| FTP ALG logging now more verbose
| | Issue: |
Some FTP ALG troubleshooting has been problematic due to inexact logging of
certain events. For example: overly long lines were not logged as such, only that
the connection was closed.
| | Change: |
As of v8.10.03, v8.20.02 and v8.30.01, log events emitted by the FTP ALG are
much more verbose.
|
| DHCP relayer can now relay to built-in DHCP server
| | Issue: |
In some cases, it may be helpful to use the DHCP relayer to relay
leases to the built-in DHCP server. The DHCP relayer can do several
things that the DHCP server cannot, e.g. add dynamic routes for
relayed leases, restrict the number of DHCP clients per interface (VLAN)
and so forth.
| | Change: |
As of v8.30.01, the DHCP relayer can be configured to relay to "127.0.0.1".
|
| 'e1000' driver updated to support newer Intel Gigabit NICs
| | Issue: |
Support for 19 new NICs based on Intel's Gigabit chips has been
added, including Intel's new quad port gigabit NIC.
| | Change: |
The updated 'e1000' driver is available as of v8.30.01.
|
| DHCP server will no longer hand out certain addresses
| | Issue: |
In v8.30.00, the DHCP server would hand out any address it was
configured to hand out.
| | Change: |
As of v8.30.01, the DHCP server will never hand out the firewall's
own interface addresses, nor addresses ending in .0 or .255.
| | |
The latter is relevant even for networks with netmasks larger than /24.
Reportedly, the Windows TCP/IP stack will refuse to communicate with
any IP address ending in .0 or .255 regardless of it begin local or
remote.
|
| Better compatibility with various cluster systems
| | Issue: |
Some HA cluster systems (e.g. Linux 'Heartbeat' clusters) use a shared
virtual IP address that changes MAC address as the active cluster role
moves. However, some clusters announce this only through a single
non-targeted ARP broadcast which surrounding equipment is supposed
to pick up on and change their ARP caches.
| | Change: |
As of v8.30.01, Clavister Firewall will listen to non-targeted ARP
broadcasts for ARP cache update purposes, if it is configured
to be RFC 826 compliant.
| | See: |
See KB #10032
for more information.
|
| DHCP client can now be configured to not check for IP conflicts
| | Issue: |
The DHCP client normally checks if the IP address in an offer
is already taken on the local network by performing an ARP
query for it. However, some routers may ARP publish IP addresses
while the DHCP transaction is running and cause false positives.
One such example is the Clavister Firewall DHCP relayer before v8.30.01,
in certain configurations. There are also others.
| | Change: |
As of v8.30.01, the DHCP client can be configured to not check for
IP conflicts in offered leases via "Advanced Settings" -> "DHCP"
-> "DHCP_DisableArpOnOffer".
|
| Statistics for connections states added
| | Issue: |
When dimensioning the size of the firewall state table and/or
modifying timeouts for various states, it may be useful to
know the distribution of connections in various states.
| | Change: |
As of v8.30.01, the firewall offers statics for connection states, e.g.
how many connections are in TCP_SYN state, how many connections are in
TCP_FIN state, etc..
|
| 'DHCP Release' support in DHCP relayer
| | Issue: |
Some operating systems (notably, newer Windows versions) send
"RELEASE" DHCP notifications during shutdown to notify the DHCP
server that it can now safely end the lease in case it needs to.
| | Change: |
As of v8.30.01, the DHCP relayer will relay RELEASE notifications.
Previously, it did not. It will also remove the lease from its
relaying list, which may help in scenarios where the relayer is
configured to only allow a single active lease per interface (VLAN),
and a user is switching computers.
|
|