Check Point NGX VoIP Hotfix-1 Release Notes June 2006

Transcription

1 Check Point NGX VoIP Hotfix-1 Release Notes June 2006 IMPORTANT Check Point recommends that customers stay up-to-date with the latest service packs, HFAs and versions of security products, as they contain security enhancements and protection against new and changing attacks. In This Section Introduction page 1 Enhancements in this Release page 1 Known Limitations & Clarifications page 2 Supported Platforms, Versions & Builds page 4 Installation Procedure page 5 Uninstalling NGX VoIP Hotfix-1 page 5 Introduction Thank you for using Check Point NGX VoIP Hotfix-1. This hotfix is a recommended version update. NGX VoIP Hotfix-1 release is based on the NGX release, and contains additional features for SIP and MGCP support. Enhancements in this Release NGX VoIP Hotfix-1 introduces the following enhancements: Support for NAT on MGCP phones Support for NAT for SIP phones in SIP B2BUA configuration Support for 2 way media connections in SIP calls with NAT Support for special NEC extensions in SIP Extended SIP state machine

2 Support for Nokia PoC Support unlimited Maximum invitations per call in SIP SmartDefense (NGX R60 Hotfix Build 2 required) Known Limitations & Clarifications NGX_VoIP_Hotfix-1 needs to be installed on both the SmartCenter server and gateway. NGX_VoIP_Hotfix-1 needs to be installed on top of R60_HFA_02 The hotfix installation process automatically overwrites modified *.def files. If you have made manual modifications to your *.def files, you will need to make these changes to the new version of the files. Uninstalling the hotfix using SmartUpdate is not supported for IPSO gateways. SIP Support Call-ID maximum length is 63 characters Username maximum length is 39 characters NAT Support for SIP All VPN-1 Pro features can be used with SIP, with the following restrictions regarding Network Address Translation (NAT): Static NAT can be used in both automatic and manual NAT rules. Hide NAT can be used in both automatic and manual rules for outgoing VoIP calls. For incoming calls, automatic rules must be used. For security reasons, when using Hide NAT for incoming calls, the Destination of the VoIP call in the appropriate rule in the Security Rule Base cannot be Any. Internal calls cannot be made from the same source to two endpoints, where one endpoint uses NAT (of either kind) and the other does not. Bidirectional NAT of VoIP calls is not supported. When using NAT, the proxy must reside in the external network in order to enable VPN-1/FireWall-1 to track the registration messages. NAT on SIP proxy is not supported. NGX VoIP HF_1 release 2.0 Release Notes. Last Update March 29,

3 SecureXL for SIP SIP connections are not accelerated. RTP and RTCP connections are. MGCP Support Call-ID maximum length is 31 characters Endpoint maximum length is 100 characters NAT Support for MGCP All FireWall-1 features can be used with MGCP, with the following restrictions regarding Network Address Translation (NAT): Static NAT can be used in both automatic and manual NAT rules. Hide NAT can be used in both automatic and manual rules for outgoing VoIP calls. For incoming calls, automatic rules must be used. For security reasons, when using Hide NAT for incoming calls, the Destination of the VoIP call in the appropriate rule in the Security Rule Base cannot be Any. Bidirectional NAT of VoIP calls is not supported. When using NAT, the Call Agent must reside in the external network in order to enable VPN-1/FireWall-1 to track the registration messages. NAT on a Call Agent is not supported. If NAT is configured on the phone, by default there is no NAT done on the source port of outgoing packet. If you would like to have NAT on the source port: Set UDP virtual session timeout to be longer then the refresh packet interval. It is located in Policy > Global Properties > Stateful Inspection. To set mgcp_standard_hide_nat to 1, proceed as follows: For Linux - in $FWDIR/modules/fwkern.conf add mgcp_standard_hide_nat =1. Create the file if it doesn't exist and reboot the machine. For Solaris - in /etc/system add set fw:mgcp_standard_hide_nat =1 and reboot the machine. For IPSO - run modzap mgcp_standard_hide_nat $FWDIR/modules/fwmod.o 1 and reboot the machine. For Windows Under registry key HKLM\System\CurrentControlSet\Services\FW1\parameters, add a DWORD value called mgcp_standard_hide_nat with value 1 and reboot the machine. NGX VoIP HF_1 release 2.0 Release Notes. Last Update March 29,

4 SecureXL for MGCP MGCP connections are not accelerated. RTP and RTCP connections are. Supported Platforms, Versions & Builds In This Section: Supported Platforms & Versions page 4 Supported Builds page 4 Supported Platforms & Versions Platform Version Solaris 8, 9, 10 IPSO 3.9, 4.0 Red Hat Enterprise Linux 3.0 SecurePlatform Windows NGX 2000 Server, 2003 Server, 2003 Server SPI Supported Builds Component Build Number Comment Firewall & Kernel The output of fw ver -k should be: This is Check Point VPN-1(TM) & FireWall-1(R) NGX (R60) HFA_02, Hotfix Build 015 Kernel: NGX (R60) HFA_02, Hotfix 11 - Build 016 SmartConsole The build number should be - Hotfix Build 2 - and can be viewed in Help > About Check Point SmartDashboard. NGX VoIP HF_1 release 2.0 Release Notes. Last Update March 29,

5 Installation Procedure This sections covers installing the hotfix on: VPN-1 Pro/Express NGX R60 HFA VPN-1 Pro/Express NGX R60 HFA Solaris/IPSO/SecurePlatform/Linux Installation 1 Decompress the NGX_VOIP_Hotfix-1 package to a local folder. It is recommended to use a folder located under /var. 2 Change your working directory to the location of your HF and invoke the installation process with the command:./fw1_hotfix_ngx_voip_hf_one_hfa_ _1 3 Reboot machine after installation is complete. Windows Installation 1 Decompress the NGX_VOIP_Hotfix-1 package to a local folder. 2 Double click on the setup.exe file in order to start the installation process. Follow the instructions that follow. 3 Reboot the machine after installation is complete. Uninstalling NGX VoIP Hotfix-1 Solaris/IPSO/SecurePlatform/Linux Uninstallation You can uninstall on these platforms by invoking the command:./uninstall_fw1_hotfix_ngx_voip_hf_one_hfa This is located at /opt/cpsuite-r60. Windows Uninstallation You can uninstall through the Add/Remove Programs in the Microsoft Windows Control Panel. NGX VoIP HF_1 release 2.0 Release Notes. Last Update March 29,