Release Notes Threat Management Services zl Module ST.1.2.110427 06-2011

Known Issues

Release ST.1.0.090603

The connection allocation must be deleted and recreated to change the direction.

■ PR_39730 — Using the Authenticated Firewall feature, the TMS zl Module could experience

an httpd crash on malformed RADIUS packets coming from the trusted RADIUS server on

the internal network.

■ PR_40534 — An error message is displayed after applying changes on an attack settings

page. This occurs if the user enables the option Sequence Number Out of range and sets the

ranges with low values, then refreshes the page and clicks the Apply My changes button. The

page loads slowly and the problem appears to be due to clicking the Apply My changes button

while the page is loading.

Example:

1. Go to Firewall > Settings > Attack Settings page

2. Select the option Sequence Number Out of range

3. Set as Range and RST Range the value 10 and check the Drop packets outside the range.

4. Click Apply My Changes button

5. Refresh the page

6. Immediately click again the Apply My Changes button

You now see the error message.

■ PR_40663 — Log entries from the ping-of-death and jolt attacks are missing source and

destination zone information. However, the IP addresses are reported.

time="2009-05-17 16:06:33" severity=major pri=2 fw=ProCurve-TMS-zl-Module

id=fw_l2l3_attack msg="Jolt attack detected" srczone=UNKNOWN_ZONE

src=192.168.70.67 srcport=0 dstzone=UNKNOWN_ZONE dst=192.016870.1 dstport=0

proto=UDP subfamid=dosattack mtype=attack mid=1001

time="2009-05-17 16:06:33" severity=major pri=2 fw=ProCurve-TMS-zl-Module

id=fw_l2l3_attack msg="PingOfDeath attack detected" srczone=UNKNOWN_ZONE

src=192.168.70.67 dstzone=UNKNOWN_ZONE dst=192.168.70.1 proto=ICMP subf-

amid=dosattack mtype=attack mid=1000

■ PR_40664 — Even though ICMP Error and ICMP Replay Message are not enabled in Attack

Protection, the following log entry is still generated.

time="2009-05-17 16:14:42" severity=warning pri=4 fw=ProCurve-TMS-zl-Module

id=fw_l2l3_attack msg="ICMP:Error message not allowed by firewall"

srczone=EXTERNAL src=192.168.80.100 dstzone=INTERNAL dst=192.168.70.100

proto=ICMP icmptype=3 subfamid=icmppacketanomaly mtype=attack mid=648 icmp-

code=1

■ PR_40665 — Some log entries for ALGs show that the max size has been exceed, but the

max size is not defined. For example: