| HTTP ALG might cause the Security Gateway to freeze in some situations
| | Problem: |
In some scenarios when the HTTP ALG handles a lot of traffic, it might cause
the Security Gateway to stop responding.
| | Results: |
The Security Gateway will freeze a few minutes and will then automatically reboot.
| | Affects: |
Clavister Firewall v8.40.00 and up
| | Solution: |
Solved in v8.50.02.
|
| Route failover is not working correctly in HA setups
| | Problem: |
When gateway ARP resolution is used to monitor a route in HA setups, the shared ip
and MAC address is not used. Instead, each node uses its own addresses.
| | Results: |
When gateway ARP resolution is used to monitor a route in HA setups, the surrounding
equipment will get ARP requests from each node instead of only from the active node.
| | Affects: |
Clavister Firewall v8.50.00 and up
| | Solution: |
Solved in v8.50.02.
|
| Netcon ping problems with Virtual Routers
| | Problem: |
When trying to admin a Security Gateway on a interface bound to a virtual router, netcon udp
pings does not work.
| | Results: |
When trying to admin a Security Gateway on a interface bound to a virtual router, the manager
can't poll the Security Gateway to verify that the Security Gateway is still up.
| | Affects: |
Clavister Firewall v8.50.00 and up
| | Solution: |
Solved in v8.50.02.
|
| L2TP does not support requests for usage of sequence numbers in data messages.
| | Problem: |
If L2TP clients requests to use sequence numbers for data messages, the L2TP server
will deny the connection attempt and disconnect the user.
| | Results: |
If the L2TP server receives a request for a new session with requirements to use sequence
numbers for data messages, the L2TP server will treat the message as invalid and close down
the connection attempt.
| | Affects: |
Clavister Firewall v8.50.00 and up
| | Solution: |
Solved in v8.50.02.
| | Note: |
The L2TP server still does not support sequence numbers for data messages, only for control
messages. Now clients are allowed to request usage of sequence numbers for data
messages, but the L2TP server will not use sequence numbers for data messages.
|
| Connected L2TP clients are not updated if ruleset is changed
| | Problem: |
If the advanced setting L2TPBeforeRules is set to false and a rule allowing
L2TP traffic to the L2TP server is configured, clients can connect to the
L2TP server. If the rule is changed or removed, the connected clients are not
updated to comply to the new ruleset.
| | Results: |
If a rule allowing L2TP connections to the L2TP server is removed when the advanced
setting L2TPBeforeRules is false, the already connected clients are not disconnected.
| | Affects: |
Clavister Firewall v8.50.00 and up
| | Solution: |
Solved in v8.50.02.
|
| Possible crash during reconfiguration if the new configuration fails
| | Problem: |
If the Security Gateway is configured with many IPsec tunnels and a new faulty
configuration is uploaded to the Security Gateway it is possible that the Security Gateway
will crash during reconfiguration.
| | Results: |
The Security Gateway can possibly crash during reconfiguration if many IPsec tunnels are
configured and the new configuration fails.
| | Affects: |
Clavister Firewall v8.50.00 and up
| | Solution: |
Solved in v8.50.02.
|
| WebAuth login sometimes fails if special characters are used in username/password
| | Problem: |
When logging in through WebAuth, the login can sometimes fail if special characters such as
the swedish characters å,ä,ö, are used in the username or password.
| | Results: |
The HTTP/HTTPS WebAuth login will fail.
| | Affects: |
Clavister Firewall v8.40.00 and up
| | Solution: |
Solved in v8.50.02.
|
| No logging information of assigned IP addresses for clients connected to PPTP/L2TP servers
| | Problem: |
The logs generated when a client connects to a PPTP/L2TP server does not contain information of
the assigned IP address for the client.
| | Results: |
With no assigned IP information, it is hard to track client activities.
| | Affects: |
Clavister Firewall v8.50.00 and up
| | Solution: |
Solved in v8.50.02.
|
| The HTTPALG sometimes wrongly say that a request contains invalid UTF8 encoding
| | Problem: |
If a special character is found at the end of a request, such as the swedish
characters å,ä,ö, the HTTP ALG sometimes fails to calculate the length
of the request correctly and denies the request.
| | Results: |
The user will be presented with a 403 forbidden page.
| | Affects: |
Clavister Firewall v8.40.00 and up
| | Solution: |
Solved in v8.50.02.
|
| The PPPoE client fails to connect to some servers when Service Name is empty
| | Issue: |
PPPoE clients can use an empty Service Name tag to specify that they can accept
any Service Name. If the PPPoE client is configured with a empty Service Name it will however only
accept connections to servers that has no Service Name set.
| | Results: |
The result of this problem is that the Service Name has to be known when the PPPoE client is
configured. If the Service Name is left empty, the client will fail to connect to a PPPoE
server that has a Service Name configured.
| | Affects: |
Clavister Firewall v8.30.00 and up.
| | Solution: |
Solved in v8.50.02.
|
| Routes added by IPsec will in some cases be left active after the tunnel is down
| | Issue: |
When IPsec dynamically add routes, the routes may still be left active
after the tunnel is down.
| | Results: |
Leaving routes still active may lead to memory leakage and routing failures.
| | Affects: |
Clavister Firewall v8.20.00 and up.
| | Solution: |
Solved in v8.50.02.
|
| PPPoE tunnels failing to establish might cause tunnel limit to be reached
| | Issue: |
When a PPPoE tunnel failes to establish, it does not close properly.
The next attempt to establish the tunnel will use a new tunnel.
| | Results: |
After the count of open PPP tunnels reaches the system's limit, the PPPoE
tunnel(s) cease to make connection attempts. A reboot would be
required to flush the open tunnels.
| | Affects: |
Clavister Firewall v8.50.00.
| | Solution: |
Solved in v8.50.02.
|
| A host with statically configured IP can prevent a DHCP enabled host with Windows as host OS from receiving an "valid" IP
| | Problem: |
The DHCPServer expects that the client should check if the offered IP is in use
before it accepts it. Windows does not do this verification until after it have
accepted the IP. Since the DHCPServer does not accept decline in BOUND state the
declines are dropped.
| | Results: |
The DHCPServer keeps offering the same IP to the client whose decline will be ignored.
| | Affects: |
Clavister Firewall v8.30.00 and up
| | Solution: |
Solved in v8.50.02.
|
| Possible crash when an active L2TP tunnel is removed from configuration
| | Problem: |
When an active L2TP tunnel is removed from the configuration, the Security Gateway may in some
cases crash when the L2TP tunnel is closed.
| | Affects: |
Clavister Firewall v8.50.00 and up
| | Solution: |
Solved in v8.50.02.
|
| Interface equivalency problems for nonfirst packets on state-tracked connections
| | Problem: |
Non-first packets of a state-tracked connection is not handled correctly
regarding interface equivalency.
| | Results: |
If fragmented packets are sent over a connection, and routing
gets changed so the data stream starts arriving on a different interface,
the nonfirst fragments won't make it through.
| | Affects: |
Clavister Firewall v8.00.00 and up
| | Solution: |
Solved in v8.50.02.
|
| PPTP/L2TP tunnel status displayed by ifstatus command
| | Problem: |
The PPTP/L2TP tunnel status is not displayed in a general fashion using
the ifstatus command.
| | Affects: |
Clavister Firewall v8.00.00 and up
| | Solution: |
As of v8.50.02 the ifstatus command displays the PPTP/L2TP tunnel status
in a general fashion like other interface types.
|
| ARP incompatibility with Microsoft Network Load Balancing
| | Problem: |
The core sends ARP responses to the MAC address found in
the ethernet header of the query. Microsoft NLB apparently does rely
on the response to be sent to the source MAC address in the ARP data.
| | Affects: |
Clavister Firewall v5.00 and up
| | Solution: |
As of v8.50.02 the core sends ARP responses to the source MAC address
in the ARP data.
|
| Log message when PPP license limit is exceeded is not parser friendly
| | Problem: |
The log message generated when the PPP licenese limit is exceeded is not
parser friendly. It is written in the form: "tunnels=x/y" where x is the number
of active tunnels and y is the total number of tunnels the license allows.
| | Results: |
Some log parsers may fail to parse the license limit exceeded message.
| | Affects: |
Clavister Firewall v8.40.00 and up
| | Solution: |
Solved in v8.50.02.
| | Note: |
Only the license limit is now displayed in the log message
and not the current usage.
|
| Configuring overly large IP address pool in L2TP/PPTP server would cause crash
| | Problem: |
Configuring an IP pool larger than the total RAM can hold, e.g. "0.0.0.0/0" or an entire
class A network (16 million addresses), will lead to a crash when configuration is deployed.
| | Affects: |
Clavister Firewall v8.50.00
| | Solution: |
As of v8.50.01, the pool size is limited to 1 million addresses. Configuring
a pool larger than that will lead to a warning message and the pool being
set to zero length.
|
| Intel e1000 NIC link problems (gigabit ports in all Clavister appliances)
| | Issue: |
Some Intel e1000 series chips has problems establishing
or maintaining link with some equipment.
| | Affects: |
Clavister Firewall v7.00 and up.
| | Solution: |
Solved in v8.40.05 and v8.50.01.
|
| Unable to log in via serial / physical console
| | Issue: |
The serial console (and physical, in the case of non-appliances), may be password protected.
| | Problem: |
A change in v8.50.00 broke the routine responsible for receiving the password
from the serial port / local keyboard.
| | Results: |
If a console password had been set, one would be unable to login using the
serial (and physical) console. Firewall Manager use would not be affected.
| | Affects: |
Clavister Firewall v8.50.00.
| | Solution: |
Solved in v8.50.01.
|
| User authentication timeouts not reset by traffic passing through FwdFast rules
| | Issue: |
When a user authenticated to the Security Gateway has an "idle timeout" configured,
it should be reset by traffic passing through the Security Gateway.
| | Problem: |
The idle timeout gets reset only by traffic being permitted by "Allow" and
"NAT" rules - state-tracked connections. Not by statelessly permitted
traffic via "FwdFast" rules.
| | Result: |
If all traffic for a logged-on user is permitted by FwdFast rules,
the user is logged out when the "idle timeout" period expired
regardless of sending traffic through the Security Gateway or not.
| | Affects: |
Clavister Firewall v8.10.00 and up.
| | Solution: |
Solved in v8.40.05 and v8.50.01.
|
| DSA certificates does not work in IPsec
| | Issue: |
IPsec can use RSA and DSA certificates for authentication. RSA
is by far and large the more common of the two.
| | Problem: |
Attempting to upload a configuration using DSA certificates
to the Security Gateway results in an error message:
"Error: Failed to decode private key for name-of-your-cert"
| | Affects: |
Clavister Firewall v8.10.00 -- .02, v8.20.00 -- .01, v8.30.00 -- .01, v8.40.00 -- .04, v8.50.00.
| | Solution: |
Solved in v8.10.03, v8.20.02, v8.30.02, v8.40.05 and v8.50.01.
|
| PPTP and L2TP tunnels not usable in HA setups
| | Problem: |
Configuring PPTP and L2TP tunnels (both servers and clients) on a High Availability
cluster results in configuration warnings, and the Slave unit enters
"Local Lockdown" mode, in which no traffic passes through it.
| | Affects: |
Clavister Firewall v8.50.00.
| | Solution: |
As of v8.50.01, PPTP and L2TP servers behave as can be expected.
PPTP and L2TP clients will establish their outbound connections from the unique
IP addresses of the cluster members, and quite often both members will have their tunnels
up at the same time.
| | Note: |
For PPTP and L2TP clients on a HA cluster, the only outbound traffic that is likely to
work through the tunnels is dynamically NATed connections. The reason for this is that
the PPTP/L2TP server in the other end otherwise will not know where to send the return
traffic, as there would be two tunnels with the same IP networks "behind" them.
|
| Loopback interfaces not usable in HA setups
| | Problem: |
Configuring loopback interfaces on a High Availability
cluster results in configuration warnings, and the Slave unit enters
"Local Lockdown" mode, in which no traffic passes through it.
| | Affects: |
Clavister Firewall v8.50.00.
| | Solution: |
Solved in v8.50.01.
|
|