Version 4.3.4 bug fixes

System

Authentication - SSL VPN

Support references 78073 - 81741

In a configuration using a main external LDAP directory and a backup external LDAP directory, switching from the main directory to the backup directory would occasionally cause the authentication engine to shut down unexpectedly, preventing uses from accessing the SSL VPN. This issue has been fixed.

Firewall managed from Stormshield Management Center (SMC)

Support reference 81863

When an administrator connects to a firewall from their SMC connecting server, this administrator’s connection identifier will now correctly appear in the right upper banner of the firewall’s web administration interface.

Values of SD-WAN monitoring parameters

To fit most SD-WAN requirements, the default values and values acceptable as availability testing parameters have been changed:

  • Idle timeout: 1s by default (as opposed to 2s prior to SNS 4.3.4),
  • Frequency: 5 seconds by default, with a minimum of 2 seconds (as opposed to 15s prior to SNS 4.3.4),
  • Number of tries: 5 (as opposed to 3 prior to SNS 4.3.4).

Logs - SD-WAN statistics

Support reference 83961

Statistics regarding SD-WAN metrics (latency, jitter, packet loss rate, etc.) are now collected every 10 minutes (instead of 15) to be better synchronized with routing statistics.

VPN logs

Support reference 83792

Anonymized VPN logs (without any specific access privileges granted) would occasionally reveal information about the remote user certificate by mistake (remoteid field). This anomaly has been fixed.

Network configuration

Support reference 84225

When there are two sections with the exact same name in the network configuration file, the mechanism that reloads network parameters would freeze. This issue has been fixed.

Static routing

An anomaly which sometimes prevented some routes from being correctly applied (unroutable gateways) has been fixed.

SD-WAN - Logs

In configurations that use SD-WAN, the system log now indicates what caused the links to switch.

Hardware monitoring - Disks

Support reference 84083

The mechanism that analyzes the results of SMART tests has been adapted to stop raising inappropriate alerts on some SSD references.

SNMP Agent

Support reference 81710

Several anomalies that could cause memory leaks in the SNMP agent have been fixed.

QoS

After a traffic shaper was assigned to an interface, its default queue or default ACK queue could no longer be changed. This anomaly has been fixed.

Defining a CBQ QoS queue by using both an absolute value and a percentage for its min. and max. bandwidth characteristics (or reverse min. and max.) could generate inconsistencies in the QoS configuration and block matching traffic. This type of configuration is now explicitly rejected.

QoS configured in a protocol alarm

Support reference 84237

Renaming a QoS queue that is used in a protocol alarm would make this queue disappear from the alarm configuration and cause a system error. This issue has been fixed.

Web administration interface

High availability

Support reference 83724

When an error occurs while attempting to connect a firewall to a cluster, the web administration interface no longer freezes when the “High Availability configuration in progress” message appears.

IPsec VPN - Encryption profiles

Support reference 84245

When AES-GCM_16 is selected as the phase 1 (IKE) algorithm, the field that makes it possible to specify an authentication algorithm is now grayed out.
As the only authentication method that AES-GCM-16 supports is prfsha256, it will be automatically selected.

Enabling the ANSSI Diffusion Restreinte (DR) mode

Support reference 82914

When DR mode is enabled on an IPsec configuration that does not meet all of this mode’s requirements, the warning message indicating that the IPsec configuration has been disabled now comes with a blinking symbol indicating that the firewall must be manually restarted in order to apply changes (upper right section of the screen).