Clavister Security Gateway changes from v8.70.01 to v8.70.02

Clavister Security Gateway changes from v8.70.01 to v8.70.02

8.70.02 Release date: 2006-11-27 [ISO]

Please Note: If upgrading from versions prior to 8.70.00, the Clavister Loader MUST be upgraded before Clavister CorePlus!

Contents of this document

Version 8.70.02 contains fixes to problems in CorePlus and FineTune. This document outlines problems fixed as well as improvements for each component.

The upgrade procedures in this document refer to upgrades from earlier v8.0x installations.

Summary of changes and problems fixed in v8.70.02

Files installed by v8.70.02

How to upgrade earlier v8.0x releases to v8.70.02

How to upgrade v6.0x/v7.0x releases to v8.0x

HA upgrade procedure

Clavister FineTune
[Problems Fixed]

Clavister CorePlus
[Problems Fixed] [Known Issues]

For future reference: This document is stored in the "Docs" sub-folder of your Clavister FineTune installation folder.

Change logs / release notes for earlier versions of Clavister Security Gateway are available in the release notes section of www.clavister.com/support.

Summary of changes and problems fixed

FineTune

Problem fixed: The downloaded IDP database is lost when a security gateway is renamed.

CorePlus

  Problem fixed: NATed L2TP/IPSec clients can't reconnect to a broken connection

  Problem fixed: Advanced setting TCPAllowReopen is not always obeyed

  Problem fixed: Certificate and tunnel mismatch problem with self-signed certificates and ID lists.

  Problem fixed: A memory leak in the Intrusion Detection and Prevention engine.

  Problem fixed: Change of proxy IDs during IPsec SA negotiation corrupted internal data structures.

  Problem fixed: Dead Peer Detection only triggered on the absence of incoming traffic after there has been outgoing traffic.

  Problem fixed: Detection of CSPN servers will fail for an inactive HA node.

  Problem fixed: The IDP autoupdate functionality uses the private IP addresses to download updates.

  Known problem: HA: Transparent Mode won't work in HA mode

  Known problem: HA: No state synchronization for ALGs

  Known problem: HA: Tunnels unreachable from inactive node

  Known problem: HA: No state synchronization for L2TP and PPTP

  Known problem: HA: No state synchronization for IDP signature scan states.

Files installed by v8.70.02

This is a list of files that are new to the v8.70.02 release. All paths are relative to your Clavister FineTune installation folder.


»	Cores/sgc-8.70.02-full.cfx This is the full v8.70.02 of CorePlus. Upload it to your existing Security Gateway, or create new boot media with it. It contains all available functionality.

»	Cores/sgc-8.70.02-sg50.cfx This is the v8.70.02 CorePlus for the SG50 appliance. Upload it to your existing Security Gateway. It contains all available functionality.

»	Cores/sgc-8.60.02-mini.cfx This is a version of v8.60.02 CorePlus with certain features removed. It is less than half the size of the full version. This version should be used if you would like to start the system on a floppy before copying it over to another media.

»	Docs/changes-8.70.01-to-8.70.02.html This document.

»	Docs/Clavister EULA.pdf The Clavister End User License Agreement.

»	Docs/Clavister_CorePlus_Admin_Guide_8_70.pdf The Clavister CorePlus administration guide for the v8.70.02 release.

»	Docs/Clavister_FineTune_Admin_Guide_8_70.pdf The Clavister FineTune administrators guide for the v8.70.02 release.

»	Docs/Clavister_Log_Reference_Guide_8_70.pdf The log reference guide for the v8.70.02 release.

»	Docs/SG50_Installation_Setup.pdf Installation and Setup guide for the SG50 series platform.

»	Docs/SG3100_Installation_Setup.pdf Installation and Setup guide for the SG3100 series platform.

»	Docs/SG4200_Installation_Setup.pdf Installation and Setup guide for the SG4200 series platform.

»	Docs/SG4400_Installation_Setup.pdf Installation and Setup guide for the SG4400 series platform.

»	Docs/SG5500_Installation_Setup.pdf Installation and Setup guide for the SG5500 series platform.

»	FineTune.exe This is the v8.70.02 Clavister FineTune executable.

»	SNMP/Clavister-Traps.mib This is the Clavister v8.70.02 SNMP Traps MIB.

»	SNMP/Clavister-SMI.mib This is the Clavister v8.70.02 SNMP Structure of Management Information file.

How to upgrade earlier v8.0x releases to v8.70.02

Please Note: If upgrading from versions prior to 8.70.00, the Clavister Loader MUST be upgraded before Clavister CorePlus!

Upgrading a previous v8.x release to v8.70.02 is completely straightforward.
First upload the new Clavister Loader, followed by the new CorePlus, "sgc-8.70.02-full.cfx" (or "sgc-8.70.02-sg50.cfx" for the SG50 Series), to your Security Gateway and restart it.

HA upgrade procedure

Note: For upgrades from v7.x HA clusters, first follow the HA upgrade procedures outlined in changes-7.0x.xx-to-8.00.02.html.

Note: Upgrades from versions prior to v8.40.01: Upgrading directly to v8.50.00 or later from a version prior to v8.40.01 will lead to loss of state synchronization. All open states will be closed as a result of the upgrade. If this is acceptable, continue with the upgrade as described below. Otherwise, first upgrade to v8.40.01 or a later v8.4x core and then upgrade to v8.70.02.

Simply upload the new CorePlus file to the Security Gateways in your cluster and make sure that the first upload and restart is successful before uploading to the second Security Gateway.

We recommend beginning with the Security Gateway that is currently active, even though this will necessitate two failovers. The reason for this is that ALG sessions are not synchronized.

The "immediate availability" method

Upload the core to the currently active Security Gateway ("Security Gateway A") and restart it.
Issue a 'reconfigure' on the Security Gateway B to rapidly fail back to the now upgraded Security Gateway A. Make sure Security Gateway A functions properly.
Upload the core to Security Gateway B and restart it.
End result: Security Gateway A is now the active node, just as it was before the upgrade procedure.

Note that this leaves the second Security Gateway untested, even though it most likely will work just as well as the first Security Gateway. If you want to specifically test the second Security Gateway, you can:
1) cause two failovers manually, or
2) connect to it via e.g. the remote console just to make sure it's running, or
3) if ALG and tunnel synchronization is not a concern, follow this procedure:

The "long-term safe" procedure:

Upload the core to the currently inactive Security Gateway ("Security Gateway B") and restart it.
Issue a 'reconfigure' on Security Gateway A. This causes failover to Security Gateway B. Make sure Security Gateway B functions properly.
Upload the core to Security Gateway A and restart it.
Issue a 'reconfigure' on Security Gateway B to fall back to Security Gateway A. Make sure Security Gateway A functions properly.
End result: Security Gateway A is now the active node, just as it was before the upgrade procedure.

Note that the "availability" issues affect only synchronization of ALGs and tunnels; there is more information about this in the Known Issues section. All other states are, as usual, fully synchronized and not affected in either procedure.

FineTune Problems Fixed

The downloaded IDP database is lost when a security gateway is renamed.
Problem:	When a security gateway is renamed, the downloaded IDP database is lost.
Results:	The IDP database must be downloaded from the security gateway.
Affects:	Clavister CorePlus v8.70.00 and v8.70.01.
Solution:	Fixed in v8.70.02.

CorePlus Problems Fixed

NATed L2TP/IPSec clients can't reconnect to a broken connection
Problem:	If a NATed client connected with L2TP/IPsec incorrectly gets disconnected, the associated IPSec SA is still active in the security gateway.
Results:	The NATed client will not be able to reconnect if the connection has been disconnected by mistake.
Affects:	Clavister CorePlus v8.60.00, v8.60.01 and v8.60.02
Solution:	Fixed in v8.60.04 and v8.70.02.

Advanced setting TCPAllowReopen is not always obeyed
Problem:	The advanced setting TCPAllowReopen is not always obeyed.
Results:	In some cases it has been possible to reestablish closed TCP connection even though the setting prohibits it.
Affects:	Clavister CorePlus v8.60.03, v8.70.01 and v8.70.00.
Solution:	Fixed in v8.60.04 and v8.70.02.

Certificate and tunnel mismatch problem with self-signed certificates and ID lists.
Problem:	IPsec tunnel matching with ID lists did not work when used together with self-signed certificates.
Results:	One or more clients will fail to connect.
Affects:	Clavister CorePlus v8.60.00, v8.60.01, v8.60.02, v8.70.00 and v8.70.01
Solution:	Fixed in v8.60.04 and v8.70.02

A memory leak in the Intrusion Detection and Prevention engine.
Problem:	A memory leak in the Intrusion Detection and Prevention engine caused increased memory usage over time.
Results:	Excessive use of memory.
Affects:	Clavister CorePlus v8.70.01.
Solution:	Fixed in v8.70.02.

Change of proxy IDs during IPsec SA negotiation corrupted internal data structures.
Problem:	The change of proxy IDs during IPsec SA negotiation corrupted internal data structures.
Results:	Could cause a system crash.
Affects:	Clavister CorePlus v8.60.00, v8.60.01, v8.60.02, v8.60.03, v8.70.00 and v8.70.01
Solution:	Fixed in v8.60.04 and v8.70.02.

Dead Peer Detection only triggered on the absence of incoming traffic after there has been outgoing traffic.
Results:	DPD will fail to detect a dead peer if there is only incoming traffic to the peer.
Solution:	Fixed in v8.60.04 and v8.70.02.

Detection of CSPN servers will fail for an inactive HA node.
Problem:	Detection of CSPN servers will be done using the shared IP address in HA setups. Only the active node will perform server detection.
Results:	The inactive HA node will not be able to determine what CSPN server to contact if only the shared IP address can access the internet.
Affects:	Clavister CorePlus v8.70.00 and v8.70.01.
Solution:	Fixed in v8.70.02.

The IDP autoupdate functionality uses the private IP addresses to download updates.
Problem:	Automatic downloads of IDP signatures uses the private IP address to download updated signatures.
Results:	IDP Update requires two globally accessible IP addresses as private IPs on the two external interfaces towards the Internet.
Affects:	Clavister CorePlus v8.70.00 and v8.70.01.
Solution:	Fixed in v8.70.02.

CorePlus Known Issues

HA: Transparent Mode won't work in HA mode
Problem:	There is no state synchronization for Transparent Mode and there is no loop avoidance.
Results:	Transparent Mode won't work in HA mode. There is no state synchronization and loop avoidance is not in place.

HA: No state synchronization for ALGs
Problem:	No aspect of ALGs are state synchronized
Results:	This means that all traffic handled by ALGs will freeze when the cluster fails over to the other peer. If, however, the cluster fails back over to the original peer within approximately half a minute, frozen sessions (and associated transfers) should begin working again. Note that such failover (and consequent fallback) occurs each time a new configuration is uploaded.

HA: Tunnels unreachable from inactive node

Problem:

The inactive node in a HA cluster cannot communicate over IPsec, PPTP, L2TP and GRE tunnels, as such tunnels are established to/from the active node.

Results:

»	Inactive HA member cannot send log events over tunnels.
»	Inactive HA member cannot be managed / monitored over tunnels.
»	OSPF: If the cluster members do not share a broadcast interface so that the inactive node can learn about OSPF state, OSPF failover over tunnels uses normal OSPF failover rather than accelerated (<1s) failover. This means 20-30 seconds with default settings, and 3-4 seconds with more aggressively tuned OSPF timings.

HA: No state synchronization for L2TP and PPTP
Problem:	There is no state synchronization for L2TP and PPTP tunnels.
Results:	On failover, incoming clients will re-establish their tunnels after the tunnels are deemed non-functional. This timeout is typically in the 30 -- 120 second range.

HA: No state synchronization for IDP signature scan states.
Problem:	No aspects of the IDP signature states are synchronized.
Results:	This means that there is a small chance that the IDP engine causes false negatives during a HA failover.