Global Technology Associates, Inc.
Title: GTA Firewall Systems Release Notes
Product: GNAT Box System Software version 3.4.0
Date: 1 August 2003
RELEASE NOTES HISTORY
These notes cover the latest patch release of GNAT Box System Software
version 3.4.0. Release notes for previous versions can be found at
GTA's website, www.gta.com.
-------------------------------------------------------------------------
UPGRADE NOTES
For more about upgrading, see individual product text files.
New Surf Sentinel Feature Activation Code
----
Before upgrading to version 3.4.0, Surf Sentinel customers upgrading from
a version previous to 3.3.4 must enter a new feature activation code to
accommodate Cerberian Web Filter version 2.0. The new code is available
in the GTA support center under View Registered Products. Delete the old
feature code, enter the new code and save, then upgrade the firewall.
Default SSL Encryption Settings
----
If upgrading from a version previous to 3.2.2, SSL will be disabled and the
default port set to 80. To enable SSL encryption, copy the current web
access Remote Access Filter, change the port on it to 443 and enable. Save
the section. Next, default and save the Authorization > Remote
Admin/Authentication function and save the section. This will enable all
encryption and change the server port to 443. Delete the old filter.
High Availability Names
----
Beginning in version 3.3, H2A systems began using Interface Object names
(HA-EXTERNAL, HA-PROTECTED), so GTA recommends changing references to HA
systems to reflect the new nomenclature.
Netscape/Mozilla
----
Version 3.4.0 installs a new default security certificate. Some browsers,
including Netscape and Mozilla, will not recognize the new certificate if
the original has never been replaced. If you are unable to log on to the
GTA Firewall after upgrading, delete the browser security certificate, then
exit and restart.
-------------------------------------------------------------------------
KNOWN ISSUES
Internet Explorer 5 for Macintosh
----
Internet Explorer 5 for Macintosh will not allow you to accept or install
the SSL security certificate. SSL must be disabled to use this combination.
Internet Explorer 5 Export Version, No Patch
----
The export version of IE 5 improperly implements SSL version 3.0, so to use
SSL 3.0, you must have installed the IE security patches.
Security Vulnerabilities in SSL Version 2.0
----
Due to security vulnerabilities in SSL 2.0, support for it has been
removed in GNAT Box System Software.
-------------------------------------------------------------------------
Release Notes include following enhancements, modification and bug fix
sections:
1. SYSTEM SOFTWARE
2. SERVICES
3. CFG LIBRARY
4. ALL USER INTERFACES
5. GBADMIN (Windows Only)
6. WEB
7. CONSOLE
8. CONTENT FILTERING
9. INSTALLERS
10. GTASYSLOG
11. GBAUTH (Windows Only)
------------------------------------------------------------------------
1. SYSTEM SOFTWARE
1.1 Enhancements
1. Make NAT, IP Pass Though and VPNs inherit their logging and
priority settings from the filter that allowed them to be
created. GB340432
2. Add to transparent proxy the ability to return a block
message or redirect to a URL when blocking a user. GB340435
3. Add ability to require tunnel and filter authentication.
GB340436
4. Close connections that use a time-based filter at the stop
time set for the filter, if connection is still active.
GB340441
5. Log user, packets received (pkts_rcvd) and packets sent
(pkts_sent) when logging NAT, VPN and IP Pass Through closes.
GB340455
6. Allow TCP packets with ECN bits set. ECN is commonly used by
default on LINUX systems, but is non-standard, and so was
previously denied by GTA firewalls. GB340601
1.2 Modifications
1. Enhancements to system software have increased the size of the
runtime image, so remove support for the less-used functions
RIP and Gigabit from floppy-disk based products. GB340517
1.3 Bug Fixes
1. Non HTTP services running on HTTP service ports (80 or 8080)
can not be accessed using WWW proxy. GB340006
Resolution:
Pass unparseable connections to content filtering as type
unknown.
2. SERVICES
2.1 Enhancements
1. Add support for PPTP to PPP client. GB340457, GB340498
2. Simplify the use of VPN mobile protocol: mobile protocol will
be used only if "Force mobile protocol" is selected in the
VPN object. GB340540
3. Set 300 connection maximum on email proxy connections to
prevent excess memory use. GB340616
4. Add to SMTP proxy the ability to log to and from addresses,
and log reason for block, when rejecting email. GB340453
2.2 Modifications
NONE
2.3 Bug Fixes
1. IKE service exhausts memory when using RIP. GB340594
Resolution:
Remove routing memory leak from IKE daemon.
2. Primary domain name is not appended to hosts when using Ping
or Traceroute if using the DNS Proxy. GB340636
Resolution:
When using DNS Proxy, use primary domain, if specified.
3. CFG LIBRARY
3.1 Enhancements and Changes
1. Add ability to use wildcard character "*" when specifying DNS
hosts. GB340407
3.2 Modifications
1. Added verification for matching aliases to network information
screen networks when aliases specify a netmask and the alias is
on the same logical network as a primary address. GB340402
2. Add PPPoE interface information to the configuration report
network information section. GB340514
3.3 Bug Fixes
1. Number of VPN security associations for mobile users and
authorized VPNs is not directly verified. GB340538
Resolution:
Add verification check for number of security associations
being defined. Additionally, when configuring VPNs ignore
those that would cause system to exceed allowed security
associations.
4. ALL USER INTERFACES
4.1 Enhancements
1. Add ability to use objects for configuring a remote network
in Users Authorization. GB340012
2. Simplify VPN configuration under VPN Authorization. GB340470
3. Enhance inbound tunnel configuration by adding a description
field and an enable checkbox, similar to filter
configuration. GB340471
4. Add system activity report to display authenticated users.
GB340495
5. When updating a HA standby/slave firewall, preserve the
standby firewall's PPP configuration. GB34501
6. Change the Destination IP address for the Traditional Proxy
default filter to (previously, the default
destination IP address was
|
