Clavister Firewall Changes from v8.20.00 to v8.30.00

Release date: 2003-10-08 [ISO]

Users upgrading from v7.0x and earlier versions should read changes-7.0x.xx-to-8.00.02.html first. It contains the list of major changes from v7.0x, and also instructions on how to upgrade; the upgrade procedure from v7 to v8 differs markedly from the normal procedure. Once the firewall is upgraded to 8.0, you can follow the procedures in this document.

Version 8.30.00 is a new major version. It is available for all license holders with a software subscription covering 2003-09-01. The major new features are:
» Built-in DHCP server
» User authentication via HTTPS
» PPPoE support
» Traffic shaping now controlled by separate pipe ruleset

Version 8.30.00 also contains bug fixes to the Firewall Core and the Firewall Manager. This document outlines bug fixes as well as improvements for each component.

The upgrade procedures in this document refers to upgrades from earlier v8.0x installations.

  • New files installed by v8.30.00
  • How to upgrade earlier v8.0x firewalls to v8.30.00
  • How to upgrade v6.0x/v7.0x firewalls to v8.0x
  • HA upgrade procedure
  • Firewall Manager
  • [Changes [Bug Fixes  
  • Firewall Core
  • [Changes] [Bug Fixes]  
  • Firewall Core - VPN specific  
  •   [Bug Fixes] [Known Bugs / Problems
  • Firewall Core - HA specific
  •     [Known Bugs / Problems]

    For future reference: This document is stored in the "Docs" sub-folder of your Firewall Manager install folder.

    Change logs / release notes for earlier versions of Clavister Firewall are available in the release notes section of www.clavister.com/support.



     Summary of changes and bug fixes                
    All changes and bug fixes affecting the standard firewall core also affect VPN and HA cores, unless explicitly stated otherwise.

    Firewall Manager
      Change: "disable", "move" etc now works on multiline selections
      Bug fix: Configuration download from HA cluster fails

    Firewall Core
      Change: Built-in DHCP server implemented
      Change: User authentication via HTTPS
      Change: PPPoE support implemented
      Change: Traffic shaping now controlled by separate pipe ruleset
      Change: User authentication via IKE XAuth now carries to main ruleset
      Change: DHCP relayer state kept over reboot
      Change: Pipe user grouping per source/destination interface/VLAN
      Change: DHCP relayer can now add routes to PBR tables
      Change: DHCP relayer leases can now be ended from console
      Bug fix: Intel e100 NIC driver IRQ sharing problems
      Bug fix: HTTPPoster does not work with dyndns.org DynDNS services

    Firewall Core - VPN specific
      Bug fix: Security Alert: Buffer overrun in IKE certificate ASN.1 parser
      Known bug: Interoperability problem with 7.0x gateways (unstable tunnels)

    Firewall Core - HA specific
      Known bug: No state synchronization for FTP ALG



     New files installed by v8.30.00                
    This is a list of the files that are new to the v8.30.00 release. All paths are relative to your Firewall Manager install folder.
    » Cores/fwc-8.30.00-full.cfx
    This is the v8.30.00 full firewall core. Upload it to your existing firewall, or create new boot media with it. It contains VPN as well as HA functionality.
    » Cores/fwc-8.30.00-novpn.cfx
    This is a version of the v8.30.00 core without VPN support. It is roughly half the size of the full version.
    » Cores/fwcoreup8.exe
    This is the core used to remotely upgrade v7.0x and earlier firewalls. It will install a "8.00.02-full" core.
    » Docs/Changes-8.20.00-to-8.30.00.html
    This document.
    » FWMgr8.exe
    This is the v8.30.00 Firewall Manager. Earlier version 8 Firewall Managers will be overwritten. Version 7 Firewall Managers (if installed) will not be overwritten, as they are named "FWMgr7.exe", and are also typically installed in a different directory.


     How to upgrade earlier v8.0x firewalls to v8.30.00                
    Upgrading a previous v8.0x firewall to v8.30.00 is completely straightforward.
    Simply upload the new core, "fwc-8.30.00-full.cfx", to your firewall and restart it.
    (Alternatively, upload the "-novpn" version if you do not wish VPN functionality.)


     HA upgrade procedure                
    Note: For upgrades from v7.x HA clusters, first follow the HA upgrade procedures outlined in changes-7.0x.xx-to-8.00.02.html.

    There are no incompatibilities in the HA synchronization protocol between 8.30.00 HA cores and earlier v8.0x HA cores. No special procedures are required.

    Simply upload the new firewall core file to the firewalls in your cluster and make sure that the first upload and restart is successful before uploading to the second firewall.

    We recommend beginning with the firewall that is currently active, even though this will necessitate two failovers. The reason for this is that ALG sessions are not synchronized.

      The "immediate availability" method
    • Upload the core to the currently active firewall ("firewall A") and restart it.
    • Issue a 'reconfigure' on the firewall B to rapidly fail back to the now upgraded firewall A. Make sure firewall A functions properly.
    • Upload the core to firewall B and restart it.
    • End result: Firewall A is now the active node, just as it was before the upgrade procedure.

    Note that this leaves the second firewall untested, even though it most likely will work just as well as the first firewall. If you want to specifically test the second firewall, you can:
    1) cause two failovers manually,   or
    2) connect to it via e.g. the remote console just to make sure it's running,   or
    3) if ALG synchronization is not a concern, follow this procedure:

      The "long-term safe" procedure:
    • Upload the core to the currently inactive firewall ("firewall B") and restart it.
    • Issue a 'reconfigure' on firewall A. This causes failover to firewall B. Make sure firewall B functions properly.
    • Upload the core to firewall A and restart it.
    • Issue a 'reconfigure' on firewall B to fall back to firewall A. Make sure firewall A functions properly.
    • End result: Firewall A is now the active node, just as it was before the upgrade procedure.
    Again, note that the "availability" issues only affect ALGs. All other states are, as usual, fully synchronized and not affected in either procedure.


     Firewall Manager Changes                
    "disable", "move" etc now works on multiline selections
        Change: Several operations that could previously only be done on a per-row basis in the security editor may now be done on multiline selections.



     Firewall Manager Bug Fixes                
    Configuration download from HA cluster fails
        Problem: When the Firewall Manager downloads a configuration from HA cluster members, it will make erroneous changes to the downloaded configuration file before saving it; the IP addresses of interfaces will be changed around.
        Results: The configuration will still parse, but will not function properly if uploaded to the cluster members.
        Affects: FWMgr v8.10.00-8.10.01 and v8.20.00.
        Fixed: Fixed in v8.10.02, v8.20.01 and v8.30.00.



     Firewall Core Changes                
    Built-in DHCP server implemented
        Change: Clavister Firewall now includes a highly flexible DHCP server. Multiple pools can be specified per interface and/or group of interfaces. All relevant settings maybe adjusted on a per-pool basis, and for virtual firewall scenarios, the same IP span can be reused in individual pools on different interfaces.

    User authentication via HTTPS
        Change: As of v8.10, Clavister Firewall has been able to do user authentication via HTTP. This same functionality is now also available via encrypted HTTP: HTTPS. This, in combination with an SSL server certificate installed on the firewall, allows secure user authentication.

    PPPoE support implemented
        Change: An increasing number of DSL and cable modem ISPs use the PPP-over-Ethernet protocol for customer authentication. Clavister Firewall now includes a PPPoE client, which allows it to function in such networks.

    Traffic shaping now controlled by separate pipe ruleset
        Change: The traffic shaping functionality of Clavister Firewall has so far been controlled through pipe settings on a per-rule basis in the standard ruleset.
    As of 8.30.00, the new pipe ruleset contains all rules regarding pipes. It is evaluated after the main ruleset.
    The main benefit is reduced ruleset complexity; the main ruleset can now concentrate on access policy while the pipe ruleset handles traffic shaping policy.
        Note: When a firewall has been upgraded to 8.3, you will be offered the opportunity to move your pipe settings to the pipe ruleset. This operation is not destructive. Everything will keep working exactly as it did before the conversion. If you still do not want to do this immediately, you can decline, and do it at a later point via the context menu of the "Rules" node in the tree.
        Sidenote: The "pipe rules" view now has two columns where the main ruleset previously had one: one column for pipes in the forward direction, and one column for the reverse direction. With in-cell editing enabled, this makes it even easier to manage your pipe settings.

    User authentication via IKE XAuth now carries to main ruleset
        Change: Previously, user authentication done via IKE XAuth only controlled the opening of the actual IPsec tunnel. Now, this logon information is also carried to the main ruleset; policies using authenticated network objects can now be written the same way as with users logged on via HTTP(s).

    DHCP relayer state kept over reboot
        Change: The built-in DHCP relayer will now keep its state over reboot. This changes very little from a pure relaying standpoint, but is very helpful when the DHCP relayer is configured to automatically add routes to the routing table according to relayed leases.
    By default, it will save the relay table on config re-read and shutdown, but can also be configured to save the relay table periodically. See the DHCPRelay_SaveRelayPolicy and DHCPRelay_AutoSaveRelayInterval advanced settings.

    Pipe user grouping per source/destination interface/VLAN
        Change: The Clavister Firewall traffic shaper allows users in each "pipe" to be grouped according to a number of parameters. Previously, this list has included Network (configurable mask), IP address and TCP/UDP ports.
    As of 8.30.00, pipe users may also be grouped per source/destination interface, which of course includes VLAN interfaces.

    DHCP relayer can now add routes to PBR tables
        Issue: It has previously been possible to have the DHCP relayer automatically add routes to the routing table for leases that it relays. This, in combination with proxy ARP allows for great flexibility in network designs.
        Change: As of 8.30.00, the DHCP relayer can also add routes to routing tables other than the main routing table. The routing table to manipulate may be specified on a per-rule basis.

    DHCP relayer leases can now be ended from console
        Change: The "dhcprelay" console command now has "-release <ipaddr>" switch, which forcefully makes the relayer forget about a relayed lease, including removing automatically added routes, if any.



     Firewall Core Bug Fixes                
    Intel e100 NIC driver IRQ sharing problems
        Problem: The Intel e100 driver may cause problems if it shares IRQs with other NIC cards.
        Results: The firewall would freeze during startup or during only a short time of operation.
        Affects: v8.00.00-8.00.06, v8.10.00-8.10.01 and v8.20.00.
    Clavister Firewall appliances not affected.
        Fixed: Fixed in v8.00.07, v8.10.02, v8.20.01 and v8.30.00.

    HTTPPoster does not work with dyndns.org DynDNS services
        Problem: The HTTPPoster would not send a "User-Agent" string in its requests. Dyndns.org does not accept such HTTP requests.
        Results: Dyndns.org would not obey changes posted via the HTTPPoster.
        Affects: v8.20.00.
        Fixed: The HTTPPoster now sets the "User-Agent" to
    "CFW-HTTPPoster/1.0 support@clavister.com".
    Fixed in v8.20.01 and v8.30.00.



     Firewall Core - VPN Specific Bug Fixes                
    Security Alert: Buffer overrun in IKE certificate ASN.1 parser
        Issue: All VPN enabled firewalls that support certificate-based authentication are vulnerable to a buffer overrun in the ASN.1 parser in the IKE code.
        Impact: If an IKE connection can be established to a VPN enabled firewall, the firewall can be crashed. This normally leads to an automatic restart.
    The full extent of the buffer overrun is not yet fully understood; for the time being, Clavister assumes that it may be possible to take control of the firewall itself. Initial observations however suggest that this may be difficult.
        Workaround:
    » For firewalls that do not require VPN functionality: upload a firewall core that does not support IPsec VPNs ("-novpn" cores).
    » For VPN gateways: disable the "IPsecBeforeRules" advanced setting and add rules that allow IKE and IPsec (e.g. the "ipsec-suite" service) only from known IP addresses.
    This reduces the window of exposure until a patch can be installed.
    It may indeed be a good idea to always restrict who may speak IPsec to your VPN gateways, if possible.
        Affects: v8.00.00-8.00.06, v8.10.00-8.10.01 and v8.20.00.
        Fixed: Fixed in v8.00.07, v8.10.02, v8.20.01 and v8.30.00.



     Firewall Core - VPN Specific Known Problems                
    Interoperability problem with 7.0x gateways (unstable tunnels)
        Problem: We have received reports of tunnel instability problems between 7.0x and 8.x VPN gateways. We are currently investigating these reports; it is possible, albeit not certain, that these problems are linked to IKE SAs having lifetimes over four hours.
        Action: Please report any such problems to support@clavister.com, and, if possible, the results of lowering the IKE lifetime to four hours or less.
        Workaround: Use the "VPN Keepalive" functionality in v8.2+ gateways to monitor and quickly reestablish tunnels that cease working. Using manual configuration of the monitoring settings, this will work even though the remote gateway is not a v8.2 (or, indeed, Clavister) gateway.
        Note: If we do not receive new information on this issue, it will be closed without further action and this note not included in subsequent release notes.



     Firewall Core - HA Known Bugs / Problems                
    No state synchronization for FTP ALG
        Problem: No aspect of the FTP ALG is state synchronized
        Results: This means that control channels as well as data channel established through the FTP ALG will freeze when the cluster fails over to the other peer. If, however, the cluster fails back over to the original peer within approximately half a minute, frozen sessions (and associated transfers) should begin working again.
    Note that such failover occurs each time a new configuration is uploaded.