Aventail Installation Tech Note

Transcription

1 Aventail Installation Tech Note ST2+ / SSL VPN version Aventail Corporation. All rights reserved. Aventail, Aventail Cache Control, Aventail Connect, Aventail Connect Mobile, Aventail Connect Tunnel, Aventail End Point Control, Aventail Management Console, Aventail OnDemand, Aventail OnDemand Tunnel, Aventail Secure Desktop, Aventail Smart Access, Aventail Smart Policy, Aventail Smart SSL VPN, Aventail Smart Tunneling, Aventail ST, Aventail Unified Policy, Aventail WorkPlace, Aventail WorkPlace Mobile, Aventail EX- 750, Aventail EX-1500, Aventail EX-1600, Aventail EX-2500 and their respective logos are trademarks, registered trademarks, or service marks of Aventail Corporation. Other product and company names mentioned are the trademarks of their respective owners. Last modified 11/28/2006 9:27 AM

2 2 Aventail ST2+/SSL VPN This document describes the process of installing the Aventail ST2+ (v8.8.0) platform update on an Aventail SSL VPN appliance. For a complete list of known issues from previous versions that are fixed in this release, see the Readme file. Notes Update Requirements If you changed the root password from the command-line interface (using the passwd command), it will be reset during the upgrade process. To log in to the appliance after an upgrade, enter the root password as originally specified using Setup Tool. (29312) After updating, WorkPlace will be configured to use the default (dark blue) color scheme. If your previous configuration used a different color scheme, you will need to log in to Aventail Management Console (AMC), reset the color scheme, and apply changes. (30740) Advanced EPC, which is new in version 8.8.0, enables you to check for the presence and status of a wide variety of personal firewall, antivirus, and antispyware protection applications. It is licensed separately. If you don t have Advanced EPC, the earlier preconfigured device profiles (for example, Windows Antivirus) will not be available after you upgrade unless your device profiles already reference them. One of the following Aventail SSL VPN platform versions must currently be installed on the appliance in order to install the update: v v v To verify the current version: Obtaining the Update Files 1. From the main navigation menu in AMC, click System Status. 2. Make sure that the Version number is one of the supported version numbers listed above. Before updating, you must obtain the update file and its corresponding checksum and copy them to the file system of your local computer. These two files are delivered in a single.zip file. 1. Log in to Aventail s support site at 2. Open the Downloads > Aventail EX-2500/1500/750 > ST v8.8.0 Update folder, and download the upgrade_8_8_0_<three-digit build number>.zip file to your local computer. The.zip file contains the following files: upgrade_8_8_0_<three-digit build number>.bin upgrade_8_8_0_<three-digit build number>.bin.md5 3. Using a file-extraction program such as WinZip, extract the.bin and.bin.md5 files and save them to your local computer.

3 Installation TechNote 3 NOTE: When saving an.md5 file, a.txt file extension may be appended to the file name. If so, delete the.txt extension so that the file name ends with an.md5 extension. Installing the Update This section outlines the process of updating your system. Backing Up Your Current Configuration Before updating, you can back up the current configuration data from your appliance using the Export feature in AMC. This step is optional. 1. From the main AMC navigation menu, click Maintenance. 2. In the System configuration area, click Import/Export. 3. Click Export. The Export Configuration page appears, and a File Download dialog box prompts you to open the.aea file or save it to your hard drive. NOTE: On Windows XP with Service Pack 2, Internet Explorer may block the download of the.aea file. To work around this, click the information bar that appears beneath the Internet Explorer Address box, and then click Download File. 4. Click Save, browse to the correct directory on your hard drive, and then save the.aea file. 5. Click OK on the Export page to return to the Import/Export page. Installing the Update File Next, install the update through AMC. 1. From the main navigation menu in AMC, click Maintenance. The Maintenance page appears. 2. In the System Configuration area, click Update. 3. If you have not already downloaded the update file (as described in Obtaining the Update Files ), click the Aventail Assurance Web site link and log in to download the appropriate update file to your local file system. 4. Type the path of the update file or click Browse to locate it. 5. Click Install Update. A file upload status indicator appears. If necessary, you can stop the upload process by clicking Cancel. This step may take several minutes, depending on the network connection speed. After the file upload process is complete, the update is automatically installed on the appliance. You cannot cancel this installation process. After the installation process is complete, the appliance automatically restarts. NOTE: If you changed the root password from the command-line interface (using the passwd command), it will be reset during the upgrade process. To log in to the appliance after an upgrade, enter the root password as originally specified using Setup Tool. (29312)

4 4 Aventail ST2+/SSL VPN Verifying the Update After installing the update, verify the current version number in AMC. To verify the current version number: 1. Log in to AMC. 2. From the main navigation menu, click System Status and make sure that the update succeeded by verifying that the Version number is <three-digit build number>. Hotfix for Connect Mobile Version includes Connect Mobile, which is signed with an M2M (Mobile2Market) certificate for use on all Windows Mobile devices. The Connect Mobile files in v8.8.0, however, are not correctly signed. You must apply a hotfix (clt-hotfix-8_8_0-001) to v8.8.0 in order to obtain correctly signed files for Connect Mobile. The instructions for applying this hotfix are included here and in the Readme that accompanies it. The clt-hotfix-8_8_0-001 hotfix contains replacements for the following files: connectmobile.cab cmsetup.exe The script performs the following actions: Backs up existing files. Replaces the files with updated ones containing the fix. Installation Instructions Follow these steps to apply the clt-hotfix-8_8_0-001 hotfix to v8.8.0: 1. Copy the file clt-hotfix-8_8_0-001.gz from the Assurance site to the root of the appliance (/). 2. Log in to the appliance via SSH or serial connection as root. (If you are administering an HA pair of appliances, the hotfix must be applied to both nodes.) 3. Change directory: cd / 4. Decompress the archive: gzip -d clt-hotfix-8_8_0-001.gz 5. Mark the hotfix script as executable: chmod a+x clt-hotfix-8_8_ Execute the hotfix script:./clt-hotfix-8_8_ i

5 Installation TechNote 5 Updating a Clustered Pair To update the Aventail software in a cluster environment, you must install the update file on each node of the cluster. The order in which you update the nodes in the cluster is very important. There may be some disruption to service when performing the update, so you should schedule it during a maintenance window. For more information on managing a cluster, see the Installation and Administration Guide. Notes It is very important that you begin the process with the master node. It is also important that you perform the procedure on both nodes of the cluster. Do not promote the slave node to master node during the update. If you have already done so, disable both nodes while updating. There is a restriction regarding the cluster interface IP addresses (backplane) used for communication between the two nodes in a cluster: the last octet must be between 1 and 32, inclusive. If your addresses don t meet this criterion, call Aventail Technical Support for a hotfix that will change your addresses without affecting other configuration data. This section describes how to update a cluster. 7. Log in to AMC and verify which node is the master. For more information, see Monitoring a Cluster in the Installation and Administration Guide. 8. Log in to AMC on the master node and then, from the main navigation menu in AMC, click Maintenance. 9. In the System Configuration area, click Update. 10. If you have not already downloaded the update file (as described in Obtaining the Update files ), click the Aventail Assurance Web site link and log in to download the appropriate update file to your local file system. 11. Type the path of the update file or click Browse to locate it. 12. Click Install Update. A file upload status indicator appears. If necessary, you can stop the upload process by clicking Cancel. While the master node is updating, the slave node continues servicing requests. When the update to the master node completes and the master comes back online, it notices that the slave node s version differs from its own. It then stops the services on the slave node and services all incoming requests itself. 13. Log in to AMC on the slave node and then, on the AMC Home page, click Update. 14. Type the path of the update file or click Browse to locate it. 15. Click Install Update. A file upload status indicator appears. If necessary, you can stop the upload process by clicking Cancel. When the update to the slave node completes and the slave node comes back online, it rejoins the cluster and is synchronized with the master node. The load balancer is then aware that both nodes are available to service requests. 16. Make sure that the update succeeded by verifying in AMC on both nodes that the Version number is <three-digit build number>.