX 00432882 Improved gateway stability when enabling VPN-1 on Virtual Systems. 00465719 Improved stability when a gateway attempts to create a new VLAN tag and fails. 00405230 Improved stability when running cplogd. This resolves a problem where cplogd became unresponsive, and may have produced error messages such as, [cplogd 2025]@albert CLogDaemonApp::sigExitHandler : sig == 15, not in the main thread (2051!= 1024), forwarding to the main thread. 00418561 Improved stability in DHCP relay processes. 00502316 The correct value for hmem peak bytes is displayed when running: fw ctl pstat/snmp/cpstat -f hmem. 00496323 Improved stability during policy installation. 00496339 Improved stability when deleting a Virtual System. 00466960 Improved stability of the fwm logexport command. 00496342 Improved stability when unloading the fw driver. 00408898 Improved stability of interfaces with bnx2 drivers. 00445871 Improved gateway stability when installing policy after a customer deletes a service. 00416548 Improved stability in the fw process when running fw tab -u -t connections. 00494620 Sequence mismatch errors, which caused high CPU consumption by the fwd process, no longer appear. The following is an example of output that may have appeared in few.elg as a result of the sequence mismatch error: rtm_input: unexpected sequence number: expected 3554599, received 3675425 Page 8
ClusterXL 00414826 Failover on VSX with Load Sharing, configured with a Virtual Switch and with the kernel parameter fwha_recovery_delay_timeout enabled, now works correctly. 00414828 Improved performance, as there is no longer redundant CCP traffic on the Virtual Switch. 00426500 Improved connectivity in High Availability as a Standby Virtual System connected to a Virtual Switch sends ARP requests correctly, using the MAC address of the Active Virtual System. GateD 00441998 On Crossbeam, the OSPF restart process has been improved to allow additional time before checking the Self-Originated LSAs. 00442009 Improved GateD performance in Crossbeam after CPM Failover when the NFS is back up. 00446301 After failover between VAP group members in a Crossbeam Cluster, one GateD is set as master and the routing table is synchronized correctly. 00442032 Problems with synchronization between neighbors after a failover have been resolved. 00442031 Improved stability when updating while using dynamic routing in situations where a large amount of routes need to be learned. This resolves a problem with updates that may have produced the following error message in syslog: recvmsg failed 00441985 Routes learned from an IBGP peer are now successfully installed. 00441978 On Crossbeam, OSPF routing now works consistently after hard reset of the master VAP APM. 00441784 Improved stability in GateD when configuring an OSPF virtual link. SecurePlatform 00463858, 00433001, 00496501 Improved stability when a machine has reached its maximum memory usage. 00439748 When enabling crontab,the following error messages are no longer sent incorrectly to the gateway console: application bug: crond(1646) has SIGCHLD set to SIG_IGN but calls wait(), application bug: crond(1663) has SIGCHLD set to SIG_IGN but calls wait(). 00463856 Bnx2 drivers now automatically change settings to 1000/Full Duplex when autoneg is selected. Page 9
00415375 Fixed vulnerability CVE-2008-0960 - SNMPv3 HMAC: Verification relies on the client to specify the HMAC length, which makes it easier for remote attackers to bypass SNMP authentication via a length value of 1, which only checks the first byte. 00446267 Fixed Vulnerability CVE-2007-5846 - The SNMP agent allows remote attackers to cause a denial of service (CPU and memory consumption) via a GETBULK request with a large max-repeaters value. 00500658 Fixed Vulnerability CVE-2009-1385 - Integer underflow in the e1000_clean_rx_irq function allows remote attackers to cause a denial of service (panic) via a crafted frame size. SecureXL 00446110 SecureXL now supports the keep_df_flag (DF=Don't Fragment). 00407402 The link collision mechanism is now activated by default; this resolves issues with using NAT traversal and IP compression in order to connect to a VPN with SecureClient. SmartDefense 00414826 Failover on VSX with Load Sharing, configured with a Virtual Switch and with the kernel parameter fwha_recovery_delay_timeout enabled, now works correctly. 00414828 Improved performance, as there is no longer redundant CCP traffic on the Virtual Switch. 00426500 Improved connectivity in High Availability as a Standby Virtual System connected to a Virtual Switch sends ARP requests correctly, using the MAC address of the Active Virtual System. URL Filtering 00446383 Uncategorized websites can be blocked and unblocked using the following kernel parameters: vsx set <vsid> fw ctl set int g_ci_uncategorized_accept_vsid <vsid> fw ctl set int g_ci_uncategorized_accept_opt <0 to block, 1 accept> Page 10
VoIP 00421259 Improved stability when MGCP traffic is used. 00445916 MGCP traffic is no longer dropped due to the short buffer length of the Endpoint IP. 00421192 Improved stability in the event of Cluster failover with SIP TCP traffic. 00414193 In the SCCP inspection, all of the sk_hdr_content_verifier defenses are now per VS and not global to all Virtual Systems. 00496659 Improved stability of SCCP inspection, especially when logging is used. 00430220 SIP traffic now passes successfully when the 2xx response is to a port other than 5060. VPN 00446279 In SecureRemote/SecureClient, Remote access rules based on groups defined on the RADIUS server are now properly applied to all users. 00415615 The SecureClient connections are now maintained after a failover in VSX with Load Sharing. 00446239 Improved VPN connectivity after changing the authentication method from username/password to RADIUS ActiveIdentity. 00446242 In the event of an IP address collision between a remote access client and a host in the encryption domain, a new connection to the remote access client's IP address will be sent to the IP address in the encryption domain. Note: This behavior mitigates security threats associated with IP collision. For more details see sk34579 (http://supportcontent.checkpoint.com/solutions?id=sk34579). Gateway Protection 00509491 In response to the Sockstress TCP DoS vulnerability, this HFA provides a comprehensive protection for Check Point Security Gateways and the resources behind them. See sk42723 https://supportcontent.checkpoint.com/solutions?id=sk42723 Page 11