Release Notes. Contents. Platform Compatibility. Release Caveats. Dell SonicWALL Aventail SRA EX-Series Release Notes. Secure Remote Access

Transcription

1 Secure Remote Access Dell SonicWALL Aventail SRA EX-Series SonicOS Contents Platform Compatibility... 1 Release Caveats... 1 What s New in This Release?... 2 Known Issues... 3 Resolved Issues... 6 Technical Documentation and the Knowledge Portal Platform Compatibility The Dell SonicWALL Aventail E-Class SRA EX-Series release is supported on the following SonicWALL appliances: SonicWALL Aventail E-Class SRA EX9000 SonicWALL Aventail E-Class SRA EX7000 SonicWALL Aventail E-Class SRA EX6000 SonicWALL Aventail E-Class SRA EX-2500 SonicWALL Aventail E-Class SRA EX-1600 SonicWALL Aventail E-Class SRA EX-750 SonicWALL Aventail E-Class SRA Virtual Appliance Note: Windows machines running version clients should be used with SRA EX-Series appliances running one of the following versions: If clients are used with appliances running / or earlier, zone classification will fail when connecting, and the user will be put in the default zone. If you are upgrading a SonicWALL Aventail E-Class SRA EX-Series appliance to version from an earlier release, be sure to consult the upgrade instructions in the SonicWALL Aventail Upgrade Guide for detailed information. You ll find a copy of this document on the MySonicWALL Web site ( Release Caveats The 10.5.X release series was the last release with support for OnDemand Dynamic Mode, which is a proxy based agent deployed through the WorkPlace portal. It is important to note that the OnDemand Proxy Agent has two configurations: Dynamic Mode and Mapped Mode. The Mapped Mode use case is still supported, and only Dynamic Mode support is being removed. We recommend customers who still have OnDemand Dynamic mode configured through the WorkPlace portal consider the OnDemand Tunnel agent as an alternative. The OnDemand Tunnel agent offers superior performance and platform coverage over OnDemand Dynamic mode, with identical installation requirements. Aventail SRA EX-Series

2 What s New in This Release? This version of the Aventail SRA EX-Series software includes the following new and enhanced features: Windows 8 Support Version is compatible with Microsoft Windows 8. Mac OS X 10.8 Support Version is compatible with Mac OS X Internet Explorer 10.0 Support Version is compatible with Internet Explorer OESIS Fallback Detection for Vendor Libraries Uses Windows Security Center for product detection. Windows Security Center can be used for product detection when OESIS Local does not support a product in the field yet, or when OESIS Local product detection fails. This feature allows detection of Anti-Virus, Anti-Spyware, and Firewall products and libraries installed on the endpoint. Windows Security Center is available on Microsoft Windows XP SP2 and higher, and on Windows Vista. It is also available on Windows 7, but is renamed to Windows Action Center. Windows Security Center supports a minimal subset of the product state information and remediation actions that OESIS Local provides. Only the following information is available for products detected with Windows Security Center: Anti-Virus Products: Product Version Service Information Product Authenticity Installation Directory RTP (Real-time Transport Protocol for delivering audio and video over IP networks) Data File Time Anti-Spyware Products: Product Version Service Information Product Authenticity Installation Directory Anti-Spyware File System Protection Enforcement Status Anti-Spyware Data File Time Firewall Products: Product Version Service Information Product Authenticity Installation Directory Firewall Enabled Status Although OESIS Local libraries provide significantly more information about detected products, Windows Security Center helps to bridge the gap between the time a product is released and when it is supported by OESIS Local. 2

3 Known Issues This section contains a list of known issues in the Aventail release. Cache Cleaner After WorkPlace login, the Cache Cleaner applet does not load properly and the user is logged out of WorkPlace. Password for URL Resources is not deleted. Cache Cleaner wipe in progress and Cache Cleaner wipe complete messages appear during a WorkPlace session. Cache Cleaner busy icon is displayed, Cache Cleaner version cannot be displayed by rightclicking, and timer does not display a value. Cache Cleaner does not remove cookies. Occurs when using Mac OS X (10.7.x/10.8.x) and Safari 6 with Java 1.7.x. After the user logs into WorkPlace using a realm enabled with Cache Cleaner, the Cache Cleaner applet consumes more than 1 GB of memory and fails to load and the user will be logged out of WorkPlace. Occurs when using Windows XP/7/Vista with Internet Explorer 8/9. Occurs when using Windows XP, Windows Vista (32-bit/64-bit), Windows 7 (32-bit/64-bit), Windows 8 (32-bit/64-bit), Mac 10.6 (32-bit), or Mac 10.7 or 10.8 (32-bit/64-bit) with Internet Explorer, Firefox, or Safari for a Cache Cleaner-enabled realm. Occurs when Cache Cleaner is launched with inactive connection setting. Occurs when using Internet Explorer 10 and Windows 8 with the built-in administrator account Extraweb Login Apache core generated. Occurs when upgrading an appliance, importing a partial configuration, or applying a license under certain conditions. Workaround: These are one-off core files and can be safely ignored

4 High Availability An EX-Series High Availability pair running , , or may experience problems with password synchronization. End-users might experience intermittent authentication failures when logging into the HA pair. Occurs when an HA pair running or is using a local authentication database to authenticate local users. If the user changes their local authentication password at any point on or , the user will intermittently not be able to log in with the new password since it was not synchronized between the two nodes. The issue occurs on after upgrading from a or HA pair with unsynchronized local user passwords. Workaround: Force the primary (active) node to synchronize all passwords. Note that some endusers will have to use an old password if they changed their password on the secondary (standby) HA node, since passwords are overwritten during replication. After upgrading both nodes to , SSH to the ACTIVE appliance and run the command: mysqldump users users mysql users This will rebuild the users table, and with replication turned on, the secondary node will sync to these values. The passwords on the primary and secondary nodes will stay in sync from this point forward OnDemand Proxy OnDemand Proxy agent activation fails after an accessed resource session is closed. Occurs when using Windows 8 and Firefox 12. Workaround: Upgrade to Firefox Policy Server Policy server core found on EX9000 appliance. Authentication fails and users cannot login. Occurs when upgrading an EX9000 appliance or importing/exporting its configuration file with LDAP cert-auth enabled. Workaround: These are one-off core files and can be safely ignored. Occurs when the device is upgraded from to because the node secret is not migrated correctly. Workaround: Clear the node secret for the authentication agent on the RSA server under security console

5 Secure Virtual Desktop Active Internet Explorer windows are not closed when WorkPlace starts. Popup blocker appears when accessing a web resource. Internet Explorer 10 is opened inside WorkPlace when launched from the PC desktop. Internet Explorer 10 is opened on the PC desktop when launched inside WorkPlace. Users receive Windows host process (Rundll32) has stopped working and avinit.app stopped working error messages. Occurs when using Windows XP SP3 with Internet Explorer 7. Workaround: Upgrade to a newer version of Internet Explorer or use another browser. Occurs when using accessing a web resource from WorkPlace using Windows 8. Occurs when using 64-bit Windows 8 and WorkPlace has already been launched. Occurs when using 64-bit Windows 8 and Internet Explorer 10 has already been launched from WorkPlace. Occurs when launching WorkPlace with EWPCA on Windows Vista SP2 while using ActiveX and Java fallback WorkPlace ipad-based WorkPlace access is not functioning properly after upgrading to version 10.6.x. Occurs when using an ipad to access WorkPlace and the ipad Safari browser profile is set incorrectly. Workaround: Change the Agent Configuration > Browser Profiles setting for ipad Safari to Advanced mobile

6 Resolved Issues The following issues are resolved in the Aventail release: ActiveSync iphone/ipad users receive The server is unavailable message when attempting to download . ActiveSync consumes multiple licenses for a user, primarily when using an iphone or ipad. Occurs when appliance fails to contact exchange server when connecting with ActiveSync. Occurs when HA is configured and a various devices are used to sync AMC Appliance system time is incorrect in the Unregistered Device Log. Appliance can be accessed only from a directly connected subnet. Hotfixes do not update configuration files. Configuration changes appear in AMC but not in WorkPlace and other services. Occurs when time zone is set to a time zone other than GMT. Occurs when the external interface is disabled and changes are applied. Occurs when a hotfix is installed that generates configuration data such as a vtl or xsl template. Apply All must be performed before rebooting. Occurs when changes are not saved in configuration file The Connect Tunnel Service section of the Agent Configuration > Client Installation Packages page indicates the Connect Tunnel Service can be installed on outdated operating systems. Occurs because text was not updated Some AMC Administrators cannot discard pending changes. Read-only administrator can delete communities. Occurs when the Administrator is an external (for example, Active Directory or local authentication) Administrator. Occurs when the Realm page is displayed and user hovers over the community and clicks the red X mark Replication limit is reached. Occurs when attempting to add more than 10 appliances

7 Authentication Non-ASCII characters ( $ and French accent mark) are not allowed in SSO password. Multiple users cannot log into a realm. Occurs when using basic or NTLM authentication and Single Sign-On. Occurs when Cache Group Checking is enabled on an Active Directory authentication server Certificates SSL VPN client certification authentication fails with Your certificate is invalid. Contact your helpdesk for more information error message. User receives Invalid format message when adding LDAP-based CDP URL Occurs when the name contains a BMPString value. Occurs when adding LDAP-based CDP URL that does not include the host[:port] Connect Tunnel Realm is not updated with Windows dial-up connection. Tunnel client displays Authentication prompts refreshed for the selected connection message. User can log in from ipad logged in through Mobile Connect, but resources cannot be accessed Custom messages created in an Active Directory authentication server (Advanced section) are truncated. Occurs when multiple realms are configured and a null authentication realm is used to install Connect Tunnel from the WorkPlace. Occurs when fetching authentication prompts from the server, which may take a few seconds when using a slow connection. Occurs when using Mobile Connect 1.m.25 on an ipad with an explicit ACL rule. Occurs when logged in as a non-administrative user if Connect Tunnel was installed in Admin mode

8 End Point Control A specific zone cannot be defined in a device profile or detected by Aventail Connect for Android. Zone details for a user are not displayed in Connect Tunnel. Trend Micro anti-virus status is not checked. Occurs when a device profile is configured as Linux with Application because com.macafee.vsm_android_dcm isn t detected (MacAfee OEM version for Docomo). Occurs when user attempts to log in using their network login. Occurs when application contains Japanese characters Browsing history of URLs, RDP, SMB domains, and network shares are not cleared. Occurs when using Firefox Zone classification fails on a Mac PC (10.7.4). Occurs when Advanced EPC (ClamXav version) is enabled with OnDemand Tunnel Logging Month fields in logs pushed to the FTP server with the aarpushlogs script are missing. Occurs when using an outdated version of the aarpushlogs script OnDemand Tunnel OnDemand Tunnel session terminates. User receives Java prompts and errors when selecting a file share shortcut from WorkPlace. Occurs when public sites are accessed from Workplace. Occurs when network share resources are accessed from WorkPlace with Java 7 on the user s Windows 7 PC Java Applets fail to connect to EW and give exception when Java 7 JVM is used. Occurs when using SonicExplorer and JRE Policy Server RDP does not load from WorkPlace when using a custom port. Occurs when using a custom port higher than

9 Sharepoint Users cannot access Sharepoint-based documents from WorkPlace. Occurs when using Sharepoint 2012 and Word Translation Users receive Critical error message when creating Outlook Web Access rules. Links in s opened in Outlook Web Access 2007 accessed through a WorkPlace shortcut are translated. Occurs when user logs into WorkPlace with a translated realm. Occurs when Translation mode is enabled for WorkPlace WorkPlace WorkPlace personal bookmarks containing upper case characters in the URL are converted to lower case. Occurs when creating bookmarks containing upper case characters

10 Technical Documentation and the Knowledge Portal Check the SonicWALL Customer Support Knowledge Portal, available when you log in to MySonicWALL, for information and hotfixes that are relevant to your appliance. Technical documentation and Knowledge Base articles are also available on the SonicWALL Technical Documentation Online Library: Last updated: 11/7/