-XQLSHU1HWZRUNV
1HW6FUHHQ5HOHDVH1RWHV
3URGXFW1HW6FUHHQ;71HW6FUHHQ*71HW6FUHHQ1HW6FUHHQ
1HW6FUHHQ1HW6FUHHQ1HW6FUHHQ1HW6FUHHQ
1HW6FUHHQ
9HUVLRQ6FUHHQ26U
5HOHDVH6WDWXV3XEOLF5HOHDVH
3DUW1XPEHU
'DWH

&RQWHQWV
1. Version Summary on page 2
2. New Features and Enhancements on page 2
3. Changes to Default Behavior on page 2
4. Addressed Issues on page 2
5. Known Issues on page 3
5.1 Limitations of Features in ScreenOS 5.1.0r1 on page 3
5.2 Compatibility Issues in ScreenOS 5.1.0r1 on page 5
5.3 Known Issues in ScreenOS 5.1.0r1 on page 6
6. Getting Help on page 7

6FUHHQ26U5HY$3DJHRI

-XQLSHU1HWZRUNV

1HW6FUHHQ5HOHDVH1RWHV

 9HUVLRQ6XPPDU\ScreenOS 5.1.0 is the latest release version of ScreenOS firmware for theNetScreen-5XT, NetScreen-5GT, NetScreen-25, NetScreen-50, NetScreen-204 andNetScreen-208 security appliances, and the NetScreen-500 and NetScreen-5200
and NetScreen-5400 security systems.
The ScreenOS 5.1.0r1 release is interoperable with, and provides basic support forall versions of NetScreen Remote and ScreenOS 2.6.1 and later versions.

 1HZ)HDWXUHVDQG(QKDQFHPHQWV
For a list and descriptions of new features and enhancements in this release orScreenOS 5.1.0r1, refer to the NetScreen ScreenOS Migration Guide.

Note: You must register your product at www.juniper.net/support/ so that certain
ScreenOS features, such as antivirus or deep inspection, can be activated on thedevice. If you already have an account, enter your user ID and password; if you are anew NetScreen customer, create your account first. To register your product, youneed the model and serial number of the device. After registering your product,confirm that your device has internet connectivity. Issue the CLI command exec
license-key update to make the device connect to the NetScreen server to activate
the feature.

 &KDQJHVWR'HIDXOW%HKDYLRUThere are numerous changes in default behavior. For detailed information onchanges to default behavior in ScreenOS 5.1.0r1, refer to the NetScreen ScreenOS
Migration Guide.

 $GGUHVVHG,VVXHVAs this is the initial release of ScreenOS 5.1.0, there are no addressed issues atthis time.

6FUHHQ26U5HY$

3DJHRI

-XQLSHU1HWZRUNV

1HW6FUHHQ5HOHDVH1RWHV

 .QRZQ,VVXHVThis section describes known issues with the current release.
• Section 5.1 “Limitations of Features in ScreenOS 5.1.0r1” identifies featuresthat are not fully functional at the present time, and will be unsupported forthis release.
• Section 5.2 “Compatibility Issues in ScreenOS 5.1.0r1 on page 5 describes
known compatibility issues with other products, including but not limited tospecific NetScreen appliances, other versions of ScreenOS, Internetbrowsers, NetScreen management software and other vendor devices.
Whenever possible, information is provided for ways to avoid the issue,
minimize its impact, or in some manner work around it.
• Section 5.3 “Known Issues in ScreenOS 5.1.0r1 on page 6 describes
deviations from intended product behavior as identified by NetScreen Test
Technologies through their verification procedures. Again, wheneverpossible, information is provided to assist the customer in avoiding orotherwise working around the issue.

 /LPLWDWLRQVRI)HDWXUHVLQ6FUHHQ26U
This section describes the limitations in various features in ScreenOS. They apply
to all platforms, unless otherwise noted.

 /LPLWDWLRQVLQ6FUHHQ26
The following limitations are present in ScreenOS 5.1.0r1.

6FUHHQ26U5HY$•SIP – When using SIP and you configure two phones in the Trustzone, you must configure the Gatekeeper in the Trust zone too. If you
configure the Gatekeeper in the Untrust zone, the two phones will not
be able to communicate with each other.

•(NetScreen-500) Saving Firmware to Flash – You cannot saveScreenOS 5.1.0 firmware to flash memory using the boot loader. Usethe WebUI or CLI to save ScreenOS 5.1.0 firmware to flash memory.

•(NetScreen-5000 Series) Transparent Mode – Moving sessions(both sessions and VPNs) from one interface to another in the same
L2 zone is not supported on these platforms.

•(NetScreen-200 Series) Deep Inspection - Installing the DeepInspection (DI) license key on the NetScreen-200 in advanced mode
decreases the maximum number of sessions to 64,000 sessions. To
restore the number of sessions supported to 128,000 sessions, remove
the DI license key and reboot the NetScreen device.

3DJHRI

-XQLSHU1HWZRUNV

1HW6FUHHQ5HOHDVH1RWHV•

Antivirus (AV) - ScreenOS 5.1.0 does not support the external AVfeature.

•Large File Transfers - The maximum size file inspected by theintegrated AV feature defaults to 10MB. If AV and Deep Inspection(DI) are enabled, this is reduced to 6 MB. If AV, DI, and URL filtering
are all enabled, this is reduced to 4MB.

•VoIP - Juniper Networks tested VoIP with the following IP phonevendors:• H.323 IP Phones: Avaya 4612/4606/4624; Digital 6408D• Analog Phones: Polycom: Phones were connected to an OKI H.323
gateway to convert the analog signal into H.323.
• SIP IP Phones: Cisco IP Phone 7960 and 7940, image version 6.3

 /LPLWDWLRQVIURP3UHYLRXV5HOHDVHV
The following limitations from previous releases are also present in thisrelease.
•

SSH Version 1 Interoperability – The embedded SSH server inScreenOS 5.1.0 has issues with the client from SSH Communications
Security when operating in SSH version 1 mode.
W/A: Use the SSH Communications client in version 2 mode, or use adifferent SSH version 1 client, such as OpenSSH.

•SSHv2 Interoperability – The only tested and certified SSHv2
clients are OpenSSH and Secure CRT.

•(NetScreen-5XT and NetScreen-5GT) Primary & Backup
Interfaces – The primary and backup interfaces bound to theUntrust security zone cannot both use DHCP for address assignment
at the same time. You can use DHCP for one interface and PPPoE forthe other, or you can use PPPoE for both interfaces.

•(NetScreen-500 and NetScreen-5000 Series) Vsys for GroupIKE ID – Group IKE ID users cannot be used in a vsys if that vsys
uses a shared untrust interface.
W/A: Use a private Untrust interface (tagged VLAN subinterface ordedicated physical interface) for the vsys.

•6FUHHQ26U5HY$(NetScreen-5000 Series) Aggressive Aging – The Aggressive
Aging feature is not supported on the NetScreen-5000 Series devices.

3DJHRI

-XQLSHU1HWZRUNV

1HW6FUHHQ5HOHDVH1RWHV

 &RPSDWLELOLW\,VVXHVLQ6FUHHQ26U
Below are the known compatibility issues at the time of this release. Wheneverpossible, a work-around (starting with “W/A:”) has been provided for yourconvenience.
• General Compatibility Issues– Freeswan - The Freeswan VPN client is incompatible with ScreenOS
5.1.0r1 in certain configurations due to IKE features that Freeswan does
not fully support. The result is that Phase 2 negotiations and Phase 2 SA
will not complete if the following commands are enabled:
set ike initiator-set-commit
set ike responder-set-commit
set ike initial-contact
W/A: Unset these commands to ensure compatible configuration on theNetScreen device.
• Compatible Web Browsers - The WebUI for ScreenOS 5.1.0r1 was tested
with and supports Microsoft Internet Explorer (IE) browser versions 5.5 andabove, and Netscape Navigator 6.X for Microsoft Windows platforms, andMicrosoft Internet Explorer version 5.1 for MacOS 10.x. Other versions ofthese and other browsers, were reported to display erroneous behavior.

 8SJUDGH3DWKVIURP3UHYLRXV5HOHDVHV
If you are upgrading a NetScreen device from a release that is earlier thanScreenOS 5.0.0, you must upgrade it to ScreenOS 5.0.0 before upgrading toScreenOS 5.1.0. For detailed information on how to upgrade any NetScreen
device, refer to the NetScreen ScreenOS Migration Guide. The migration
guide provides step-by-step upgrade procedures and important information
about upgrading NetScreen devices.

6FUHHQ26U5HY$

3DJHRI

-XQLSHU1HWZRUNV

1HW6FUHHQ5HOHDVH1RWHV

 .QRZQ,VVXHVLQ6FUHHQ26UThe following are known deficiencies in features at the time of this release.
Whenever possible, a work-around is suggested following the description of theproblem. Workaround information starts with “W/A:” If there is no subsection for
a particular ScreenOS release, no new known issues were identified for thatrelease.
• 44099 (NetScreen 5000 series) – When running high volumes of calls on theNetScreen device, some media sessions fail when the call setup rate is equal
to or greater than 50 cps.
• 43260 (NetScreen-5GT) – When the NetScreen device is in Extended portmode, the WebUI erroneously displays the port mode as Trust/Untrust anddoes not allow you to change it.
W/A: Use the get system CLI command to display the correct port mode andto change the port mode.
• 43113 – When the NetScreen device is in transparent mode, internal servers
cannot initiate sessions to dialup VPN clients.
• 43100 – When running SIP in a High Availability (HA) configuration, thebackup NetScreen device may crash on continuos heavy load testing.
W/A: Reset the backup device.
• 43097 – When the NetScreen device is in transparent mode, it creates
duplicate multicast sessions.
• 43054 – When you use the integrated URL filtering feature, the port numberrange (1024 -32767) allowed by the WebUI is incorrect. The CLI allows 1024
to 65535, which is correct.
• 43008 – Before you put a NetScreen device into a cluster, you cannot add/
modify/remove NSRP track-IP objects on the Track IP page of the WebUI.
• 42992 – The NetScreen device could crash when the new RTSP session rate
goes over 100 RTSP sessions and there is additional traffic going through thedevice.
• 42801 – When you use the redirect URL filtering feature with a SurfControl
server, sending a URL that is longer than 512 bytes may cause theSurfControl server to go down.

6FUHHQ26U5HY$

3DJHRI

-XQLSHU1HWZRUNV

1HW6FUHHQ5HOHDVH1RWHV

 *HWWLQJ+HOS
For further assistance with Juniper Networks products, visit
www.juniper.net/support
Juniper Networks occasionally provides maintenance releases (updates andupgrades) for ScreenOS firmware. To have access to these releases, you mustregister your NetScreen device with Juniper Networks at the above address.
Copyright © 2004 Juniper Networks, Inc. All rights reserved.
Juniper Networks, the Juniper Networks logo, NetScreen, NetScreen
Technologies, GigaScreen, and the NetScreen logo are registered trademarks ofJuniper Networks, Inc. NetScreen-5GT, NetScreen-5XP, NetScreen-5XT,NetScreen-25, NetScreen-50, NetScreen-100, NetScreen-204, NetScreen-208,
NetScreen-500, NetScreen-5200, NetScreen-5400, NetScreen-Global PRO,NetScreen-Global PRO Express, NetScreen-Remote Security Client, NetScreenRemote VPN Client, NetScreen-IDP 10, NetScreen-IDP 100, NetScreen-IDP 500,
GigaScreen ASIC, GigaScreen-II ASIC, and NetScreen ScreenOS are trademarksof Juniper Networks, Inc. All other trademarks and registered trademarks are theproperty of their respective companies.
Information in this document is subject to change without notice.
No part of this document may be reproduced or transmitted in any form or by anymeans, electronic or mechanical, for any purpose, without receiving written
permission from:Juniper Networks, Inc.
1194 N. Mathilda Ave.
Sunnyvale, CA 94089-1206
U.S.A.
ATTN: General Counsel
www.juniper.net

6FUHHQ26U5HY$

3DJHRI

-XQLSHU1HWZRUNV

6FUHHQ26U5HY$1HW6FUHHQ5HOHDVH1RWHV

3DJHRI