EQ/OS 10.3.2 Release Notes About This Document .................................................................................................................. 2 Supported Hardware ................................................................................................................... 2 EQ/OS 10 Documentation ........................................................................................................... 2 Enhancements and Fixes in 10.3.2a ........................................................................................... 3 What’s New .....................................................................................................................................3 Top Level Health Checks ......................................................................................................3 Layer 7 Header Editing .........................................................................................................3 Change Notices ..............................................................................................................................4 Version 8.6 Configuration Converter Not Supported in 10.3.2 and Later Releases .....4 Resolved Issues ..............................................................................................................................5 Known Issues ................................................................................................................................ 9 Registering Your Product .......................................................................................................... 13 Page 1 of 14 EQ/OS 10.3.2 Release Notes 18 February 2015 About This Document These are the release notes for EQ/OS Version 10.3.2 releases. Release notes are available from the Fortinet Support Site: http://support.fortinet.com They are also available from the legacy Coyote Point Systems Website: http://www.coyotepoint.com/downloads-category/release-notes Supported Hardware This release is supported on all LX and GX model hardware. Please see the EQ/OS 10 Support Web Page for download links: http://www.coyotepoint.com/content/eqos-10-support-page EQ/OS 10 Documentation The online Webhelp system in the Equalizer graphical user interface (Web UI) contains complete hardware installation, configuration, and operation information. To display Webhelp while using the Web UI, press the F1 key or choose Help > Context Help from the menu at the top right of the Web UI screen. The Administration Guide is the PDF format version of the Webhelp available in the Web UI. The latest Guide is always available from the EQ/OS 10 Support Web Page: http://www.coyotepoint.com/content/eqos-10-support-page Copyright 2015 Coyote Point Systems Inc. A subsidiary of Fortinet, Inc. All Rights Reserved. Page 2 of 14 EQ/OS 10.3.2 Release Notes 18 February 2015 Enhancements and Fixes in 10.3.2a What’s New Top Level Health Checks In previous releases, health check probes were limited to defining all probe parameters on an object-by-object basis. Starting with version 10.3.2a, all Health Checks are defined at the top or global level of the object hierarchy, at the same level as cluster, server pools, server, etc. These global ‘templates’ are then attached to specific objects. Some Health Check parameters (e.g., IP, port) can be specified either in the Health Check itself, or using the parameters on the objects to which the health check is attached. Two basic health check types can be defined: status and load health checks. Status health checks indicate whether an object is available or not (up or down), and can be attached to any supported object. Load health checks indicate the relative availability of an object compared to other objects, and for this reason can only be attached to server pools. To complement top level health checks, new alert object types are now supported. In addition to the existing capability of attaching alerts to objects such as servers, you can also set alerts on health checks attached to load balancing objects (such as server instance health checks, LLB Gateway Health Checks, etc. When upgrading from version 10.3.1c and earlier releases, upgrade scripts convert your existing configuration automatically when you upgrade the firmware. The details of how existing configurations are converted to use top level health checks is in the ‘Health Checks’ chapter in the product WebHelp and in the Administration Guide. Layer 7 Header Editing Header editing allows you to add, modify, and delete Layer 7 packet header data contained in client requests and server responses. You can choose to apply header editing rules on every request or response, or you can selectively apply header edits based on whether or not the client request is selected by a match rule. Header editing is supported on Layer 7 HTTP and HTTPS clusters only. Edits are defined using a server side scripting language, similar to PHP, that allows you to create custom scripts with a set of rich locator and editing functions that let you easily select headers, locate and modify specific header data, and use that data to add or modify additional headers. Among the operations you can perform are: • Mask server information such as server version. Copyright 2015 Coyote Point Systems Inc. A subsidiary of Fortinet, Inc. All Rights Reserved. Page 3 of 14 EQ/OS 10.3.2 Release Notes 18 February 2015 • Update request URIs to accommodate path changes on servers. For example, you could change paths from /marketing to /departments/marketing. • Work around broken features on the server. For example if compression were broken on a server, you could delete gzip from the accept-encoding header. • Make changes to a query string. For example, you may wish to extract a session ID from a cookie and add it to the query string before sending a request on to a server. For more information, see the Header Editing chapter in WebHelp and in the Administration Guide. Specifying Which System Will Generate Alerts in Failover A new advanced option has been added to the CLI that allows the user to specify which unit in failover will generate alerts for failover groups. [Objects not associated with failover groups will continue to be generated by all units.] The new ‘primary’ flag on users is set as follows: eqcli > user name flags primary When in failover, this flag controls the generation of alerts on for all failover groups. If set, alerts for the following load balancing objects will only be generated for failover groups that are in primary mode on the ADC: • • • • Servers Server pools Server instances LLB gateways If the ‘primary’ flag is not set, alerts for load balancing objects will be generated for all failover groups. If not in failover, this flag has no effect. This option will be added to the Web UI in a future release. Change Notices Version 8.6 Configuration Converter Not Supported in 10.3.2 and Later Releases The Version 8.6 to Version 10 configuration converter supported in previous releases is discontinued with version 10.3.2a. This means that customers currently running Version 8.6 on legacy Coyote Point GX hardware will need to follow this upgrade path to Version 10.3.2: 8.6.0i-patch1 > 10.3.1c-RELEASE > 10.3.2x 1. Customers must be running Version 8.6.0i-patch1 to upgrade to Version 10.3.1c. Copyright 2015 Coyote Point Systems Inc. A subsidiary of Fortinet, Inc. All Rights Reserved. Page 4 of 14 EQ/OS 10.3.2 Release Notes 18 February 2015 2. After upgrading to 10.3.1c, the configuration converter can be used to convert a backup archive of your Version 8.6 configuration to a Version 10 configuration. 3. Once your configuration is running 10.3.1c, you can upgrade to Version 10.3.2a and subsequent releases. Resolved Issues Bug Description 2594 SNMP: Two new OIDs have been added to report the number of servers active in a server pool attached to a cluster or match rule: eqClusterStatusHTTPSActiveServers eqClusterMatchRuleStatusHTTPSActiveServers 8582 Web UI: Clusters are now sorted in ascending alphabetical order in the left frame, without regard to cluster type. 8589 SNMP: New OIDs have been added that expand the storage reporting information available for the Host Resources MIB (RFC2790). 8638 Web UI: The HTTPS cluster summary (appears when you click on a cluster name in the left frame) has been enhanced to clearly indicate when a cluster is disabled because of a missing certificate or server pool. 8759 Link Aggregation Stability / Reliability: If a port is removed from an aggregated interface, and then the same port is re-added to the same aggregated interface, the system may panic. This bug has been fixed. 8903 Interface Reliability: The error message “MDIC write error problem” may appear in the log and cause connectivity outages on 1Gb interfaces. 8948 Alerts: In some cases, a similar alert configured for more than one user may only fore for one of the configured users. This issue has been fixed. (1204360) 9092 Web UI: Fixed scrolling issues that appear when attempting to assign a VMware UUID to a server. Copyright 2015 Coyote Point Systems Inc. A subsidiary of Fortinet, Inc. All Rights Reserved. Page 5 of 14 EQ/OS 10.3.2 Release Notes 18 February 2015 Email Alert Format: Enhanced the default subject line and body text of email type alerts to provide critical information at a glance. (1243443) 9097 The default subject line format is now: Subject: <hostname>: <object_type> <object_name> [in <container_object_type><container_name>] <status>: <SUBJECT> Note that <SUBJECT> is the user-provided text from the alert definition. The default alert email body is now: <alert_type>: <object_type> <object_name> (<IP:port>) [in <containing_object_type> (<IP:port>)] <status> 9166 IP Reputation: If the user attempts to upload a very large file that is NOT an IP Reputation database file, a success popup may appear with an ‘undefined error’ message. This issue has been fixed so that a failure popup appears in this case, and a proper error message is returned. 9185 Certificates: When attaching a certificate to an HTTPS cluster, the Web UI has been enhanced to prevent the user from attaching a certificate that is incomplete (e.g., missing a key file). 9189 9300 IP Address Validation: Added validation to prevent adding an object with a blank IP address, or with an IP address that is all zeros. 9195 Certificate Validation: Modified certificate validation as follows: • If the user uploads a certificate and key file, and the key file validation fails against the certificate, an error is returned. Both the key file and the certificate file are not stored. • If the user uploads only a certificate file and does not attempt to upload a key file, the certificate is uploaded and stored in the configuration. 9205 Failover: If two systems are configured in failover and are simultaneously rebooted, the following error may be seen on one of the systems: "47000017: eqipc call failed - configd communication error”. This bug has been fixed. 9212 SSL Certificates: Improved error processing in GUI when the user submits an invalid certificate file, or accidentally provides two key files when uploading a certificate/key file pair. 9241 Remote Management via Telnet: A new global ‘services’ option has been added to enable telnet access across all existing subnets. Copyright 2015 Coyote Point Systems Inc. A subsidiary of Fortinet, Inc. All Rights Reserved. Page 6 of 14 EQ/OS 10.3.2 Release Notes 18 February 2015 9276 SSL Certificates: A certificate can be deleted while it is in use. This bug has been fixed; the system will not allow the user to remove a certificate unless it is not attached to any object. 9289 Web UI: Fixed an issue where a server pool cannot be removed from an enabled match rule unless there is a responder attached. 9364 Alerts: Exception alerts sent to the remote syslog are always sent with LOG_INFO priority. Exception alerts have been enhanced to return LOG_ERR, LOG_WARN, and LOG_NOTICE in specific situations where they are required. 9367 Web UI: Fixed an issue that caused a long certificate list to be truncated on display. 9397 Failover Reliability: Preferred Peer Setting Change Not Synchronized: In a failover configuration, creating a cluster in the CLI and then immediately removing the ‘preferred_peer’ setting may not be correctly reflected on other peers; the existing ‘preferred_peer’ setting may not be updated on the remote peers. This bug has been fixed. (1271540) 9403 Failover Reliability: Corrupted UUID After Config Sync: Adding a real server (not a VM) on one unit, the change is configured to the other peers, but the UUID 1287135: corrupted UUID value appears after config sync. 9411 Web UI: Disabling the TLS 1.0 flag also disables the Server Side Encryption flag. This bug has been fixed. (1299256) 9434 Web UI: Fixed issues that caused the Cluster Summary to display as a blank page on Internet Explorer 9 (only). 9452 Web UI: Sorting on the Server Pool Summary page table does not work for columns other than ‘Cluster’. This bug has been fixed. (1295397) 9454 Web UI: Category status (allow or block) is incorrectly reflected in the GUI, bot h for default and modified values. (The CLI is always correct.) This bug has been fixed. (1295015) 9489 Documentation: Updated information about addresses used as NAT addresses on outbound subnets. If a specified NAT address does not already exist on one of the unit’s subnets, it will be instantiated on the appropriate subnet after the NAT is added. (1278015) 9491 Link Aggregation: If an aggregated interface is removed from a subnet, and an IP address on that subnet is then ping’ed, the system may panic. This bug has been fixed. Copyright 2015 Coyote Point Systems Inc. A subsidiary of Fortinet, Inc. All Rights Reserved. Page 7 of 14 EQ/OS 10.3.2 Release Notes 18 February 2015 9499 Web UI Certificates: Added validation to prevent a DSA or EC certificate to be attached to the Web UI. (Currently, these are not supported for use with the GUI.) 9552 9608 HTTPS Cluster Reliability / Stability: During certain rare events on hardware-accelerated systems, an HTTPS cluster can become unresponsive when certain rare events occur during SSL processing. The message returned is: “abort in cav_pending_assert unexpected cavium pending “. This issue has been fixed. (1324824) 9554 HTTPS Cluster Reliability / Stability: Fixed issues with undocumented error codes (e.g., 0x42) being returned on hardware-accelerated systems. 9560 User Management: Disabling any user flags removes an already configured mail server from the user configuration. This bug has been fixed. Copyright 2015 Coyote Point Systems Inc. A subsidiary of Fortinet, Inc. All Rights Reserved. Page 8 of 14 EQ/OS 10.3.2 Release Notes 18 February 2015 Known Issues Read this section thoroughly before upgrading! Bug ID Description 3351 3989 Match Rules: debug_message(), ssl2(), ssl3(), and tls1() functions (supported in Version 8) are not accepted for expressions. 3468 Clusters: The ‘Reset on server failure’ global option supported in previous releases is not yet implemented in Version 10. 4101 Layer 4 UDP clusters: The ‘persist override’ flag on UDP cluster server instances does not override persistence. (4101 5393 TCP/ACV Health Checks: The CLI and Web UI will indicate that a server instance is 'ACV DOWN' (or not responding to ACV probes) even when ACV is not set, when the server is not responding to TCP probes. It should be shown as ‘L4 TCP DOWN’. In any case, the server is correctly marked ‘down’. 5663 Health Checks: In a server pool configuration, do not define more than 16 health check instances per server instance. If 17 health check instances are defined on a server instance, the system will become unresponsive and reboot. The workaround, after the system comes back up, is to remove the 17th health check from the configuration file. This bug will be fixed in a future release. 6385 VMware Integration: In a VMware configuration where Microsoft Active Directory is used, logging in to VMware from Equalizer will fail if the VMware account used to log into VMware is defined within an Active Directory domain. On VMware the login succeeds, but on Equalizer the login attempt fails. If you test the login, it will appear to hang. Messages like the following appear in the Equalizer log: “vlbd[22043]: |e|v vCenter;|75000039: unable to send message|Message too long|”.The workaround is to use a VMware account that is not defined within Active Directory to log into VMware. 6583 If you modify a VLAN MTU parameter to a value that is lower than the currently set value, you must reboot Equalizer to ensure proper operation of the network interface. Copyright 2015 Coyote Point Systems Inc. A subsidiary of Fortinet, Inc. All Rights Reserved. Page 9 of 14 EQ/OS 10.3.2 Release Notes 18 February 2015 6634 UDP Health Checks: If a UDP health check is attached to an object with a port that is not port 53, 111, or 2049, then no probing will occur. If the health check is attached to a server pool, all server instances for which the destination port is one of the 3 supported ports will be probed; others will not. UDP probing on ports other than 53, 111, and 2049 will be provided in a future release. 6648 Responders: It is not possible to enter a regular expression containing a "?" character using the CLI. The workaround is to use the Web UI instead 6669 SSH: When using SSH to log into the CLI, the file editor (for certificates, responders, etc.) may not work. This may be due to the terminal type presented to the system on login. To work around this issue, modify your terminal emulator settings before logging in and set the terminal type to ‘xterm’. 6497 ACV Probes Require ‘\r\n’ at Layer 7: In Version 8.6, Layer 7 ACV probes did not require that the user insert ‘\r\n’ characters at the end of the Probe. In Version 10, the user must add these characters at the end of the probe string manually. (6497) 6966 Web UI: Cannot define an SNMP Trap server in the Web UI. The workaround is to use the CLI. 7363 Web UI: Some CLI commands are not supported by the CLI Console widget in the Web UI Dashboard. See the online WebHelp for more information. 7599 Subnet destination (or policy) routes have been removed (see bug 7556, above). That feature included the ability to specify the source IP address to use for a packet routed to another network. Now, the system automatically configures destination routes, and uses the subnet IP address as the source IP address. The capability to specify a source IP address will be provided in a future release. 7750 Layer 4 TCP Clusters: The IP address and port for an FTP cluster (a TCP cluster with a start port of 21) cannot be modified. The workaround is to create a new FTP cluster. 7814 Failover: The per-subnet ‘command’ flag has been moved in the CLI to a new ‘failover’ context. This flag must currently be managed through the CLI. In the Web UI, this flag remains on the subnet configuration tab. Attempting to disable the flag in the Web UI appears to succeed, but if the tab is redisplayed the flag is still set on that subnet. This issue in the Web UI will be fixed in a subsequent release. Copyright 2015 Coyote Point Systems Inc. A subsidiary of Fortinet, Inc. All Rights Reserved. Page 10 of 14 EQ/OS 10.3.2 Release Notes 18 February 2015 7830 The VLAN MTU parameter cannot be modified to be larger than 4839 on all LX and FortiADC hardware, as well as on Equalizer OnDemand. For legacy GX models, the MTU parameter limitation is 1500. This will be fixed in a future release. 7923 Preferred static routes: If the user adds a ‘0/0’ static route and a preferred static route for a server with the same gateway, then the preferred static route is ignored. 8657 SSL Ciphers: The following cipher is temporarily disabled for all HTTPS clusters due to reconnection issues: • AES256-GCM-SHA384 Upgrade using Local File in Web UI: When upgrading using a ‘Local File’ uploaded to the system via the browser, the system displays a popup that says: ‘Downloading the upgrade archive…’. If the system runs out of space in the filestore, this popup will appear and never be dismissed. Also, a message in the system log will appear: 8676 command phpcgi, on /var/crash: file system full If this occurs, you must remove files from the filestore (using the CLI) so that there is at least 50MB of space in the filestore. Then, re-try the upgrade and it should now succeed. 9257 Web UI Certificate: A certificate that requires a DSA (DSS) private key cannot be selected for use as the certificate for Web UI HTTPS connections. 9465 Web UI: If a Health Check that returns both up/down status and a load value returns a ‘down’ status, the previously obtained (and now invalid) load values remain displayed in the Web UI. 9562 Health Check ‘Coalescing’: If 2 non-UDP health checks are identical except for the probe timing parameters, they will coalesce into a single probe. This means that probing might happen at a different interval than expected. Copyright 2015 Coyote Point Systems Inc. A subsidiary of Fortinet, Inc. All Rights Reserved. Page 11 of 14 EQ/OS 10.3.2 Release Notes 9630 18 February 2015 Duplicate Cluster IP Addresses: If more than one cluster is configured with the same IP address (and different ports), then the last cluster IP/port configured on the subnet will take ownership of the address. For example: 1. Create two clusters with the same IP address and different ports. 2. Ping the IP address -- a ping response is received. 3. Disable the first cluster -- the ping will still succeed. 4. Re-enable the first cluster and disable the second -- there is no response to the ping. Copyright 2015 Coyote Point Systems Inc. A subsidiary of Fortinet, Inc. All Rights Reserved. Page 12 of 14 EQ/OS 10.3.2 Release Notes 18 February 2015 Registering Your Product Fortinet customer services (such as firmware updates and technical support) require product registration. Take a moment now to register your product at the Fortinet Customer Service and Support web site: https://support.fortinet.com Before you can register, you will need: 1. Access to a new or existing Support Account. Information on how to create and manage a support account is provided in the Fortinet Support Portal User Guide. If your organization already has an account, obtain the user name and password information from your local account administrator to log in. 2. The serial number of the unit you want to register. You can find this information using either the CLI or the GUI after powering up your appliance: • To use the CLI, log in to the CLI (over the serial console or, if networking is configured, using SSH over an appropriately configured subnet) and enter the following CLI command: eqcli > version Record the System Serial Number from the command output. • If networking is configured and the GUI has been enabled on a subnet., you can also get the serial number from the ‘System Information’ widget on the GUI dashboard. The Dashboard appears automatically when you log into the GUI. Once you have obtained both the login credentials of a support account and the System Serial Number of the unit to register, do the following: 1. Log in to https://support.fortinet.com using the login credentials obtained above. 2. Follow the instructions provided in the Registration Frequently Asked Questions under the heading “How do I register a Fortinet device?”. When requested, enter the System Serial Number you obtained above into the appropriate form. Once registration is completed, the appliance serial number and other information will appear in the FortiCare Registration area. Your system is now registered. If your system can connect to the internet, you can now update the support information displayed in the CLI and GUI by doing one of the following: • In the CLI, enter the following to update the support information on your unit: eqcli > forticare registration Copyright 2015 Coyote Point Systems Inc. A subsidiary of Fortinet, Inc. All Rights Reserved. Page 13 of 14 EQ/OS 10.3.2 Release Notes 18 February 2015 View the updated Support information (including Last refresh date, Support end, and Email) by entering: eqcli > version • In the GUI, select the System configuration tab on the left navigational pane and then click on Global > Dashboard. The System information widget on the right pane will indicate the Support information (including Last refresh date, Support end, and Email). Click on the Refresh button to update the registration information. Note that the registration information does not update automatically in either the CLI or the GUI; you must use either the CLI ‘forticare registration’ command or the Refresh button in the GUI Dashboard’s System Information widget to update. Copyright 2015 Coyote Point Systems Inc. A subsidiary of Fortinet, Inc. All Rights Reserved. Page 14 of 14
© Copyright 2024