System Compatibility. Enhancements. Security. SonicWALL Security Appliance Release Notes

Transcription

1 Security SonicWALL Security Appliance Release Notes System Compatibility SonicWALL Security is supported on the following SonicWALL Security appliances: SonicWALL Security 200 SonicWALL Security 300 SonicWALL Security 400 SonicWALL Security 500 SonicWALL Security 3300 SonicWALL Security 4300 SonicWALL Security 6000 SonicWALL Security 8000 SonicWALL Security 8300 Enhancements The following is a list of new enhancements made to features in the SonicWALL Security Firmware release: Junk Store Relay (CASS Junk Store) A Relay Domains page is now available that allows users to restrict domains that the Junk Store would normally allow to relay. This enhancement applies to CASS Junk Store ONLY. Hungarian and Polish Translation Hungarian and Polish translation of Junk Box Summaries is now available in this release of the Security product. Flood Protection The Flood Protection feature supports the Zombie Protection feature by automatically blocking specified users from sending outbound mail when it exceeds the Message Threshold specified by the administrator. Co-Branding Support Co-branding provides administrators with the ability to customize aspects of the product with company name, logo, and other branding assets. Administrators will be able to upload replacement assets for the key branding elements as presented within the Security product. Additionally, the Junkbox Summary will be modified to utilize the very same branding features specified for the ASG GUI. CIFS Mounting of External Storage by the Appliances CIFS Mounting provides an external drive on the local data directory that does not limit the appliance to local disk space. A redundant CC architecture is also available when the external drive is mounted successfully. Scheduled Backups The Scheduled Backups feature allows users to schedule daily, weekly, or monthly backups. By providing specific inputs like backup time, duration, remote FTP server, user ID, and password, the user will be able to schedule backups where snapshots are taken periodically and copied onto the configured remote FTP server. Secondary NIC Support (Host Configuration) Secondary Network Interface Controller (NIC) Support allows administrators the ability to enable, disable, and configure a second NIC on all Security appliances. Support for Virtual IPs (Host Configuration) Security 7.3 now allows users to add, remove, or configure virtual IPs on one or both of the Network Interface Controllers. LDAP Redundancy The LDAP Redundancy feature allows administrators to specify a secondary LDAP server for fail-over redundancy. The secondary server must be identical to the primary and will only be used when the primary server is not available.

2 Customizable Delivery Status Notification (DSN) Customizable Delivery Status Notification (DSN) allows users to customize both transient and permanent notification s. Users can customize the body, subject, and sender fields of the . For transient DSNs, users can customize the interval at which DSNs are sent. PGP Encryption Specific Policy Rules Users are now able to create a set of policy rules that make the process of integrating a PGP Encryption server easier. Restrictions and Limitations These are the restrictions and limitations currently reported in the SonicWALL Security Appliance release: Symptom Auditing and Junk Box messages do not display after downgrading from SonicWALL Security to Virtual IP information does not display on the User Interface after configuring in DHCP mode. Condition Occurs after a successful upload of the SonicWALL Security Der-signed patch. Upon logging into the appliance again, the user will receive a warning message, as well as no inbound messages in the Auditing and Junk Box screens. Workaround: Login to the SNWLCLI and run the rebuildsearchdb command. All messages will be displayed in the Junkbox/Auditing UI. Occurs after attempting to configure the Virtual IPs to eth0 and eth1 from the CLI, using the following commands: vip --add IPADDRESS1 netmask SUBNETMASK1 interface eth0 vip --add IPADDRESS2 netmask SUBNETMASK2 interface eth1 Upon logging into the User Interface, the existing Virtual IPs do not display. Users are unable to add or delete either Static or DHCP Virtual IPs configured to eth0 or eth1. Virtual IPs are supported for Static Ethernet Addresses ONLY. 2

3 Known Issues These are the known issues currently reported in the SonicWALL Security Appliance release: Symptom The LCD screen of SonicWALL Security 8300 appliances incorrectly displays eth1 s IP address and subnet mask for eth0 s IP address and subnet mask The Scheduled Backup process does not confirm the available disk space before initiating a backup zip file creation User cannot access appliance if Samba directory is deleted from NAS or SAN. Condition Occurs after enabling or disabling the Ethernet1 port of a SonicWALL Security 8300 appliance. When attempting to view the default IP address and subnet mask for the eth0 interface, the LCD displays eth1 s IP address and subnet mask, respectively. Occurs when attempting to schedule a backup. The Scheduled Backup process should estimate the space required for the backup before initializing a backup zip file creation. Occurs when creating a Samba share, then deleting the share from the NAS or SAN. When attempting to login to the appliance, the appliance is unable to be accessed. Workaround: Unmount the drive from the Web UI before deleting. Resolved Known Issues These are the resolved known issues currently reported in the SonicWALL Security Appliance release: Symptom Security services do not work if remote drive is offline. Condition Occurs when the mounted network shared drive (CIFS) is offline. Security services still do not work if remove drive comes back online The Junk Box login data does not cache. Occurs when the initial login to the Junk Box via the mini_login does not load the peruser Junk Box. The login information must be cached before the peruser_junkbox can be loaded The updating usermap files process takes a long time to complete. Occurs when uploading a usermap file with K entries A Tomcat insufficient memory alert displays. Occurs when deleting a large block of s from the Junk Store. The Tomcat Handle count would spike up and cause the virtual memory to exceed the 2GB limit, cauting an Out of Memory alert for Tomcat s coming from a known source IP address would be incorrectly labeled as junk. Occurs when the Sender ID is enabled. 3

4 Important Note for McAfee Anti-Virus Subscribers Feature Upgrade McAfee to Engine 5400 Summary McAfee will be ending support for the anti-virus scan engine v5300 (running in SonicWALL Security versions and lower). SonicWALL security customers using McAfee antivirus will need to upgrade their security firmware by February 28th, SonicWALL strongly recommends customers running McAfee to upgrade to the latest firmware version. McAfee has released an upgraded version of their anti-virus engine using a newer, enhanced format that provides smaller, faster signature updates, improved bandwidth, and better detection of the latest malware. As of February 28, 2010, SonicWALL McAfee anti-virus engines in the firmware versions and lower will no longer receive virus signature updates. Customers using McAfee anti-virus will begin to see degraded virus protection and will no longer be protected against the latest virus outbreaks. Customers can simply upgrade their SonicWALL Security firmware to receive the benefits of the McAfee upgrade. The impact will be largely transparent to administrators and end customers. To ease the transition, SonicWALL will offer customers the following upgrade path: Upgrade to SonicWALL s newest, latest firmware (version 7.3.2). In addition to the enhanced SonicWALL McAfee engine, firmware version offers several significant enhancements, including best-in-class effectiveness, bandwidth improvement, improved ease of management and significant scalability improvements. 4

5 Upgrading the Security Firmware The following procedures are for upgrading an existing Security appliance. Backing Up Your Existing Environment Before you upgrade your firmware, you should back up your existing environment. This will enable you to restore it if you decide to change back for some reason. Your backup should include the settings files, including the per user settings. To back up your existing environment: 1. Login to Security interface using the admin account 2. In the left navigation pane under System, choose Backup/Restore. You will see the Backup/Restore page: 3. In the Manage Backups section, select Settings. 4. Click Take Snapshot Now to create a snapshot. 5. Click Download Snapshot to save the snapshot to your local file system Upgrading Your SonicWALL Security Firmware Follow this procedure to upgrade your existing Security firmware. 1. Navigate to the System > Advanced page and scroll down to the Upload Patch section. 2. Click Browse to locate the Security Firmware file on your local file system, and then click Apply Patch. 3. As part of the upgrade process, the Security appliance will reboot. The upgrade process could take between minutes. All the settings and data will be preserved. NOTE for ES8300 Your ES8300 is equipped with a battery backup unit on the RAID Controller Card, which allows the appliance to write volatile memory to disk in the event of a loss of power. This battery backup unit must be charged for 24 hours. When deploying your ES8300 appliance, follow the startup and registration instructions detailed in the Getting Started Guide, and then allow the battery backup in the unit to charge for 24 hours. If the battery is not fully charged, some RAID features are turned off, and the appliance performance is temporarily impaired until the battery is fully charged. 5

6 Related Technical Documentation For basic and advanced deployment examples, SonicWALL documentation is available in the SonicWALL Technical Documentation Online Library: Also, refer to the following related Knowledge Based articles: How to Upgrade a Windows server in Split Mode Configuration How to Setup/Breakup Cluster Licensing for Security s Split-Configuration How to Recover a Non-Accessible Security Appliance How to Reset the Authentication for GUI Login Back to Default Credentials Part Number: Rev A Last Updated: 5/23/2011 6