Version 4.3.6 bug fixes

System

URL classification - Extended Web Control (EWC)

Support reference 83619

An anomaly affecting communication with EWC servers would occasionally occur after several unsuccessful attempts to classify a URL. This anomaly has been fixed.

HTTP proxy

Support reference 83607

Issues with competing access to connection counters, which could cause the proxy to shut down unexpectedly, have been fixed.

IPsec VPN - Protocol selection

Support references 83711 - 83777

Selecting the only protocol allowed to set up an IPsec tunnel (TCP, UDP, ICMP or GRE in the Protocol column of the tunnel grid) would sometimes prevent IPsec tunnels from being monitored in the web administration interface. This regression, which first appeared in SNS version 4.2, has been fixed.

Host reputation

Support reference 77080

Hosts referenced in the host reputation monitoring list could previously be deleted from the object database. This inappropriate operation, which would cause a system error that prevented the proxy from starting, has been fixed.

Traffic statistics - Virtual IPsec interfaces

Support reference 82960

The counters that counted packets passing through virtual IPsec interfaces were no longer refreshed (SNMP requests or netstat system command). This anomaly, which first appeared in SNS version 4.1, has been fixed.

Outgoing traffic statistics - SSL VPN

Support reference 79814

The counters that counted packets leaving the network interface linked to the SSL VPN were no longer refreshed This anomaly, which first appeared in SNS version 4.1, has been fixed.

Local connection of an administrator with the "Console (SSH)" permission

Support reference 84289

When administrators with the Console (SSH) permission attempted to connect locally (in console mode or with a monitor/keyboard), their attempts would fail and could cause the console to freeze after two attempts. This issue has been fixed.

IPsec VPN with certificate-based authentication - Topology deployed via SMC

Support reference 84231

Whenever an IPsec VPN topology with certificate-based authentication was deployed from an SMC server, any attempt to modify the firewall (via the web administration interface) of the peer defined in this topology would wrongly display a system error message “A mandatory token for this message has not been specified”. This issue has been fixed.

QoS - Modifying a default queue initially configured in percentage

Any attempt to reconfigure a default queue (or a default ACK queue) that was initially configured in bandwidth percentage would cause an error and display the error message “Reference needed for percentage”. This issue has been fixed.

Hosts with dynamic IP address resolution used in sub-groups

Support references 84202 - 81951

Whenever a host was:

  • Configured with dynamic IP address resolution,
  • Placed in a sub-group that is in turn used in a configuration module on the firewall (filter rules, permissions to access the web administration interface, etc.).

Changes to this host’s IP address would be ignored in the configuration module in question. This issue has been fixed.

Intrusion prevention

SOFBUS - LACBUS protocol

An anomaly in the engine that analyzes the SOFBUS protocol would wrongly raise the "SOFBUS: invalid protocol” alarm (modbus:741). This anomaly has been fixed.

Android WhatsApp and Facebook applications

Support reference 82865

Legitimate packets from Android WhatsApp or Facebook applications would sometimes wrongly trigger the block alarm "SSL version mismatch" (ssl:117 alarm). This regression, which first appeared in SNS version 4.2.1, has been fixed.

SSL protocol

Enabling the option Allow 0-RTT could wrongly raise the alarm "SSL: invalid answer with connection state” (ssl:735 alarm). This issue has been fixed.