User guide

ManualsBrandsWatchguard ManualsNetworkingV10

RELEASE NOTES JANUARY 22, 2009 PAGE 1

WatchGuard System Manager and Fireware™

Release Notes for WSM v10.2.7 and Fireware v10.2.7

Introduction

WatchGuard is pleased to release WatchGuard System Manager (WSM) v10.2.7 management software

and Fireware / Fireware Pro v10.2.7 appliance software.

The v10.2.7 release contains a number of defect fixes for issues reported by WatchGuard customers.

Areas affected include High Availability, Mobile VPN with SSL, and more. This release also includes the

ability to configure QoS and policy schedules for managed branch office VPN tunnels.

See the Resolved Issues section below for a complete list of resolved issues.

Before You Start

Before you install this release, make sure that you have:

 (IMPORTANT) Fireware or Fireware Pro v8.3 or later installed on your Firebox. If you have an

earlier version of Fireware installed on your Firebox, you must upgrade to Fireware v8.3 or

later before you install Fireware v10.2.7. See the Known Issues section for more instructions.

 (IMPORTANT) A backup copy of your current Fireware or WFS configuration file. To make a

backup of the configuration file, see “Configuration Files” in the

WatchGuard System Manager

User Guide

 (IMPORTANT) A full backup of the Fireware image or Firebox X WFS image. To make a

backup of the image, see “Configuration Files” in the

WatchGuard System Manager User

Guide

 An appropriate Firebox and the required hardware and software components as shown in

“WSM v10.2.7 System Requirements” below.

 Feature key for your Firebox – If you are a new user, download this from the WatchGuard

LiveSecurity site after you register your Firebox. If you have already registered a Firebox X

Core or Peak e-Series and have not updated your feature key since v9.0 was released,

download and save a new feature key for your Firebox to take advantage of changes in firewall

throughput limits in the feature key.

 Documentation for this product is available at

www.watchguard.com/help/documentation

Summary of content (14 pages)

PAGE 1
WatchGuard System Manager and Fireware™ Release Notes for WSM v10.2.7 and Fireware v10.2.7 Introduction WatchGuard is pleased to release WatchGuard System Manager (WSM) v10.2.7 management software and Fireware / Fireware Pro v10.2.7 appliance software. The v10.2.7 release contains a number of defect fixes for issues reported by WatchGuard customers. Areas affected include High Availability, Mobile VPN with SSL, and more.
PAGE 2
WATCHGUARD SYSTEM MANAGER AND FIREWARE WSM/FIREWARE 10.2.7 WatchGuard System Manager v10.2.
PAGE 3
WATCHGUARD SYSTEM MANAGER AND FIREWARE WSM/FIREWARE 10.2.7 6. To upgrade your Firebox to Fireware v10.2.7, use WSM v10.2.7 to connect to the Firebox. Use Policy Manager to open your Firebox X Peak or Firebox X Core configuration file. 7. From Policy Manager, select File > Upgrade. Browse to C:\Program Files\Common Files\WatchGuard\resources\Fireware\10.2 8. Select the FW1020B207454.wgu file and click OK. Wait for the Firebox to reboot. You see a success message when the upgrade is complete. 9.
PAGE 4
WATCHGUARD SYSTEM MANAGER AND FIREWARE WSM/FIREWARE 10.2.7 To install Single Sign-On (SSO) software If you are upgrading from a previous SSO implementation, you must first uninstall the existing SSO agent. With the v10.2.4 release, you can install a new SSO client software package to improve the efficiency and accuracy of your Single Sign-On implementation. See the help system for your Firebox for more information about the new SSO implementation. To install v10.2.4 Single Sign-On agent software 1.
PAGE 5
WATCHGUARD SYSTEM MANAGER AND FIREWARE WSM/FIREWARE 10.2.7 WSM and Firebox System Manager connections no longer fail after a configuration save to two Fireboxes configured in an HA configuration. [31990] Mobile VPN with SSL The Windows SSL VPN client no longer fails to install on Windows XP with a Runtime Error message. [31932] RELEASE NOTES The Windows SSL VPN client now operates correctly after a computer returns from sleep mode.
PAGE 6
WATCHGUARD SYSTEM MANAGER AND FIREWARE WSM/FIREWARE 10.2.7 Known Issues and Limitations These are known issues for WatchGuard System Manager and Fireware v10.2.7. Where available, we include a way to work around the issue. Upgrading to Fireware v10.2.7 from Fireware v8.2 and earlier It is not possible to upgrade directly to Fireware v10.2.7 from Fireware v8.0, v8.1, or v8.2.x. You must upgrade to Fireware v8.3 before you install Fireware v10.2.7.
PAGE 7
WATCHGUARD SYSTEM MANAGER AND FIREWARE WSM/FIREWARE 10.2.7 and complete the Send email from text box before any email notification messages can be sent from the server. The Management Server, Report Server, Log Server, and Quarantine Server share the same administrative password. If you restore a back up configuration to the Management Server, the administrative password changes for all servers.
PAGE 8
WATCHGUARD SYSTEM MANAGER AND FIREWARE WSM/FIREWARE 10.2.7 continue to use your existing Log Server. The new Log Server is not compatible with previous implementations of Historical Reports. Customers, including those running appliances with WFS, who have grown accustomed to the existing report tool should thoroughly review the documentation before they upgrade to WSM v10.x.
PAGE 9
WATCHGUARD SYSTEM MANAGER AND FIREWARE WSM/FIREWARE 10.2.7 The default managed VPN tunnel configuration does not enable NAT-Traversal. [23756] When you use the default route VPN tunnel feature, all traffic from the remote networks will match the default ‘ANY’ policy created by the Management Server. This prevents remote BOVPN traffic from matching other firewall policies configured at the central location.
PAGE 10
WATCHGUARD SYSTEM MANAGER AND FIREWARE WSM/FIREWARE 10.2.7 Forcing the interface link speed to 1000MB, Full or Half Duplex may result in a failed interface link speed negotiation. We recommend that you always use the option to auto-negotiate link speed. [21319] ICMP protocol unreachable messages do not pass through the Firebox. The option to allow Protocol Unreachable messages under Setup > Global Settings > ICMP Error Handling does not work.
PAGE 11
WATCHGUARD SYSTEM MANAGER AND FIREWARE WSM/FIREWARE 10.2.7 Workaround Open your configuration in Policy Manager and go to Setup > Feature Keys. Click Remove one time to remove the expired feature key. Save the configuration to the Firebox. If you use multiple proxy policies on a Firebox X Core model X500, X700, X1000 and X2500, we recommend that you upgrade the Firebox memory to 512MB. Contact your WatchGuard reseller for information on how to purchase a 512MB memory upgrade kit.
PAGE 12
WATCHGUARD SYSTEM MANAGER AND FIREWARE WSM/FIREWARE 10.2.7 The spamBlocker Proactive Patterns feature is not available for Firebox X Core models X500, X700, X1000, and X2500. Policy Manager allows the user to configure the proactive patterns feature for non e-Series Core Fireboxes, however, the feature does not work.
PAGE 13
WATCHGUARD SYSTEM MANAGER AND FIREWARE WSM/FIREWARE 10.2.7 Workaround Use WSM to remove the managed Branch Office VPN tunnel and then create the tunnel again. Beginning with the v8.3 release, you cannot use non-ASCII characters in BOVPN shared keys. The UI does not allow you to enter non-ASCII characters in the shared key field. Mobile VPN with IPSec At the end of the Add Mobile VPN with IPSec Setup Wizard, the check box to add users to the group may not be visible.
PAGE 14
WATCHGUARD SYSTEM MANAGER AND FIREWARE WSM/FIREWARE 10.2.7 client configuration size. The route limit is not exact, but, depending on data in the configuration the limit is approximately 12 to 25 routes. [24226] The Mobile VPN with SSL client can fail to stay connected if the client computer has more then one active network interface. [27112] You cannot use extended ASCII characters (ä,ö,ü,ß) in a user name for Mobile VPN with SSL Active Directory authentication.