TMS zl Module Release Notes ST.1.2.100916

ManualsBrandsHP ManualsComputer AccessoriesHP ProCurve Switch xl Access Controller Module

Table Of Contents

Release Notes:

Version ST.1.2.100916 Software

for the HP ProCurve Threat Management Services zl Module

These release notes include information on the following:

■ Downloading documentation from the Web (page 1)

■ Downloading and installing software updates (page 2)

■ Special Considerations prior to updating (page 6)

■ Clarifications (page 11)

■ Enhancements (page 16)

■ Software fixes included in release ST.1.2.100916 (page 38)

■ Known Issues (page 41)

Support Notices

Caution

The HP ProCurve Series 5400 zl and 8200zl switches require software version K.13.55 or later to

support the Threat Management Services (TMS) zl Module. To download the latest switch software,

please go to the Software for switches page on the HP ProCurve Web site.

Caution

Before you update software to a new version, ProCurve strongly recommends that you save a copy

of your config file to an external location. See "Backup and Restore System Configuration" in the

Management and Configuration Guide for the HP ProCurve Threat Management Services zl

Module for more information (ProCurve manuals).

Note

HP ProCurve is now a part of HP Networking. As we begin using our new name, you may see

references to our old name and URLs with our old name in the product documentation. We appreciate

your understanding as we make this transition.

Summary of content (106 pages)

PAGE 1
Release Notes: Version ST.1.2.100916 Software for the HP ProCurve Threat Management Services zl Module These release notes include information on the following: ■ Downloading documentation from the Web (page 1) ■ Downloading and installing software updates (page 2) ■ Special Considerations prior to updating (page 6) ■ Clarifications (page 11) ■ Enhancements (page 16) ■ Software fixes included in release ST.1.2.
PAGE 3
Contents Software Management Download Documentation from the Web . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 View or Download the Software Manual Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Software Updates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Software Releases and Support . . . . . . . . . . . . . . . . .
PAGE 4
ST.1.1.100226 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Command Line Interface (CLI) control of VPN functionality . . . . . . . . . . . . . . . . . . . . . . . . 20 RADIUS authentication for management logins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 RADIUS authentication for L2TP users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 5
Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 IPS/IDS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 Monitor Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 High Availability . . . . . . . . . . . . . . . .
PAGE 6
IPS/IDS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94 VPN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94 High Availability (Active/Standby) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95 Monitor Mode Only . . . . . . . . . . . . . . . . . . . .
PAGE 7
Software Management Download Documentation from the Web Software Management Download Documentation from the Web You can download software updates and the corresponding product documentation from the ProCurve Networking Web site as described below. View or Download the Software Manual Set Go to: www.hp.com/go/procurve/manuals You may want to bookmark this Web page for easy access in the future.
PAGE 8
Software Management Software Updates Controller 800, and HP ProCurve DCM Controller. The following hardware mobility products have a one-year hardware warranty with extensions available: HP ProCurve M111 Client Bridge, HP ProCurve MSM3xx-R Access Points, HP ProCurve MSM7xx Mobility and Access Controllers, HP ProCurve RF Manager IDS/IPS Systems, HP ProCurve MSM Power Supplies, HP ProCurve 1 Port Power Injector, and HP ProCurve CNMS Appliances.
PAGE 9
Software Management Software Updates 6. Click Download and install to download the software to the module and install it. Figure 1. A Successful TMS zl Module Software Update Using the Web Browser Interface 7. Wait for this message in the Latest Status field: Success: Image download and install have completed successfully. (see Figure 1). 8. Select the Reboot tab and click the Reboot button to complete the installation.
PAGE 10
Software Management Software Updates 3. Enter the ProductOS context for the TMS zl Module. Syntax: services name tms-module Replace with the letter for the chassis slot in which the module is installed. Example: hostswitch# services c name tms-module OR Syntax: services Replace with the letter for the chassis slot in which the module is installed.
PAGE 11
Software Management Software Updates 2. Initiate a console session with the host switch. 3. Enter the ProductOS context for the TMS zl Module. hostswitch# services c 2 4. Copy the image from the server and install. 5. Reboot the module to complete the update. hostswitch(tms-module-C)# reboot For example, suppose that you copied the image to a TFTP server that has the parameters shown below: 1. • IP address—192.168.1.13 • Filename—ST.1.2.100916.
PAGE 12
Software Management Special Considerations Prior to Updating You can type the first few letters of the directory name, then press the Tab key to complete the name. You might need to add the last few characters of the directory name if the USB drive contains more than one image. 9. Update the software. For example, if the new image directory is ST.1.2.100916, you would type: hostswitch(services-module-C:HD)# update product ST.1.2.100916 Again, you can use tab completion for the file name. 10.
PAGE 13
Software Management Special Considerations Prior to Updating March 2010 Version, ST.1.1.100330 Environments that should update: ■ TMS zl Modules that are running below 75% CPU utilization1 regardless of configuration OR ■ TMS zl Modules that are encountering stability or reliability issues Environments that should not update ■ TMS zl Modules that are running above 75% CPU utilization1 regardless of configuration. 1.
PAGE 14
Software Management Special Considerations Prior to Updating GRE Tunnels When updating to ST.1.1.100430 from ST.1.0.0901213 or ST.1.0.090603, any configured GRE tunnels will go down and not pass traffic until an additional configuration item, the tunnel peer IP address, is entered. Prior to updating, please schedule the appropriate downtime for these GRE tunnels, as well as document the tunnel peer IP address for each end of the tunnel, so that the re-configuration process goes smoothly.
PAGE 15
Software Management Special Considerations Prior to Updating After updating to ST.1.1.100430 from ST.1.0.0901213 or ST.1.0.090603, the traffic selectors are migrated but the GRE tunnel is down.
PAGE 16
Software Management Special Considerations Prior to Updating The administrator will have to manually enter the Tunnel Peer IP address to get the GRE tunnel back up. Once the GRE tunnel is back up, the administrator can take advantage of new GRE features available with release ST.1.1.
PAGE 17
Software Management Clarifications Clarifications HP Security Policy and Release Notes Per HP policy, a Security Bulletin must be the first published notification of a security defect. Fixes to security defects are not documented in release notes, also by HP policy. The official communication for security defect fixes will always be through HP Security Bulletins. For more information on security bulletins, and information on how to subscribe to them, please see the www.procurve.
PAGE 18
Software Management Clarifications IAS RADIUS Configuration - Special Steps If you use the IAS wizard, you need to remove the port-type attribute after a remote access policy is configured. The following screens show the process for removing this attribute. First, right-click the policy and choose to view its properties.
PAGE 19
Software Management Clarifications The condition NAS-Port-Type matches ’Virtual [VPN]’ AND, was automatically configured by the wizard, but it is not supported by the TMS zl Module. It must be removed. Highlight this port attribute policy and click Remove. After removing the unsupported port attribute condition, the policy is shown below.
PAGE 20
Software Management Clarifications For more information, the updated Management and Configuration Guide for the HP ProCurve Threat Management Services zl Module on the ProCurve Web site contains an example of setting up a custom policy using the wizard. This example shows the attributes that the TMS zl Module supports. Any non-supported policy attributes must be removed before a policy can be used with the TMS zl Module. Application Layer Gateways (ALGs) If you upgrade from ST.1.0 to ST.1.
PAGE 21
Software Management Clarifications 15
PAGE 22
Software Management Enhancements Enhancements Enhancements in ST.1.2.100916 The following enhancements were added in this update. Firewall Throughput Firewall throughput increased from 3.0 Gbps up to 5.0 Gbps (performance may vary depending on network traffic and environment). System Utilization Graphs The dashboard has been enhanced to add System Utilization Graphs.
PAGE 23
Software Management Enhancements Updated VPN Client Support White papers are being developed to help configure and deploy TMS VPN solutions and will be posted here when available: http://h10144.www1.hp.com/library/whitepapers.aspx IPsec Tunneling: 4800 Connections ProCurve VPN client on Windows XP Shrew Soft VPN client 2.1.6* IPSecuritas v3.4 on MacOS Openswan v2.X on Red Hat and SuSE.
PAGE 24
Software Management Enhancements The IPS engine qualifies traffic as client initiated or server initiated. You can independently set the inspection depth values, in bytes, for client-to-server and server-to-client traffic. This means that you can tune the IPS inspection depth to values desirable to your deployment. For example, if your environment warranted greater scrutiny to be applied to client initiated traffic, you could set a larger inspection depth value for client-to-server traffic.
PAGE 25
Software Management Enhancements • Enabling/disabling ICMP message handling settings • Modifying SCEP server information • Importing certificate keys ST.1.1.100430 The following enhancements were added in this update. Log Threshold Monitoring This feature evaluates the logging engine's resource consumption on the TMS zl Module.
PAGE 26
Software Management Enhancements IPS Protection Levels The Intrusion Prevention>Signatures>View screen contains a new field, Protection:, where filters are provided to select for viewing IDS/IPS Signatures based on the protection they provide. The filter choices are illustrated below. Please see the updated Management and Configuration Guide for the HP ProCurve Threat Management Services zl Module on the ProCurve Web site for details on how to configure and use this new feature.
PAGE 27
Software Management Enhancements RADIUS authentication for management logins Please see the updated Management and Configuration Guide for the HP ProCurve Threat Management Services zl Module on the ProCurve Web site for details on how to configure and use this new feature. RADIUS authentication for L2TP users Please see the updated Management and Configuration Guide for the HP ProCurve Threat Management Services zl Module on the ProCurve Web site for details on how to configure and use this new feature.
PAGE 28
Software Fixes in Releases ST.1.0.090213 - ST.1.2.100916 Release ST.1.0.090213 Software Fixes in Releases ST.1.0.090213 - ST.1.2.100916 Software fixes are listed in chronological order, oldest to newest. Unless otherwise noted, each new release includes the software fixes added in all previous releases. Release ST.1.0.090213 was the first production software release for the HP ProCurve Threat Management Services zl Module. Release ST.1.0.090213 No problems resolved in release ST.1.0.090213.
PAGE 29
Software Fixes in Releases ST.1.0.090213 - ST.1.2.100916 Release ST.1.0.090603 ■ PR_17313 — For a VLAN association, the user can specify DHCP as a method for getting an IP address for the TMS zl Module. If the user goes in and edits the VLAN association and changes the IP address method to a Static IP address, the DHCP client process still runs in the background and can overwrite the static IP address.
PAGE 30
Software Fixes in Releases ST.1.0.090213 - ST.1.2.100916 Release ST.1.0.090603 time="2009-03-30 09:17:09" severity=critical pri=1 fw=ProCurve-TMS-zl-Module id=fw_l2l3_attack msg="FW: packet with invalid tcp flags found, packets dropped" srczone=INTERNAL src=192.168.0.134 srcport=18155 dstzone=EXTERNAL dst=192.168.1.128 dstport=80 proto=TCP subfamid=packetheaderanomaly mtype=attack mid=625 The log messages are no longer logged as critical.
PAGE 31
Software Fixes in Releases ST.1.0.090213 - ST.1.2.100916 Release ST.1.0.090603 ■ PR_38564 — The log message with the message ID of 648 is marked as critical should not be. time="2009-04-01 11:41:59" severity=critical pri=1 fw=ProCurve-TMS-zl-Module id=fw_l2l3_attack msg="ICMP:Error message not allowed by firewall" srczone=INTERNAL src=192.168.0.1 dstzone=EXTERNAL dst=192.168.1.
PAGE 32
Software Fixes in Releases ST.1.0.090213 - ST.1.2.100916 Release ST.1.0.090603 time="2009-04-15 10:20:00" severity=critical pri=1 fw=ProCurve-TMS-zl-Module id=fw_l2l3_attack msg="FW: icmp header is less than expected, packets dropped" srczone=EXTERNAL src=192.168.80.5 dstzone=SELF dst=192.168.80.
PAGE 33
Software Fixes in Releases ST.1.0.090213 - ST.1.2.100916 Release ST.1.0.090603 ■ PR_18204 — If you filter signatures by severity, then disable a family of signatures, the expected result is that all displayed signatures in that family will be disabled. However, the actual result is that only some of the signatures displayed get disabled. This can be observed by viewing info signatures, then disabling the XSS family. When the operation completes, refresh the page, and view info signatures.
PAGE 34
Software Fixes in Releases ST.1.0.090213 - ST.1.2.100916 Release ST.1.0.090603 time="2009-03-19 02:01:49" severity=critical pri=1 fw=ProCurve-TMS-zl-Module id=ips_attack_family rule=3189 msg="IPS detection: Allow: BackDoor Digital Root Beer" src=192.168.1.20 srcport=1050 dst=192.168.3.
PAGE 35
Software Fixes in Releases ST.1.0.090213 - ST.1.2.100916 Release ST.1.0.090603 ■ PR_38217 — When setting up an IPsec policy with a Key Exchange of Manual, it was possible to specify an SPI number that was already in use by another IPsec policy and it would not be detected. Duplicate SPI numbers across IPsec policies are not allowed and an error needs to be displayed.
PAGE 36
Software Fixes in Releases ST.1.0.090213 - ST.1.2.100916 Release ST.1.1.100226 Release ST.1.1.100226 The following problems were resolved in release ST.1.1.100226 General ■ PR_813 — Web browser interface does not function without JavaScript enabled and does not notify user that JavaScript is required. ■ PR_961 — The initial login banner text of the Web browser interface in the TMS zl Module differs in size depending on whether the user is accessing it with HTTP or HTTPS.
PAGE 37
Software Fixes in Releases ST.1.0.090213 - ST.1.2.100916 Release ST.1.1.100226 ■ PR_11856 — When using the Web browser interface, an error message is displayed when a valid IP Address is trying to be set in some pages, such as RADIUS, IPsec Policies, and so forth. For example, this may occur when an otherwise valid IP address is added with a final space at the end. ■ PR_12802 — When adding an NSSA or STUB area to the OSPF configuration, leading zeros in the area ID are flagged as an error.
PAGE 38
Software Fixes in Releases ST.1.0.090213 - ST.1.2.100916 Release ST.1.1.100226 ■ PR_18145 — In the Web browser interface, if a VLAN is added with an invalid IP address in the range 224.0.0.0 -254.255.255.255, an error is returned stating: VLAN could not be added. Failed to add VLAN IP address. but the VLAN is actually added, but not associated to any zone. In the CLI, the error message only states: Error: Failed to set VLAN IP address. ■ PR_37988 — Upgrading to an ST.1.1.XXXXXX release from any ST.1.0.
PAGE 39
Software Fixes in Releases ST.1.0.090213 - ST.1.2.100916 Release ST.1.1.100226 Monitor Mode ■ PR_17758 — In monitor mode, when IPS full inspection is turned on and the FTP ALG is turned off, sending an FTP copy of the startup configuration to the network fails with a broken pipe error. High Availability ■ PR_8325 / PR_14916 — When configured for High Availability, the Rebalance button in the Web browser interface is not needed for an Active/Standby configuration.
PAGE 40
Software Fixes in Releases ST.1.0.090213 - ST.1.2.100916 Release ST.1.1.100226 ■ PR_40301 — GRE Tunnel displayed GREv2 Error in tcpdump when attempting to verify the connectivity with a ping packet. ■ PR_40313 — When adding a RADIUS server, the administrator can specify a NAS-ID that accepts a script as input allowing code injection to RADIUS Web interface page. ■ PR_40319 — In the log file, log entries with the following message IDs may truncate the username: 1213, 1214, and 1204.
PAGE 41
Software Fixes in Releases ST.1.0.090213 - ST.1.2.100916 Release ST.1.1.100330 ■ PR_51483 — Enabling IP compression and disabling fragmentation causes a TMS crash in Site-to-Site VPNs. Steps: 1. Configured site-site VPN tunnel with one host each end HOST1(10.11.0.10)-----TMS1----(VPN)----TMS2----HOST2(10.13.0.10) 2. Host2 sends a large ping using: ping 10.11.0.10 -s 64000. TMS2 works fine, TMS1 fails.
PAGE 42
Software Fixes in Releases ST.1.0.090213 - ST.1.2.100916 Release ST.1.1.100430 ■ PR_49894 — TMS zl Module Web browser interface performance Related HA + IPS issue scheduled to be addressed in May-June 2010 release. Should not affect users with < 75% CPU utilization. ■ PR_50615 — Unable to monitor RAM and CPU performance via SNMP.
PAGE 43
Software Fixes in Releases ST.1.0.090213 - ST.1.2.100916 Release ST.1.1.100430 ■ PR_43869 — When a Zone is renamed, the new Zone name does not show up in log files. ■ PR_46963 — When rate limit reaches the limit defined per policy, a log message is generated for every packet drop. ■ PR_50209 — Log messages with mid=615, 1350, 1355, 624, 621, 605 are not critical but classified as critical.
PAGE 44
Software Fixes in Releases ST.1.0.090213 - ST.1.2.100916 Release ST.1.2.100916 ■ PR_ 52119 — A DSA generated CA certificate does not show on the Web browser interface or CLI after the certificate is imported, while an RSA generated CA certificate will display okay. After importing the CA certificate on the Web browser interface (VPN> certificates> certificate authorities > import certificate), the CA display is empty.
PAGE 45
Software Fixes in Releases ST.1.0.090213 - ST.1.2.100916 Release ST.1.2.100916 ■ 1. Client 1 establishes L2TP over IPsec to TMS. The NAT router translates all outgoing connections to its external IP. However, NAT router cannot modify the L2TP port which is encrypted by IPsec. 2. When Client 2 establishes an L2TP over IPsec to the TMS, the NAT router translates all outgoing connections to its external IP but it cannot modify the L2TP port again.
PAGE 46
Software Fixes in Releases ST.1.0.090213 - ST.1.2.100916 Release ST.1.2.100916 WARNING: You are attempting to save the running configuration on an HA Participant device. This action can disrupt the configuration of the HA cluster and can prevent proper synchronization of the cluster configuration. This action is not recommended.
PAGE 47
Known Issues Release ST.1.2.100916 Known Issues Known issues fixed in a later software release are indicated using the following format: ■ PR_xxxxxxxxxx — To confirm what release fixed the issue, use the issue number to search the PDF file. Known issues that are open as of the latest software release appear as follows: ■ PR_xxxxxxxxxx — Release ST.1.2.100916 The following problems are known issues as of release ST.1.2.100916.
PAGE 48
Known Issues Release ST.1.2.100916 ICMP Error Message. ICMPMessage Type 3 and Code 1 are not allowedseverity: infoid: configdst: 10.1.10.10proto: ICMPicmptype: 3adminname: sipsubfamid: ipsecv4payloadprocessingmtype: ipsecv6mid: 306569icmpcode: 1 ■ PR_60506 — An erroneous log message displayed showing application connect failed but with no details.
PAGE 49
Known Issues Release ST.1.2.100916 ■ PR_60478 — A VPN log message incorrectly shows up in monitor mode. Example: date: 2010-08-03 time: 09:55:05 msg: VPN global configuration updated adminname: root severity: warning id: vpn_ipseccommon src: 0.0.0.0 srcport: 0 dst: 0.0.0.
PAGE 50
Known Issues Release ST.1.2.100916 Unfortunately, when the previous master is in the middle of shutting down itself, it issues erroneous Gratuitous ARP requests for the previous management IP address which updates the ARP cache on machines local to that subnet. This update has the affect of directing the management IP communication to a device that cannot handle the communication.
PAGE 51
Known Issues Release ST.1.1.100430 From the Windows system, the VPN client just returns an error message saying that the connection was interrupted. ■ PR_63072 — RADIUS error messages generated on successful authentication for Windows 7 L2TP/IPsec VPN user. In this particular scenario, the client was sending the machine-name first, prior to sending the username. The username was configured for access but the machine-name was not. As a result, log messages showing the machine-name failures were recorded.
PAGE 52
Known Issues Release ST.1.1.100430 time="2009-07-08 19:39:33" severity=warning pri=5 fw=ProCurve-TMS-zl-Module id=fw_access_control ruleid=10 msg="FW: tcp sequence number translation failed, packets dropped" srczone=INTERNAL src=192.168.80.2 dstzone=INTERNAL dst=192.168.70.2 proto=ICMP rcvd=0 rcvdsc=0 sent=36 sentsc=0 srcnatport=0 destnatport=0 destnatipaddr=0.0.0.0 subfamid=accessdeny mtype=access_control mid=617 srcnatipaddr=0.0.0.
PAGE 53
Known Issues Release ST.1.1.100430 ■ PR_55506 — When an invalid protocol number is specified for an access policy, the error message gives a valid range as 0 to 255 when the correct range is 1 to 255. ■ PR_55698 — In the command line interface, the command show connections will truncate the word "Other". ■ PR_54075 — When Firewall policies are moved in order (priority), current active sessions are re-evaluated against the new priority. However, some data associated with the policy is not updated.
PAGE 54
Known Issues Release ST.1.1.100430 Monitor Mode ■ PR_54944 — An invalid critical log message can be generated in monitor mode with no message content. The message id is 337. ■ PR_56203 — In Monitor Mode, the log messages with identifiers 100000 and 99999 are missing content, date, and time.
PAGE 55
Known Issues Release ST.1.1.100430 ■ PR_54897 — If a VLAN is configured with DHCP and the lease expires, if master gets a different IP address from the DHCP server, the IP address does not get synced to participant. When the participant takes over after a failover, it will use the old IP address. ■ PR_56234 — The proper order to break up a High-Availability Active/Standby Cluster is to do the following via the switch Command Line Interface (CLI) For ST.1.0.
PAGE 56
Known Issues Release ST.1.1.100430 ■ PR_55116 — Shrew Soft VPN client cannot establish the tunnel when RSA is being used for IPsec authentication. ■ PR_55129 — Shrew Soft VPN client can establish the tunnel 'Enable extended sequence number' option is selected, but no traffic flows. ■ PR_55485 — There have been extremely rare occurrences where after an upgrade and subsequent reboot, a GRE tunnel could come back with a large value for number of days up (for example, 14715).
PAGE 57
Known Issues Release ST.1.1.100430 ■ PR_55807 — The TMS allows user groups to be removed even when there are L2TP users and access-policies associated to it. There should be a warning explaining that removing the group will leave the L2TP user unable to access resources and that any access-policy associated to the group will be deleted as well. ■ PR_55809 — The TMS, for a site to site IKEv1 policy, the remote gateway accepts invalid IP address.
PAGE 58
Known Issues Release ST.1.1.100430 ■ PR_54222 — A terse error message is seen when doing a 'show l2tp user' command and the user is not defined. Example: ProCurve Switch 8212zl(tms-module-D)# show l2tp user a Software Revision : ST.1.1.100430 Error: DIM : No DiUsers Present ■ PR_54403 — An invalid username for L2TP shows an error message indicating the policy name instead. Example: ProCurve Switch 8212zl(tms-module-D:config)# l2tp user aaaaaaaaaaaaaaaaaaaaaaaaaaaaa Error: Policy name is too long.
PAGE 59
Known Issues Release ST.1.1.100226/ST.1.1.100330 Release ST.1.1.100226/ST.1.1.100330 The following problems are known issues as of release ST.1.1.100226. General ■ PR_9285 / PR_9286 — For RIP, there are some minor issues when interoperating between RIP version 1 and RIP version 2 on the switch. As a general recommendation when using a TMS zl Module, always standardize on RIP version 1 or RIP version 2, with RIP version 2 preferred.
PAGE 60
Known Issues Release ST.1.1.100226/ST.1.1.100330 ■ PR_42753 — In the TMS zl Module CLI, the show ip command's output has domain misspelled as Dommain. ■ PR_42760 — The TMS zl Module SNMPv3 server only supports security level authPriv for SNMPv3 users. ■ PR_42887 — Changing the hostname in the Web browser interface does not change the hostname in the CLI immediately. A current user of the CLI must logout and log back in again to see the change reflected in the prompt.
PAGE 61
Known Issues Release ST.1.1.100226/ST.1.1.100330 ■ PR_44788 — When trying to add an IP route via the CLI, an error is shown without any error message. This situation happens when there are two CLI sessions and when one CLI session does a show ip route, and then the other CLI session tries to add a route. ProCurve Switch 5406zl(tms-module-C)# 10.10.10.254 ip route 192.168.3.27 255.255.255.
PAGE 62
Known Issues Release ST.1.1.100226/ST.1.1.100330 8. In the destination field, specify a Unicast IP address. Unicast IP address in the destination field should cause an error message. Instead, no error message is displayed and the incorrect IP address is accepted. ■ PR_45671 — In the Web browser interface, Firewall>Access Policies>Addresses, duplicate Network (IP/mask) entries can be added for a given name. For instance, 10.10.10.0/24, 10.10.20.0/24, 10.10.10.0/24 could be added under a given name.
PAGE 63
Known Issues Release ST.1.1.100226/ST.1.1.100330 3. Add a Source NAT policy (e.g., NAT from Zone1 >External Services FTP, HTTP,SSH; Source Any, dst 10.10.100.1-10-10.100.20 NAT value 10.10.100.111) 4. Open FTP server or any of the basic services 5. Verify IP address gets translated on the destination zone 6. Send ICMP traffic 7. Verify IP address gets translated on the destination zone when it should not be.
PAGE 64
Known Issues Release ST.1.1.100226/ST.1.1.100330 ■ PR_ 52440 — Performance Related IPS issue - scheduled to be addressed in May-June 2010 release. Should not affect users with < 75% CPU utilization. ■ PR_52604 — In the Web browser interface the Dashboard has a field for Chassis Name but never displays anything. In the TMS zl Module CLI, the command show system-information also shows a field for Chassis Name but doesn't display any value for it.
PAGE 65
Known Issues Release ST.1.1.100226/ST.1.1.100330 ■ PR_15088 — The connection for DNS will have a high timeout value in some circumstances when a customer uses a DNS address object and performs a modification to the address object content. Customer will see a high timeout when doing show connections and can use the no connections command to remove any problematic sessions. ■ PR_15293 — A lot of firewall logs are generated for normal management activities.
PAGE 66
Known Issues Release ST.1.1.100226/ST.1.1.100330 ■ PR_42210 — The local users cannot login to the TMS zl Module Web browser interface via HTTP. Steps: 1. Open the browser and connect to TMS zl Module Web browser interface via http. 2. Set the local user's name into the User name text field. 3. Set the local user's password into the Password text field. 4. Press the Login button. The logon fails; the TMS zl Module Web browser interface displays Invalid Login!.
PAGE 67
Known Issues Release ST.1.1.100226/ST.1.1.100330 DMZ maps to the name in the 4th row of the Zone table (4). ZONE1 maps to the name in the 5th row of the Zone table (5). ZONE2 maps to the name in the 6th row of the Zone table (6). ZONE3 maps to the name in the 7th row of the Zone table (7). ZONE4 maps to the name in the 8th row of the Zone table (8). ZONE5 maps to the name in the 9th row of the Zone table (9). ZONE6 maps to the name in the 10th row of the Zone table (10).
PAGE 68
Known Issues Release ST.1.1.100226/ST.1.1.100330 msg: IP header checksum failed msg: FW: gre packet header length is less than expected, packets dropped msg: MCAST: icmp packet type is unknown, packets dropped ■ PR_50433 — When DHCP is used as the IP address acquisition method for VLANs, the TMS zl Module can take a long time to reboot as it has to acquire an IP address for each VLAN serially.
PAGE 69
Known Issues Release ST.1.1.100226/ST.1.1.100330 Monitor Mode ■ PR_42670 — Firewall Logs are shown for broadcast packets in monitor mode. time="2009-07-08 19:36:37" severity=warning pri=5 fw=ProCurve-TMS-zl-Module id=fw_access_control ruleid=0 msg="FW: no access policy found, packets dropped" srczone=ZONE6 src=10.255.134.37 srcport=137 dstzone=ZONE6 dst=10.255.135.255 dstport=137 proto=UDP rcvd=0 rcvdsc=0 sent=0 sentsc=0 srcnatport=0 destnatport=0 destnatipaddr=0.0.0.
PAGE 70
Known Issues Release ST.1.1.100226/ST.1.1.100330 ■ PR_46778 — High Availability cannot be disabled without serious service disruption and loss of connectivity. When high availability is disabled, the following message is displayed: ProCurve Switch 5406zl(tms-module-C:config)# no high-availability Shutting down HA will remove the IP addresses of the TMS VLANs, and any remote connections to the TMS zl Module will be lost.
PAGE 71
Known Issues Release ST.1.1.100226/ST.1.1.100330 Success: HA IP Address set to: 172.16.100.100 255.255.255.0 ProCurve 5406zl(tms-module-C:config)#exit ProCurve 5406zl(tms-module-C)#write memory ProCurve 5406zl(tms-module-C)#boot Device will be rebooted, do you want to continue [y/n]? y At this point, the TMS product will initialize the VLANs correctly and new VLANs can be added. VPN ■ PR_40382 — Importing a CRL file which does not contain the 'nextUpdate' field is not successful.
PAGE 72
Known Issues Release ST.1.1.100226/ST.1.1.100330 ■ PR_44478 — TMS zl Module does not support CRL retrieval via HTTP, LDAP, or OCSP. ■ PR_44479 — TMS zl Module will use the old CRL past the next CRL update time if it has not retrieved the new CRL. ■ PR_44555 — When checking the IKE SA status on the Web browser interface, the SA lifetime value is not automatically updated. For example, if a user clicks on View Status several times, the SA lifetime remains the same and is not updated.
PAGE 73
Known Issues Release ST.1.1.100226/ST.1.1.100330 2. Click on Add a policy 3. On the source field, go to Options button and select Enter custom IP,IP/mask or IP-Range and enter a non-multicast IP address. 4. On the destination field, go to Options button and select Enter custom IP,IP/mask or IP-Range and enter a multicast IP address. 5. Before you click on Apply button and Close button, make sure you make a note of what zones you picked for the policy. 6. Click on Apply button. 7.
PAGE 74
Known Issues Release ST.1.1.100226/ST.1.1.100330 ■ PR_48372 — VPN traffic can be denied without a proper log message. Unfortunately, the log messages are confusing: time="2009-11-18 18:22:36" severity=warning pri=5 fw=ProCurve-TMS-zl-Module id=fw_access_control ruleid=125 msg="FW: VPN inbound processing deny, packets dropped" srczone=EXTERNAL src=10.60.0.10 srcport=60 dstzone=INTERNAL dst=10.50.0.
PAGE 75
Known Issues Release ST.1.0.090603 ■ PR_51945 — VPN Site to Site: Traffic is not passing through when enabling or disabling the VLAN to have a unique MAC or not to have a unique MAC. Workaround: 1. Delete all of the static routes associated with the VLAN using CLI "no ip route .... " (faster method) or the Web browser interface (slower method) 2. Add back the static routes again using CLI "ip route ..." (faster method) or the Web browser interface (slower method).
PAGE 76
Known Issues Release ST.1.0.090603 When the TMS zl Module is running ST.1.0.090213, the following behavior is observed: The output of the switch CLI command, show services detail, and the output of the TMS zl Module CLI command, show version, are both correct. After the TMS zl Module has been updated to ST.1.0.
PAGE 77
Known Issues Release ST.1.0.090603 3. Select the View Log tab. 4. Open a tool that allows to connect via SSH to the TMS zl Module. 5. Try to login to the TMS with an invalid user. 6. The following log entries are displayed: time="2009-03-20 17:14:30" severity=warning pri=4 fw=ProCurve-TMS-zl-Module id=ssh msg="Failed password for invalid user one from 192.168.8.
PAGE 78
Known Issues Release ST.1.0.090603 3. Go to the logging section. 4. Select the View Log tab. 5. Search for the log entry generated when logging in as Local user previously created. 6. The following log entry is displayed: time="2009-03-24 17:00:02" severity=warning pri=4 fw=ProCurve-TMS-zl-Module id=user_statistics msg="Radius authentication failed" srczone=SELF dstzone=SELF logintime=0 logouttime=0 useripaddr=0.0.0.
PAGE 79
Known Issues Release ST.1.0.090603 Routes in R1 when VLAN300 has v2 enabled in TMS zl Module Destination Gateway Metric Distance VLAN Type 10.10.30.0/24 192.168.3.254 3 100 vlan300 rip 10.10.40.0/24 192.168.3.254 3 100 vlan300 rip 192.168.1.0/24 192.168.3.254 3 100 vlan300 rip 192.168.2.0/24 192.168.2.250 1 0 vlan200 connected 192.168.3.0/24 192.168.3.250 1 0 vlan300 connected 192.168.5.0/24 192.168.3.254 3 100 vlan300 rip 192.168.11.0/24 192.168.11.
PAGE 80
Known Issues Release ST.1.0.090603 3. Press the tab key. end exit logout show Return to the Manager Exec context. Return to the previous context or terminate session. Terminate current session. Display TMS device operation information. The rp-address should be listed in PIM context. ■ PR_38778 — Learned RP are deleted when setting a static RP from the TMS module. Example: 1. Open CLI session 2.
PAGE 81
Known Issues Release ST.1.0.090603 ■ PR_38849 — A incorrect log entry is generated when logging in with a user authenticated by a RADIUS server: 1. Open the TMS zl Module Web browser interface. 2. Login as correctly a user associated with a RADIUS user previously created (i.e. user1@tms.local) 3. Click the log out button 4. Log in as Manager 5. Go to the logging section 6. Select the View Log tab 7.
PAGE 82
Known Issues Release ST.1.0.090603 ■ PR_40292 — When a user has a local account on the TMS zl Module and has an account with the same name on the RADIUS server, the user will always be authenticated to the local account and no attempt is made to access the RADIUS server, even if the user name includes the realm, as in username@domain. ■ PR_40313 — When adding a RADIUS server, the administrator can specify a NAS-ID that accepts a script as input allowing code injection to RADIUS Web interface page.
PAGE 83
Known Issues Release ST.1.0.090603 time="2009-05-08 22:03:53" severity=critical pri=1 fw=ProCurve-TMS-zl-Module id=fw_l2l3_attack msg="FW: protocol value is not set, packets dropped" srczone=EXTERNAL src=192.168.70.100 srcport=0 dstzone=INTERNAL dst=192.168.70.100 dstport=0 proto=0 subfamid=protocolanomaly mtype=attack mid=659 ■ PR_40662 — Log entries with mid=681 and mid=611 are marked as critical when they should not be considered critical.
PAGE 84
Known Issues Release ST.1.0.090603 The connection allocation must be deleted and recreated to change the direction. ■ PR_39730 — Using the Authenticated Firewall feature, the TMS zl Module could experience an httpd crash on malformed RADIUS packets coming from the trusted RADIUS server on the internal network. ■ PR_40534 — An error message is displayed after applying changes on an attack settings page.
PAGE 85
Known Issues Release ST.1.0.090603 time="2009-05-17 16:17:20" severity=warning pri=4 fw=ProCurve-TMS-zl-Module id=fw_l2l3_attack msg="IRC:Size of Message is more than MAX_IRCSIZE" srczone=INTERNAL src=192.168.80.100 srcport=39489 dstzone=EXTERNAL dst=192.168.70.100 dstport=6667 proto=TCP subfamid=intergritycheck mtype=attack mid=118 time="2009-05-17 16:11:58" severity=warning pri=4 fw=ProCurve-TMS-zl-Module id=fw_l2l3_attack msg="TFTP-ALG: Request size length exceeded Max size...
PAGE 86
Known Issues Release ST.1.0.090603 High Availability (HA) ■ PR_38143 — A better description should be added to the log message when the Participant leaves the Active-Standby configuration. The current message is as follows: 19:11:44" severity=info pri=6 fw=POSTMR id=hacl_vsrp msg="Detected device down" proto=VRRP masterid=2 vsrpstate="MASTER" clusterstatus="Disabled" mgmt_ipaddress="10.10.10.
PAGE 87
Known Issues Release ST.1.0.090213 time="2009-04-15 16:14:04" severity=warning pri=4 fw=ProCurve-TMS-zl-Module id=fw_l2l3_attack msg="TCP: invalid ACK packet, packets dropped" srczone=INTERNAL src=192.168.80.5 srcport=60290 dstzone=INTERNAL dst=192.168.80.
PAGE 88
Known Issues Release ST.1.0.090213 ■ PR_961 — The initial login banner text of the Web browser interface in the TMS zl Module differs in size depending on whether the user is accessing it with HTTP or HTTPS. While noticeable, this difference in size does not impair functionality. ■ PR_1044 — From the TMS zl Module CLI, when a TMS zl Module is operating in Routing Mode using OSPF, the command show ip ospf neighbor has an output that is not the same as a ProCurve switch that is running OSPF.
PAGE 89
Known Issues Release ST.1.0.090213 ■ PR_4577 — When the CLI command show logging local is used with paging disabled, extra blank lines are seen. These blank lines should be ignored. ■ PR_4766 — When there are multiple syslog servers on the same IP address, differing by facility or port, the user is unable to delete the specific entry in question because only the syslog IP address is used for removing a syslog server.
PAGE 90
Known Issues Release ST.1.0.090213 ■ PR_7723 — In the TMS zl Module CLI, an error message should be displayed and the entry rejected when an invalid mask value is used for IP Address/Mask when specifying an IP address for a VLAN. The user must carefully validate their input. In the following example the incorrect mask value may result in the wrong subnet mask being used: ProCurve Switch(tms-module-D:config)# vlan 1 ip address 192.168.11.25/2254 Success: Set VLAN 1 IP address to: 192.168.11.25 255.255.252.
PAGE 91
Known Issues Release ST.1.0.090213 ■ PR_8428 — Multicast routing is enabled after adding or editing multicast on a VLAN and refreshing the screen. If multicast routing is going to be configured and disabled until a later time, the user should always disable multicast routing as the last step, after configuring VLAN Settings. Example: 1. Launch the TMS zl Module’s Web browser interface. 2. Go to the Network section. 3. Select the Routing. 4. Go to the Multicast tab. 5.
PAGE 92
Known Issues Release ST.1.0.090213 • Invalidly fragmented UDP packets The TMS zl Module only detects invalidly fragmented UDP packets and generates a log with mid=1001 with msg="Jolt attack detected". This log message should identify jolt2. The TMS zl Module does not detect the following: • Jolt- which sends very large fragmented ICMP packets to a target machine.
PAGE 93
Known Issues Release ST.1.0.090213 10. Again add VLAN 40 to the VLAN Association page. Actual Result: VLAN 40 is displayed on OSPF and Multicast pages. Expected Result: VLAN 40 should only be displayed on the VLAN Associations page. ■ ■ PR_11856 — When using the Web browser interface, an error message is displayed when a valid IP Address is trying to be set in some pages, such as RADIUS, IPsec Policies, and so forth.
PAGE 94
Known Issues Release ST.1.0.090213 session to be deleted. If IPS is enabled, the TMS zl Module will forward the RST packet to IPS. After IPS finishes processing the packet, the TMS zl Module gets the RST packet. Since TMS zl Module has already marked the session to be deleted and the RST timeout value is 0, the RST packet is not forwarded to the peer and is dropped. The problem only happens for RST packets. By setting the RST timeout value to something other than zero, this issue can be avoided.
PAGE 95
Known Issues Release ST.1.0.090213 ■ PR_13560 — When a user is in a TMS zl Module CLI session and they copy the startup-config file to an FTP server when the ALG for FTP is disabled, the copy command appears to hang. After about 60 seconds, the copy command will timeout and the user session can be recovered. Example: 1. Open a TMS zl Module CLI session. 2. Disable alg ftpv4 ProCurve Switch (tms-module-D:config)# no alg ftpv4 3.
PAGE 96
Known Issues Release ST.1.0.090213 ■ PR_14823 — When adding a VLAN to a zone, the log displays two entries with the exact same message, but containing a different priority. The message describes the routing interface coming up. For example, if VLAN 50 is added to a zone, the following two log messages are created: time="2008-12-12 13:14:24" severity=warning pri=4 fw=ProCurve-TMS-zl-Module id=routing msg="if_rtup: UP route for interface vlan50 10.10.10.1/255.255.
PAGE 97
Known Issues Release ST.1.0.090213 4. Run the command ProCurve Switch (tms-module-D:config)# show connection-settings timeout The protocol and the port number of the custom connection timeout should be updated, but they are not. ■ PR_15462 — The VLAN name is not checked for special characters. If a VLAN name is created with special characters, when the VLAN name is displayed in the Web browser interface, problems can occur in the display of the VLAN name.
PAGE 98
Known Issues Release ST.1.0.090213 2. ■ Either export the local log or, in the Web browser interface, set the number of entries per page to 500 and go to page 6. PR_18145 — In the Web browser interface, if a VLAN is added with an invalid IP address in the range 224.0.0.0 - 254.255.255.255, an error is returned stating: VLAN could not be added. Failed to add VLAN IP address, but the VLAN is actually added, but not associated to any zone.
PAGE 99
Known Issues Release ST.1.0.090213 4. Click the Apply button. Expected result: The access policy should be added in the first position. Actual Result: An error message is displayed but the policy is added. ■ PR_8074 — When a new named object (for example, an Address Object, Service Object, and so on) is added, a log entry is generated referring to an IPDB record modified. This simply means that the IP database that keeps track of these things was modified.
PAGE 100
Known Issues Release ST.1.0.090213 ■ PR_12598 — In the Web browser interface, address objects and address groups can be added using the same name. This results in ambiguity when adding an access policy. To prevent such ambiguity, make sure address objects and address groups have unique names. Service objects and service groups also should have unique names.
PAGE 101
Known Issues Release ST.1.0.090213 ■ PR_38217 — When setting up an IPsec policy with a Key Exchange of Manual, it is possible to specify an SPI number that is already in use by another IPsec policy and it would not be detected. Duplicate SPI numbers across IPsec policies are not allowed and an error needs to be displayed. ■ PR_38218 — Cannot change a bypass or ignore policy to apply with key exchange method manual. Workaround: Delete the policy and add a new one.
PAGE 102
Known Issues Release ST.1.0.090213 1. Open the switch management Web browser interface 2. Select the Configuration tab 3. In the Device View page in the Switch Web browser interface press the Details link on the TMS Zl Module. Expected Results: the link should direct the user to the management IP address. Actual Results: the link directs the user to the High Availability IP address.
PAGE 103
Known Issues Release ST.1.0.090213 In the output, the Last Signature Download field appears as None even though the signatures were synchronized. ■ PR_14823/14916 — When using the TMS zl Module CLI, the high-availability command lists a rebalance option that is not valid for Active/Standby mode. In the Web browser interface for High Availability, a rebalance button is also present.
PAGE 104
Known Issues Release ST.1.0.090213 ■ 98 PR_17758 — In monitor mode, when IPS full inspection is turned on and the FTP ALG is turned off, sending an FTP copy of the startup configuration to the network fails with a broken pipe error.
PAGE 105
This page intentionally left blank.
PAGE 106
© 2009-2010 Hewlett-Packard Development Company, LP. The information contained herein is subject to change without notice.