Amaranten Firewall Changes from v8.00.06 to v8.00.07

Release date: 2003-10-10 [ISO]

Version 8.00.07 contains bug fixes to the Firewall Core and the Firewall Manager. This document outlines bug fixes as well as improvements for each component.

The upgrade procedures in this document refers to upgrades from earlier v8.0x installations.

·  New files installed by v8.00.07

·  How to upgrade earlier v8.0x firewalls to v8.00.07

·  HA upgrade procedure

·  Firewall Manager

[Changes]

[Bug Fixes]

[Known Bugs / Problems]

·  Firewall Core

[Changes]

[Bug Fixes]

[Known Bugs / Problems]

·  Firewall Core - VPN specific  

[Changes]

[Bug Fixes]

[Known Bugs / Problems] 

·  Firewall Core - HA specific

[Changes]

[Bug Fixes]

[Known Bugs / Problems]

For future reference: This document is stored in the "Docs" sub-folder of your Firewall Manager install folder.

Change logs / release notes for earlier versions of Amaranten Firewall are available in the release notes section of www.Amaranten.com/support.

 

 

 Summary of changes and bug fixes

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

All changes and bug fixes affecting the standard firewall core also affect VPN and HA cores, unless explicitly stated otherwise.

Firewall Manager

  Bug fix: 

Netobject name changes do not propagate to comma-separated lists

  Bug fix: 

Copying service groups causes FWMgr to freeze

  Bug fix: 

Status icon of folders etc not updated when firewall status changes

Firewall Core

  Change: 

New TCP ECN "Nonce Sum" flag now handled the same way as other ECN flags

Firewall Core - VPN specific

  Bug fix: 

Security Alert: Buffer overrun in IKE certificate ASN.1 parser

Firewall Core - HA specific

  Known bug: 

No state synchronization for FTP ALG

 

 New files installed by v8.00.07

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

This is a list of the files that are new to the v8.00.07 release. All paths are relative to your Firewall Manager install folder.

» 

Cores/fwc-8.00.07-full.cfx
This is the v8.00.07 full firewall core. Upload it to your existing firewall, or create new boot media with it. It contains VPN as well as HA functionality.

» 

Cores/fwc-8.00.07-novpn.cfx
This is a version of the v8.00.07 core without VPN support. It is roughly half the size of the full version.

» 

Cores/fwcoreup8.exe
This is the core used to remotely upgrade v7.0x and earlier firewalls. It will install a "8.00.02-full" core.

» 

Docs/changes-8.00.06-to-8.00.07.html
This document.

» 

FWMgr8.exe
This is the v8.00.07 Firewall Manager. Earlier version 8 Firewall Managers will be overwritten. Version 7 Firewall Managers (if installed) will not be overwritten, as they are named "FWMgr7.exe", and are also typically installed in a different directory.

 

 How to upgrade earlier v8.0x firewalls to v8.00.07

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Upgrading a previous v8.0x firewall to v8.00.07 is completely straightforward.
Simply upload the new core, "fwc-8.00.07-full.cfx", to your firewall and restart it.
(Alternatively, upload the "-novpn" version if you do not wish VPN functionality.)

 

 HA upgrade procedure

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

There are no incompatibilities in the HA synchronization protocol between 8.00.07 HA cores and earlier v8.0x HA cores. No special procedures are required.

Simply upload the new firewall core file to the firewalls in your cluster and make sure that the first upload and restart is successful before uploading to the second firewall.

We recommend beginning with the firewall that is currently active, even though this will necessitate two failovers. The reason for this is that ALG sessions are not synchronized.

The "immediate availability" method

  • Upload the core to the currently active firewall ("firewall A") and restart it.
  • Issue a 'reconfigure' on the firewall B to rapidly fail back to the now upgraded firewall A. Make sure firewall A functions properly.
  • Upload the core to firewall B and restart it.
  • End result: Firewall A is now the active node, just as it was before the upgrade procedure.

Note that this leaves the second firewall untested, even though it most likely will work just as well as the first firewall. If you want to specifically test the second firewall, you can:
1) cause two failovers manually,   or
2) connect to it via e.g. the remote console just to make sure it's running,   or
3) if ALG synchronization is not a concern, follow this procedure:

The "long-term safe" procedure:

  • Upload the core to the currently inactive firewall ("firewall B") and restart it.
  • Issue a 'reconfigure' on firewall A. This causes failover to firewall B. Make sure firewall B functions properly.
  • Upload the core to firewall A and restart it.
  • Issue a 'reconfigure' on firewall B to fall back to firewall A. Make sure firewall A functions properly.
  • End result: Firewall A is now the active node, just as it was before the upgrade procedure.

Again, note that the "availability" issues only affect ALGs. All other states are, as usual, fully synchronized and not affected in either procedure.

 

 Firewall Manager Bug Fixes

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Netobject name changes do not propagate to comma-separated lists

    Issue:

It is possible to use lists of netobject directly in the rules section and other places without creating a netobject group and then using this group.

    Problem:

If a netobject is renamed, the name change would not propagate to such lists where it is used. A netobject could be deleted even though being in use.

    Result:

The configuration would most likely fail to parse and could not be saved.

  Affects:

FWMgr v8.00.00-8.00.06, v8.10.00-v8.10.01.

    Fix:

Fixed in v8.00.07, v8.10.02 and v8.20.00.

 

Copying service groups causes FWMgr to freeze

   Problem:

Attempting to make a copy of a service group would cause FWMgr to freeze and consume 100% CPU.

   Affects:

FWMgr v8.00.00-8.00.06, v8.10.00-8.10.01.

    Fixed:

Fixed in v8.00.07, v8.10.02 and v8.20.00.

 

Status icon of folders etc not updated when firewall status changes

    Issue:

When the status of a firewall changes (e.g. from 'up and running' to 'unreachable'), the status of its parent folder / namespace / cluster should change with it.

    Problem:

This change would not occur until the folder / namespace / cluster in question was clicked.

   Affects:

FWMgr v8.00.00-8.00.06, v8.10.00-8.10.01.

    Fixed:

Fixed in v8.00.07, v8.10.02 and v8.20.00.



 

 Firewall Core Changes

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

New TCP ECN "Nonce Sum" flag now handled the same way as other ECN flags

    Issue:

The TCP Explicit Congestion Notification mechanism has previously only been using two TCP flags: ECE and CWR (previously known as the XMAS/YMAS flags). A new extension to the ECN mechanism will add a third flag, "NS". This flag must be handled the same way as the original two flags.

    Change:

As of 8.00.07, 8.10.02 and 8.20.00, the following changes are made:

» 

The "TCPECN" setting now works on three flags : the original two, plus the new "NS" flag.

» 

The "TCPRF" setting, which previously worked on four unused flags in the TCP header now only works on three flags, as one of them was used by the new "NS" flag.

» 

TCP flag dumps generated by the firewall (e.g. syslog events) will display the flag as "ns=1".

» 

TCP flag dumps were also revised to show "ece=1" and "cwr=1" rather than "xmas=1" and "ymas=1".

    Note:

As the "TCPECN" and "TCPRF" settings both default to "Strip", there is no difference for configurations where these values have been left unchanged.
However, for configurations where ECN has been allowed (TCPECN = Ignore), it will soon become necessary to upgrade, or make sure that TCPECN and TCPRF are set the same way. The former is more preferable.