Funkwerk UTM Release Notes (english)

Transcription

1 Funkwerk UTM Release Notes (english) General Hints Please create a backup of your UTM system's configuration (Maintenance > Configuration > Manual Backup) before you start to install the software update. Also make a note which software version is currently running on the UTM system. In case of complications during the software update (e.g. power failure, accidental power down) the UTM system may become unusable. In this case perform a Factory Reset, install the software version which was running before the upgrade and restore (Maintenance > Configuration > Restore) the saved configuration. After this try to install the software update again. The file format of the configuration backup is not compatible between different software versions. Please create a new configuration backup immediately after you have upgraded your UTM system. Release Release date: This version of the system software supports the following platforms: UTM 1100 UTM 1500 UTM 2100 UTM 2500 Hints Regarding The Release In order to install this update on UTM 1500, 2100 or 2500, it is required that the system is running at least software version or later. 1

2 New Features And Changes HTTP Content Filter Access to web pages using the HTTP Proxy can now be granted or denied based on categories (e.g. Pornography, Shopping...). For this, allowed or forbidden categories can be combined into Content Profiles (Entities > Content Profiles). These profiles can then in turn be associated with HTTP policies under Firewall > Policies > HTTP. A combination with other policy settings (e.g. user authentication) is also possible. The Content Filter feature is an extension that needs to be licensed separately. High Availability The High Availability feature (Local Services > High Availability) can be used to improve system availability in conjunction with deployment of a hot standby system. In case of failure of the primary (master) system, the hot standby system will take over its functions. The system configuration needs to be maintained on the master system only and is transferred to the standby system automatically. Transfer of the configuration as well as exchange of the heartbeat signal is performed via one of the Ethernet ports. There is no transfer of established sessions (firewall, VPN...). Extensions (users, Kaspersky Antivirus, Commtouch Antispam...) have to be licensed only once for each master/standby installation. Quality of Service (QoS) The QoS feature allows controlling the bandwidth of outgoing traffic on a virtual interface. For this, available bandwidth is divided into classes which are then assigned IP packets using a variety of criteria. A minimum and maximum bandwidth can be defined for each class. If a class does not use up the minimum bandwidth in its entirety, the remaining bandwidth is distributed among the other classes, allowing them to benefit until their maximum bandwidth is matched. 2

3 OSPF Routing Protocol Funkwerk UTM is now able to dynamically exchange routing information with other systems using the OSPFv2 routing protocol. For every interface of the type Base it is possible to separately select participation in the OSPF routing process. Firewall Support for SIP, PPTP and TFTP The firewall was extended with so called connection trackers for SIP, PPTP and TFTP. These connection trackers enable the stateful firewall to handle protocols that dynamically negotiate additional connections between client and server (e.g. RTP with SIP). Timeout and manual flushing of IP/license bindings Every client system within an internal network sending IP packets passing through the Funkwerk UTM uses one of the available licenses. For this, the IP address of the system is assigned to a license. In previous releases this binding was maintained until the Funkwerk UTM was restarted. A timeout feature has now been added to this mechanism. If the client system stops sending IP packets across the Funkwerk UTM, the binding is released after 5 hours and the license becomes available again for use by other client systems. In addition, the menu item Monitoring > License Usage now offers a way to manually flush individual IP/license bindings. Deleting the entire mail queue (UTM 1500, 2100, 2500 only) Using the menu item Maintenance > Diagnostic > Mailqueue it is now possible to delete the entire content of the SMTP proxy's mail queue. This function will delete all mail queue entries after prompting for confirmation. 3

4 Secondary IP Addresses Secondary IP addresses can now be bound to interfaces with a static primary IP address (Networking > Interfaces > IP / Virtual). In addition it is configurable whether UTM services (e.g. proxies, web interface...) should only be bound to the primary IP address of an interface or to the secondary addresses as well. All VPN variations are exempt from this. VPN servers can only be bound to the primary address in all cases. Bug Fixes Display of the IPSec Phase 1 ID (Bug ID 8949) Under Monitoring > VPN Connections > IPSec the Phase 1 ID of an IPSec connection was displayed incorrectly. Certificate Calculator (Bug ID 8778) Under Certificates > Calculator, place holders for the User Distinguished Name were determined incorrectly. 4

5 Release Release date: This version of the system software supports the following platforms: UTM 1100 UTM 1500 UTM 2100 UTM 2500 Hints Regarding The Release During the installation of the update on UTM 1500, 2100 and 2500 systems the configuration data will be converted. This operation will take a few minutes. New Features And Changes Setup Wizard The selection Previous Configuration / Factory Defaults was removed from the Setup Wizard. Now the Setup Wizard always uses the factory default configuration. Administration via any Interface Now it is possible to access the web GUI via any interface (including PPPoE, PPTP and L2TP). This allows administration of the UTM system from IP addresses outside of the local network. This feature was already available in the UTM DHCP Client The UTM system can act now as a DHCP client on each ethernet interface. This feature was already available in the UTM

6 IPSec peers with dynamic IP address Now it is possible to make outgoing IPSec connections to peers with a dynamic IP address. The peer has to use dynamic DNS (e.g. Dyndns) to provide its IP address. The UTM system will reconnect the IPSec tunnel if it detects a change of the DNS resolution. IPSec Dead Peer Detection Dead Peer Detection based on RFC 3706 is now supported by the UTM system. This feature can be configured separately for each connection definition. Configurable IPSec IDs The local and the peer's IPSec ID can be configured now. The following types of IDs are available: IP address, FQDN, address. Bug Fixes CA root certificates for IPSec Now all imported and local generated CA root certificates will be used to validate the peer's certificate. Sender spam notification Even though sender spam notification was configured in Local Services > Anti Spam no notification was sent to the sender of the spam . Forbidden Extensions The setting Forbidden Attachments in Local Services > Proxy Server > SMTP was not used when virus and spam check was disabled. 6

7 HTTP proxy user authentication (Bug ID 8484) Authentication against the HTTP proxy was not possible for users with upper case characters in their user names. Commtouch spam detection (UTM 1100 only) The Commtouch spam detection was not working when the UTM system's hostname was configured as a FQDN. Processing of UTF 8 encoded s (UTM 1500, 2100, 2500 only) The UTM system was not able to handle s with UTF 8 encoded parts correctly. The was bounced to the sender. GUI TCPDump (UTM 1100 only) In Maintenance > Diagnostic > TCPDump the download button was not working. GUI stack trace in SMTP Proxy configuration When no Network Items of type Host were configured on the UTM system a stack trace was displayed when pressing the OK button in Local Services > Proxy Server > SMTP. Import of CA root certificates (Bug ID 8556) It was not possible to import root certificates with the content critical in the section 509v3 Basic Constraint. 7

8 GUI stack trace during the import of CA root certificates (Bug ID 8828) During the import of root certificates without a private key (e.g. PEM format) a GUI stack trace was displayed. Display of RSA key size (Bug ID 8461) Instead of displaying the correct key size in Entities > RSA Keys, 512 bit was always displayed. L2TP via NAT traversal It was not possible to make L2TP connections from clients behind a NAT firewall to the UTM system. Deletion of last admin user (Bug ID 8462) It was possible to delete the last user in System Management > Administration > User. After this it was no longer possible to login to the UTM system. Creation of certificates (Bug ID 8767) If the CA's passphrase was entered incorrectly during the creation of a certificate or a CRL, no error message was displayed and an incomplete configuration was stored. Filtering of the internal Log If the value All was selected for the option Subsystem in the dialogue Monitoring > Internal Log, no log messages were displayed 8

9 GUI stracktrace when displaying Active Connections In some circumstances a GUI stack trace was displayed in Monitoring > Active Connections. ClamAV error message (Bug ID: 8214) ClamAV has generated the error message unknown error when looking for updates. Error code 55'. Now ClamAV error messages are no longer interpreted by the UTM, allowing for easier diagnostics. Error message during HTTP requests (Bug ID: 8678, UTM 1100 only) During the update of virus patterns the following error message was displayed in the web browser: Virus scan failed: Scan daemon failed (1013 Error\srunning\sclamdscan WARNING:\sCan't\sconnect\sto\sclamd.\n) GUI stack trace during configuration of IPSec Policies (Bug ID: 8827) In VPN > IPSec > Policies a stack trace was displayed when Aggressive Mode was selected. The aggressive mode was removed completely from the UTM product. 9

10 Release Release date: This version of the system software supports the following platforms: UTM 1100 UTM 1500 UTM 2100 New Features And Changes POP3 Proxy tagging of spam messages Now the subject of spam messages is tagged by the POP3 Proxy with the tag ***SPAM***. Bug Fixes Login to the web GUI For gateway users (Entities > Authentication > User) it was possible to login to the UTM web GUI like admin users. Error in IPS configuration (portscan) When the Network Item Any (or another Network Item of type network and the content /0) was used in the portscan configuration, it was not possible to start the IPS subsystem. Error in IPS configuration (REJECT action) When the REJECT action was used for any rule or rule group, it was not possible to start the IPS subsystem. 10

11 Timeout problem during FTP downloads via HTTP Proxy During the FTP download of large files via the HTTP Proxy timeouts occurred depending on the file size and the available bandwidth. DNS server When only one DNS server was configured in Management > Global Settings > Settings a reboot was required to activate the configuration. With the configuration of two servers the changes took effect immediately. NAT An incorrect user entry could prevent the firewall subsystem from starting up. IPSec Algorithms which are not supported by the underlying IPSec implementation were removed from the web GUI (VPN > IPSec > Policies). Timestamp offset in log entries There was an offset in the timestamp of log entries of various subsystems. The offset between UTC and local time was not handled correctly. 11

12 Release Release date: This version of the system software supports the following platforms: UTM 1100 UTM 1500 UTM 2100 New Features And Changes ClamAV scan engine Update of the ClamAV scan engine Bug Fixes na 12

13 Release Release date: This version of the system software supports the following platforms: UTM 1100 UTM 1500 UTM 2100 New Features And Changes na Bug Fixes Not possible to activate interfaces After running the Setup Wizard it was not possible to activate additional interfaces. Release Release date: This version of the system software supports the following platforms: UTM 1100 UTM 1500 UTM

14 New Features And Changes IPS Improved portscan detection. Bug Fixes na 14