| Transparent Mode implemented
| | Issue: |
The Transparent Mode feature aims at simplifying the deployment of
firewall appliances into the existing network topology, to strengthen
security. It helps to ease the administration work in a way that
there is no need to reconfigure all the settings for the nodes within
the current network, when a firewall is introduced into the communication
flow. Also, the Transparent Mode feature enables hosts to move between
different interfaces within the same group of transparent interfaces.
| | Change: |
As of v8.60.00, there is an new route type called SwitchRoute that is
used to define a group of transparent interfaces to act in a transparent
manner within the same transparent "switch".
|
| Server Load Balancing implemented
| | Issue: |
Server Load Balancing (SLB) is a mechanism dealing with
distribution of traffic load across multiple servers to scale
beyond the capacity of one single server, and to tolerate a
server failure.
| | Change: |
As of v8.60.00, there is an new SLB_SAT rule type capable of
dealing with distribution of traffic load across multiple servers.
| | Note: |
The new SLB_SAT rule is apart from the SLB specific settings, handled
like a normal SAT rule. This means that a secondary Allow or NAT rule
is needed.
|
| Radius Accounting support implemented
| | Issue: |
Radius Accounting can be used to keep track of usage statistics for
logged in users, such as session time, number of packets sent and received during
the session and the total amount of data sent and received.
| | Change: |
As of v8.60.00, there is an new Radius Accounting configuration option
for user authentication rules.
| | Note: |
The Radius Accounting feature can be used together with either the
local user authentication database or another radius server for
authentication. The accounting feature is separated from the
authentication, thus the authentication source/server and accounting server
does not have to be the same.
|
| Support for server-side IKE Configuration Mode
| | Issue: |
Support for server-side IKE Configuration Mode (cfg-mode) has
been added to allow assigning e.g. IP address and DNS information
to VPN (IPsec) clients.
| | Change: |
As of v8.60.00, IPsec tunnels can be configured to support server-side
Configuration Mode.
|
| Misc. IPsec changes
| | Issue: |
IKE Dead Peer Detection (DPD) can now be controlled through the
firewall configuration. Support for automatically establishing
IPsec tunnels at system startup has been added.
| | Change: |
As of v8.60.00, the IKE Dead Peer Detection can be controlled
per tunnel through the firewall configuration. Support has been
added for configuration of automatic establishment of IPsec
tunnels at system startup.
|
| Conn command modified
| | Issue: |
The conn command can now be used to close connections.
| | Change: |
As of v8.60.00, the conn command has been extended with
a "-close" switch.
|
| ARP timeout setting limit decreased
| | Issue: |
The ARP timeout setting was limited to a minimum value of 10 seconds.
| | Change: |
As of v8.60.00, the ARP timeout setting can now be configured as low
as one second.
| | Note: |
It is not recommended that the ARP timeout interval should be set lower
than 10 seconds, however, in some scenarios a lower timeout setting may
be needed.
|
| New synrelayer available
| | Issue: |
A new and improved synrelayer is available.
| | Change: |
As of v8.60.00, a new synrelayer is available that handles TCP MSS options.
| | Note: |
To enable the new synrelayer instead of the old one, enable the "TCPNewSynProtect" advanced setting.
|
| New "routemon" console command
| | Issue: |
A new "routemon" console command is available.
| | Change: |
As of v8.60.00, a new "routemon" console command is available that can be
used to list information about all monitored routes.
|
| HTTP ALG now allows compressed data
| | Issue: |
The HTTP ALG always asked the web server not to send compressed data
as this does not work with content stripping.
| | Change: |
As of v8.60.00, the HTTP ALG will allow the server to send compressed
data as long as the HTTP ALG isn't configured to do content stripping.
| | Note: |
This means that compressed data is allowed as long as the HTTP ALG
isn't configured to perform stripping of ActiveX objects, Java Applets
and Javascripts/VBScripts.
|
|