R200-Serie and TR200aw/bw Release Notes System Software Copyright 4. March 2009 Funkwerk Enterprise Communications GmbH Version 1.

Transcription

1 R200-Serie and TR200aw/bw Release Notes System Software Copyright 4. March 2009 Funkwerk Enterprise Communications GmbH Version 1.0

2 Purpose This document describes new features, changes, and solved problems of System Software Liability Trademarks Copyright Guidelines and standards How to reach Funkwerk Enterprise Communications GmbH While every effort has been made to ensure the accuracy of all information in this manual, Funkwerk Enterprise Communications GmbH cannot assume liability to any party for any loss or damage caused by errors or omissions or by statements of any kind in this document and is only liable within the scope of its terms of sale and delivery. The information in this manual is subject to change without notice. Additional information and changes can be found at As multiprotocol gateways, Bintec gateways set up WAN connections in accordance with the system configuration. To prevent unintentional charges accumulating, the operation of the product should be carefully monitored. Funkwerk Enterprise Communications GmbH accepts no liability for loss of data, unintentional connection costs and damages resulting from unsupervised operation of the product. Bintec and the Bintec logo are registered trademarks of Funkwerk Enterprise Communications GmbH. Other product names and trademarks mentioned are usually the property of the respective companies and manufacturers. All rights are reserved. No part of this publication may be reproduced or transmitted in any form or by any means graphic, electronic, or mechanical including photocopying, recording in any medium, taping, or storage in information retrieval systems, without the prior written permission of Funkwerk Enterprise Communications GmbH. Adaptation and especially translation of the document is inadmissible without the prior consent of Funkwerk Enterprise Communications GmbH. Bintec gateways comply with the following guidelines and standards: R&TTE Directive 1999/5/EG CE marking for all EU countries and Switzerland You will find detailed information in the Declarations of Conformity at Funkwerk Enterprise Communications GmbH Suedwestpark 94 D Nuremberg Germany Telephone: Fax: Internet: Funkwerk Enterprise Communications 6 Avenue de la Grande Lande - CS Gradignan cedex France Telephone: +33 (0) Fax: +33 (0) Internet:

3 1 Important Information Applicability Incompatibility Preparation and update with the FCI Downgrade with the FCI Preparation and update with SNMP shell and Setup tool Downgrade with SNMP shell and Setup tool ComPoint Manager New Functions New ADSL firmware ISAKMP Configuration Method (IKE Config Mode) GRE alert SSH Client IGMP Host for local applications HTML Page for Update SSL Tunnel Query the BOSS minimum version VLAN prioritization Checking the MAC address DNS - Bailiwick Checking Internet Browser - additional information Telephone - Switchable time-controlled call assignment Telephone - Display caller name System Software Release Notes 3

4 2.16 FCI - Support for Opera FCI - List entries - New filter FCI - Defining the message level of syslog entries FCI - Input field for DHCP MAC Address FCI - New TCP MSS Clamping field FCI - WLAN - New ARP processing field FCI - Multicast - Extensions FCI - Dialup retries limited FCI - Delete IPSec configuration FCI - Displaying administrative access rules FCI - New entry in services list FCI - PBX - Music on Hold - Melodies changed FCI - PBX - Configurable timer for call forwarding FCI - PBX - Configurable SIP registration timer FCI - PBX - VoIP provider cannot be reached FCI - PBX - Configurable SIP transport protocol FCI - PBX - VoIP connection as static host FCI - PBX - Call Through with CLID Authentication FCI - PBX - Import or export phone book data FCI - PBX - Export call records FCI - DHCP options extended FCI - Scheduling - New option FCI - Maintenance - New system logic field FCI - Details of interface statistics Release Notes System Software

5 2.40 Setup Tool - HTTPS added Setup Tool - New option for monitoring interfaces Bandwidth on Demand (BoD) extended New variables in MIB table autheapol DHCP - New MIB variable SendRepliesToRelay Changes Password length restricted Ping function expanded Processing of blank IP addresses changed DNS with two IP addresses DNS Query IDs generated randomly IP address ranges (pools) revised Default value for number of NAT ports increased NAT pass-through added UDP port numbers generated randomly PBX - Advanced configuration options FCI layout, spelling, terminology FCI - ISDN port selection changed FCI - System management extended FCI IP Configuration update FCI - ADSL configuration FCI NAT entry for outgoing connection FCI - ATM - Bridging field removed FCI - Phase-1 and Phase-2 profiles - New default settings System Software Release Notes 5

6 3.19 FCI - PBX - External numbers FCI - PBX - Extensions FCI - PBX - SIP - Codec settings extended FCI - PBX - Description changed FCI DHCP configuration changed FCI Setup Tool - DHCP Pool Configuration expanded Setup Tool improved configuration change Setup Tool interface description changed Setup Tool - ATM - Descriptions changed Setup Tool Configuration Management expanded Problems Solved Stacktrace for routing over L2TP or bridging over L2TP PPPoE and Ethernet interfaces - Problems with external DSL modems PPPoE multilink - no error checking PPPoE problems PPTP connection setup failed PPTP connection setup failed Number of Telnet sessions unlimited RIP source IP address incorrect Syslog messages - Values not output SNMP Shell - Faulty input/output link (pipe) SNMP shell - Problems with Signal Interrupt SNMP shell - ifoperstatus shown incorrectly IPSec - Panic Release Notes System Software

7 4.14 IPSec - Panic without reboot IPSec - Setting option missing for Twofish key length IPSec - Tunnel setup IPSec / OSPF - Unwanted OSPF update Cert - No support for negative indices IPSec - Phase -2 negotiation failed QoS - Counter overrun Multicast protocols - Loss of 64 byte blocks Name server responses not accepted FCI - Display off-centre FCI - No extended routes after reboot FCI - Errors in Online Help FCI - Active sessions not displayed FCI - Different formats for time data FCI - Display incorrect FCI - Bridge groups list incorrect FCI - Standard interfaces can be deleted FCI - Problems with SIF FCI - Leased lines not displayed FCI - ISDN - NT/TE mode not displayed FCI - Switching from DHCP mode to static IP address FCI - Removing a VLAN failed FCI - Wireless LAN menu revised FCI - Missing transfer rates System Software Release Notes 7

8 4.38 FCI - Missing default entries FCI - No input for hexadecimal figures FCI - WLAN - Incorrect error message FCI - Protocol list incorrect FCI - Missing fields FCI - Load balancing 100% exceeded FCI - PPPoE - Device crashes FCI - Real Time Jitter Control FCI - Problems with Real Time Jitter Control Real Time Jitter Control - Counter malfunction for VoIP calls FCI - L2TP - Authentication FCI - PPTP callback FCI - QoS entries can be deleted FCI - qosiftable FCI - PBX - Status column missing FCI - DynDNS Update - No input check FCI - DynDNS Provider - No input check FCI - DynDNS Provider can be deleted FCI - DHCP Pool settings not saved FCI - WLAN - "Unknown Interface" FCI - Problem with missing configuration file FCI - Unintentional spaces FCI - IP Accounting - Page filter did not function correctly FCI - Error displaying system messages Release Notes System Software

9 4.62 FCI - Filter incorrect FCI - Incorrect icon displayed for detail view Setup Tool - Stacktrace for ISDN-LAN-LAN connection Setup Tool - WAN bridge cannot be configured Setup Tool - Problems displaying an IP address Setup Tool - Interface in bridging mode - Errors in configuration Setup Tool - WLAN - Incorrect fields displayed Setup Tool - PPPoE - MAC addresses not unique Setup Tool - SIF - Incorrect port range Setup Tool - Missing field mode Setup Tool - Deleting two TDRC entries triggers a stacktrace Setup Tool - Alias not created Setup Tool - Entries deleted System Software Release Notes 9

10 10 Release Notes System Software

11 Important Information 1 1 Important Information Please read the following information about System Software carefully to avoid problems when updating or using the software. 1.1 Applicability System Software is available only for the following devices and cannot be used on other devices: R230a R230aw R232b R232aw R232bw TR200aw TR200bw. Note Please note that new features, changes or the solution of a problem are only available on your device if the menu described is shown. 1.2 Incompatibility Configurations set up or saved with System Software are incompatible with some earlier versions of our system software. Take note, however, of the following indications regarding the update and the possibilities of a downgrade. You can carry out an update or downgrade using the Funkwerk Configuration Interface or - if desired - using the SNMP shell and the Setup tool. System Software Release Notes 11

12 1 Important Information Preparation and update with the FCI The update of the system software with the Funkwerk Configuration Interface uses a BLUP (bintec Large Update) so as to update all necessary modules intelligently. All those elements are updated that are newer in the BLUP than on your gateway. The result of interrupted updating operations could be that your gateway no longer boots. Do not turn your gateway off during the update. Attention! To prepare and carry out an update to System Software with the Funkwerk Configuration Interface, proceed as follows: 1. For the update, you will need, for a device of the R-200 series, the file bl7802.rey, or for TR200aw/bw devices, the file bl7802.sey. Make sure that the file you need for the update is available on your PC. If the file is not available on your PC, enter in your browser. This will open the Funkwerk website. You will find the required file in the download area for your gateway. Save it on your PC. 2. Backup the current boot configuration. Export the current boot configuration using the MAINTENANCE SOFTWARE & CONFIGURATION menu on the Funkwerk Configuration Interface. To do this, select: ACTION = Export Configuration CURRENT FILE NAME IN FLASH = boot INCLUDE CERTIFICATES AND KEYS = enabled CONFIGURATION ENCRYPTION = disabled and click Go. The window Opening <name of gateway>.cf will open: Leave the selection Save to diskette/hard disk and click OK, to save the configuration on your PC. The file <name of gateway.cf> will be saved and shown in the Downloads window. 3. Carry out the update to System Software using the MAINTENANCE SOFTWARE & CONFIGURATION menu. 12 Release Notes System Software

13 Important Information 1 To do this, select ACTION = Update system software SOURCE = Local File FILE NAME = bl7802.rey Confirm by clicking Go. The message "System Maintenance. Please stand by. Operation in progress." shows that the selected file is being uploaded to the device. When the upload procedure is finished, you will see the message "System - Maintenance. Success. Operation completed successfully. The System must be restarted." Click on Reboot. You will see the message "System - Reboot. Rebooting. Please wait. This takes approximately 40 seconds." The device will start and the browser window will open. You can log into your device and configure it Downgrade with the FCI If you wish to carry out a downgrade, proceed as follows: 1. Replace the current boot configuration with the previous backed up version. Import the backed up boot configuration using the MAINTENANCE SOFTWARE & CONFIGURATION menu. To do this, select: ACTION = Configuration import CONFIGURATION ENCRYPTION = disabled FILENAME = <name of the device>.cf and click on Go. The message "System request. Please wait. Your request is being processed." or "System maintenance. Please stand by. Operation in progress." shows that the selected system software is being uploaded to the device. When the upload procedure is finished, you will see the message "System - Maintenance. Success. Operation completed successfully. The System must be restarted." Click on Reboot. System Software Release Notes 13

14 1 Important Information You will see the message "System - Reboot. Rebooting. Please wait. This takes approximately 40 seconds." The device will start and the browser window will open. Log into your device. 2. Carry out the downgrade to the desired software version using the MAINTENANCE SOFTWARE & CONFIGURATION menu. To do this, select ACTION = Update system software SOURCE = Local file FILENAME = bl7601.rey or, as appropriate, FILENAME = bl7601.rey and click on Go. The message "System maintenance. Please stand by. Your request is being processed." or "System maintenance. Please stand by. Operation in progress." shows that the selected system software is being uploaded to the device. When the upload procedure is finished, you will see the message "System - Maintenance. Success. Operation completed successfully. The System must be restarted." Click on Reboot. You will see the message "System - Reboot. Rebooting. Please wait. This takes approximately 40 seconds." The device will start with the previously backed up boot configuration and the old version of the system software. The browser window will open. You can log into your device and configure it Preparation and update with SNMP shell and Setup tool If appropriate, proceed as follows to prepare and carry out an update to System Software 7.8.2: 1. Backup the current boot configuration. Use one of the following possibilities: a) In the SNMP shell, enter cmd=save path=boot.alt. This backs up the current boot configuration in the Flash ROM of your gateway under the name "boot.alt". 14 Release Notes System Software

15 Important Information 1 b) On a computer on your LAN, start a TFTP server and export the current boot configuration using the CONFIGURATION MANAGEMENT menu of the Setup tool. To do this, select: OPERATION = put (FLASH -> TFTP) TFTP SERVER IP ADDRESS = <IP address of the TFTP servers on the LAN> TFTP FILE NAME = boot.alt NAME IN FLASH = boot. 2. Carry out the update to System Software with a BLUP (bintec Large Update) so as to update all necessary modules intelligently. The update using the BLUP runs as follows: r232bw:> update /REY/Blup/bl7802.rey Starting TFTP File Transfer ( Bytes) List of files in this update (len ): Version Length Name Boss webpages.ez CountryProfiles *** Don't power-off while the update takes place *** Perform update (y or n)? Here, the software modules contained in the BLUP are listed: Boss - the operating system itself webpages.ez - the HTML configuration interface CountryProfiles - an update of the country profiles used by the Express Setup wizard. If you confirm with y, all those elements are updated that are newer in the BLUP than on your gateway. When updating to System Software this will, as a rule, be all three modules. System Software Release Notes 15

16 1 Important Information The update then takes place for all modules concerned: Updating Boss Erasing Flash ROM... OK Writing Flash ROM... OK Verifying Flash ROM... OK Software update successfully finished Updating webpages.ez Perform Flash ROM update Update Flash ROM... OK Verify Flash ROM... OK File update successfully finished Updating CountryProfiles Perform Flash ROM update Update Flash ROM. OK Verify Flash ROM. OK File update successfully finished Rebooting... (y or n) [n]? After the reboot, you have the new software version and thus the FCI available. You can access it using a supported Web browser under the IP address of the gateway. If you have deleted the boot configuration, the gateway will again have the standard address Downgrade with SNMP shell and Setup tool If you wish to carry out a downgrade, proceed as follows: 1. Replace the current boot configuration with the previous backup version. Use one of the following possibilities: a) In the SNMP shell, enter cmd=move path=boot.alt pathnew=boot. This overwrites the current boot configuration with the previous backup version. The configuration named "boot.alt" is thereby deleted from the flash ROM (if you want to keep this in the flash, use cmd=copy instead of cmd=move). 16 Release Notes System Software

17 Important Information 1 b) On a computer on your LAN, start a TFTP server and import the current boot configuration using the CONFIGURATION MANAGEMENT menu of the Setup tool. To do this, select: OPERATION = get (TFTP -> FLASH) TFTP SERVER IP ADDRESS = <IP address of the TFTP servers on the LAN> TFTP FILE NAME = boot.alt NAME IN FLASH = boot. 2. Carry out the downgrade to the desired software version. 3. Reboot the gateway. The device will start with the previously backed up boot configuration and the old version of the system software. 1.3 ComPoint Manager The ComPoint Manager discovers all devices in your network for which the ENABLE DISCOVERY SERVER field is enabled in the LOCAL SERVICES FUNKWERK DISCOVERY OPTIONS menu. In their ex-works state, this field is not enabled in devices of the R200-series and TR200 devices. On all devices using the BOSS operating system, the ComPoint Manager can be used only to change the IP address. System Software Release Notes 17

18 1 Important Information 18 Release Notes System Software

19 New Functions 2 2 New Functions System Software includes a number of new functions that significantly extend the performance compared with System Software 7.6.1: New ADSL firmware on page 21 ISAKMP Configuration Method (IKE Config Mode) on page 21 GRE on page 22 alert on page 24 SSH Client on page 28 IGMP Host for local applications on page 29 HTML Page for Update on page 29 SSL Tunnel on page 30 Query the BOSS minimum version on page 35 VLAN prioritization on page 36 Checking the MAC address on page 36 DNS - Bailiwick Checking on page 36 Internet Browser - additional information on page 36 Telephone - Switchable time-controlled call assignment on page 36 Telephone - Display caller name on page 37 FCI - Support for Opera 9.5 on page 37 FCI - List entries - New filter on page 37 FCI - Defining the message level of syslog entries on page 37 FCI - Input field for DHCP MAC Address on page 37 FCI - New TCP MSS Clamping field on page 38 FCI - WLAN - New ARP processing field on page 38 FCI - Multicast - Extensions on page 38 System Software Release Notes 19

20 2 New Functions FCI - Dialup retries limited on page 38 FCI - Delete IPSec configuration on page 39 FCI - Displaying administrative access rules on page 39 FCI - New entry in services list on page 39 FCI - PBX - Music on Hold - Melodies changed on page 39 FCI - PBX - Configurable timer for call forwarding on page 40 FCI - PBX - Configurable SIP registration timer on page 40 FCI - PBX - VoIP provider cannot be reached on page 40 FCI - PBX - Configurable SIP transport protocol on page 41 FCI - PBX - VoIP connection as static host on page 41 FCI - PBX - Call Through with CLID Authentication on page 41 FCI - PBX - Import or export phone book data on page 42 FCI - PBX - Export call records on page 42 FCI - DHCP options extended on page 42 FCI - Scheduling - New option on page 42 FCI - Maintenance - New system logic field on page 43 FCI - Details of interface statistics on page 43 Setup Tool - HTTPS added on page 43 Setup Tool - New option for monitoring interfaces on page 43 Bandwidth on Demand (BoD) extended on page 44 New variables in MIB table autheapol on page 44 DHCP - New MIB variable SendRepliesToRelay on page Release Notes System Software

21 New Functions New ADSL firmware System Software provides the new version of the ADSL firmware. Any problems with previous versions have been solved. 2.2 ISAKMP Configuration Method (IKE Config Mode) System Software now offers the ISAKMP Configuration Method (IKE Config Mode for short) that allows you to connect a mobile PC workstation (Secure IPSec Client) to the head office over VPN. The IP address and, if required, other data such as the domain and server parameters for DNS and WINS are sent to the client by the VPN gateway on request. This method allows a dynamic IP address to be assigned from the internal address range for the head office. IKE Config Mode can be operated by extending the IPSec configuration. Data is transmitted from the gateway to the client in IPSec according to IKE (Phase 1) and is therefore protected by encryption. Note that IKE Config Mode is only available for IPSec peers with a virtual interface. Note Proceed as follows to use IKE Config Mode. 1. Create at least one IP address range. To do this, select the FCI menu options VPN IPSEC IP POOLS and click Add. Enter the IP POOL NAME and the IP POOL RANGE for the current IP address range. Click Add to create additional IP address ranges. Save the IP address range you have created with OK. The IP address ranges are now available. System Software Release Notes 21

22 2 New Functions 2. Select IKE Config Mode and assign your chosen IP address range. To do this, select the FCI menu options VPN IPSEC IPSEC PEERS and click New. Select IP ADDRESS ASSIGNMENT = IKE Configuration Mode. Select IP ASSIGNMENT POOL = <Your chosen pool>. IKE Config Mode configuration is complete and a secure IPSec client can now dial into the gateway. 2.3 GRE In System Software the GRE function is available in the FCI. In the VPN GRE menu you can used the Generic Routing Encapsulation (GRE) protocol to encapsulate other protocols and to transport these over the internet protocol using tunnels. The VPN GRE GRE TUNNEL NEW menu contains the following fields: Parameter Description Local GRE IP Address Remote GRE IP Address Standard Route Local IP Address Value Enter a description for the GRE tunnel. Enter the source IP address of the GRE packets to the GRE partner. If no IP address is given (this corresponds to IP address ), the source IP address of the GRE packets is selected automatically from one of the addresses of the interface via which the GRE partner is reached. Enter the destination IP address of the host or network to which the packets are to be sent through the GRE tunnel. If you enable the DEFAULT ROUTE, all data is automatically routed to a single connection. The function is disabled by default. Enter the IP address to be used as the source address for this GRE connection. 22 Release Notes System Software

23 New Functions 2 Parameter Route Entries MTU Use Key Key Value Value Define other routing entries for this connection partner. Add a new entry with Add. REMOTE IP ADDRESS: IP address of the destination host or network. NETMASK: Netmask of REMOTE IP ADDRESS. If no entry is made, your device uses a default netmask. METRIC: The lower the value, the higher the priority of the route (possible values ). The default value is 1. Enter the maximum packet size (Maximum Transfer Unit, MTU) in bytes that is allowed for the GRE connection between the partners. Possible values are 1 to The default value is Enable the key input for the GRE connection, which makes it possible to distinguish between several parallel GRE connections between two GRE partners (see RFC 1701). The function is activated with Enabled. The function is disabled by default. Only for USE KEY = enabled. Enter the GRE connection key. Possible values are 0 to The default value is 0. Table 2-1: Fields in the VPN GRE GRE TUNNEL NEW menu System Software Release Notes 23

24 2 New Functions 2.4 alert In System Software the alert function is available in the FCI. The gateway administrator can be notified of certain events that are displayed by syslog messages via . You can configure the alert function in the FCI menu EXTERNAL REPORTING ALERT. The EXTERNAL REPORTING ALERT ALERT SERVER BASIC PARAMETERS menu contains the following fields: Parameter Alert service Sender's Address Maximum number of messages per minute Value Here you can enable and disable the function. The function is enabled by default. Enter the address to be displayed in the sender field of the . Here you can limit the number of outgoing s per minute. Possible values are 1 to 15. The default value is 6. Table 2-2: Fields in the EXTERNAL REPORTING ALERT ALERT SERVER BASIC PARAMETERS menu The EXTERNAL REPORTING ALERT ALERT SERVER SMTP SETTINGS menu contains the following fields: Parameter SMTP Server Value Enter the address (IP address or valid DNS name) of the mail server to be used for sending the s. The entry is limited to 40 characters. 24 Release Notes System Software

25 New Functions 2 Parameter SMTP Authentication Value Select whether or not authentication should be used between the client and server and if so, which protocol should be used. Possible values: None (default value): No authentication should be used. ESMTP: Extended SMTP with Authentication should be used. SMTP after POP: POP (Post Office Protocol) with Authentication should be used first, following by SMTP with the same authentication. User name Password POP3 Server Only for SMTP AUTHENTICATION = ESMTP or SMTP AUTHENTICATION = SMTP after POP. Enter the user name of the client for authentication. Only for SMTP AUTHENTICATION = ESMTP or SMTP AUTHENTICATION = SMTP after POP. Enter the password of the client for authentication. Only for SMTP AUTHENTICATION = SMTP after POP. Enter the address (IP address or valid DNS name) of the POP3 server to be used for downloading the s. Appropriate POP3 server software must be installed so that the mailserver can answer the requests via POP3. System Software Release Notes 25

26 2 New Functions Parameter POP3 Timeout Value Only for SMTP AUTHENTICATION = SMTP after POP. Select the period of time after which authentication will expire. After this time, s cannot be sent. The possible values are 60 to 3600 seconds, the default value is 600. Table 2-3: Fields in the EXTERNAL REPORTING ALERT ALERT SERVER SMTP SETTINGS menu The EXTERNAL REPORTING ALERT ALERT RECIPIENT NEW ADD/EDIT RECIPIENT menu contains the following fields: Parameter Recipient Matching String Value Enter the recipient's address here. Enter the string that must occur in a syslog message for an to be sent. Bear in mind that without the use of wildcards (e.g. "*"), only those strings that correspond exactly to the entry fulfil the condition. The string entered therefore usually contains wildcards. To be informed of all syslog messages of the selected level, just enter "*". 26 Release Notes System Software

27 New Functions 2 Parameter Severity Value Here you select the syslog level at which the string entered in the MATCHING STRING field must occur to trigger an alert. Possible values: Emergency (default value) Alert Critical Error Warning Alert Information Debug. Message Timeout Number of Messages Enter the maximum number of seconds the gateway must wait after a relevant event before it sends an . Possible values are 0 to 86400, the default value is 60. The value 0 disables the timeout. Here you enter the number of syslog messages that must be reached before an can be sent for this case. If MESSAGE TIMEOUT is configured, the is sent when this expires, even if the NUMBER OF MESSAGES has not been reached. The default value is 1. System Software Release Notes 27

28 2 New Functions Parameter Message Compression Value Here you can select whether the message text is to be shortened. The then contains the syslog message only once plus the number of relevant events. Enable or disable the function. The function is enabled by default. Table 2-4: Fields in the EXTERNAL REPORTING ALERT RECIPIENT NEW ADD/EDIT RECIPIENT menu The EXTERNAL REPORTING ALERT RECIPIENT NEW MONITORED SUBSYSTEMS menu contains the following fields: Parameter Subsystem Value Here you select the subsystems to be monitored. Add a new system with Add. Table 2-5: Fields in the EXTERNAL REPORTING ALERT RECIPIENT NEW MONITORED SUBSYSTEMS menu 2.5 SSH Client In System Software the SSH (Secure Shell) Client function is available. This allows you to set up a secure connection from your gateway to a remote computer or to a second gateway and, for example, to output the command line of the remote computer on your gateway or to check the configuration of the second gateway. To dial into a remote computer or a second gateway, enter the command line ssh <User Name Gateway>@<IP address of the remote computer or IP address of the second gateway>. 28 Release Notes System Software

29 New Functions IGMP Host for local applications System Software supports IGMP for local multicast applications; i.e. local applications (e.g. Access Point Discovery Daemon) log in to specific multicast groups using IGMP reports and so can receive multicast packets. This may be necessary for switches that use IGMP snooping. For this mode you do not need to manually enable IGMP for each application on the corresponding interface as you can simply use the automated function provided: As soon as a host opens a local application using multicast, IGMP is enabled automatically on the corresponding interface and the IGMP interface is operated in host mode. You can configure this automated function in the FCI menu ROUTING MULTICAST OPTIONS by choosing the setting IGMP STATUS = Auto. If the IGMP status is enabled (IGMP STATUS = Enabled), you must configure the respective interfaces manually for IGMP host. If an interface is operation in "Only Host Mode" (ROUTING MULTICAST IGMP ICON TO CHANGE AN ENTRY with MODE = Only Host), applications will only receive packets on this interface. Routing must be allowed (ROUTING MULTICAST IGMP ICON TO CHANGE AN ENTRY with MODE = Host and Routing) to manage IGMP statuses for other systems on this interface and to route incoming packets there. In the ROUTING MULTICAST IGMP menu you can view the interfaces on which IGMP has been enabled by the same automated function or manually in the ROUTING MULTICAST IGMP NEW menu. 2.7 HTML Page for Update In System Software an HTML page is now displayed as part of the system software when logging in under the address address of your gateway>/maint that performs an update for the gateway. System Software Release Notes 29

30 2 New Functions 2.8 SSL Tunnel In System Software you can transport unsecure TCP data securely via an SSL tunnel, without needing a VPN. Each SSL tunnel can contain up to five TCP connections, e.g. for HTTP where several TCP connections are normally set up. You can configure SSL tunnels in the Setup Tool menu SECURITY SSL TUNNEL. The SECURITY SSL TUNNEL menu contains the following fields: Parameter SSL Tunnel Value Here you can enable and disable the function. Possible values: down (default value): The function isdisabled. up: The function is enabled. TCP Keepalive Retries If no data is currently being exchanged on the TCP connection, you can specify how often a TCP packet is sent for test purposes to establish whether or not the partner is maintaining the current TCP session. The fields TCP KEEPALIVE RETRIES and TCP KEEPALIVE TIMEOUT (SEC) determine how often and at what interval a TCP packet is sent for test purposes. Possible values are 0 to 255. The default value is Release Notes System Software

31 New Functions 2 Parameter TCP Keepalive Timeout (sec) Value If no data is currently being exchanged on the TCP connection, you can specify the number of seconds after which a TCP packet is sent to establish whether or not the partner is maintaining the current TCP session. The fields TCP KEEPALIVE RETRIES and TCP KEEPALIVE TIMEOUT (SEC) determine how often and at what interval a TCP packet is sent for test purposes. Possible values are 0 to The default value is 5. Table 2-6: Fields in the SECURITY SSL TUNNEL menu In the SECURITY SSL TUNNEL TUNNELS menu you can view the tunnels that have already been created. In the SECURITY SSL TUNNEL TUNNELS ADD menu you can create new tunnels. The SECURITY SSL TUNNEL TUNNELS ADD menu contains the following fields: Parameter Admin status Value Here you can enable and disable the tunnel. Possible values: down (default value): The tunnel is disabled. up: The tunnel is enabled. Description Enter a description that uniquely defines the tunnel. System Software Release Notes 31

32 2 New Functions Parameter External IP Value IP address of remote terminal client: IP address the client will connect to. server: If an IP address is set, the server can only connect to a client with this IP address. If no IP address is set, the server can connect to any client. External port External mode External port used according to the setting in the EXTERNAL MODE field. Indicates whether the tunnel is set up at the specified EXTERNAL PORT or listens at the EXTERNAL PORT because the tunnel is being set up from the remote terminal. Possible values: client: The tunnel is set up at the EXTERNAL PORT. server: The tunnel listens at the EXTERNAL PORT. Internal IP Internal port IP address of the gateway The default value is Internal port used according to the setting in the INTERNAL MODE field. 32 Release Notes System Software

33 New Functions 2 Parameter Internal mode Value Indicates whether the tunnel is set up from the specified INTERNAL PORT or listens at the INTERNAL PORT because the tunnel is being set up from the remote terminal. Possible values: client: The tunnel is set up from the INTERNAL PORT. server: The tunnel listens at the INTERNAL PORT. Certificate CA Certificate Enter the certificate to be used for authentication. Enter the CA (Certificate Authority) certificate to be used for authentication. Table 2-7: Fields in the SECURITY SSL TUNNEL TUNNELS ADD menu System Software Release Notes 33

34 2 New Functions The SECURITY SSL TUNNEL TUNNELS ADD (ADVANCED) TIMER SETTINGS menu contains the following fields: Parameter Retry timeout (s) Value Defines the time in seconds after which another attempt should be made to set up the tunnel if the connection setup fails. Possible values are 0 to The default value is 60. Maximum retries Reopen delay (s) Short hold Defines the maximum number of attempts that should be made to set up the tunnel if the connection setup fails. Possible values are -1 to 50. A value of -1 means that the system will try to set up a tunnel again and again without restricting the number of attempts. The default value is 3. Defines the delay after which a dropped tunnel is reopened if the connection setup is successful. Possible values are -1 to A value of -1 means that the tunnel will be reestablished at once. The default value is 0. Defines the idle time in seconds. Possible values are -1 to A value of -1- means that the connection is always maintained, i.e. is never cleared. Table 2-8: Fields in the SECURITY SSL TUNNEL TUNNELS ADD (ADVANCED) TIMER SETTINGS menu 34 Release Notes System Software

35 New Functions Query the BOSS minimum version In System Software you can query the minimum BOSS version required for the correct operation of specific hardware. If a minimum version is specified, you will need this version or a later version. To do this, enter show rev in the SNMP shell. The following output is displayed (example): Logic : V.1.0 Bootmon : V BOSS : V IPSec from 2008/12/12 00:00:00 (minimal version: 7.8.2) The last row indicates the minimum version required. Alternatively, you can query the minimum version with the update command. To do this, enter update -i in the SNMP shell: The following output is displayed: Flash-ROM management shell Flash-Sh > Enter info -m. If a minimum version is defined in the flash, the following output is displayed (example): BOSS minimal version If a minimum version is defined, the following output is displayed: BOSS minimal version: none specified. System Software Release Notes 35

36 2 New Functions 2.10 VLAN prioritization If in System Software data is received with VLAN prioritization according to IEEE 802, this data is accepted and processed further Checking the MAC address To reduce the risk of spoofing attacks, an additional check has been added for the MAC address if the variable ALLOWEDPEERS = dhcpclients is set in the MIB table IPEXTIFTABLE DNS - Bailiwick Checking In System Software Bailiwick Checking has been added, i.e. no unqueried supplied entries (Additional Resource Records) can be infiltrated in DNS replies Internet Browser - additional information If you configure your gateway over the HTML interface, in System Software the device and menu path is displayed on the active tab in the Web browser during the configuration Telephone - Switchable time-controlled call assignment In System Software you can now switch time-controlled call assignment between day and night using the telephone as well as in the ACTIVE MODE field in the PBX CALL ASSIGNMENT CALENDAR menu. The key sequence *9* switches to day call assignment, #9* switch to night call assignment. 36 Release Notes System Software

37 New Functions Telephone - Display caller name In System Software the name of the caller if displayed on the connected analogue telephone and on the SIP telephone, if the caller is available in the gateway's internal phone book. You can use this new function with telephones of the type elmeg IP290 and IP FCI - Support for Opera 9.5 In System Software you can use the Funkwerk Configuration Interface with the browser Opera FCI - List entries - New filter In the FCI the Status option has been added under FILTERS IN for filtering list entries FCI - Defining the message level of syslog entries In the MAXIMUM MESSAGE LEVEL OF SYSLOG ENTRIES field in the FCI menu SYSTEM MANAGEMENT GLOBAL SETTINGS SYSTEM you can define the level up to which syslog entries should be displayed under MONITORING INTERNAL LOG FCI - Input field for DHCP MAC Address In System Software you can change the preset MAC address in the MAC ADDRESS field in the FCI menu LAN IP CONFIGURATION INTERFACES NEW. System Software Release Notes 37

38 2 New Functions 2.20 FCI - New TCP MSS Clamping field In System Software the FCI menu LAN IP CONFIGURATION INTERFACES NEW / ICON TO CHANGE AN ENTRY ADVANCED SETTINGS has been supplemented with the field TCP MSS CLAMPING, which is required for RDP, VNC, Lotus Notes and SQL Syn processes over IPSec tunnels. If the TCP MSS CLAMPING setting is enabled the default value 1350 is displayed; you can modify this value FCI - WLAN - New ARP processing field The new ARP PROCESSING field has been added in the FCI menu WIRELESS LAN WLANX VIRTUAL SERVICE SETS New FCI - Multicast - Extensions If the FCI Menu ROUTING MULTICAST IGMP ICON TO CHANGE AN ENTRY is exited with OK without created an EXTENDED ROUTE under ROUTING ROUTES IP ROUTES, the message "If you exit this page by clicking "OK", multicast will be disabled for all interfaces without extended routes" appears. A new option Only host has been added to the MODE field in the FCI menu ROUTING MULTICAST IGMP ICON TO CHANGE AN ENTRY / NEW. A new option Auto has been added to the IGMP STATUS field in the FCI menu ROUTING MULTICAST OPTIONS FCI - Dialup retries limited A new field MAXIMUM NUMBER OF DIALUP RETRIES has been added to the FCI menus WAN INTERNET + DIALUP PPPOE New ADVANCED SETTINGS, WAN INTERNET + DIALUP PPPTP New ADVANCED SETTINGS, WAN 38 Release Notes System Software

39 New Functions 2 INTERNET + DIALUP PPPOA New ADVANCED SETTINGS and WAN INTERNET + DIALUP ISDN New ADVANCED SETTINGS FCI - Delete IPSec configuration A new field DELETE COMPLETE IPSEC CONFIGURATION has been added to the FCI menu VPN IPSEC OPTIONS. You can only use this field if IPSec is disabled FCI - Displaying administrative access rules You can display the administrative access rules by selecting DISPLAY ADMINISTRATIVE ACCESS RULES = Enabled in the FCI menu FIREWALL POLICIES FILTER RULES FCI - New entry in services list In System Software the FCI menu FIREWALL SERVICES SERVICES LIST now offers the new entry sip with UDP/TCP (5060) FCI - PBX - Music on Hold - Melodies changed In System Software the MUSIC ON HOLD (MOH) field in the FCI menu PBX GENERAL SETTINGS BASIC SETTINGS now offers two new options Internal melody 1 (German) and Internal melody 2 (English) with new melodies for German and English. System Software Release Notes 39

40 2 New Functions 2.28 FCI - PBX - Configurable timer for call forwarding In System Software you can now specify the time that should pass before a call is forwarded to the specified destination in the CALL FORWARDING (CFNR) field in the FCI menu PBX GENERAL SETTINGS BASIC SETTINGS FCI - PBX - Configurable SIP registration timer In System Software the FCI menu PBX LINE CONFIGURATION VOIP CONFIGURATION New offers a new field REGISTRATION TIMER with the default value 60 seconds. This field allows you to define the individual time periods during which the gateway has to register with the VoIP provider again for each provider FCI - PBX - VoIP provider cannot be reached If several VoIP providers are configured (in FCI menu PBX LINE CONFIGURATION VOIP CONFIGURATION New) and the first cannot be reached, in System Software the system switches to the second provider. If an external call over a VoIP provider fails and the PSTN is used instead, this change is indicated by an acoustic signal (three beeps). 40 Release Notes System Software

41 New Functions FCI - PBX - Configurable SIP transport protocol In System Software you can toggle between the default value UDP and the value TCP in the TRANSPORT PROTOCOL field in the FCI menu PBX LINE CONFIGURATION VOIP CONFIGURATION ICON TO CHANGE AN ENTRY ADVANCED SETTINGS. One advantage of this is that the configuration is then compatible with Microsoft Unified Communications FCI - PBX - VoIP connection as static host (ID n/a) For configurations with no registration (e.g. connection to a Microsoft Exchange Communication Server) the connection can be set up as a static host (PBX INTERNAL NUMBERS VOIP EDIT ADVANCED SETTINGS). This requires you to specify the static IP address of the terminal FCI - PBX - Call Through with CLID Authentication Particularly when using handheld PCs, PDAs or call through external software System Software now allows you to determine whether PIN2 and Checking Incoming Number (CLID) (default value), Only Checking Incoming Number (CLID), Only PIN or PIN2 or Checking Incoming Number (CLID) is used for authentication in the APPROVAL field in the FCI menu PBX CALL ROUTING CALL THROUGH by setting the STATUS to enabled. System Software Release Notes 41

42 2 New Functions 2.34 FCI - PBX - Import or export phone book data In System Software you can export the gateway's phone book data in *.txt format or import data from other applications into the gateway's phone book from the FCI menu PBX INTERNAL PHONEBOOK IMPORT / EXPORT. If the imported telephone numbers are in canonical format, e.g. +49 (911) , they will be converted automatically by the system so that the PBX can dial the numbers directly FCI - PBX - Export call records In System Software you can export data to *.txt format using the Save function in the FCI menu PBX CALL RECORDS and can import the data into other applications such as Microsoft Excel for editing FCI - DHCP options extended InSystem Software the FCI menu LOCAL SERVICES DHCP SERVER DHCP POOL ICON TO CHANGE AN ENTRY ADVANCED SETTINGS has been supplemented with additional DHCP OPTIONS. Click Add to display the OPTION dropdown menu containing the new options Time Server, DNS Server, DNS Domain Name, WINS/NBNS Server, WINS/NBT Node Type and TFTP Server. The VALUE field is also displayed so that you can enter the value of the chosen option FCI - Scheduling - New option The option Update Dynamic DNS has been added to the SELECT ACTION field in the FCI menu LOCAL SERVICES SCHEDULING TIME SCHEDULE New. This option is displayed if entries are configured in the LOCAL SERVICES DYNDNS CLIENT DYNDNS UPDATE menu. 42 Release Notes System Software

43 New Functions FCI - Maintenance - New system logic field The new SYSTEM LOGIC field has been added to display the logic version in the FCI menu MAINTENANCE SOFTWARE & CONFIGURATION, as logic and system software versions can vary FCI - Details of interface statistics You can display the details of each interface using the magnifying glass icon in the FCI menu MONITORING INTERFACES STATISTICS Setup Tool - HTTPS added The option https (tcp) has been added to the SERVICE field in the Setup Tool menu SECURITY LOCAL SERVICES ACCESS CONTROL Add Setup Tool - New option for monitoring interfaces The new option set interface dialup has been added to the OPERATION field in the Setup Tool menu MONITORING AND DEBUGGING INTERFACES EXTENDED. System Software Release Notes 43

44 2 New Functions 2.42 Bandwidth on Demand (BoD) extended In System Software you can automatically reduce the number of unused links / B channels for incoming connections in the MIB table PPPEXTIFTABLE using the MIB variable BODMODE = bod-reduce-incoming. This is useful, for example, if Windows clients have been configured for Multilink PPP dialin, but the gateway is configured without Multilink PPP and without channel bundling New variables in MIB table autheapol System Software comes with the new MIB variables QUIETPERIOD, TXPERIOD, SUPPTIMEOUT, MAXREQ, REAUTHPERIOD, REAUTHENABLED and KEYTXENABLED in the MIB table AUTHEAPOL DHCP - New MIB variable SendRepliesToRelay The variable SENDREPLIESTORELAY has been added to the MIB table IPDHCPPOOLTABLE for sending DHCP replies from the internal DHCP server to the DHCP relay when required. 44 Release Notes System Software

45 Changes 3 3 Changes The following changes have been made in our system software to improve its performance and usability: Password length restricted on page 46 Ping function expanded on page 46 Processing of blank IP addresses changed on page 46. DNS with two IP addresses on page 47 DNS Query IDs generated randomly on page 47 IP address ranges (pools) revised on page 47 Default value for number of NAT ports increased on page 47 NAT pass-through added on page 48 UDP port numbers generated randomly on page 48 PBX - Advanced configuration options on page 48 FCI layout, spelling, terminology on page 48 FCI - ISDN port selection changed on page 48 FCI - System management extended on page 49 FCI IP Configuration update on page 49 FCI - ADSL configuration on page 49 FCI NAT entry for outgoing connection on page 49 FCI - ATM - Bridging field removed on page 49 FCI - Phase-1 and Phase-2 profiles - New default settings on page 50 FCI - PBX - External numbers on page 50 FCI - PBX - Extensions on page 50 FCI - PBX - SIP - Codec settings extended on page 50 FCI - PBX - Description changed on page 51 System Software Release Notes 45

46 3 Changes FCI DHCP configuration changed on page 51 FCI Setup Tool - DHCP Pool Configuration expanded on page 51 Setup Tool improved configuration change on page 51 Setup Tool interface description changed on page 52 Setup Tool - ATM - Descriptions changed on page 52 Setup Tool Configuration Management expanded on page Password length restricted In System Software the length of the password for the configuration file is restricted to 10 characters. 3.2 Ping function expanded In System Software the Don't Fragment Flag can be set in outgoing IP packets. To do this, enter the ping -M <IP Address>. 3.3 Processing of blank IP addresses changed Previously was displayed automatically when the IP address was blank. If an MIB table returns a blank IP address, this is displayed immediately as blank. The system checks whether or not an IP address has to be entered. A message window appears if applicable. 46 Release Notes System Software

47 Changes DNS with two IP addresses Some SIP providers use an infrastructure with optimised load balancing to guarantee high availability for their users. When a gateway sends a DNS request to one of these providers, two IP addresses will be returned. In System Software both IP addresses are now sent by the gateway rather than only one as in previous versions. Both addresses can be determined using the nslookup command, for example, in Windows XP. 3.5 DNS Query IDs generated randomly In System Software the DNS Query IDs are generated randomly for security reasons. 3.6 IP address ranges (pools) revised The administration of IP addresses has been revised, as IP address ranges are now used by different subsystems. The MIB table IPDYNADDRTABLE has been replaced with two tables, the table IPDYNAADDRTABLE for dynamically generated entries, which are not saved in the configuration, and IPSTATADDRTABLE for manually generated entries, which are saved in the configuration. In the table IPDYNAADDRTABLE the MIB variable STATE has been expanded with the values iprequest and ipreply. In addition, the MIB table IPDYNADDRPOOLTABLE, which contains all of the IP addresses that can be assigned dynamically, and the MIB table IPADDRTABLE are used in this context. 3.7 Default value for number of NAT ports increased The default value for the number of NAT ports in global pools has been increased from 4000 to System Software Release Notes 47

48 3 Changes 3.8 NAT pass-through added In System Software you can now use the new MIB table IPNATEXCLUDETABLE to work off part of the data traffic from NAT, i.e. configure NAT pass-through. 3.9 UDP port numbers generated randomly In System Software numbers are assigned randomly in the range 1024 to to UDP ports for LOCAL SERVICES. Previously, these were used in ascending order starting at PBX - Advanced configuration options System Software supports advanced configuration options in the following areas: SIP provider configuration with MSN and DID Configuration of teams in the call assignment Signalling of the outgoing number FCI layout, spelling, terminology Small flaws to the layout have been remedied. The usability of some menus has been improved. Spelling and terminology has been revised FCI - ISDN port selection changed On devices with a single ISDN port, the dropdown menu no longer appears with this port as the only selection option. 48 Release Notes System Software

49 Changes FCI - System management extended The FCI menu SYSTEM MANAGEMENT STATUS has been extended with the DSP MODULE field FCI IP Configuration update In System Software the IP Configuration has been updated following changes to the FCI Menu SYSTEM MANAGEMENT Interface Mode / Bridge Groups in the MODE / BRIDGE GROUP field FCI - ADSL configuration In the FCI menu PHYSICAL INTERFACES ADSL MODEM ADSL CONFIGURATION all of the values displayed are updated automatically according to the setting in the AUTOMATIC REFRESH INTERVAL field FCI NAT entry for outgoing connection Previously outgoing NAT mapping was performed automatically at the same time as portforwarding for incoming connections in the FCI menu ROUTING NAT PORTFORWARDING, i.e. an entry in the MIB table IPNATOUTTABLE. Now you can choose whether or not this entry should be created in the CORRESPONDING NAT ENTRY FOR OUTGOING CONNECTION field FCI - ATM - Bridging field removed In the FCI menu WAN ATM PROFILES New the BRIDGING field has been removed for the setting TYPE = Ethernet over ATM. System Software Release Notes 49

50 3 Changes 3.18 FCI - Phase-1 and Phase-2 profiles - New default settings In System Software the FCI menu now offers new default settings under VPN IPSEC PHASE-1 PROFILES NEW where DESCRIPTION = PSK Multiproposal and under VPN IPSEC PHASE-2 PROFILES NEW where DESCRIPTION = Multi-Proposal FCI - PBX - External numbers In the FCI menu PBX LINE CONFIGURATION EXTERNAL NUMBERS New the Login Authentication option in the SERVICE field has been renamed ISDN Login so that it matches the description used in the PBX LOGIN AUTHENTICATION EXTERNAL NUMBERS menu FCI - PBX - Extensions In the FCI menu PBX INTERNAL NUMBERS ISDN you can add and delete up to 8 extensions, in the PBX INTERNAL NUMBERS VOIP menu you can add and delete up to 10 extensions and in the PBX INTERNAL NUMBERS CAPI menu you can add and delete up to 2 extensions FCI - PBX - SIP - Codec settings extended System Software has made the configuration options for codecs more flexible so that certain codecs can now be used for selected connections. For SIP clients you can now define the codecs that can be used in the PBX INTERNAL NUMBERS VOIP ICON TO CHANGE AN ENTRY ADVANCED SETTINGS menu depending on the codecs offered by the SIP provider. For SIP providers you can configure the codecs in the PBX LINE CONFIGURATION VOIP CONFIGURATION New ADVANCED SETTINGS FCI menu. The OPTIMIZE BANDWIDTH FOR SPEECHCOMPRESSION field has been removed from this menu. 50 Release Notes System Software

51 Changes FCI - PBX - Description changed The FCI menu PBX CALL ASSIGNMENT CALL ASSIGNMENT has been changed to PBX CALL ASSIGNMENT ASSIGNMENT FCI DHCP configuration changed In the FCI menu LOCAL SERVICES DHCP SERVER IP/MAC BINDING the Delete button has been removed due to the modified DHCP configuration FCI Setup Tool - DHCP Pool Configuration expanded If you want to create a DHCP pool independently of an IP or route entry, you can select the No Gateway option in the GATEWAY field in the FCI Menu LOCAL SERVICES DHCP SERVER DHCP POOL NEW ADVANCED SETTINGS. Alternatively, you can choose the no option in the GATEWAY field in the Setup Tool menu IP IP ADDRESS POOLS DHCP ADD. Both settings use the MIB variable GATEWAYENABLED in the MIB table IPDHCPPOOLTABLE Setup Tool improved configuration change The implementation of the IP and DHCP configuration for changing an interface from routing to bridging and vice versa has been improved to obtain consistent configurations. System Software Release Notes 51

52 3 Changes 3.26 Setup Tool interface description changed The description of the Call-by-Call (dialin only) option has been changed to the Multiuser (dialin only) option in the SPECIAL INTERFACE TYPES field of the Setup Tool menu WAN PARTNER ADD/EDIT ADVANCED SETTINGS Setup Tool - ATM - Descriptions changed In the Setup Tool menu ATM ETHERNET OVER ATM ADD the values bridged-no-fcs and bridges-fcs in the ENCAPSULATION field have been changed to LLC Bridged no FCS and LLC bridged FCS respectively. In addition, the position of the ATM INTERFACE field has been changed in the ATM PPP OVER ATM ADD and ATM ROUTED PROTOCOLS OVER ATM ADD menus Setup Tool Configuration Management expanded The OPERATION field in the Setup Tool menu CONFIGURATION MANAGEMENT has been expanded with the options get-all (TFTP -> FLASH) and put-all (FLASH - > TFTP). 52 Release Notes System Software

53 Problems Solved 4 4 Problems Solved Not all devices listed in chapter see Important Information on page 11 were affected by the following problems. If your device does not have the menu or property in question, you can ignore the problem mentioned. The following problems have been solved in System Software 7.8.2: 4.1 Stacktrace for routing over L2TP or bridging over L2TP (ID 10619) For routing over L2TP or bridging over L2TP, high data rates could cause a panic followed by a stacktrace. 4.2 PPPoE and Ethernet interfaces - Problems with external DSL modems (ID 9225) If the MAXTXRATE MIB variable in the QOSIFTABLE MIB table was changed, in the table IFTABLE, the variable SPEED was not adjusted for PPPoE and Ethernet interfaces. This led to latency problems in scenarios with external DSL modems. System Software Release Notes 53

54 4 Problems Solved 4.3 PPPoE multilink - no error checking (ID n/a) Previously, several interfaces with the same MAC address could be used for a PPPoE multilink because no error checking was carried out. 4.4 PPPoE problems (ID 10668) Problems sometimes occurred when establishing a PPPoE session if the provider's BRAS was not operating according to RFC PPTP connection setup failed (ID 10379) The PPTP connection setup sometimes failed if it had been initiated externally and if IP load balancing was used. 4.6 PPTP connection setup failed (ID 2787) The PPTP connection setup sometimes failed if it had been initiated externally, if the gateway was a tunnel endpoint and if PPTP passthrough was activated. 54 Release Notes System Software

55 Problems Solved Number of Telnet sessions unlimited (ID 1882) If several incoming Telnet sessions were opened simultaneously, the gateway stopped responding. The problem has been solved; the number of Telnet sessions is now limited, the default value is RIP source IP address incorrect (ID 10378) RIP packets with the source IP address were sent via WAN interfaces. 4.9 Syslog messages - Values not output (ID 10305) In syslog messages values were not output in 64 bit format; "u" was displayed instead. The problem has been solved; the values are output correctly SNMP Shell - Faulty input/output link (pipe) (ID n/a) Processes sometimes froze when using a pipe. System Software Release Notes 55

56 4 Problems Solved 4.11 SNMP shell - Problems with Signal Interrupt (ID n/a) When sending a SIGINT (Signal Interrupt; e.g. with the key combination Ctrl + c or by entering kill) to the SNMP shell whilst displaying the prompt, the prompt sometimes changed and it was impossible to display the previously shown table SNMP shell - ifoperstatus shown incorrectly (ID 4751) Interfaces with extended routes were shown with an incorrect status through ifoperstatus IPSec - Panic (ID 10155) A panic occurred if a subject name was entered using an incorrect notation for certificate enrolment over SCEP. 56 Release Notes System Software

57 Problems Solved IPSec - Panic without reboot (ID 10024) If an IPSec peer with traffic listen entry or a traffic list entry was deleted, a panic without reboot occurred IPSec - Setting option missing for Twofish key length (ID n/a) When configuring an IKE or IPSec proposal there is no option to specify a key length for using Twofish. In System Software , 192 and 256 bit length keys can be used. After updating the software, the IPSec configuration is not adjusted automatically, as new proposals have to be created. In a new configuration, this support function is enabled automatically IPSec - Tunnel setup (ID 9004) If an IPSec tunnel was setup using a packet generated locally by the gateway, the phase 2 of the tunnel was setup with the IP address of the source interface and a 32 bit netmask, instead of with the values of the corresponding subnet (e.g /32 instead of /24). This caused errors in the tunnel setup, particularly with open source IPSec solutions. This problem has been solved System Software Release Notes 57

58 4 Problems Solved 4.17 IPSec / OSPF - Unwanted OSPF update (ID 10371) An unwanted OSPF update was triggered during an IPSec tunnel to renegotiate the key. This interrupted the tunnel depending on the configuration Cert - No support for negative indices (ID 11285) The cert tool on the SNMP shell did not support any certificates with a negative index and without description. However, certain certificates are saved in this format, but could not be deleted manually IPSec - Phase -2 negotiation failed (ID 10877) A false netmask was tried for phase-2 negotiation under certain conditions and the negotiation failed accordingly QoS - Counter overrun (ID n/a) Due to the high data rates of modern interfaces, the octet counter often overran when using QoS. The problem has been solved; 64 bit counters are now used. 58 Release Notes System Software

59 Problems Solved Multicast protocols - Loss of 64 byte blocks (ID n/a) When multicast protocols such as IGMP were activated, 64 byte blocks were lost if a "non-data" multicast packet was sent Name server responses not accepted (ID n/a) "Manke" DNS requests were not accepted by mistake and were rejected with the error message "Bailiwick check failed for <xxx>.com". The domain association was miscalculated internally when validating a top level record FCI - Display off-centre (ID n/a) The alignment of menu elements was off-centre in several menus, which resulted in a lack of clarity. System Software Release Notes 59

60 4 Problems Solved 4.24 FCI - No extended routes after reboot (ID 9386) When extended routes were created and saved in the boot configuration, they were no longer available after a reboot FCI - Errors in Online Help (ID n/a) Errors occurred in the navigation for FCI Online Help due to duplicate IDs FCI - Active sessions not displayed (ID 9345) 0 was always displayed in the ACTIVE SESSIONS (SIF, RTP, ETC...) field in the FCI menu SYSTEM MANAGEMENT STATUS FCI - Different formats for time data (ID n/a) Time data was displayed in different formats in the SYSTEM DATE field in the FCI menu SYSTEM MANAGEMENT STATUS and in the NEW DATE field in the FCI menu SYSTEM MANAGEMENT GLOBAL SETTINGS DATE AND TIME. The problem has been solved; the same format is used in both fields. 60 Release Notes System Software

61 Problems Solved FCI - Display incorrect (ID 10122) The tab header in the browser was not the same for all device types in the FCI menu SYSTEM MANAGEMENT GLOBAL SETTINGS DATE AND TIME and the layout on the page itself was incorrect. The problems have been solved FCI - Bridge groups list incorrect (ID n/a) The list in the FCI menu SYSTEM MANAGEMENT INTERFACE MODE / BRIDGE GROUPS showed the virtual Ethernet interfaces, although these interfaces cannot be operated in bridging mode FCI - Standard interfaces can be deleted (ID n/a) Standard interfaces could be deleted using the recycle bin icon in the FCI menu SYSTEM MANAGEMENT ADMINISTRATIVE ACCESS. The problem has been solved; the recycle bin icon has been removed for standard interfaces. System Software Release Notes 61

62 4 Problems Solved 4.31 FCI - Problems with SIF (ID 8575) Problems occurred with the interface-based SIF policies in FCI menu SYSTEM MANAGEMENT ADMINISTRATIVE ACCESS. The problems have been solved by a standard configuration of SIF rules for physical interfaces and a standard rule for access to local services FCI - Leased lines not displayed (ID 10394) If leased lines were configured on the gateway, these were not shown in the ISDN overview of the PHYSICAL INTERFACES menu FCI - ISDN - NT/TE mode not displayed (ID 10392) ISDN modes TE and NT were not displayed in the PORT NAME field for BRI interfaces in the FCI menu PHYSICAL INTERFACES ISDN PORTS ISDN CONFIGURATION ICON TO CHANGE AN ENTRY. 62 Release Notes System Software

63 Problems Solved FCI - Switching from DHCP mode to static IP address (ID n/a) If the ADDRESS MODE in the FCI menu LAN IP CONFIGURATION INTERFACES ICON TO CHANGE AN ENTRY had been changed from DHCP to Static, it was possible to save the configuration with a blank IP ADDRESS field. If the only IP Ethernet interface was saved with this configuration, access could only be obtained via the serial console on the device. The problem has been solved and now the message "Please enter a valid IP address!" appears when the IP ADDRESS field is left blank, irrespective of the interface selected FCI - Removing a VLAN failed (ID 10230) If all VLAN MEMBERS for a VLAN were deleted in the FCI menu LAN VLAN VLANS ICON TO CHANGE AN ENTRY, the VLAN itself could not be deleted. If a VLAN contained VLAN MEMBERS, the recycle bin icon was still displayed for deletion. The problems have been solved FCI - Wireless LAN menu revised (ID 9287) The FCI menu WIRELESS LAN did not follow the Style Guide. The problem has been solved; the WIRELESS LAN menu has been revised and adapted to the FCI Style Guide. System Software Release Notes 63

64 4 Problems Solved 4.37 FCI - Missing transfer rates (ID 10608) The values 6 mbps and 9 mbps in the dropdown menu were missing in the MAX. TRANSMISSION RATE field in the FCI menu WIRELESS LAN WLANX RADIO SETTINGS ICON TO CHANGE AN ENTRY FCI - Missing default entries (ID n/a) The default entries in the FCI menu WIRELESS LAN WLANX RADIO SETTINGS ICON TO CHANGE AN ENTRY ADVANCED SETTINGS were not used correctly and a system message was displayed as long as wireless module was not activated for the first time. The problem has been solved; the corresponding fields are only shown when the wireless module is activated FCI - No input for hexadecimal figures (ID 9679) No hexadecimal figures could be entered in the WEP KEY 1-4 fields in the FCI menu WIRELESS LAN WLANX VIRTUAL SERVICE SETS ICON TO CHANGE AN ENTRY / NEW SECURITY SETTINGS if SECURITY MODE = WEP 40 or SECURITY MODE = WEP 104. No input could be made with the Setup Tool. 64 Release Notes System Software

65 Problems Solved FCI - WLAN - Incorrect error message (ID 10320) In the WLAN configuration the REGION field in the FCI menu WIRELESS LAN ADMINISTRATION was changed to "United States", while the CHANNEL field in the WIRELESS LAN WLANX RADIO SETTINGS ICON TO CHANGE AN ENTRY menu was set to 12 or 13, the error message "Changes not supported by the Setup Tool!" was displayed because use of this channel is not permitted in the USA FCI - Protocol list incorrect (ID 9609) The term Überspringen was displayed instead of Skip in the dropdown menu of the PROTOCOL field in the FCI menu ROUTING NAT PORTFORWARDING New when SERVICE = User Defined FCI - Missing fields (ID 9331) The fields for entering a netmask were missing for the EXTERNAL IP ADDRESS and MAP TO HOST in the FCI menu ROUTING NAT PORTFORWARDING New. The problem has been solved, the fields for entering netmasks have been added. System Software Release Notes 65

66 4 Problems Solved 4.43 FCI - Load balancing 100% exceeded (ID 9790) In the FCI menu ROUTING LOAD BALANCING LOAD BALANCING GROUPS New Add could be used to configure the DISTRIBUTION RATIO across all interfaces greater than 100%. The problem has been solved; the sum total is now limited to 100%. When the 100% limit is exceeded, an error message appears FCI - PPPoE - Device crashes (ID 10612) The device crashed when disabling the PRIORITIZE TCP ACK PACKETS option with an existing Internet connection in the FCI menu WAN INTERNET + DIALUP PPPOE New ADVANCED SETTINGS FCI - Real Time Jitter Control (ID 10050) Interfaces were mistakenly available in bridging mode in the FCI menu WAN REAL TIME JITTER CONTROL CONTROLLED INTERFACES New. The problem has been solved, the interfaces are no longer shown here in bridging mode. 66 Release Notes System Software

67 Problems Solved FCI - Problems with Real Time Jitter Control (ID n/a) Several real time jitter control entries could be created with the FCI for the same interface; the interface was changed accordingly if entries already existed. The problem has been solved; the interface can no longer be changed with real time jitter control entries Real Time Jitter Control - Counter malfunction for VoIP calls (ID 9199) If the real time jitter control function was enabled on an interface, the number of active VoIP calls was not transferred to the control counter. This resulted in negative counter readings at the end of some calls, which in turn prevented the dynamic initiation of the control mechanism FCI - L2TP - Authentication (ID 11049) The default value in the AUTHENTICATION field was incorrectly set to PAP/CHAP/MS-CHAP instead of MS-CHAPv2 in the FCI menu VPN L2TP USERS New ADVANCED SETTINGS. System Software Release Notes 67

68 4 Problems Solved 4.49 FCI - PPTP callback (ID 9786) If the CALLBACK field was not enabled in the FCI menu VPN PPTP PPTP TUNNEL New Advanced Settings, the fields INCOMING ISDN NUMBER and OUTGOING ISDN NUMBER were still displayed. The problem has been solved; the fields are only shown if CALLBACK is enabled FCI - QoS entries can be deleted (ID n/a) Entries used by the REAL TIME JITTER CONTROL function could be deleted in the FCI menu FIREWALL POLICIES QOS. The problem has been solved; these entries can no longer be deleted FCI - qosiftable (ID 10156) With the FCI several QoS configurations could be created for the same interface, i.e. several entries in the MIB table QOSIFTABLE FCI - PBX - Status column missing (ID 10730) The STATUS column was missing from the FCI menu PBX INTERNAL NUMBERS VOIP. 68 Release Notes System Software

69 Problems Solved FCI - DynDNS Update - No input check (ID n/a) The fields HOSTNAME and USER NAME could be left blank in the FCI menu LOCAL SERVICES DYNDNS CLIENT DYNDNS UPDATE New, an invalid selection could be made in the INTERFACE field FCI - DynDNS Provider - No input check (ID n/a) The PROVIDER NAME, SERVER and UPDATE PATH fields in the FCI menu LOCAL SERVICES DYNDNS CLIENT DYNDNS PROVIDER New could be left blank FCI - DynDNS Provider can be deleted (ID n/a) Predefined DynDNS providers could be mistakenly changed or deleted in the FCI menu LOCAL SERVICES DYNDNS CLIENT DYNDNS PROVIDER without being able to save the result. The problem has been solved; predefined DynDNS providers can no longer be changed or deleted. System Software Release Notes 69

70 4 Problems Solved 4.56 FCI - DHCP Pool settings not saved (ID 10823) The setting in the POOL FOR FORWARDED DHCP REQUESTS field in the FCI menu LOCAL SERVICES DHCP SERVER DHCP POOL was not saved with OK FCI - WLAN - "Unknown Interface" (ID n/a) If the field SELECT ACTION = Activate WLAN in the FCI menu LOCAL SERVICES SCHEDULING TIME SCHEDULE New, the dropdown list in the SELECT INTERFACE field contains the value Unknown Interface FCI - Problem with missing configuration file (ID 10755) If you wanted to rename, copy or delete a configuration in the FCI menu MAINTENANCE SOFTWARE & CONFIGURATION and no configuration was available, a blank dropdown menu appeared along with an unhelpful error message. The problem has been solved; the error message "No configuration file found" now appears. 70 Release Notes System Software

71 Problems Solved FCI - Unintentional spaces (ID n/a) Unintentional spaces appears in the table in the FCI menu MAINTENANCE SOFTWARE & CONFIGURATION FCI - IP Accounting - Page filter did not function correctly (ID n/a) The page filter did not function correctly when switching from Select All to Deselect All and vice versa in the IP ACCOUNTING field in the FCI menu EXTERNAL REPORTING IP ACCOUNTING INTERFACES FCI - Error displaying system messages (ID 10253) Scrolling did not function correctly or the page were not displayed correctly when scrolling if the VIEW setting was greater than 20 (e.g. 500) in the FCI menu MONITORING INTERNAL LOG. System Software Release Notes 71

72 4 Problems Solved 4.62 FCI - Filter incorrect (ID / n/a) The filter function "Description" for WLAN interfaces did not function correctly in the FCI menu MONITORING INTERFACES STATISTICS. "Not supported" was displayed in the Type column and the message "Changes not supported by the Setup Tool!" was also displayed FCI - Incorrect icon displayed for detail view (ID n/a) The "Wrench" icon was displayed instead of the "Magnifying glass" icon for displaying the detailed view in the FCI menu MONITORING INTERFACES STATISTICS Setup Tool - Stacktrace for ISDN-LAN-LAN connection (ID 9751) An ISDN-LAN-LAN connection with static channel bundling triggered a stacktrace followed by a reboot. 72 Release Notes System Software

73 Problems Solved Setup Tool - WAN bridge cannot be configured (ID n/a) WAN bridging could not be carried out in the Setup Tool following the introduction of the new bridge concept. PPP interfaces could no longer be used simultaneously for routing and bridging Setup Tool - Problems displaying an IP address (ID 10833) If the IP address has been changed and not saved in the LOCAL IP NUMBER field in the ETHERNET Edit menu in the Setup Tool in bridging mode, the current IP address can be seen in the first LOCAL IP NUMBER field and the new IP address entered in the second LOCAL IP NUMBER field by scrolling Setup Tool - Interface in bridging mode - Errors in configuration (ID 9595) The settings in the Setup Tool menu ETHERNET Edit ADVANCED SETTINGS were applied exclusively to interfaces in routing mode and not to interfaces in bridging mode. The settings could be corrected using the relevant MIB variables. System Software Release Notes 73

74 4 Problems Solved 4.68 Setup Tool - WLAN - Incorrect fields displayed (ID n/a) In the Setup Tool the fields WPA CIPHER or WPA2 CIPHER were displayed with the setting OPERATION MODE = Client under WLAN in the WLAN CLIENT CONFIGURATION menu if SECURITY MODE = NONE, SECURITY MODE = WEP 40/64 or SECURITY MODE = WEP 104/128. The problem has been solved; the fields are no longer displayed Setup Tool - PPPoE - MAC addresses not unique (ID n/a) If an Ethernet switch was operated in split port mode, problems occurred with PPPoE or Multilink PPPoE connections because the assigned MAC addresses appeared more than once. A new MAC address will be assigned if required in the CREATE NEW (UNIQUE) MAC ADDRESS <NEW MAC ADDRESS> FOR PORT <CORRESPONDING PORT> field in the Setup Tool menu WAN PARTNER ADD ADVANCED SETTINGS EXTENDED INTERFACE SETTINGS Setup Tool - SIF - Incorrect port range (ID n/a) Values from 0 to could be entered by mistake in the RANGE field in the the Setup Tool menu SECURITY STATEFUL INSPECTION EDIT SERVICES ADD/EDIT. The problem has been solved; the possible values have been changed to Release Notes System Software

75 Problems Solved Setup Tool - Missing field mode (ID 9296) The MODE field was not displayed for the settings ROUTE TYPE = Default route and NETWORk = LAN in the Setup Tool menu IP ROUTING ADDEXT Setup Tool - Deleting two TDRC entries triggers a stacktrace (ID 6464) If two entries were created for a T-DSL interface in the Setup Tool menu IP BANDWIDTH MANAGEMENT (TDRC / LOAD BALANCING / BOD) TCP DOWNLOAD RATE CONTROL (TDRC) ADD, one with OPTIMIZE DOWNLOAD RATE VIA TCP ACK PRIORISATION = yes and the other with OPTIMIZE DOWNLOAD RATE VIA TCP ACK PRIORISATION = no and TDRC MODE = static (fixed maximum rate for TCP download), both entries were selected and deleted, the message "Exception: 0x1c00 Data breakpoint Debug" appeared followed by a stacktrace without reboot Setup Tool - Alias not created (ID 9315) If an interface was created in the Setup Tool menu ATM ROUTED PROTOCOLS OVER ATM ADD, no alias was displayed for this interface in the SECURITY STATEFUL INSPECTION EDIT ADDRESSES menu. System Software Release Notes 75

76 4 Problems Solved 4.74 Setup Tool - Entries deleted (ID 10105) If an entry had been made for IPEXTRTTABLE on the SNMP shell, this was deleted the next time the corresponding interface is changed in the Setup Tool menu BASIC IP SETTINGS. 76 Release Notes System Software