Release date: 2001-10-31 [ISO]

Version 7.00.02 is a minor update from v7.00.00. It consists of the v7.00.01 Firewall Core and the v7.00.02 Firewall Manager. There is no v7.00.02 Firewall Core.

For changes from v6.01 to v7.00.00, please see Changes-6.01-to-7.00.htm.

This document outlines bug fixes as well as improvements for the v7.00.01 core and the v7.00.02 manager:

New files installed by v7.00.02
How to upgrade a v7.00.00 firewall to v7.00.01
Distribution		[Bug Fixes]
Firewall Manager	[Changes]	[Bug Fixes]
Firewall Core	[Changes]	[Bug Fixes]	[Known Bugs / Problems]

For future reference: This document is stored in the "Docs" sub-folder of your Firewall Manager install folder.  

• Cores/fwc_700.exe
  This is the v7.00.01 standard firewall core. Upload it to your existing (standard) firewall, or create new boot media with it.
  Your previous v7.00.00 core (also named fwc_700.exe) is overwritten.
  Note: VPN firewalls should, as always, use the VPN core file, below.

• Cores/fwc_700v.exe
  This is the v7.00.01 VPN firewall core. Upload it to your existing (VPN) firewall, or create new boot media with it.
  Note: This file is not installed by the standard installation package, as only licensed users have access to it. Rather, it is available as a separate installation package (typically a Clavister Upgrader package).

• Docs/Changes-7.00.00-to-7.00.02.htm
  This document.

• FWMgr7.exe
  This is the v7.00.02 Firewall Manager. Version 6 Firewall Managers (if installed) will not be overwritten, as they are named "FWMgr6.exe".

• Template IPsec proposals were incorrectly flagged as "transport mode"
  Issue: The v7 template proposal lists distributed with the firewall manager were incorrectly treated as "transport mode" proposals, even though they were actually tunnels.
  Results: One would not be able to specify the remote gateway in VPN connections using such proposal lists, until one edited the proposal list and saved it again. This procedure would correctly flag the proposal list as being a "tunnel mode" proposal.
  Fix: The template proposal lists distributed in this package are correctly flagged as being tunnel mode proposals.
  

• Configuring VPN firewalls works in the v7 series
  Version 7.00.00 of the Firewall Manager could not configure VPN firewalls; the functionality was simply disabled as a result of the VPN gateway not being finished at the time the standard core was relesed.
  As of v7.00.01, the first version distributed with v7 series VPN cores, this is again possible.
  

• Plugged a memory/resource leak
  Issue: Memory and GDI resources weren't properly freed in some places in the configuration display.
  Results: May lead to garbled displays and/or error messageboxes
  Fixed: In v7.00.02
  

• Some statistics values weren't correctly updated
  Issue: The statistics values for "IP errors", "Send fails", and fragment reassembly weren't correctly updated.
  Affects: v7.00.00.
  Fixed: in v7.00.01.
  

• The SNMP 'bytesIn' counter wasn't updated for ODI interfaces
  Issue: The SNMP 'bytesIn' counter wasn't updated at all for ODI interfaces. However, it was correctly updated for all other interface types.
  Affects: v7.00.00 SNMP data, if enabled
  Fixed: in v7.00.01.
  

• ARP cache problem fixed
  Issue: Firewall interfaces passing traffic to (through) a single IP address, f.i. the external interface speaking to a default gateway only, would sometimes refuse to resolve the IP address in question, after having resolved it once.
  Results: The IP address in question, once it stops resolving, won't resolve until one attempts to speak to another IP address, or flushes the ARP cache (f.i. through "arp -flush" or by re-reading the firewall configuration).
  Affects: v7.00.00 cores.
  Fixed: in v7.00.01.
  

• State engine is overly strict during TCP initial handshake
  Issue: The state engine currently requires strict conformance to the "SYN", "SYN/ACK", "ACK" initial TCP handshake pattern (possibly with resends). However, some operating systems will respond to resent SYNs with a plain "ACK", which the state engine will not accept.
  Affects: All Firewall Cores, from v5.1
  Results: This may lead to failed connections between certain operating systems, if packet loss occurs in the "right" place during the handshake. The firewall will also send "LogStateViolations" log events regarding "SYN ACK" flags at a later point in the handshake.
  Fix: This problem will be addressed in a future release.

• DEC/Intel Tulip driver may fail to attach during high traffic
  The DEC/Intel Tulip chipset NIC driver may fail to attach on some systems if it receives a large number packets during the attach phase.
  We currently do not know the exact circumstances during which this may occur. It appears like this will only occur on hardware that have PCI bus problems in general. However, this is only a preliminary observation.
  The matter is being researched.