Contents. Release Purpose. Platform Compatibility. SonicOS TZ 105 / TZ 205 Series Release Notes. SonicOS

Transcription

1 SonicOS Contents Release Purpose... 1 Platform Compatibility... 1 Browser Support... 2 Enhancements in SonicOS Supported Features by Appliance Model... 3 Known Issues... 5 Resolved Issues... 6 Upgrading SonicOS Image Procedures... 9 Related Technical Documentation Release Purpose SonicOS is a continuation of the SonicOS x releases. SonicOS provides several enhancements and resolves a number of issues found in earlier releases. This release addresses the POODLE vulnerability (CVE ). SonicOS provides all the features and contains all the resolved issues that were included in previous releases of SonicOS x. For detailed information, see the previous release notes. SonicOS is the most recent x release. The SonicOS TZ 105/205 Series Release Notes are available at: You can find other SonicOS x release notes at: Platform Compatibility The SonicOS release is supported on the following SonicWALL Deep Packet Inspection (DPI) security appliances: SonicWALL TZ 105 / 105 Wireless SonicWALL TZ 205 / 205 Wireless The SonicWALL WXA series appliances (WXA 6000 Software, WXA 500 Live CD, WXA 5000 Virtual Appliance, WXA 2000/4000 Appliances) are also supported for use with SonicWALL TZ products running The minimum recommended firmware version for the WXA series appliances is 1.3. SonicOS is only compatible with WXA and newer. Earlier versions of WXA are not supported.

2 Browser Support SonicOS with Visualization uses advanced browser technologies such as HTML5, which are supported in most recent browsers. SonicWALL recommends using the latest Chrome, Firefox, Internet Explorer, or Safari browsers for administration of SonicOS. This release supports the following Web browsers: Chrome 18.0 and higher (recommended browser for dashboard real-time graphics display) Firefox 16.0 and higher Internet Explorer 8.0 and higher (do not use compatibility mode) Safari 5.0 and higher Mobile device browsers are not recommended for SonicWALL appliance system administration. Enhancements in SonicOS DPI-SSL The DPI-SSL feature is upgraded to use Transport Layer Security (TLS) 1.0 in place of Secure Sockets Layer (SSL) 3.0 as the default protocol for data encryption. CFS Custom Policies The maximum number of custom Content Filter Service policies is increased from 15 to 64. Geo-IP A Note with a link to the Geo-IP Status Lookup site is added at the bottom of the Security Services > Geo-IP Filter page. The site has a form you can submit to request that the geolocation of an IP address be changed. AppFlow Monitor A Botnet tab is added to the AppFlow Monitor page to provide a way to filter the reported Botnet traffic and identify the individual host, user, and IP address associated with the detected applications. AppFlow Reports A Clear IP Report button is added to the diag page to allow the administrator to reset the counter for reported IP addresses appearing on the IP tab of the AppFlow Reports page. This is used to reset the counter when new IP addresses begin to be displayed as Others after the number of IP addresses reaches more than 25K (25,600). Gateway Anti-Virus Logging Log entries for viruses detected by Gateway Anti-Virus now include the URI of the virus file source location. VPN IKE Logging Log entries for VPN now include detailed information when the Phase 2 IPsec proposal does not match. 2

3 Supported Features by Appliance Model The following table lists the key features in SonicOS 5.8 and which appliance models support them. Feature / Enhancement TZ 105 Series TZ 205 Series Accept Multiple VPN Client Proposals Supported Supported App Control Advanced Supported Supported App Control Policy Configuration via App Flow Monitor App Rules Supported Supported AppFlow > Flow Reporting AppFlow Dash AppFlow Monitor AppFlow Reports Application Usage and Risk Report Auto-Configuration of URLs to Bypass User Authentication Supported Supported Browser NTLM Authentication Supported Supported CASS 2.0 Supported Supported CFS Enhancements Supported Supported Cloud GAV Supported Supported Connection Monitor Supported Supported Current Users and Detail of Users Options for TSR Supported Supported Customizable Login Page Supported Supported DHCP Scalability Enhancements Supported Supported DPI-SSL Dynamic WAN Scheduling Supported Supported Enhanced Connection Limit Supported Supported Geo-IP Filtering and Botnet Command & Control Filtering Global BWM Ease of Use Enhancements Supported Supported IKEv2 Supported Supported IPFIX & NetFlow Reporting LDAP Primary Group Attribute Supported Supported Link Aggregation 3

4 Feature / Enhancement TZ 105 Series TZ 205 Series Log Monitor Supported Supported Management Traffic Only Option for Network Interfaces Supported Supported NTP Authentication Type Supported Supported Packet Monitor Enhancements Supported Supported Port Redundancy Preservation of Anti-Virus Exclusions After Upgrade Supported Supported Real-Time Monitor SIP Application Layer Enhancements Supported Supported SonicPoint Ne/Ni Supported Supported SonicPoint VAPs Supported Supported SonicPoint-N DR Supported Supported SSL VPN NetExtender Client Update Supported Supported SSO User Import from LDAP Supported Supported Stateless High Availability Supported Top Global Malware User Monitor Tool Supported Supported VLAN Subinterfaces Supported Supported WAN Acceleration Support Supported Supported Wire and Tap Mode Wireless Client Bridge Support Supported Supported YouTube for Schools Supported Supported 4

5 Known Issues This section contains a list of known issues in the SonicOS release. DPI-SSL Symptom Condition / Workaround Issue The DPI-SSL cipher method reverts to the default setting. Occurs when the DPI-SSL cipher method is changed on the diag page and then the firewall is restarted Excluding a User Object or User Group for Server DPI-SSL causes Client DPI-SSL to not work properly. Occurs when accessing HTTPS websites from a client computer without logging in as a user on the client computer. Client DPI-SSL does not change the site certificate to the SonicWALL certificate Networking Symptom Condition / Workaround Issue Interfaces go up and down several times Occurs at random throughout the day during the day. This issue is specific to the NSA 2400 appliance. The L2TP client on the WAN interface of the firewall gets disconnected every two minutes. Occurs when the WAN interface IP Assignment is L2TP and the WAN interface is connected to an L2TP/PPP server. When PPP messages are exchanged, there is no magic number negotiation on the client side during the Link Control Protocol (LCP) configuration request. Only the server attempts to negotiate the magic numbers. The LCP echo reply from the firewall has the same magic numbers as the server. After 4 attempts, the server terminates the connection, but the firewall continues to retry the connection every 2 minutes FTP or HTTP traffic cannot pass through a pair of interfaces configured in Wire Mode and set to Secure. Users Occurs when using a Stateful High Availability pair and Active-Active DPI is enabled Symptom Condition / Workaround Issue A limited administrator can log out the firewall Occurs when a limited administrator is in nonconfiguration administrator on the Users > Status page. mode. 5

6 Resolved Issues The following issues are resolved in the SonicOS release: AppFlow The IP Address field displays Others in the Dashboard > AppFlow Reports page. Occurs when the number of IP addresses is more than 25K (25,600), after which any new IP addresses are included in Others and there is no option to reset the counter Content Filtering Google search results are not displayed and SonicOS logs show they are blocked based on network access denied category 99. Occurs when Safe Search Enforcement is enabled in the SonicOS CFS policy to force Google to disable SSL searching, and the user is logged into Google Geo IP / Botnet Traffic or websites from unknown countries is not blocked and the TSR shows none instead of blocked for Unknown and for several other countries. Occurs when Geo IP filtering is enabled and configured to block certain countries and block all unknown countries and then the TSR is generated High Availability SNMP status is not correct for an interface on the backup unit. Occurs when the X1 interface is disconnected on the backup unit, showing link down in SonicOS, but SNMP GET shows it as up Networking Vlan traffic does not pass through a Portshield interface, but is dropped. Occurs when using a TZ 210 and a VLAN is configured on X0, and X6 is portshielded to X0, then a client connects to the VLAN on X6 and attempts to send traffic OSPF gets disabled when the appliance is rebooted. Some phones lose connectivity to the VOIP server. Occurs when a site-to-site VPN is configured in Tunnel Mode with Advanced Routing and OSPF enabled, and then the firewall is rebooted. Occurs when using VoIP for 24 to 48 hours without flushing the connections and VoIP packets are detected by IDP (Intrusion Detection & Prevention) and are dropped

7 Invalid address objects can cause policy rule Occurs when SonicWALL GMS requests creation problems after a reboot because of an index mismatch. of an address object with the wrong FQDN or MAC type and SonicOS accepts it and adds an entry in the index table for it, and then the firewall is rebooted. During the reboot process the invalid address objects are discovered and removed, but the index table is not adjusted, causing some policies to refer to the wrong address objects. DDNS cannot connect to Dyn.com and returns a certificate error. Occurs when the DDNS certificate is using SHA A client machine connected to X0 on the appliance cannot communicate with SonicOS and the link stays down for X0. IP Helper does not forward a DHCP offer to a client connected to the LAN (X0) interface, although for requests coming from the DMZ (X6), the offer is forwarded to clients correctly. SonicOS drops packets while clients are accessing websites and begins to block all inbound FTP traffic over the VPN, and logs the reason as SYN Flood Detection Code 30 or NAT policy unique remap port failed, code 221. A reboot is required to allow traffic again. NAT load-balancing does not work properly and after a couple of hours the traffic stops passing through the appliance. Packets destined to the Public IP are not reaching the device. System Occurs on an NSA 2400 when the appliance is completely off and no Ethernet cables are connected to any interfaces, then the appliance is turned on and booted up, and then an Ethernet cable is connected between the client computer and the X0 interface. Occurs when DHCP over VPN is enabled using Central Gateway mode, IP Helper is configured for multiple zones, and the DHCP client is connected to X0. Occurs when the appliance has been working fine for a day or more, but then new connections are not allowed due to NAT source port mapping exhaustion. Occurs when there are two or more NAT targets grouped into a destination network group object. Proxy ARPs are not successful for the NAT addresses in the Few-to-Many or One-to-Many destination translation The firewall configuration settings including NAT policies are changed and incorrect after the firewall went down unexpectedly. Occurs when the primary unit in an HA pair goes down unexpectedly and then restarts. During restart, new objects are created before the policies are updated, which changes the indexing of the policies

8 VoIP H.323 VoIP transformations do not work via LAN to VPN Tunnel. Phone connections do not work for LAN to VPN and LAN to WAN simultaneously. Occurs when using a PBX server with a current phone connection from a client at an external location to the PBX (LAN to WAN), and attempting to establish a connection from a client to the PBX through a VPN in Tunnel Interface mode with another SonicWALL firewall Vulnerabilities A vulnerability in the design of the SSL 3.0 protocol can result in unauthorized access to encrypted communication between a client and server. This is the "POODLE" (Padding Oracle On Downgraded Legacy Encryption) issue (CVE ). Occurs when SonicOS uses the SSL v3.0 protocol. This has been disabled now and the more secure TLS version is being used in SonicOS OpenSSL Protocol vulnerabilities: TLS protocol downgrade attack reported in CVE Race condition in SSL parsing reported in CVE The OpenSSL cryptography library has a vulnerability that allows man-in-the-middle and other attacks as reported in CVE Occurs when OpenSSL is used in SonicOS to implement SSL and TLS encryption. This is replaced by a newer version of OpenSSL in SonicOS Occurs when OpenSSL is used in SonicOS to implement SSL and TLS encryption. This is replaced by a newer version of OpenSSL in SonicOS

9 Upgrading SonicOS Image Procedures The following procedures are for upgrading an existing SonicOS image to a newer version: Obtaining the Latest SonicOS Image Version... 9 Saving a Backup Copy of Your Configuration Preferences... 9 Upgrading a SonicOS Image with Current Preferences Importing Preferences to SonicOS Importing Preferences from SonicOS Standard to SonicOS 5.8 Enhanced Support Matrix for Importing Preferences Upgrading a SonicOS Image with Factory Defaults Using SafeMode to Upgrade Firmware Obtaining the Latest SonicOS Image Version To obtain a new SonicOS firmware image file for your SonicWALL security appliance: 1. Connect to your mysonicwall.com account at 2. Copy the new SonicOS image file to a directory on your management station. You can update the SonicOS image on a SonicWALL security appliance remotely if the LAN interface or the WAN interface is configured for management access. Saving a Backup Copy of Your Configuration Preferences Before beginning the update process, make a system backup of your SonicWALL security appliance configuration settings. The backup feature saves a copy of your current configuration settings on your SonicWALL security appliance, protecting all your existing settings in the event that it becomes necessary to return to a previous configuration state. In addition to using the backup feature to save your current configuration settings to the SonicWALL security appliance, you can export the configuration preferences file to a directory on your local management station. This file serves as an external backup of the configuration preferences, and can be imported back into the SonicWALL security appliance. Perform the following steps to save a backup of your configuration settings and export them to a file on your local management station: 1. On the System > Settings page, click Create Backup. Your configuration preferences are saved. The System Backup entry is displayed in the Firmware Management table. 2. To export your settings to a local file, click Export Settings. A popup window displays the name of the saved file. 3. On the System > Diagnostics page, under Tech Support Report, select the following checkboxes and then click the Download Report button: VPN Keys ARP Cache DHCP Bindings IKE Info SonicPointN Diagnostics Current users Detail of users The information is saved to a techsupport_ file on your management computer. 9

10 Upgrading a SonicOS Image with Current Preferences Perform the following steps to upload new firmware to your SonicWALL appliance and use your current configuration settings upon startup: 1. Download the SonicOS firmware image file from mysonicwall.com and save it to a location on your local computer. 2. On the System > Settings page, click Upload New Firmware. 3. Browse to the location where you saved the SonicOS firmware image file, select the file, and click Upload. 4. On the System > Settings page, click the Boot icon in the row for Uploaded Firmware. 5. In the confirmation dialog box, click OK. The SonicWALL restarts and then displays the login page. 6. Enter your user name and password. Your new SonicOS image version information is listed on the System > Settings page. Importing Preferences to SonicOS 5.8 Preferences importing to the SonicWALL network security appliances is generally supported from the following SonicWALL appliances running SonicOS: NSA Series NSA E-Class Series TZ 215/210//205/200//105/100/190/180/170 Series PRO Series There are certain exceptions to preferences importing on these appliances running the SonicOS 5.8 release. Preferences cannot be imported in the following cases: Settings files containing Portshield interfaces created prior to SonicOS 5.x Settings files containing VLAN interfaces are not accepted by the TZ 100/200 Series firewalls Settings files from a PRO 5060 with optical fiber interfaces where VLAN interfaces have been created Full support for preferences importing from these appliances is targeted for a future release. At that time, you will need to upgrade your firmware to the latest SonicOS maintenance release available on MySonicWALL. Importing Preferences from SonicOS Standard to SonicOS 5.8 Enhanced The SonicOS Standard to Enhanced Settings Converter is designed to convert a source Standard Network Settings file to be compatible with a target SonicOS Enhanced appliance. Due to the more advanced nature of SonicOS Enhanced, its Network Settings file is more complex than the one SonicOS Standard uses. They are not compatible. The Settings Converter creates an entirely new target Enhanced Network Settings file based on the network settings found in the source Standard file. This allows for a rapid upgrade from a Standard deployment to an Enhanced one with no time wasted in re-creating network policies. Note: SonicWALL recommends deploying the converted target Network Settings file in a testing environment first and always keeping a backup copy of the original source Network Settings file. The SonicOS Standard to Enhanced Settings Converter is available at: If the preferences conversion fails, your SonicOS Standard configuration file to [email protected] with a short description of the problem. In this case, you may also consider manually configuring your SonicWALL appliance. To convert a Standard Network Settings file to an Enhanced one: 1. Log in to the management interface of your SonicOS Standard appliance, navigate to System > Settings, and save your network settings to a file on your management computer. 2. On the management computer, point your browser to 3. Click the Settings Converter button. 10

11 4. Log in using your MySonicWALL credentials and agree to the security statement. The source Standard Network Setting file must be uploaded to MySonicWALL as part of the conversion process. The Setting Conversion tool uses MySonicWALL authentication to secure private network settings. Users should be aware that SonicWALL will retain a copy of their network settings after the conversion process is complete. 5. Upload the source Standard Network Settings file: Click Browse. Navigate to and select the source SonicOS Standard Settings file. Click Upload. Click the right arrow to proceed. 6. Review the source SonicOS Standard Settings Summary page. This page displays useful network settings information contained in the uploaded source Network Settings file. For testing purposes, the LAN IP and subnet mask of the appliance can be changed on this page in order to deploy it in a testing environment. (Optional) Change the LAN IP address and subnet mask of the source appliance to that of the target appliance. Click the right arrow to proceed. 7. Select the target SonicWALL appliance for the Enhanced deployment from the available list. SonicOS Enhanced is configured differently on various SonicWALL appliances, mostly to support different interface numbers. As such, the converted Enhanced Network Settings file must be customized to the appliance targeted for deployment. 8. Complete the conversion by clicking the right arrow to proceed. 9. Optionally click the Warnings link to view any differences in the settings created for the target appliance. 10. Click the Download button, select Save to Disk, and click OK to save the new target SonicOS Enhanced Network Settings file to your management computer. 11. Log in to the management interface for your SonicWALL appliance. 12. Navigate to System > Settings, and click the Import Settings button to import the converted settings to your appliance. 11

12 Support Matrix for Importing Preferences 12

13 Upgrading a SonicOS Image with Factory Defaults Perform the following steps to upload new firmware to your SonicWALL appliance and start it up using the default configuration: 1. Download the SonicOS firmware image file from mysonicwall.com and save it to a location on your local computer. 2. On the System > Settings page, click Create Backup. 3. Click Upload New Firmware. 4. Browse to the location where you saved the SonicOS firmware image file, select the file, and click Upload. 5. On the System > Settings page, click the Boot icon in the row for Uploaded Firmware with Factory Default Settings. 6. In the confirmation dialog box, click OK. The SonicWALL restarts and then displays the Setup Wizard, with a link to the login page. 7. Enter the default user name and password (admin / password) to access the SonicWALL management interface. 13

14 Using SafeMode to Upgrade Firmware The SafeMode procedure uses a reset button in a small pinhole, whose location varies: on the NSA models, the button is near the USB ports on the front; on the TZ models, the button is next to the power cord on the back. If you are unable to connect to the SonicWALL security appliance s management interface, you can restart the SonicWALL security appliance in SafeMode. The SafeMode feature allows you to quickly recover from uncertain configuration states with a simplified management interface that includes the same settings available on the System > Settings page. To use SafeMode to upgrade firmware on the SonicWALL security appliance, perform the following steps: 1. Connect your computer to the X0 port on the SonicWALL appliance and configure your IP address with an address on the /24 subnet, such as Do one of the following to restart the appliance in SafeMode: Use a narrow, straight object, like a straightened paper clip or a toothpick, to press and hold the reset button on the front of the security appliance for more than 20 seconds. Use the LCD control buttons on the front bezel to set the appliance to Safe Mode. Once selected, the LCD displays a confirmation prompt. Select Y and press the Right button to confirm. The SonicWALL security appliance changes to SafeMode. The Test light starts blinking when the SonicWALL security appliance has rebooted into SafeMode. Note: Holding the reset button for two seconds will send a diagnostic snapshot to the console. Holding the reset button for six to eight seconds will reboot the appliance in regular mode. 3. Point the Web browser on your computer to The SafeMode management interface displays. 4. If you have made any configuration changes to the security appliance, select the Create Backup On Next Boot checkbox to make a backup copy of your current settings. Your settings will be saved when the appliance restarts. 5. Click Upload New Firmware, and then browse to the location where you saved the SonicOS firmware image, select the file, and click Upload. 6. Select the boot icon in the row for one of the following: Uploaded Firmware New! Use this option to restart the appliance with your current configuration settings. Uploaded Firmware with Factory Defaults New! Use this option to restart the appliance with default configuration settings. 7. In the confirmation dialog box, click OK to proceed. 8. After successfully booting the firmware, the login screen is displayed. If you booted with factory default settings, enter the default user name and password (admin / password) to access the SonicWALL management interface. 14

15 Related Technical Documentation Dell SonicWALL Release Notes and User Guides are available on the Dell Software Support site: Knowledge articles and links to related community forums and other resources are available on the Dell Software Support site: Dell SonicWALL instructional videos are available on the Dell Software Support site: For basic and advanced deployment examples, refer to SonicOS Guides and SonicOS TechNotes available on the website. Last updated: 11/25/