| Configuring overly large IP address pool in L2TP/PPTP server would cause crash
| | Problem: |
Configuring an IP pool larger than the total RAM could hold, e.g. "0.0.0.0/0" or an entire
class A network (16 million addresses), would lead to a crash.
| | Affects: |
Clavister Firewall v8.50.00
| | Fix: |
As of v8.50.01, the pool size is limited to 1 million addresses. Configuring
a pool larger than that will lead to a warning message and the pool being
set to zero length.
|
| Intel e1000 NIC link problems (gigabit ports in all Clavister appliances)
| | Issue: |
Some Intel e1000 series chips would have link problems establishing
or maintaining link with some equipment.
| | Affects: |
Clavister Firewall v7.00 and up.
| | Fix: |
Fixed in v8.40.05 and v8.50.01.
|
| Unable to log in via serial / physical console
| | Issue: |
The serial console (and physical, in the case of non-appliances), may be password protected.
| | Problem: |
A change in v8.50.00 broke the routine responsible for receiving the password
from the serial port / local keyboard.
| | Results: |
If a console password had been set, one would be unable to login using the
serial (and physical) console. Firewall Manager use would not be affected.
| | Affects: |
Clavister Firewall v8.50.00.
| | Fix: |
Fixed in v8.50.01.
|
| User authentication timeouts not reset by traffic passing through FwdFast rules
| | Issue: |
When a user authenticated to the firewall has an "idle timeout" configured,
it should be reset by traffic passing through the firewall.
| | Problem: |
The idle timeout was only reset by traffic being permitted by "Allow" and
"NAT" rules - state-tracked connections. Not by statelessly permitted
traffic via "FwdFast" rules.
| | Result: |
If all traffic for a logged-on user was permitted by FwdFast rules,
they would be logged out when the "idle timeout" period expired
regardless of sending traffic through the firewall or not.
| | Affects: |
Clavister Firewall v8.10.00 and up.
| | Fix: |
Fixed in v8.40.05 and v8.50.01.
|
| PPPoE tunnels failing to establish might cause tunnel limit to be reached
| | Issue: |
When a PPPoE tunnel failed to establish, it would not be closed properly.
The next attempt to establish the tunnel would use a new tunnel.
| | Results: |
After the count of open PPP tunnels reached the system's limit, the PPPoE
tunnel(s) would (correctly) cease trying to connect. A reboot would be
required to flush the open tunnels.
| | Affects: |
Clavister Firewall v8.50.00.
| | Fix: |
Fixed in v8.50.01.
|
| DSA certificates would not work in IPsec
| | Issue: |
IPsec can use RSA and DSA certificates for authentication. RSA
is by far and large the more common of the two.
| | Problem: |
Attempting to upload a configuration using DSA certificates
to the firewall would result in an error message:
"Error: Failed to decode private key for name-of-your-cert"
| | Affects: |
Clavister Firewall v8.10.00 -- .02, v8.20.00 -- .01, v8.30.00 -- .01, v8.40.00 -- .04, v8.50.00.
| | Fix: |
Fixed in v8.10.03, v8.20.02, v8.30.02, v8.40.05 and v8.50.01.
|
| PPTP and L2TP tunnels not usable in HA setups
| | Problem: |
Configuring PPTP and L2TP tunnels (both servers and clients) on a High Availability
cluster would result in configuration warnings, and the Slave unit entering
"Local Lockdown" mode, in which no traffic passes through it.
| | Affects: |
Clavister Firewall v8.50.00.
| | Fix: |
As of v8.50.01, PPTP and L2TP servers behave as can be expected.
PPTP and L2TP clients will establish their outbound connections from the unique
IP addresses of the cluster members, and quite often both members will have their tunnels
up at the same time.
| | Note: |
For PPTP and L2TP clients on a HA cluster, the only outbound traffic that is likely to
work through the tunnels is dynamically NATed connections. The reason for this is that
the PPTP/L2TP server in the other end otherwise will not know where to send the return
traffic, as there would be two tunnels with the same IP networks "behind" them.
|
| Loopback interfaces not usable in HA setups
| | Problem: |
Configuring loopback interfaces on a High Availability
cluster would result in configuration warnings, and the Slave unit entering
"Local Lockdown" mode, in which no traffic passes through it.
| | Affects: |
Clavister Firewall v8.50.00.
| | Fix: |
Fixed in v8.50.01.
|
|