Juniper Networks ScreenOS Release Notes
Products: Integrated Security Gateway (ISG) 1000, ISG 1000-IDP, ISG 2000,
ISG 2000-IDP, Secure Services Gateway (SSG) 5, SSG 20, SSG 140, SSG
300M-series, SSG 500/500M-series, and NetScreen-5000 series(NS 5000–MGT2/SPM2).
Version: ScreenOS 6.0.0r7
Revision: Rev 01
Part Number: 530-027350-01
Date: September 2008

Contents
Juniper Networks ScreenOS Release Notes ....................................................................... 1
Version Summary ............................................................................................................... 6
New Features and Enhancements ....................................................................................... 6
New Features and Enhancements Introduced in 6.0.0r5................................................. 7
ISG-IDP Session Pass Under Heavy Throughput....................................................... 7
New Features and Enhancements Introduced in 6.0.0r2................................................. 9
New Features .............................................................................................................. 9
Performance Enhancements...................................................................................... 10
CPU Protection Tools ............................................................................................... 11
New Features and Enhancements Introduced in 6.0.0r1............................................... 13
Hardware Features .................................................................................................... 13
Virtual Private Network (VPN) ................................................................................ 14
Firewall ..................................................................................................................... 15
Universal Threat Management.................................................................................. 15
IDP and GPRS .......................................................................................................... 16
Virtual Systems......................................................................................................... 17
Network Address Translation ................................................................................... 18
NetScreen Redundancy Protocol .............................................................................. 18
Layer 2 Transparent Mode........................................................................................ 18
UAC .......................................................................................................................... 18
Feature Extensions .................................................................................................... 19
Changes to Default Behavior ............................................................................................ 21
Changes to Default Behavior Introduced in 6.0.0r6 ..................................................... 21
AV Scan Engine........................................................................................................ 21
Changes to Default Behavior Introduced in 6.0.0r3 ..................................................... 21
USB Boot Sequence.................................................................................................. 21
Changes to Default Behavior Introduced in 6.0.0r2 ..................................................... 21

ScreenOS Release Notes

1

Max Dialing Interval Default.................................................................................... 21
CPU Protection and Utilization Profiling ................................................................. 21
TCP-SYN-Check Packet Flow ................................................................................. 22
Infranet Auth Object Cleanup................................................................................... 22
Infranet Auth Cold Start NSRP Synchronization ..................................................... 22
Infranet Controller and Management IP ................................................................... 22
Removing Denied Sessions on Auth Table Change ................................................. 22
Changes to Default Behavior Introduced in 6.0.0r1 ..................................................... 23
TCP-SYN-Check Default ......................................................................................... 23
RADIUS Attributes................................................................................................... 23
IP Option Packets...................................................................................................... 23
Coredump to USB..................................................................................................... 23
Addressed Issues............................................................................................................... 23
Addressed Issues in ScreenOS 6.0.0r7 ......................................................................... 24
Administration .......................................................................................................... 24
Antivirus ................................................................................................................... 24
CLI ............................................................................................................................ 24
DHCP........................................................................................................................ 25
DNS........................................................................................................................... 25
GPRS......................................................................................................................... 25
HA and NSRP ........................................................................................................... 25
IDP ............................................................................................................................ 26
Management.............................................................................................................. 26
NAT .......................................................................................................................... 26
Other ......................................................................................................................... 27
Performance .............................................................................................................. 28
Routing...................................................................................................................... 29
VoIP .......................................................................................................................... 29
VPN........................................................................................................................... 29
WebUI....................................................................................................................... 30
Addressed Issues from ScreenOS 6.0.0r6..................................................................... 31
Administration .......................................................................................................... 31
Antivirus ................................................................................................................... 32
CLI ............................................................................................................................ 32
GPRS......................................................................................................................... 32
HA & NSRP.............................................................................................................. 32
IDP ............................................................................................................................ 33
Management.............................................................................................................. 33
NAT .......................................................................................................................... 34
Other ......................................................................................................................... 34
Performance .............................................................................................................. 36
Routing...................................................................................................................... 37
VOIP ......................................................................................................................... 37
VPN........................................................................................................................... 38
WebUI....................................................................................................................... 38
Addressed Issues from ScreenOS 6.0.0r5..................................................................... 39

ScreenOS Release Notes

2

Administration .......................................................................................................... 39
Antivirus ................................................................................................................... 39
CLI ............................................................................................................................ 39
DHCP........................................................................................................................ 39
DNS........................................................................................................................... 39
GPRS......................................................................................................................... 40
HA & NSRP.............................................................................................................. 40
IDP ............................................................................................................................ 41
Management.............................................................................................................. 41
NAT .......................................................................................................................... 41
Other ......................................................................................................................... 42
Performance .............................................................................................................. 43
Routing...................................................................................................................... 43
Security ..................................................................................................................... 43
VoIP/H323 ................................................................................................................ 43
VPN........................................................................................................................... 44
WebUI....................................................................................................................... 44
Addressed Issues from ScreenOS 6.0.0r4..................................................................... 44
Administration .......................................................................................................... 44
Antivirus ................................................................................................................... 45
CLI ............................................................................................................................ 45
GRPS......................................................................................................................... 45
HA and NSRP ........................................................................................................... 45
IDP ............................................................................................................................ 45
Management.............................................................................................................. 45
Other ......................................................................................................................... 46
Routing...................................................................................................................... 47
Security ..................................................................................................................... 48
VoIP/H323 ................................................................................................................ 48
VPN........................................................................................................................... 48
WebUI....................................................................................................................... 49
Addressed Issues from ScreenOS 6.0.0r3..................................................................... 49
Antivirus ................................................................................................................... 49
HA and NSRP ........................................................................................................... 49
Management.............................................................................................................. 49
Other ......................................................................................................................... 50
Routing...................................................................................................................... 50
WebUI....................................................................................................................... 50
Addressed Issues from ScreenOS 6.0.0r2..................................................................... 50
Antivirus ................................................................................................................... 50
HA and NSRP ........................................................................................................... 51
IDP ............................................................................................................................ 51
Other ......................................................................................................................... 51
Routing...................................................................................................................... 51
WebUI....................................................................................................................... 51
Known Issues .................................................................................................................... 51

ScreenOS Release Notes

3Known Issues in ScreenOS 6.0.0r7............................................................................... 52
Administration .......................................................................................................... 53
Antivirus ................................................................................................................... 53
DHCP........................................................................................................................ 53
GPRS......................................................................................................................... 53
HA and NSRP ........................................................................................................... 54
IDP ............................................................................................................................ 54
Management.............................................................................................................. 54
Other ......................................................................................................................... 54
Performance .............................................................................................................. 56
Routing...................................................................................................................... 56
VOIP/H323 ............................................................................................................... 57
VPN........................................................................................................................... 57
WebUI....................................................................................................................... 57
Known Issues from ScreenOS 6.0.0r6.......................................................................... 57
CLI ............................................................................................................................ 57
Performance .............................................................................................................. 58
Known Issues in ScreenOS 6.0.0r5............................................................................... 59
GPRS......................................................................................................................... 59
Other ......................................................................................................................... 59
Performance .............................................................................................................. 59
Known Issues from ScreenOS 6.0.0r4.......................................................................... 59
Management.............................................................................................................. 59
Other ......................................................................................................................... 59
Known Issues from ScreenOS 6.0.0r3.......................................................................... 59
HA and NSRP ........................................................................................................... 59
Known Issues from ScreenOS 6.0.0r2.......................................................................... 60
Antivirus ................................................................................................................... 60
HA and NSRP ........................................................................................................... 60
IDP ............................................................................................................................ 61
Management.............................................................................................................. 62
Other ......................................................................................................................... 62
Performance .............................................................................................................. 64
VPN........................................................................................................................... 64
WebUI....................................................................................................................... 65
Known Issues from ScreenOS 6.0.0r1.......................................................................... 65
Antivirus ................................................................................................................... 65
HA and NSRP ........................................................................................................... 66
IDP ............................................................................................................................ 66
Management.............................................................................................................. 66
Other ......................................................................................................................... 67
Performance .............................................................................................................. 67
Routing...................................................................................................................... 68
VLAN ....................................................................................................................... 68
VPN........................................................................................................................... 68
WebUI....................................................................................................................... 68

ScreenOS Release Notes

4

Limitations and Compatibility ...................................................................................... 68
Limitations of Features in ScreenOS 6.0.0r1................................................................ 68
Compatibility Issues in ScreenOS 6.0 .......................................................................... 71
Documentation Changes ................................................................................................... 72
Changes in SSG Hardware Documentation.................................................................. 72
Documentation Changes Introduced in 6.0.0r2 ............................................................ 73
Documentation Changes Introduced in 6.0.0r1 ............................................................ 73
Getting Help for ScreenOS 6.0 Software.......................................................................... 74

ScreenOS Release Notes

5

Version Summary
ScreenOS 6.0 firmware can be installed on the following products: SecureServices Gateway (SSG) 5, SSG 20, SSG 140, SSG 320/350M, SSG 520/520M,
SSG 550/550M, Integrated Services Gateway (ISG) 1000, ISG 1000-IDP,
ISG 2000, ISG 2000-IDP, and NetScreen-5000 series with MGT2/SPM2.
This release incorporates the fixes from ScreenOS maintenance releases up to
5.3r10 and 5.4r10, plus the addressed issues listed in this document.
Note: If you are using an SSG 500-series device and an SSG 500Mseries device in a NetScreen Redundancy Protocol (NSRP) environment,
both devices must be running ScreenOS 5.4r2 or later.
Note: NSRP clusters require the use of the same hardware products
within a cluster. Do not mix different product models in NSRP
deployments.
Note: You can use NetScreen-Security Manager (NSM) 2007.1 with the
Forward Support Update software to manage devices running ScreenOS
6.0. To do this, install a schema upgrade on the management server anduser interface. The upgrade is available at
http://www.juniper.net/customers/support/. Refer to the NSM Forward
Support for ScreenOS 6.0.0 Release Notes for installation instructions andthe features and platforms supported with this schema upgrade.

New Features and Enhancements
The sections below describe new features and enhancements available in
ScreenOS 6.0.0 releases.
Note: You must register your product at http://support.juniper.net so thatlicensed features, such as antivirus, deep inspection, and virtual systems,
can be activated on the device. To register your product, you need themodel and serial number of the device. At the support page:•

If you already have an account, enter your user ID and password.

•

If you are a new Juniper Networks customer, first create an account,then enter your ID and password.

After registering your product, confirm that the device has Internet connectivity.
Use the exec license-key update all command to make the device connect to
the Juniper Networks server to activate the feature.

ScreenOS Release Notes

6

New Features and Enhancements Introduced in 6.0.0r5
The section below describes the new feature introduced in the ScreenOS 6.0.0r5
release.
ISG-IDP Session Pass Under Heavy Throughput
An option to allow sessions to pass through without inspection under heavy
throughput conditions has been introduced in this release. This feature bypasses
traffic inspection for some sessions when the Intrusion Detection and Prevention(IDP) Security Module (SM) is unable to stay in lockstep with incoming traffic
while continuing to inspect other packets. You might use this feature when you
are sensitive to packet drops and want to enable an on/off switch to have packets
inspected at the firewall level instead of through the security module. By default,
this feature is off; that is, as in previous releases, all traffic is inspected by IDP
and under heavy throughput, some packets may be dropped.
To enable this feature, use the following command syntax:
exec sm sm_id ksh "scio const set sc_adapt_enable 1"
You need to run this command on each IDP SM. The valid sm_id values are 1,
2, 3.
To disable this feature, use the following command syntax:
exec sm sm_id ksh "scio const set sc_adapt_enable 0"
When enabled, throughput conditions are taken into account and bypassing
packet inspection is done using a set of criteria. Traffic conditions will result in
IDP operating in the following modes:•

Normal inspection—All traffic is inspected by IDP.

•

Basic cut-through mode—All new sessions will be marked as cut-throughand will be allowed to pass uninspected. The first packet of the session
received by the Security Module triggers the cut-through marking. It is
possible for subsequent packets to still be sent to the Security Module
before the Management module takes cut-through into effect. All these
subsequent packets are sent out without inspection.

•

Progressive cut-through mode—All sessions for which packets are being
observed by the IDP security module will be bypassed.

Log messages are issued for any IDP bypass state. The six log types for session
bypass state changes are:•Normal to basic cut-throughScreenOS Release Notes

7•

Basic cut-through to normal•

Basic cut-through to progressive cut-through•Progressive cut-through to basic cut-through•Normal to progressive cut-through•Progressive cut-through to normal

Here are details of the log messages:•

Category is NS_LOG_CATEGORY_ALARM.

•

Logtype is NS_LOG_ALARM_OTHERS.

•

Severity is NS_LOG_SEVERITY_WARNING.

•

Service is cutthrough_transit. Its values and means are
o
o
o
o
o
o

SC_LOG_CUTTHROUGH_NORM_TO_LOW = 1
SC_LOG_CUTTHROUGH_LOW_TO_NORM = 2
SC_LOG_CUTTHROUGH_LOW_TO_HIGH = 3
SC_LOG_CUTTHROUGH_HIGH_TO_LOW = 4
SC_LOG_CUTTHROUGH_NORM_TO_HIGH = 5
SC_LOG_CUTTHROUGH_HIGH_TO_NORM = 6

Here is a sample log message for status changes:
SM %d IDP (cpu %u) transits from %s. %u sessions was bypassed in theprevious state!
The log also includes log version, timestamp, device_domain_id,
device_record_id, device_domain_ver2, and policy_id.
You can use counter commands to get information about whether a CPU is in
cut-through mode and the number of sessions that were set to cut-through mode.
For example,
exec sm 1 ksh "scio counter get kpp…
sc_kpp_loopback
sc_kpp_norm2low
sc_kpp_low2highsc_kpp_high2low
sc_kpp_low2norm…
exec sm 1 ksh "scio counter get flow…

ScreenOS Release Notes8sc_flow_session_basic_cutthrough 0
sc_flow_session_progress_cutthrough 0
sc_flow_cur_cutthrough_sessions 0

New Features and Enhancements Introduced in 6.0.0r2
The sections below describe new features and enhancements introduced in the
ScreenOS 6.0.0r2 release.
New Features
New features introduced in the ScreenOS 6.0.0r2 release are as follows:
PIM Support

The following PIMs are now supported on the SSG 300M-series devices: 6-port
GE SFP uPIM, 8-port 10/100/1000 uPIM, 16-port 10/100/1000 uPIM, ADSL2+
PIM, G.SHDSL PIM, 2-port T1 PIM, 2-port E1, and 2-port serial PIM.
2M Session Support on NS 5400

The NetScreen 5400-MGT2 Secure Port Module 2 (SPM2) now supports up to
two million (2M) sessions.
Note: Since two SPMs are required to support this feature, the NS 5200
will continue to support only 1M sessions.
SSG 320M/350M Devices

There are now two new SSG platforms introduced in conjunction with the 6.0.0r2
ScreenOS release that will support ScreenOS and JUNOS.
Web User Interface for uPIM Statistics

The WebUI now supports uPIM statistics CLI commands that were available in
6.0.0r1. In earlier releases, the standard counters were not enabled for bgroups
on the SSG 140, 520, and 550. This feature adds WebUI support for uPIM
statistics. All SSG platforms support this WebUI feature.
IPv6 Support for ISG 1000

The ISG 1000 now supports IPv6. ISG-IDP, however, does not yet support IPv6.
Unified Access Control Clustering Enhancements

Auth table entries are now synced from the active device to the backup device
and are retained after failover. Auth table cold-sync support was added tosupport seamless failover. This feature is supported on all platforms. Note that
this feature requires Unified Access Control (UAC) 2.1.

ScreenOS Release Notes

9

Network Time Protocol Server Support

ScreenOS now includes Network Time Protocol (NTP) server support for intranet
hosts using the NTP client service. This feature provides Simple Network Time
Protocol version 4 (SNTPv4) support to hosts on the internal network requesting
network time. NTP server support is available on all platforms and is enabled
per-interface on interfaces with their own IP address. Interfaces without a specific
IP address cannot use the NTP server feature. Also, NTP server is not supported
on tunnel interfaces.
The implementation currently supports only Unicast mode. CLI commands for
NTP server are [set/unset] interface <if_name> ntp-server and get interface<if_name> ntp-server. The feature supports vsys and NSRP. NTP configuration
will be synced if NTP server is enabled on a VSI. IPv6 is supported. Transparent
mode is not. NTP server support is implemented according to RFC 2030.
Performance Enhancements
Performance enhancements introduced in the ScreenOS 6.0.0r2 release are as
follows:
Improve Session Age-Out

This feature decreases the amount of communication between the ASIC andCPU by pushing more information to the session stored in hardware anddecreasing the DMA time. This change improves session age-out performanceon Juniper Networks hardware-accelerated platforms and should increase thesustained session ramp rate. The feature is supported on the ISG 1000, ISG
2000, ISG-IDP, and NetScreen-5000-MGT2/SPM2.
Improve Policy Installation PerformanceThis feature optimizes policy installation on Application-Specific Integrated Circuit(ASIC) platforms when changes are made to a single policy or when changes are
made that affect the entire policy base. This change will decrease symptoms
such as packet loss, high-CPU, and system hangs, which are often experienced
when a policy, an address object, or a service object is modified while the device
is under load. The feature is supported on all platforms.
Resource Manager ALGs Default Changed to Off

Resource manager Application Layer Gateways (ALGs) will be disabled bydefault on ASIC-based platforms. Affected ALGs include H.323, SIP, MGCP,
Skinny, RPC, and SQL. Note that this feature will only take effect on a new
installation (that is, no active configuration is currently in flash). During high CPU
utilization situations, it has been noted that the sources of the high CPU
utilization are resource manager ALGs, many of which are never in use on ASICbased platforms. The feature is supported on the ISG 1000, ISG 2000, ISG-IDP,
and NetScreen-5000-MGT2/SPM2.

ScreenOS Release Notes

10

TCP 3-way-check in ASIC for NetScreen-5000

This feature moves the TCP 3-way-check to the Packet Process Unit (PPU) in
the NetScreen-5000 for both single and multi-ASIC sessions. Performance isgreatly enhanced when the TCP 3-way-check takes place in the PPU. The
feature is implemented in this release on the NetScreen-5000-MGT2/SPM2 andwas available on the ISG 2000 in an earlier release.
NSRP Performance Improvements

NSRP messages are now optimized on high-end platforms to improve
performance. The performance improvements apply to the ISG 1000, ISG 2000,
ISG-IDP, and NetScreen-5000-MGT2/SPM2.
Note: When upgrading NSRP clusters, it is necessary to upgrade bothdevices as soon as possible. DO NOT run 6.0.0r1 and 6.0.0r2
simultaneously in the same cluster, because messages will get out of
sync, which could result in a device crash.
CPU Protection Tools
CPU protection tool features introduced in the ScreenOS 6.0.0r2 release are as
follows:
CPU Enforcement Distribution

This feature allows administration of the firewall during high CPU situations.
In prior releases, attacks were enforced by the CPU, which contributes to very
high utilization during the attack. This feature moves enforcement to the ASIC
and bases dropped traffic on a customizable blacklist. CPU protection is
implemented on the ISG 1000, ISG 2000, ISG-IDP, and NetScreen-5000MGT2/SPM2. Note that this feature is best used in conjunction with CPU
utilization profiling.
The following CLI command is used to create a CPU protection blacklist:
set cpu-protection blacklist id<num> <src-ip/mask> <dst-ip/mask>[protocol <num> [src-port <num>] [dst-port <num>] ] [timeout <num>]
CPU protection is independent of vsys; it is a per-device configuration. CPUprotection is not synced between NSRP peers and is not supported in IPv6. The
feature does support Transparent mode.
CPU Utilization ProfilingThis feature allows for prioritization of management traffic over noncriticalpackets during high-CPU situations. In prior releases, when CPU utilization wasvery high, the device often became unmanageable. Prioritizing management
traffic during high-CPU utilization is supported on the ISG 1000, ISG 2000, ISGIDP, and NetScreen-5000-MGT2/SPM2. Note that this feature is best used inconjunction with the CPU Protection feature also provided in the 6.0.0r2 release.

ScreenOS Release Notes

11

Note that CPU profiling is independent of vsys, is not synced between NSRP
peers, and is not supported in IPv6. CPU profiling does support Transparent
mode.
The table below indicates how the CPU profiling feature defines critical andnoncritical traffic.
Critical1

Critical traffic includes Management Traffic and Routing Protocol Traffic

Noncritical

2
3
4
5

BroadcastNon-first packet
First packet
Other

NSRP Security Module Monitoring

NSRP configuration options in this release include weighted security module
monitoring. Security module (sm) monitoring can be set in an NSRP cluster toensure that security modules are active and to fail the device if a particular
security module fails. If your device includes security modules and any module
fails, you can set a weight for each module failure. This gives you the flexibility of
deciding whether an entire device should fail if a particular security module onthat device fails. To set a failure weight for a security module, run set nsrp
monitor sm <x> weight <num> in the CLI. The default security module
monitored weight is 255.
ISG-IDP Flow Enhancements

ISG-IDP device policy implementation has been changed to improve CPU andmemory usage. The management module will no longer perform an infinite loop if
communication with a security module fails. A timer is used to try to resend thepolicy for a predetermined period (60 seconds). If communication fails
continuously for 60 seconds, the management module will treat this condition asa policy push failure and send the status back to NSM.
ISG-IDP devices do not handle of out-of-memory errors more gracefully. Before
compiling a policy, the amount of memory required to compile that policy isestimated. If it is determined that the free memory available is insufficient, thepolicy compilation will fail immediately, rather than failing to an irrecoverable
state later in the process.
Lastly, in the event of a policy-compile failure on at least one security module, themanagement module will send a compile cleanup message to all security
modules. Upon receiving the compile cleanup message, if the current active

ScreenOS Release Notes

12policy has previously been unloaded, then IDP will restart on the security module.
Otherwise, memory used by the new compiled policy, if any, will be freed up.

New Features and Enhancements Introduced in 6.0.0r1
The sections below describe new features and enhancements introduced in the
ScreenOS 6.0.0r1 release.
Hardware Features
Hardware features introduced in the ScreenOS 6.0.0r1 release are as follows:
16-port 10/100/1000 uPIM

The 16-port 10/100/1000 universal Physical Interface Module (uPIM) is
supported on the SSG 140, SSG 500-series, and SSG 500M-series security
devices and provides connectivity to copper-based gigabit Ethernet LANs. ThisPIM also supports up to eight bridge groups (bgroups), which let you groupseveral Ethernet interfaces together. Connect to the module using CAT-5 cable.
If you are using this module, see "PIM Power and Thermal Requirements" in the
Limitations section.
8-port 10/100/1000 uPIM

The 8-port 10/100/1000 uPIM is supported on the SSG 140, SSG 500-series,
and SSG 500M-series security devices and provides connectivity to copperbased gigabit Ethernet LANs. This PIM also supports up to four bgroups, which
let you group several Ethernet interfaces together. Connect to the module using
CAT-5 cable.
If you are using this module, see "PIM Power and Thermal Requirements" in the
Limitations section.
6-port GE SFP uPIM

The 6-port small form factor pluggable (SFP) uPIM is supported on the SSG 140,
SSG 500-series, and SSG 500M-series security devices and provides
connectivity to fiber-based and copper-based gigabit Ethernet LANs. Non-Juniper
SFPs are not currently supported by Juniper Networks Technical AssistanceCenter (JTAC). This PIM also supports up to three bgroups, which let you groupseveral Ethernet interfaces together. Connect the module using the appropriate
cable type depending on the specific media used: single-mode or multimodeoptical cable for SX and LX, and CAT-5 cable for the copper transceiver.
Synchronous Serial Mini-PIM for SSG 20

The synchronous serial Mini-Physical Interface Module (Mini-PIM) is supported
on the SSG 20 security device and provides connectivity to serial network media
types. Its dedicated network processor forwards traffic to the SSG 20 CPU,
where traffic decisions are made based upon the security policy.
ScreenOS Release Notes

131-port GE SFP Mini-PIM for SSG 20

The single port SFP Mini-PIM is supported on the SSG 20 security device andprovides connectivity to fiber-based and copper-based gigabit Ethernet LANs.
Non-Juniper SFPs are not supported by JTAC at this time. Connect the moduleusing the appropriate cable type depending on the specific media used: singlemode or multimode optical cable for SX, LX, FX, or BX, and CAT-5 cable for thecopper transceiver.
E-3 Support

ScreenOS now supports E3 PIMs on the SSG 500-series platforms.
ADSL2+ PIM

The 1x ADSL2+ PIM (Annex A or Annex B) is now supported on the SSG 140,
SSG 520/550, and SSG 520M/550M platforms. The two new discrete multitone(DMT) standards supported are:•

ITU 992.3 (also known as ADSL2): supports data rates up to 1.2 Mbps
upstream and 12 Mbps downstream•

ITU 992.5 (also known as ADSL2+): supports data rates up to 1.2 Mbps
upstream and 24 Mbps downstream

G.SHDSL PIM

The G.symmetric high-speed digital subscriber line (G.SHDSL) PIM supports
multi-rate, high-speed, symmetrical DSL technology for data transfer between asingle customer premises equipment (CPE) subscriber and a central office (CO).
The G.SHDSL PIM is now supported on the SSG 140, SSG 520/550, and SSG
520M/550M platforms.
ScreenOS 6.0 supports the ITU G.991.2, Single-pair High-speed Digital
Subscriber Line (SHDSL) Transceiver discrete multitone (DMT) standard.
Virtual Private Network (VPN)
VPN features introduced in the ScreenOS 6.0.0r1 release are as follows:
AutoConnect-Virtual Private Network (AC-VPN)

AutoConnect-virtual private network (AC-VPN) enables spokes in a hub-andspoke VPN network to dynamically create VPN tunnels directly between eachother as needed. This not only addresses issues of latency between spokes but
also reduces processing overhead on the hub and thus improves overall network
performance. Because AC-VPN creates dynamic tunnels that time out whentraffic stops flowing through them, network administrators are freed from thetime-consuming task of maintaining a complex network of static VPN tunnels. All
devices must be running ScreenOS 6.0 or later.

ScreenOS Release Notes

14

Screen on Tunnel Interface

You can now apply any configured screens to tunnel interfaces. Traffic exiting
tunnels is examined before and after encryption. However, screens that currently
have limited support on the ASIC-based platforms will continue to have the same
limitations.
FirewallFirewall features introduced in the ScreenOS 6.0.0r1 release are as follows:
WebUI Enhancements

The Web user interface (WebUI) is improved to optimize work flow, display
diagnostic information, enhance the homepage, and categorize the menu
options.
FTP Get/Put Service Enhancement

This feature redefines the FTP-Put and FTP-Get service definitions used infirewall policies. In earlier ScreenOS releases, FTP-Put and FTP-Get wereconfigured together with different actions in a policy and service groups. In
ScreenOS 6.0, the enhancements for FTP Get/Put are as follows:•

FTP / FTP-Get / FTP-Put should not be in a single service group.

•

FTP/ FTP-Get /FTP-Put should not be defined for one single policy.

•

FTP-Get or FTP-Put is the same as FTP service in policies with denyaction.

•Description in WebUI enhanced.

Automated Data Gathering

This feature is a basic looping script consisting of get commands that run as a
background process, saving the output to a FIFO file in the flash. You may record
a series of get commands to gather information in the background, but not all get
commands are supported.
Note: Depending on the information gathered, CPU usage is affected.
Universal Threat Management
Universal threat management features introduced in the ScreenOS 6.0.0r1
release are as follows:
AV Scanning for IM Services

ScreenOS supports antivirus (AV) scanning for instant messaging (IM) services
such as AIM, ICQ, Yahoo! Messenger, and MSN Messenger. AV scanning is
supported for text/group chat messages and for file transfer/file sharing.

ScreenOS Release Notes

15

The following versions of the IM client and protocol are fully supported. Forward
compatibility on later versions of the IM client and protocol are supported on a
best-effort basis.
Instant Messaging
ServiceAIM and ICQ
Yahoo! Messenger

MSN Messenger(Windows XP)

Supported Protocol Versions
OSCAR generic service
version 4
Yahoo! Messenger Service Gateway
Protocol (YMSG) version 8, 9, 10
Mobile Status Notification
Protocol (MSNP) version 11, 12, 13

Supported IM
Client Versions
AIM 5.9.3861 to 5.9.6089
ICQ 5.04 to 5.1
Yahoo! Messenger 5.5.1228(v8.0.0.506 is supported as best
efforts)
MSN Messenger 7.5

All platforms require the high-memory option to run AV scanning. Supported
platforms are the SSG 5, SSG 20, SSG 140, SSG 320M/350M, SSG 520/550,
and SSG 520M/550M.
AV HTTP Trickling Enhancement

This feature enhancement is important for low-speed links. It allows you to
configure time-based thresholds to send bits through the firewall to preventbrowser timeouts when the device is receiving data or while the data is being
scanned by the internal AV engine.
IDP and GPRS
IDP and GPRS features introduced in the ScreenOS 6.0.0r1 release are as
follows:
IDP Enhancements

IDP provides the following enhancements:•

IDP recommended actions: You can now allow recommended actions in
IDP rules. If you specify “recommended” as the action in a rule, therecommended action will be applied in cases where you do not specify anaction within a policy rule. If you specify an action within a policy rule, itwill take precedence over the recommended action.

•

VLAN groups for L2 vsys: VLAN groups for L2 vsys are now supported
on the ISG 1000, ISG 1000-IDP, ISG 2000-IDP, and NetScreen-5400
devices.

•

IDP inspection of GTP-encapsulated and GRE-encapsulated traffic:
The ISG 1000 and ISG 2000 with IDP can now inspect traffic that is
encapsulated in GPRS tunneling protocol (GTP) and generic routing
encapsulation (GRE).

•IMSI information in NSM logs: NSM IDP logs now contain International
Mobile Subscriber Identity (IMSI) data on IDP security devices. This

ScreenOS Release Notes

16

information allows you to specifically identify the end user for threats andattacks that are detected during forensic evaluation using the provided
subscriber-level identifiers.
•

IDP Detector.so has been updated to IDP 4.0: The IDP 4.0 engine has
been synced to ScreenOS 6.0. You will now have the same detection
capabilities on ISG 1000/ISG 2000 with IDP as you do on the standalone
IDP 4.0 devices.

•

DSCP marking based on application marking: You can now change the
DSCP marking of a packet based on IDP actions performed on the ISG
1000/2000 with IDP. This will allow upstream and downstream devices toprioritize traffic based on IDP rules.

•

Troubleshooting IDP: You can use the get sm tech-support command
to gather IDP configuration and statistics to troubleshoot IDP security
modules.

Authentication Service Enhancements

ScreenOS authentication service provides the following enhancements:•

Added user IP address to authentication logs•

Support for TACACS+ authentication servers•

Prioritized authentication between external server and local database•

Increased number of permitted administrator IP addresses•

Enhanced RADIUS features•“Framed-pool” support (IP pool supplied by RADIUS server, not local
device)•Customizable interface description

Virtual Systems
Virtual systems features introduced in the ScreenOS 6.0.0r1 release are as
follows:
Virtual System Enhancements

Virtual systems provide the following enhancements:•

Increased virtual system support on ISG 1000 and ISG 2000 devices:
The ISG 1000 and ISG 2000 security devices now support additional
virtual systems (vsys). The ISG 1000 now supports up to 50 vsys
(increased from 10). The ISG 2000 now supports up to 250 vsys
(increased from 50). To take advantage of these increases in vsys
support, you must install a new license key.

ScreenOS Release Notes

17•

Virtual system names: Vsys names can contain up to 20 characters.
Previously, vsys names could contain up to 10 characters.

Network Address Translation
Network address features introduced in the ScreenOS 6.0.0r1 release are as
follows:
DIP Pool Enhancement

The number of dynamic Internet Protocols (DIP) pools per vsys is increased to1020 on all platforms. For low-end platforms, the maximum number of DIP pools
is 1000; and for some high-end platforms supporting vsys, 51K for ISG 1000 and
64K for NetScreen 500, NetScreen-5000, NetScreen 5400, and ISG 2000.
NetScreen Redundancy Protocol
NSRP features introduced in the ScreenOS 6.0.0r1 release are as follows:
NSRP Dynamic Route Synchronization

ScreenOS 6.0 now supports dynamic route synchronization. You can sync
Dynamic Routing Protocol (DRP) routes in an active-passive NSRP cluster.
In the event of a failover, the new active device can use the backup routes while
it establishes peering relationships.
Layer 2 Transparent Mode
Layer 2 transparent mode features introduced in the ScreenOS 6.0.0r1 release
are as follows:
VLAN Retagging

VLAN retagging provides a way to selectively screen VLAN traffic. You place a
security device in parallel with your Layer 2 switch and configure the switch todirect to the security device only traffic from VLANs you want screened. Traffic toand from your other VLANs continues to pass directly through the switch, thus
avoiding any impact to throughput that might be caused by passing all VLAN
traffic through the security device. This is currently only supported on NetScreen5000 series devices.
UAC
UAC features introduced in the ScreenOS 6.0.0r1 release are as follows:
Infranet Authentication

The Infranet authentication includes the following enhancements:•

Visual display of auth table entries in the WebUI: This feature allows
you to view the users with active auth table entries (displays the User,
Source IP, and Roles).

ScreenOS Release Notes

18

•

Additional actions field for infranet auth policies: This feature,
available with UAC 2.1, permits the Infranet Controller to control additional
policy actions (AV, DI, logging, Web filtering, and antispam) on a per-rolebasis. This allows you to make policy decisions such as activating AV for
partners or untrusted machines, or turning on Web filtering for specificroles.

•

Increased number of auth table entries
Devices

Auth Table Entries

SSG

10,000ISG

50,000NS-5000 series

50,000Feature Extensions
Feature extensions introduced in the ScreenOS 6.0.0r1 release are as follows:
Jumbo Frames

Jumbo frames are supported on the ISG 1000 and ISG 2000 devices without
IDP. To enable jumbo frames, use the set envar CLI command and set
max-frame-size to any value from 1515 through 9830 inclusive; for example,
set envar max-frame-size=7500. When you enable jumbo frames and restart
the security device, only interfaces on the 4-port SFP IO card, plus the
management Ethernet interface, become active. Use the get envar command toshow the max-frame-size setting. Use the unset envar max-frame-sizecommand to disable jumbo frames support and return the device to the normal
maximum frame size (1514 bytes).
Jumbo frames are also supported on the NS-5000 series running MGT2 andSPM2 cards. Limitation: DI and IDP are not supported in Jumbo Frames mode.
Bridge Groups for Ethernet Ports on SSG Devices

Bridge groups (bgroups) let you group several Ethernet interfaces together.
Starting with ScreenOS 6.0, the SSG 140 security device is preconfigured withthree bgroups to which you can add the built-in Ethernet ports. New uPIMs
support bridge groups on all SSG devices. Limitation: SSG500/500M-series do
not support bgroups on the built-in Ethernet ports.
DHCP Relay Flow

No DHCP Relay: By default, ScreenOS relays DHCP request packets from allzones except the V1-Untrust zone and V1-DMZ zone. Enable this feature toprevent relay of DHCP request packets from a specified zone.

ScreenOS Release Notes

19

Layer 2 Vsys

Layer 2 vsys is now supported on the ISG 1000, ISG 1000-IDP, ISG 2000, ISG
2000-IDP, and NetScreen-5000 series devices.
Management IP Address Limit Increased

The total number of IP addresses from which a security device can be managed
is increased to 50 plus 1 times the number of virtual systems. By making thenumber of manager IPs a function of the number of vsys, memory is not wasted
on low-end devices that require relatively few manager IPs, while high-end
devices are not restricted to an artificially selected number.
PPU Enhancement

To increase throughput, TCP-SYN-Bit checking is now done in the
Programmable Processing Unit (the ASIC) and supported on the NetScreen
5200 and NetScreen 5400.
DSCP Enhancement

Differentiated Services Code Point (DSCP) marking is now supported on the ISG
1000 and ISG 2000 with IDP and on the NetScreen 5200/5400.
Universal Serial Bus Support

Universal Serial Bus (USB) ports allow file transfers such as device
configurations, user certificates, and update version images between an external
USB storage device and the internal flash storage. USB functionality is available
on SSG devices.
The following USB flash drives have been tested and found to work properly with
SSG devices:•

Lexar JumpDrive Firefly 1GB•

Kingston Datatraveler 2GB•

PNY attaché 256M•

SanDisk Cruzer Micro 512M

Some other USB flash drives have been found to not work properly with SSG
devices.
Coredump and Logs to USB Port

ScreenOS supports full coredump file, logs, and full memory dump file transfers
to the USB port on the SSG 5 and SSG 20 and USB ports/compact flash cards
on the SSG 140, SSG 500-series, and SSG 500M-series security devices.

ScreenOS Release Notes

20

IPv6 Support

IPv6 is now supported on the following security devices:•

NS-5000 series using 5000-M2 management module•

SSG 5/SSG 20: IPv6 support is available on Ethernet interfaces. (IPv6 is
not supported on wireless or WAN interfaces.)

Changes to Default Behavior
The sections below describe changes to default behavior introduced in
ScreenOS 6.0.0 releases.

Changes to Default Behavior Introduced in 6.0.0r6
This section lists changes to default behavior in ScreenOS 6.0.0r6 from previous
ScreenOS firmware releases.
AV Scan Engine
The AV scan engine has been upgraded to the latest version.

Changes to Default Behavior Introduced in 6.0.0r3
This section lists changes to default behavior in ScreenOS 6.0.0r3 from previous
ScreenOS firmware releases.
USB Boot Sequence
When converting an SSG 300M-series device from ScreenOS to JUNOS, apply
the set boot junos command. This command changes the boot sequence toboot from the USB instead of from the Primary CF card.

Changes to Default Behavior Introduced in 6.0.0r2
This section lists changes to default behavior in ScreenOS 6.0.0r2 from previous
ScreenOS firmware releases.
Max Dialing Interval Default
The maximum dialing interval has changed from 60 to 600 seconds. This
resolves an issue in previous releases regarding the dialing interval in thatsometimes dialing failed but the device did not wait long enough and instead
redialed almost immediately.
CPU Protection and Utilization Profiling
As a result of implementation of CPU protection and utilization profiling featuresin this release, the set firewall ppu command is now hidden and nonfunctioning.
ScreenOS Release Notes

21

Systems that currently have the command set will lose the setting whenupgrading to this release.
TCP-SYN-Check Packet Flow
In previous ScreenOS releases, all three handshake packets (SYN, SYN-ACK,
and ACK) were sent to the CPU when you set TCP-SYN-Check. This was thecase for single-ASIC, dual-ASIC, and multi-ASIC platforms. With the 6.0.0r2
release, only the first packet (SYN) will be sent to the CPU with the following two
packets (SYN-ACK and ACK) processed by the PPU (ASIC) when you set
TCP-SYN-Check.
Infranet Auth Object Cleanup
In releases prior to 6.0.0r2, infranet auth table entries were removed as soon asconnectivity with the Infranet Controller was lost. In this release, infranet authtable entries remain for two minutes while the device attempts to reestablish aconnection to the Infranet Controller.
When combined with Infranet Controller changes scheduled for release in UAC
2.1, the delay in removing auth table entries allows for better failover in Infranet
Enforcer and Infranet Controller clusters.
Infranet Auth Cold Start NSRP Synchronization
In releases prior to 6.0.0r2, infranet auth table entries were synchronized
between nodes in an NSRP cluster as long as both nodes were up andcommunicating with each other. Any infranet auth table changes that occurred
while one node was down, however, would not be seen by the other node.
In this release, the infranet auth table entries are synchronized between the two
nodes of an NSRP cluster when they start communicating with each other.
Infranet Controller and Management IP
In releases prior to 6.0.0r2, it was not possible to use an interface with amanagement IP configured to communicate with the Infranet Controller. This was
because the NACN message was sent from the non-management IP, and theInfranet Controller would attempt to ssh back to the Infranet Enforcer using thenon-management IP, resulting in a failed connection.
In this release, the management IP (if configured) is used to send NACN
messages to the Infranet Controller.
Removing Denied Sessions on Auth Table Change
In releases prior to 6.0.0r2, upon removal of an infranet auth table entry, allassociated sessions were terminated. However, other changes to the infranet
auth table or infranet auth policies had no effect on existing sessions. In thisScreenOS Release Notes

22release, when an infranet auth table entry changes, all of its associated sessions
are reevaluated. Any that are no longer allowed are terminated.

Changes to Default Behavior Introduced in 6.0.0r1
This section lists changes to default behavior in ScreenOS 6.0.0r1 from previous
ScreenOS firmware releases.
TCP-SYN-Check Default
The default for NS-5200/5400 devices is set flow tcp-syn-check, which includes
both SYN-bit check and a three-way handshake. In ScreenOS 6.0.0r1, thedefault is set tcp-syn-bit-check.
RADIUS Attributes
In ScreenOS 6.0.0r1, both calling-station and called-station IDs are supported as
default behavior.
IP Option Packets
The IP option packets (record-route and timestamp) in ScreenOS 6.0.0r1 are notdropped. All four IP option packets (record-route, timestamp, security, andstream) behave consistently.
Coredump to USB
The maximum file size limitation for the coredump file is removed. The maximum
USB size supported is 1GB.

Addressed Issues
This section describes addressed issues with the current release and includes
the following sections:•

Addressed Issues in ScreenOS 6.0.0r7—lists issues from earlier
releases that are fixed in this release.

•

Addressed Issues in ScreenOS 6.0.0r6—lists issues from earlier
releases that are fixed in this release.

•

Addressed Issues in ScreenOS 6.0.0r6—lists issues from earlier
releases that are fixed in this release.

•

Addressed Issues in ScreenOS 6.0.0r5—lists issues from earlier
releases that are fixed in this release.

•

Addressed Issues from ScreenOS 6.0.0r4—lists issues from earlier
releases that are fixed in this release.

ScreenOS Release Notes

23•

Addressed Issues from ScreenOS 6.0.0r3—lists issues from earlier
releases that are fixed in this release.

•

Addressed Issues from ScreenOS 6.0.0r2—lists issues from earlier
releases that are fixed in this release.

Addressed Issues in ScreenOS 6.0.0r7
The following operational issues were resolved in this release.
Administration
•
•
•
•
•
•
•

258225—The admin-preferences of the local DNS defined via the CLI are
reset when any changes are made to DNS setting via the WebUI.
259735—Incorrect information was shown on the multilink and serialinterface SNMP report for MTU, link status, operation status and linkspeed.
260995—The debug buffer may intermittently log messages even though
there are no debug commands running.
261597—[NetScreen-5GT] Unable to set the interface ethernet2 to Nullzone.
278125—When there are multiple policies using the same SRC/DST IP
and ports, and one is disabled, and one of the address book objects is
modified, the device may reset.
283897—SNMP counters for multilink interfaces are zero instead of NULL.
292227—[SSG 140] Device could not load OS after a restart.

Antivirus
•
•
•
•
•
•

225931—ICAP AV may fail with error code 3 when it runs out ofconnection objects due to incorrect freeing of ICAP connection.
226847—AV drops SMTP traffic when the SMTP server uses the BDAT
command.
263806—Some of the .exe files could not be scanned by the AV engine.
282592—Enabling AV as an http proxy in transparent mode causes thepackets to use the MAC address of the VLAN interface as the source
MAC address.
293490—In a Web proxy environment, the URL might print twice in theevent log when AV is enabled.
295023—With AV enabled, when a non-written memory page was freed
up, the device failed.

CLI•

262912—The Sync Serial card shows up as JXM-1BRI-ST in the getchassis command output.

ScreenOS Release Notes

24

•271022—Erroneous Tx and Rx counters appear when issuing a "get int
serial extensive" command.

DHCP
•

•
•

263924—When using a PPPOE interface with a DHCP IP address as thetunnel outgoing interface, the VPN tunnel session still has the old dynamic
IP address after the new address has been assigned or the firewall isrestarted.
282543—In certain situations, the device is not able to send a DHCP
client request.
305504—In transparent mode, the CLI "set zone <name> no-dhcp-relay"
does not cover the DHCP server service.

DNS•

215889—DNS queries are sent to the dynamically-learned DNS servers,
even though the DNS servers have been configured with an admin
preference of 255.

GPRS•

270890—When GTP Sequence Number Validation was enabled, the GTP
traffic was dropped due to "bad sequence number" after two NSRP
failovers.

HA and NSRP
•
•
•
•
•
•
•
•

226031—Only the first IP Pool gets synchronized to the backup device.
250504—A conflict over multiple tracked gateway routes caused thedevice to fail.
252645—Gratuitous ARPs for the secondary IP address on an interface
did not work.
253291—Unable to configure redundant interface as NSRP secondarypath.
264768—Configurations are out of sync due to PBR out of order "setmatch-group" commands.
274997—The commands "set sm enable" and "set sm disable" were
erroneously being synchronized to another member in an NSRP cluster.
275367—Traffic failed to pass over failover of NSRP in transparent modedue to virtual MAC for the vlan1 was not being used.
287173—Adding a new username/password causes the NSRP
configuration to go out of sync.

ScreenOS Release Notes

25

•
•
•

288925—NSRP configurations go out of sync after unset multiple objects
are applied in a multi-cell policy.
289119—Creating interface description causes NSRP configurations to goout of sync.
298021—NSRP configurations may go out of sync if the DNS server
specifies an src-interface, which is a local interface, instead of a VSI
interface.

IDP
•
•
•

261391—[ISG with IDP] SM client and server vectors were being written
to dbuf stream when debug flow was run.
270319—[ISG with IDP] The IDP process restarts when updating a policy
with attacks that was previously configured with no attacks.
292041—False positive detection can occur when accessing some of the
web sites with a particular combination of DI policies.

Management
•
•
•
•
•
•
•
•
•

217312—Updating devices from NSM using supplemental CLIs may
cause the cluster members to show incorrect status.
226236—A device was unable to re-establish connection to NSM after aservice disruption.
252783—The 64-bit counter on an interface showed incorrect information
after the command "clear counter" was performed.
255035—Redundant subinterfaces could not be imported properly fromNSM.
261465—Custom web filtering profile does not get saved to config file.
262697—In certain conditions, the device may reset when a policy ispushed from NSM.
273424—Under certain conditions, a device update after the creation of a
new custom vsys using NSM results in an "unknown keyword unset" error.
273959—Unable to add an object to an already existing multi-cell policy.
290562—Unable to determine the BGP aggregate status within NSM.

NAT
•
•

233490—RTSP ALG does not translate addresses properly when in NAT
mode.
288045—VIP on loopback interface that contains a serial interface does
not log traffic, and AV and anti-spam scanning will not occur.

ScreenOS Release Notes

26

Other
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•

224161—HDLC debug output was being sent to the dbuf buffer when any
debug flow was enabled, making troubleshooting difficult.
235777—The command "unset admin hw-reset" was not saved to theconfig file after a reset.
240577—Device may reset under certain traffic pattern conditions.
250703—The device fails when handling IPv6 with a NULL IP header.
252082—The FTP session for an IPv4 to IPv6 session connects, but theclient's FTP session freezes when FTP get, put, and ls commands areentered.
252398—Wireless connection instability occurs when using 802.1x withIntel Pro/Wireless NIC with 802.1x auth.
255301—The TCP socket leak causes lost SSH management and BGP
peering, which results in high task CPU utilization.
256941—The webauth.html Web page generated by ScreenOS for Web
Authentication contains some script errors.
257979—Device fails when the interface is not enabled for BGP; theadministrator requests TCP reconnection with BGP neighbor.
261543—[NetScreen-5000-MGT2] Issuing the command "get bridge word0" may cause the firewall to reset.
262894—Device fails to connect to Websense server after the Websense
server IP address has changed.
263850—The data packets were dropped because the FTP ALG did not
create the child sessions correctly for the cross-vsys flows.
267114—All permitted URLs are logged twice in the device event log
when the URL filtering is enabled.
267255—The unset ALG setting is not saved after reset.
267767—Running "get dbuf stream" prints the message "return due tosuspect loop" with any debugs specified.
267915—Incorrect address was read during processing because of acorrupted memory location.
268860—Traffic logs sent to syslog are displaying incorrect dst port
values.
269018—After enabling DI, when a syn-flood is detected, the device may
restart.
272338—[SSG 5/20] After upgrading the boot loader, the memory trace isprinted on the console at startup.
273021—The connection between the firewall and the external Surfcontrol
server was lost randomly several times a day.
274187—Under certain circumstances, the first SYN packet is notmatching the policy.
276077—Non-RPC MS Exchange traffic is dropped due to incorrect
timeout.
281722—A device reset occurred when running "debug ike" and "unset
console dbuf".

ScreenOS Release Notes

27

•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•

282781—High task CPU utilization occurs when CTL+C is typed whiledisplaying traffic logs in a CLI session.
283355—The "Unsupported command - set interface vlan1 nat" message
is displayed during startup.
285252—When traffic shaping is enabled, the MAC address is shifted on
the subinterfaces.
288525—[NetScreen-5000 M2A 2XGE] TCP cross-chip sessions
erroneously have a session timeout of 20 seconds.
288625—A policy modification via NSM may cause a device reset.
288938—The backup interface in a redundant interface setup iserroneously forwarding packets, causing duplicate packets to be sent.
289413—WLAN LED does not turn off when all wireless interfaces areshut down.
289435—[SSG 140] In transparent mode, the device may not passthrough traffic when a host moves from one interface to another in thesame zone.
289724—SIP calls are not cleaned up properly when the transaction timer
expires, resulting in operation failure.
290478—Packet is dropped due to internal congestion control
mechanism.
290501—After formatting the Compact Flash (CF) card, the set core-dump
command will freeze if there is not enough space on the CF.
296338—An SFP LX transceiver plugged into a 6GE-SFP-S is detected
as a non-Juniper 1GE SX transceiver.
296850—RTSP media flow is disconnected after about a minute.
305571—Packet drop may occur due to SYN check errors when using
combination of aggregate interface and cross ASIC traffic.
271025—Memory allocated while checking the Certificate Revocation List
(CRL) is not released properly once the check is complete.
271349—With a low-quality connection, PPPoE may stop responding
during negotiation.
289422—The device incorrectly identified some of the 1GE SXtransceivers as LX transceiver modules.

Performance••••

252920—The device may experience high CPU utilization in certain
conditions.
254058—Bandwidth testing site via web shows lower bandwidth thanactual upload speed.
259126—Packet loss and TCP retransmissions occur when performing filetransfers across T1 WAN interface.
264366—UDP flooding is detected and the packets are dropped evenwhen the pps rate is less than the specified threshold.

ScreenOS Release Notes

28

•
•
•
•

266522—[NetScreen 5000 and ISG series] L2TP traffic was handled in
the software, causing high CPU utilization.
282948—In a multicast environment, the backup device exhibits high CPU
utilization.
283200—In certain situations, the device tags the packet incorrectly,
causing traffic not to pass.
307727—[NetScreen-5000] TCP cross-chip sessions erroneously have asession timeout of 20 seconds when there is non-cross-chip TCP
background traffic and TCP SYN check is enabled.

Routing•••••

223180—Multicast traffic was not forwarded to both spokes in a hub-andspoke VPN.
263665—Routes learned via OSPF are not propagated to NSSA LSA after
NSRP failover is done.
264800—The default route advertised via BGP by the ISP's upstream
router was not propagating into the device's route table.
267357—Permanent route attributes are not being exported from one VR
to the other.
268471—BGP stops advertising the tunnel's static route after a reset.

VoIP
•
•
•

253259—In certain situations, the call setup was not successful whenusing the SIP ALG.
271315—SIP ALG did not support LWS.
289774—H.323 outgoing calls fail when DIP-Incoming is configured forincoming calls.

VPN
•
•
•
•
•
•

235321—IKE Phase 2 renegotiates before the Phase 2 lifetime expires.
254357—Pings through VPN are dropped when IPSec SA is 0.
255512—The command "unset ike policy-checking" is applied only per
device, and not per VPN.
263126—The device did not send an Account-Stop message for the old
Phase1 SA.
266573—The traffic shaping attributes are not inherited by the tunnel
interface, if the physical interface that is bound to a VPN tunnel interface ispart of a multilink interface.
279789—In some network topologies, VPN monitoring may bring the VPN
tunnel down.

ScreenOS Release Notes

29

•
•
•
•
•
•
•
•
•

280101—Dial-Up VPN traffic was dropped due to a change to the IP
address on the dialup client.
282564—Multiple dial-up VPN users cannot login if the name in thecertificate is similar to the previous user.
285743—The IKE-ID type with numeric IKE-ID from a third-party VPN
device is interpreted incorrectly during Phase1 negotiation.
285748—[NetScreen-5000] IPSec pass-through packets are being
dropped when the device is in transparent mode.
285935—VPN packet drop occurs due to traffic looping when aggregateinterfaces are used on the device.
286723—Phase 2 SA is incorrectly removed during VPN negotiation withXauth enabled.
287368—IP configuration from RADIUS such as the DNS server setting
may not be configured properly to the XAUTH client.
288633—More than one IPv6 Dial-Up VPN may cause the device to reset.
291524—VPN traffic drops if the outgoing interface is a loopback interface
and traffic shaping is enabled.

WebUI
•
•
•
•
•
•
•
•
•
•
•

227316—Unable to configure DHCP on an interface from a trustee adminuser via the WebUI.
258522—Policy list in the root vsys may be blank when viewed from the
WebUI.
262479—The Apply function on the Admin Management page failed
because the "Enable Web Management Idle Timeout" option wasincorrectly offered to the Read-Write admin account.
262490—Unable to manage a device from an untrust interface via atrustee admin via the WebUI.
262827—Deleting an aggregate subinterface via the WebUI erroneously
issues a warning that you are about to remove one aggregate interface.
265413—Unable to specify the u-fqdn IKE-ID type when creating a DialUp VPN User.
267521—The "Bypass authentication" option for XAuth cannot be
configured via the WebUI.
277867—The RP Proxy setting is not removed when its corresponding RP
Candidate is deleted via WebUI.
279141—VPN policies created with the WebUI are paired up incorrectly.
281505—In an NSRP environment, a fault error message "IP conflict" isshown in the WebUI when accessing a backup device to configure aninterface.
289628—Unable to define an Address Group via the WebUI for zones thathave an ampersand symbol in the name.

ScreenOS Release Notes

30

•
•
•
•
•

291948—If the device has many event log entries, refreshing the main
WebUI page or the report page using Report > System Log > Eventcauses high CPU utilization.
293497—The WebUI shows a lower number of exported rules than it
should.
293528—In rare occasions, the device may restart during HTTPS WebUI
access.
293998—In the WebUI, some alarm level events cannot sort by log level
correctly.
296058—The WebUI does not allow you to create a MIP with a different
subnet mask than the interface.

Addressed Issues from ScreenOS 6.0.0r6
The following operational issues were resolved in this release.
Administration•

223139—Task CPU becomes high when executing some CLI commands
with a large configuration, which triggers high overall CPU utilization, andreaches the alarm threshold.

•239747—The syslog message incorrectly shows that the action is deny,
but traffic is permitted.

•

256694—Negate policy doesn't work properly when policy has overlapping
addresses in src or dst address.

•

262685, 267506—Bridge Group interfaces would not go to full duplex,
even when the bgroup members are hard-coded to full duplex.

•

267997—Incorrect ifIndex in link-up/link-down SNMP trap for redundantinterfaces occurred.

•

273937—WebUI to an interface is accessible, although "IP Manageable"
is disabled on the interface.

•275288—Device restarts when MIP configured with incorrect mappingfrom IPv4 to IPv6.

•

282163—TFTP traffic sourced from the loopback interface fails.

ScreenOS Release Notes

31

Antivirus•

263166—With AV enabled, FTP data may freeze or fail.

•266736—With Antivirus enabled, an email containing certain characters
may cause the POP3 or SMTP session to freeze.

CLI•

227658—The device could fail after issuing the unset service any
timeout never command.

•

241267—[SSG] Output from get chassis was not included in the gettech-support output.

•

241551—[SSG 140] The get led CLI command does not show any
information.

•

271297—The get perf session detail command did not display thecorrect values.

GPRS•

224423—If a timeout is configured in one GTP object, this timeout is used
for all GTP objects.

•

260243—When disabling the rate limit in a GTP object configuration, thelimit was not actually disabled.

HA & NSRP•

227657—The syslog src-interface option is incorrectly being synchronized
to the backup device in an NSRP cluster.

•

227665—The NSRP vsd-group track-ip method CLI command is lost after
a reset.

•251157—An NSRP cluster member received a corrupted HA message,
causing the device to reset.

•

258989—[NetScreen-5000] Traffic is not forwarded when the packets arereceived on an aggregate interface of the backup VSD in an NSRP
Active/Active cluster due to the TCP SYN check failing incorrectly.

•

262533—[SSG 140] Alarm LED on the device was not displaying correctly
when an NSRP failover event occurred.

•

262695—NSRP failover may cause some VPNs to fail.

•263019—ARP entry to a non NSRP management zone causes track IP
failure after failover in transparent mode.

•

267734—The primary ISG does not read the sequence number correctlyfrom the ASIC for AES after failover.

ScreenOS Release Notes

32

•268708—Traffic fails to pass after failover of a NSRP pair with devices
configured in transparent mode.

•

268809—When no-session-backup is enabled on a policy, traffic throughthe serial interface stops passing.

•276418—When VSD-less NSRP and session ageout acknowledgement isconfigured, the CPU utilization of both devices in the cluster can become
high.

•

280217—[NS-5000, ISG] When the device is in Active/Passive NSRP
cluster, under a particular circumstance after a preempt primary device isreset, traffic via VPN is dropped by its VPN peer.

•282261—NSRP failover from the backup to the primary taking longer than
expected.

IDP•

225502—[ISG with IDP] The IDP drops legitimate HTTP traffic for verylarge HTTP downloads.

•

239575—When both tcp-syn-check is set and IDP is enabled in the policy,
the ACK packet of a 3-way handshake is dropped when ISG is intransparent mode.

•

260215—When profiling smaller networks, the profiler on an ISG-IDP is
not detecting new events and is not updating old ones.

•

292564—[ISG with IDP] The IDP Security Module restarts when updatinga policy with attacks that was previously configured with no attacks.

Management•232391—With IPv6, unable to ping management interface of ISG, evenwhen in the same subnet.

•

236724—Even with disabled HTTPS WebUI administration (via port 443)
and DNS Proxy (port 53) on Untrust interface, no VIP could be properly
created using interface-ip in the same Untrust interface.

•253800—In the case of aggregate and redundant interfaces, theifAdminStatus and ifOperStatus are reported incorrectly.

•

254755—Unable to upgrade device via Secure Copy (SCP) using PSCP
(Putty SCP).

•

259602—[SSG 320/350M] The get chassis command incorrectly displays
the CPU temperature as I/O temperature.

•259773—[SSG 140] When doing an SNMP get to the device, an incorrect
sysObjectId is returned.

ScreenOS Release Notes

33

•260188—The device is only able to send 400 to 500 logs per second to
NSM.

•

260988, 271129, 281995—In some cases, all management access may
be lost except through the console.

•

261714—The NSRP failover event log is not sent to the syslog server.

•

266159—[SSG 140] SNMP MIB walk shows up as SSG-240, instead of
SSG-140.

•266873—In the event log, when the number of telnet and ssh connections
to a device are higher than its display limitation, the log entries of thetelnet-cmd number and ssh-cmd number are incorrectly displayed.

•

267372—The SNMP trap (OID) of the interface status is not correct.

•

269298—An invalid command appeared in the CLI: "exec admin".

•

270999—The hardware counter for out bytes always shows zero on the
management interface.

•283019—Changes to the GRE tunnel interface MTU do not get saved tothe configuration file.

NAT•

252031—Creating an IPv6-based MIP sometimes results in a "One IP in
range [ ] is in use" error.

•

258279—Under certain circumstances, when using duplicated DIP IDs
among different virtual systems, the existing mapping entries may beremoved from both virtual systems when the DIP pool is removed fromone virtual system.

•

267994—CPU utilization is high after Virtual IP (VIP) is configured.

Other
•

224782—The transmit and receive counters on an HA interface between
two NSRP peers shows a mismatch, due to an incorrect byte count.

•

226075—[ISG 1000/2000, NetScreen-5000-8G2/8G2-G4] Device sending
two ESP packets with the same sequence number.

•

235311—Transmission of the multicast data stream might stop for a while
when handling a PIM fragment packet.

•

239594—The device may fail when AV is enabled and AIM traffic ispassing through.

•240625—Memory utilization is high due to DI session leak when SYN
protection is enabled.

ScreenOS Release Notes

34•241107—When sending RST to tear down the connection, the reason islogged as Close - AGE OUT.

•

251259—Some http clients generated extra CRLF after a POST request,
which might cause an out of memory situation when using URL filtering.

•

252224—The wireless client reports a different link speed than what thedevice reports.

•

252613—When a second user attempts to authenticate via WebAuth while
the first user is still active from the same IP address and the sameauthentication group, the device keeps sending authentication requests to
the RADIUS server.

•

254140—NFS mount fails due to rpcbind service erroneously being added
to the RPC mapping table.

•

254935—Serial PPP connection fails authentication when once configured
as backup.

•

256010—The device outputs a WebTrends log with an improper format.

•

256783—Device failed due to mishandling of null pointer.

•

258051—[ISG 2000] In some cases, fragments arriving at the firewall will
be given an invalid hardware address, causing the device to drop them.

•

260087—PPTP traffic not working properly when source nat policy isenabled.

•260307—Under certain conditions, the firewall seems to be corrupting
UDP checksums.

•

260626—[SSG 300] Device unable to pass packets greater than 1,468
bytes across an 802.1q tagged subinterface.

•262448—The exec policy verify command was not working when empty
address groups are used in the policies.

•

262450—The WebAuth login page contained a script error after entering auser name.

•263585—In certain situations, traffic for which NAT is performed and thatuses the H.323 ALG caused the device to reset.

•

264263—Device failed due to Null pointer access in sunrpc.

•

265230—[SSG 140] The alarm LED on the device incorrectly displays as
amber, instead of red, when an attack was detected.

•

265446—SQL data session times out incorrectly; only half of the service
timeout is used.

•

266244—The IPv6 network advertisement solicitation flag was set
incorrectly.

ScreenOS Release Notes

35•266875—Interface MAC did not change correctly when the VSI interface
was assigned to the mgt zone.

•

267370—When generating a syslog message, the source port anddestination port are incorrectly interpreted from the event log.

•

267891—URL filtering did not have a null pointer, which caused thedevice to reset.

•

269121—GRE keepalive is dropped when the recursion control bit is set.

•269668—Deleting multiple virtual systems at one time may prevent traffic
from passing through other virtual systems.

•

269922—With IPv6, an incorrect ICMP message is generated when thepolicy is configured with action reject.

•270600—[UAC] Device failed due to policy push from IC without role
name.

•

273879—Authentication entries in a pending or fail state, fails to becleared.

•274973—When get vr trust protocol pim rp proxy is executed, an
exception dump may occur.

•

279407—Memory leak occurred when a second user from the same usergroup is authenticated.

•

280079—DSCP TOS bit was not being set correctly on the device.

•280532—Websense is not working and displays the following error:"Unknown message type: 8e".

•285333—Traffic may not pass if there is a duplex mismatch between thedevice interface and the switch connected to the device.

•292720—Recursive spinlock can occur when UAC is enabled, causing thefirewall device to fail.

Performance•

234153—High flow CPU utilization caused by packet looping between
CPU and ASIC.

•

266111—Slow performance with Web traffic when URL filtering and theSYN Proxy is enabled.

•

268006—When traffic shaping is enabled, VPN traffic gets dropped.

•

284615—[SSG 500] Slow traffic throughput occurs when using copper
gigabit ethernet interfaces.

ScreenOS Release Notes

36

Routing•

225874—Creating a default route from one VR to the other VR caused thefirewall to reset.

•

259054—The BGP neighbor goes to idle after the BGP connection isreset.

•

260197—Old BGP routes, no longer advertised by the BGP peer, are notcleared from the routing table.

•

260646—The device would not become the PIM designated router (DR)after increasing the DR-priority.

•

262604—The first multicast packets in the flow get dropped.

•

269341—IGMP Join occurs 10 seconds after a unicast route haschanged.

•274788—Multicast route through GRE tunnel fails after the GRE routers
do a failover.

•276971—Tunnel interfaces were being counted as an outgoing interface,which exceeds the maximum number of interfaces allowed for multicast
traffic.

•

282293—Routes are stuck in the RIP database in multiple custom VR
configurations.

VOIP•

226994—If both the IDP module and the SCCP ALG are active, IP phones
were unable to register using SCCP.

•

229190—SIP "content-length" parsing was not being handled correctly,
which may cause the device to fail.

•256706—The device was not doing routing and policy lookup for IP
addresses with unknown contact bindings from the SIP server.

•

264625—[ISG 1000/2000] SCCP ALG logging messages in the event log,
after the ALG was disabled.

•

274300—The "Can't allocate memory for SCCP call context" message
appears in event logs due to the timing between session age-out and callcompletion.

•

278773—H.323 ALG was unable to decode Q.931 using Avaya phones,
due to not enough OLC support.

ScreenOS Release Notes

37

VPN
•

254631—VPN fails after concurrent rekeys.

•

255297—[NetScreen-5200] The device fails to handle out of order VPN
fragments.

•

257708—When subjected to heavy GRE/IPSec traffic, the device may
reset.

•

264713—Tunnel ID and hardware SA in an existing session do not update
properly after VPN change, which causes traffic to stop.

•

266098—An IKE gateway could not be created when the device was in L2
mode.

•

275108—The NSP tunnel (internal structure used in IPSec environments)
was erroneously deleted but it was still referenced by another module, andcaused the device to reset.

•

284756—In certain situations, the auto-connect acvpn-dynamic
command could not be completed.

WebUI
•

222872—Access to the WebUI is very slow when opening the main home
page.

•

265334—From the WebUI, if a RIP summary route is set to a metric of 1,
it does not get written to the config.

•

266100—The "More than one physical interface in zone V1-Trust" WebUI
error appears when binding multiple interfaces to a Layer 2 zone.

•

266871—Custom RPC service is deleted from the policy when that policy
is edited.

•

267496—The WebUI reports that the gbw value is out of range when
editing on a subinterface.

•268659—Adding redundant interface or redundant subinterface throughthe WebUI succeeds, but the WebUI incorrectly produces an error.

•

270630—Cannot disable SSH2 management from the WebUI.

•

271307—A bgroup cannot be created from the WebUI, even though it canbe created from the CLI.

•

272946—Unable to create an IKE gateway on a device in transparent
mode from the WebUI.

•

276288—When configuring an NSRP cluster ID with a value over 63 using
the WebUI, an incorrect error message is displayed.

ScreenOS Release Notes

38

Addressed Issues from ScreenOS 6.0.0r5
The following operational issues were resolved in this release.
Administration•

233016—Dropped traffic from the Self MGT zone was not being logged forIPv6 packets.

•

234164—[SSG 500] The clear counter all command did not clear the
64-bit hardware counters.

•

237639—Admin authentication to the device WebUI via Radius fails if theusername is 31 characters.

•

241401—Device failed after deleting a VSYS.

Antivirus•

237473—Large iso files cannot be downloaded from certain Web sites
when the AV keep-alive option is set.

•

237846—POP3 connection to a POP3 server is reset after enabling AV.

CLI•

223190—The set monitor cpu 100 CLI command does not show up in
the config file.

•229935—The set pak-poll command appears and disappears frequently
in the configuration file.

•238949—URL filtering gets disabled after a restart if the URL filteringprofile contains a space.

DHCP•

236408—Device does not send DHCPREQUEST message via broadcast
on T2 time when acting as DHCP client.

•

257662—User cannot set a negative integer value for DHCP custom
option 2.

DNS•240535—PPPoA learned DNS values overwrite the local DNS settings ofthe firewall, regardless of preference setting.

ScreenOS Release Notes

39

GPRS
•

238369—A failure could occur in the GTP function when referencing
deleted GTP tunnels, which in some circumstances were not deleted by
the system.

•

241576—After an ISRAU, only one GTP tunnel is deleted while the otherstays active.

HA & NSRP•

220773—After merging configurations via TFTP to the primary device,some of the configuration fails to synchronize to the backup device,
resulting in partial configuration loss.

•

227549—The backup device in an NSRP cluster failed after forcing
failover and then doing failback, due to accessing a null pointer.

•

230940—With NSRP session synchronization, it was possible for the
backup device to see a single host with multiple DIP addresses from afixed-port DIP pool.

•

236524—The NSRP backup device in transparent mode incorrectly
forwards SNMP requests sent to its manage-ip, and treats traffic asthrough-traffic instead of self-traffic, which causes the corresponding
switch MAC address to flap.

•

238578—Non-VSD sessions in an Active/Active NSRP configuration
incorrectly synchronize between cluster members if the session's egress
subinterface differs between cluster members.

•

251797—In certain conditions, when a policy is deleted from the primarydevice, it does not sync to the backup device.

•

253075—FTP traffic stopped when an NSRP failover occurred.

•

258684—The tcp/udp/icmp sessions were not cleared on the backup
device in transparent mode. Also, the set nsrp rto-mirror session
ageout-ack command was not functioning correctly, resulting in sessions
on the backup not being cleared.

•

259736—When an AES algorithm or AH protocol is used, the backup
firewall fails to read the correct SA sequence number from the primary
firewall, causing a VPN issue after a device failover.

•

260760—[SSG 5] NSRP failover not working properly when both NSRP
interfaces and a secondary path are enabled.

ScreenOS Release Notes

40

IDP
•

229742—[ISG 1000/2000] In transparent mode, integrated URL filtering
does not work when IDP inspection with Security Module is also enabled.

•

232075—[ISG 1000/2000] Time binding attacks are not reporting logs to
the NSM server.

•

236437—[ISG 1000/2000] In certain situations, the traffic passing throughan inline mode IDP rule may experience excessive delay when other rules
are configured for TAP mode IDP.

•

237769—[ISG 1000/2000] There is high CPU utilization on a single SM(Security Module) due to uneven session distribution.

•

252958—[ISG 1000/2000] Login attempts with FTP brute force signature
were erroneously being logged as accepted.

Management•224382—Task CPU spikes when the authentication result from the
RADIUS server does not arrive on time.

•232175—The device failed when updating the configuration via TFTP.

•

239362—The BGP Established Time was not shown correctly using
SNMP walk.

•252700—Unsupported "Far End" OIDs were modified so that they return a"no such object" response to an SNMP query.

•

252781—64-bit hardware counters for aggregate interface exceed the32-bit limit, causing inaccurate results.

•

253762—The NSM agent sends an incorrect MS-RPC UUID service value
back to NSM, causing a configuration update issue.

•

258148—SNMP reports incorrect ifspeed on serial interface.

NAT•

250756—In certain cases, NAT translation for ICMP/ICMPv6 causes thedevice to restart.

•

255034—Under certain conditions, MIPs may be deleted, even though thesame MIPs are still being referenced in a policy.

•

255984—Policy-based NAT is unable to perform NAT to pass through
ESP packets.

•

261134—With set arp nat dst enabled, the device responds to an ARP
request, even though the policy is disabled.

ScreenOS Release Notes

41

Other•214857—With a CF card inserted, under certain conditions, the "Flash"
LED does not illuminate after a reboot.

•225211—The ISDN Basic Rate Interface (BRI) does not work correctlywith certain ISDN vendors.

•

225870—The device can restart in the presence of two PPP active lines(for example, DSL) when one of the lines is reset.

•

227315—After adding 10/100/1000TX interfaces to an aggregateinterface, the counter of the aggregate interface is wrong.

•

227438—CTS traffic incorrectly detected as"HTTP:Overflow:Content-Overflow" and dropped.

•

228235—Spam emails are not tagged properly when source uses
DomainKey Signature.

•

229985—In unframe mode, an SSG 140 sent an idle flag that conflictedwith an M7i router.

•

231670—In certain environments, if only URL filtering is enabled in thepolicy, the HTTP response might fail to be parsed.

•

234140—Debug causes device failure because of malformed TCP
packets.

•

234233—Xauth server configuration is lost after restart if the auth-server
name contains a space.

•

234715—The device may fail under certain conditions when receiving
MGCP traffic.

•

234773—When a cable is not connected to an interface with track-ip
configured, the device may restart periodically.

•

236565—L2TP configured in a VSYS would not work after a restart.

•

236694—In rare cases, the device may restart due to invalid interface
reference.

•

241343—When a user in the Radius system belongs to multiple groups,
and the user is authenticated via the firewall to the Radius server, thefirewall may restart.

•

251463—Device failed when a packet with an invalid ALG port number
address was being forwarded.

•

252624—NSRP DIP debugging messages are being printed to theconsole even with no debugs enabled.

•

253020—On occasion, a device failure occurs when the function to match
sessions from IPv6 embedded packets tries to access an incorrect
memory location.

ScreenOS Release Notes

42•253965—Frame Relay clocking mode did not initialize properly.

•

256071—TCP sessions established through a tunnel interface with GRE
are not removed from the session table, even after application termination.

•

256589—When a large number of VPN policy is configured, the device
may fail to create VPN policy when the tunnel id is not specified.

•258336—The device restarts on its own when the Deep Inspection
Signature Pack is updated.

•

262666—When NTP is enabled, and set ntp server src-interface isused, NTP communication cannot be checked in policy when the traffic issent out to an interface other than the one specified in the command.

Performance•

233167—[ISG, NetScreen-5000] High CPU utilization in flow occurs when
L2TP traffic passes through the device.

•

254924—In some cases, when a packet loops between two devices, theTTL is not decreased accordingly, which causes high CPU utilization.

Routing•

225134—When gateway tracking routes are configured, the device may
restart while processing traffic that uses the gateway tracked route.

•227948—When OSPF is configured with Reduce flooding, a rare conditionof network changes can cause an incorrect value of "LSAs with no DCoption" counter, resulting in continuous purging of OSPF LSAs.

•

228200—An alternate route cannot be added to the routing table and be
active after a tunnel failure. This issue will occur when using the set
interface tunnel_name protocol rip demand-circuit command.

•

235160—IPv6 routing suddenly fails due to an exception on one of the
PPUs.

•

240158—The device may fail when one IGMP router interface proxies
more than one host interface.

Security•

228860—Device not passing traffic when Infranet Controller isunreachable or unavailable.

VoIP/H323•

227486—In transparent mode, h.323 communication failed due to inability
to execute the MAC cache operation.

•

255168—With the ALG enabled, the pre-marked DSCP values for H.323
traffic are not retained when passing through the device.

ScreenOS Release Notes

43

VPN
•

224953—In certain situations, the device is unable to create a route-based
VPN.

WebUI
•

234071—Under some circumstances, the ADSL PPPoE interface service
option cannot be changed via the WebUI.

•

235599—It is possible to erroneously configure a VIP that is the same as
Untrust for http (port 80).

•239316—When editing an aggregate interface (next to Traffic Bandwidth),"Memmbers" is used instead of "Members."•

239748—[NetScreen-5200-MTG2] Counting configured on a policy
incorrectly shows a drastic drop in the bytes/sec counter in the WebUI.

•

241069—Using the WebUI, the software version shows an _ssg suffix,
such as 6.0.0r2_ssg.

•

250313—When using the WebUI for MIP grouping in a policy, the MIP
object can be deleted.

•

256041—In a particular circumstance, the device may fail when an adminedits a VPN configuration using the WebUI.

•

259582—When adding Antispam to an existing Antivirus Profile via the
WebUI, FTP session disconnects occur and result in abnormal behavior of
FTP commands (ls, dir).

•

264300—Config Merge from the WebUI fails.

Addressed Issues from ScreenOS 6.0.0r4
The following operational issues were resolved in this release.
Note: Due to an update in the ScreenOS problem tracking system, someissues listed here have two bug numbers. The six-digit numeric code
shown first is for the new system; the “os” and “cs” numbers included in
the listing for some issues are provided as a reference to older Known
Issues. Eventually the older reference numbers will be phased out.
Administration•

222603—When a root system administrator is authenticated via RADIUS,
it's not possible to set the admin password for a vsys.

•

226959—[SSG 520M] The alarm LED always shows red when NSRP isconfigured on the device. There is no effect on the device's performance.

ScreenOS Release Notes

44

Antivirus•

227667—Tagged VLAN traffic may be dropped when AV is enabled.

CLI•

235940—Unsetting a custom syn-flood destination threshold did not goback to the default value.

•

239997—Deleting an access list entry using the CLI does not check if
there is an address and netmask match.

GRPS•

229295—When GTP inspection was used, GTP UpdPdpRequest packets
failed the sanity check and were dropped if the TEID was zero.

HA and NSRP•

224084—When an administrator is authenticated via RADIUS in aclustered environment, some commands may not be synchronized via
NSRP.

•

227050—In an NSRP failover, the state of the XFP gigabit interface is
DOWN, but the software shows it as UP.

•

227366—FTP traffic is lost momentarily for approximately three seconds
after an NSRP failover occurs.

•

231510—When enabling an NSRP secondary path using the WebUI, it
does not get saved to flash.

•234080—The NSRP configuration was out of sync because the commandlines in the configuration were in a different order.

•

235560—[NetScreen-5000-MG2-8G2/2XGE] Once the syn-flood thresholdis reached, the syn-cookie is not turned off correctly.

•

237697—An NSRP cluster is out of sync due to the udp-flood dest-ip
setting.

IDP•

224786—The scio subs status command does not display CPU
utilization.

Management•

224163—The SNMP packet 64-bit counter values are not reporting
correctly.

•

225013—The types filed in the traffic log, byte_recv and byte_sent, should
be displayed as unsigned values in the log; however, when a value larger
than 2147483647 occurred, it was printed as a negative value.

ScreenOS Release Notes

45•226808—Under a high-traffic volume condition, the traffic log is not sent toNSM.

•

234363—[ISG 1000/2000, NetScreen-5000] Large policy installs via NSM
to ASIC platforms may cause OSPF adjacencies to drop.

•

234662—A device failed when trying to update a policy configuration
using NSM.

•

234722—In NSM, the Active Sessions statistics showed IP addresses as
being reversed.

•

235853—Some NSM configurations may cause the device to fail, due totask mismatch.

•

237505—The ASIC sector memory space has been increased to allow
more policies to be configured.

•

238162—When using src-interface for some services, the route lookup isdone in the default virtual router (VR) instead of the src-interface VR.

•

238777—When deleting 2,000 policies from an ISG 2000 using NSM, theupdate fails after about 130 policies are removed.

Other
•

207158—WebTrends messages are not sent out properly through a VPN
tunnel when the device is running under an NSRP Active/Active
configuration.

•

216025—A memory leak occurred on an SSG 500 device due to the PKI
online CRL.

•

223729—Because PPP always referenced the L2TP tunnel auth settingfor query config, set l2tp <name_string> auth server <server_name>query-config was considered to be a valid command; however, the set
l2tp default auth server <server_name> query-config command fails to
work.

•

225017—[SSG 5/20] The device may stop passing traffic due to alink-layer buffer problem.

•

227229—[ISG 1000/2000, NetScreen-5000] The devices maintaining
hardware sessions may drop packets for UDP based applications if thefrequency of the traffic and the timeout are configured to be the same.

•

227364—Traffic log information is changed when adding or removing
more specific policies.

•

227670—Under rare circumstances, the FTP connection fails when an
FTP retransmission packet is received.

ScreenOS Release Notes

46•228727—The connection between the device and the SurfControl server
failed several times a day when a high rate of activity was present,
causing content filtering to be disrupted.

•

231303—Service timeout may become incorrect when predefined service
is overloaded by custom service.

•232036—64-bit out bytes and out ucast counters are incorrect for theserial interface.

•234463—With certain protocols, such as Telnet and FTP, the firstpass-through connection can stop responding when using the policy
pass-through auth and external auth server.

•

234493—The device fails to strip the Domain Name when authenticating802.1x against the RADIUS server.

•

234503—When using 802.1x authentication, the NAS-IP-ADDRESS field
becomes 0.0.0.0 when the RADIUS server is on the remote side of aroute-based VPN using an unnumbered tunnel interface IP.

•

235905—When using MLPPP or T3, the serial interface encounters timing
slips.

•

240098—The traffic to a VIP address that is the same as the interface IP
gets dropped•

251580—The device may fail due to an address mismatch between the
ASIC and CPU.

•

260884—[ISG 1000/2000] In versions 6.0.0r2 and 6.0.0r3, the devices
erroneously reported double the maximum number of sessions that they
were able to handle. Starting with version 6.0.0r4, the code has been fixed
to reflect the correct session maximums.

Routing•

214163—An ASIC is overburdened with processing RIP packets when alarge number of RIP tunnels are being built up during the failover.

•

225869—[ISG 2000] A failure occurred because of an array error in aroute table lookup.

•226284—Certain BGP prefix routes were lost when advertising.

•

229973—Under some conditions, the device fails due to an inconsistency
between the routing table and the IP classification table, resulting in an
invalid route.

•

231865—TCP traffic cannot pass when there are no ARP entries in the
ARP table. The TCP traffic will succeed when ARP entries exist.

•

235835—Static routes redistributed into RIP, update with the wrong nexthop.

ScreenOS Release Notes

47

•

239971—[ISG 1000, ISG 2000, NetScreen-5000] IPv6 traffic does notpass on ASIC platforms when in transparent mode.

•

240429—In some cases, multiple multicast routes for the same group areadded to the routing table, causing the multicast-route limit to be reached,and no more multicast routes can be added.

Security•

233964—A critical parsing vulnerability was reported in OpenSSL ASN.1.

VoIP/H323•

222660—H.323 VoIP calls may fail due to the H.245 gate failing to open.

•

223896—A SIP auth request is dropped when MIP is configured on a SIP
Proxy.

•

230195—An unattended device failed, due to SIP ALG.

•

231134—The system failed in the SIP ALG functions.

VPN•

218452—The certificate fails to renew the CRL if the CA server's
publication interval is less than 12 hours.

•

220344—IKE phase 1 continued to use the old IP address after dynamic
DNS for a NAT-T peer had changed the IP address.

•

221350—[NetScreen-5000-MGT2] UDP fragmented packets are dropped
in a site-to-site VPN tunnel.

•

222173—The VPN Up/Down event log does not show the first time, butlater it works well.

•

222721—Under certain circumstances, such as when editing VPN
policies, the proxy-id of dial-up VPNs could be incorrectly reset to a
nonproper value. This caused the IKE key renewal to fail; then VPN
clients, such as NetScreen-Remote, prompted indefinitely for new
authentication.

•

222964—The VPN failover and then the failback do not work when using
the VPN Monitor src-interface and destination-ip with Dual Untrust mode.

•

224421—The set ike p1-max-dialgrp-session command does not work
properly because the concurrent p1 dialgrp sessions number is counted
incorrectly.

•

225131—The device may restart when running L2TP debug.

•

226681—A memory allocation error occurred when trying to establish adial-up VPN using certificates.

ScreenOS Release Notes

48

•230340—A VPN with a VLAN tag configured in a vsys, after a VPN rekey,
caused problems with VPN traffic from a remote peer that used an old
key; the old key failed to match the correct hardware session.

WebUI
•

219552—After logging into a device via SSL, a popup message occurred
regarding browser security.

•

220274—An incorrect NTP server IP address will appear in theconfiguration if NTP is set up in the WebUI with only one server.

•

227729—System may fail when doing a save self log using the WebUI.

•

227963—Black/White list entries cannot be displayed/edited using the
WebUI.

•

232471—The DSCP settings on a policy are lost when the policy ismodified.

Addressed Issues from ScreenOS 6.0.0r3
The following operational issues were resolved in this release:
Antivirus•

254153—FTP data fails when AV is enabled on the policy.

HA and NSRP•

221838—The backup device in the NSRP active-passive pair resets
unexpectedly.

Management•

227488—Issuing the get tech command via telnet or SSH causes task
CPU to spin in a loop, creating high task CPU.

•

231728—For SSG 140, the DNS information from PPPoE does not updateto the DNS host setting of the firewall.

•

232654—When upgrading from a previous version to ScreenOS version
6.0, existing policies can be imported incorrectly•

233428—In Transparent mode, the management feature on a v1-Untrustzone is not added to the configuration, so it becomes disabled after adevice reset.

•

234379—In Transparent mode, cross VSYS management traffic isallowed, even though there is no policy to allow this traffic.

ScreenOS Release Notes

49

Other•237811—Traffic fails to pass when using the NAT interface, due to DIP
allocation failure.

Routing•236497—In some cases, the device was not clearing out redistributed
routes from the RIP database, even though the sending routing protocolhas been disabled.

WebUI
•

227928—When creating a custom zone in Untrust-VR, the zone is createdin the Trust-VR instead.

•

229923—The device may inadvertently reset if you direct a browser to the
management IP address via WebUI.

Addressed Issues from ScreenOS 6.0.0r2
The following operational issues were resolved in this release.
Note: Due to an update in the ScreenOS problem tracking system, someissues listed here have two bug numbers. The six-digit numeric code
shown first is for the new system; the “os” and “cs” numbers included in
the listing for some issues are provided as a reference to older Known
Issues. Eventually the older reference numbers will be phased out.
Antivirus•

218326 [os66700]—Yahoo! Messenger IM file transfer from the Internet
does not get scanned when set av http skipmime is enabled.

•

224994 [os69848]—When the device is under heavy HTTP traffic andmemory is running low, an incorrect debug message is displayed: "Fail toallocate new data area for buf."•

225910 [os70197]—When HTTP AV is enabled and Yahoo! Messenger(YMSG) IM AV is disabled, file transfers over YMSG (that use the HTTP
protocol) may occasionally cause the file transfer to fail on reaching the
maximum configured limits. For example, a file transfer may fail if the fileis larger than the configured max-content-size.

•

225920 [os70207]—Under high stress conditions with AV, it is possible tosee FTP traffic blocked.

•

227591 [os70991]—When enabling AV and updating the AV database(either manually or automatically), CPU utilization may reach 90% after ashort time.

ScreenOS Release Notes

50

HA and NSRP•

224248 [os69429]—Unset interface <name> ip manageable is notpropagated from master to slave.

IDP•

224257 [os69438]—Under heavy traffic conditions, if the IDP Profiler isenabled, the CLI may respond slowly.

•

224759 [os69720]—If you see this event log, “dma_transmit failed to 1,”
then you’ve reached the maximum capacity of your device.

Other
•

221408 [cs12430]—Some MGCP protocol extension traffic was being
dropped by the MGCP ALG.

•

224307 [os69468]—There is no option to clear the newly introduced
bgroup interface counters on the SSG140.

•

224500 [os69570]—On the SSG 20 devices, operating mode configured
for ADSL2 or ADSL2+ is always incorrectly seen as auto in the WebUI.

•

226119 [os70287]—Global DIP pool limit is 1K on SSG devices.

•

229379—After upgrading from ScreenOS 5.4 to 6.0.0r1, SQL traffic may
fail to pass through the device.

Routing•

223879 [os69272]—ISG 1000 with IDP may fail when passing SunRPC
traffic through a security module.

WebUI
•

222724, 121948 [cs12755]—In an NSRP environment, you cannot use
the WebUI to assign priority when you create a second redundantinterface.

•225485 [os70000]—If you delete a vsys using the CLI, the vsys is still
displayed in the WebUI. Selecting this incorrectly displayed vsys on
WebUI will cause the device to fail.

•227317 [cs13945]—On SSG20-wireless devices, it is not possible to use
the WebUI to bind a wireless interface to an SSID. Attempting to do so will
result in a Web error page.

Known Issues
This section describes known issues with the current release and includes thefollowing sections:

ScreenOS Release Notes

51

•Known Issues in ScreenOS 6.0.0r7—describes deviations from intended
product behavior as identified by Juniper Networks Test Technologies
through their verification procedures. Again, whenever possible,
information is provided to assist the customer in avoiding or otherwise
working around the issue.

•

Known Issues in ScreenOS 6.0.0r6—describes deviations from intended
product behavior discovered in 6.0.0r6 that may still exist in 6.0.0r7 as
identified by Juniper Networks Test Technologies through their verification
procedures. Again, whenever possible, information is provided to assist
the customer in avoiding or otherwise working around the issue.

•

Known Issues in ScreenOS 6.0.0r5— describes deviations from
intended product behavior discovered in 6.0.0r5 that may still exist in
6.0.0r6 as identified by Juniper Networks Test Technologies through theirverification procedures. Again, whenever possible, information is provided
to assist the customer in avoiding or otherwise working around the issue.

•

Known Issues from ScreenOS 6.0.0r4—describes deviations from
intended product behavior discovered in 6.0.0r4 that may still exist in
6.0.0r5 as identified by Juniper Networks Test Technologies through theirverification procedures. Again, whenever possible, information is provided
to assist the customer in avoiding or otherwise working around the issue.

•

Known Issues from ScreenOS 6.0.0r3——describes deviations from
intended product behavior discovered in 6.0.0r3 that may still exist in
6.0.0r4 as identified by Juniper Networks Test Technologies through theirverification procedures. Again, whenever possible, information is provided
to assist the customer in avoiding or otherwise working around the issue.

•

Known Issues from ScreenOS 6.0.0r2—describes deviations from
intended product behavior discovered in 6.0.0r2 that may still exist in
6.0.0r3 as identified by Juniper Networks Test Technologies through theirverification procedures. Again, whenever possible, information is provided
to assist the customer in avoiding or otherwise working around the issue.

•

Known Issues from ScreenOS 6.0.0r1—describes deviations from
intended product behavior discovered in 6.0.0r1 that may still exist in
6.0.0r2 as identified by Juniper Networks Test Technologies through theirverification procedures. Again, whenever possible, information is provided
to assist the customer in avoiding or otherwise working around the issue.

Known Issues in ScreenOS 6.0.0r7
The following are known deficiencies in features at the time of this release.
Whenever possible, a workaround is suggested following the problem
description, preceded by W/A.

ScreenOS Release Notes

52

Administration
•
•
•
•
•
•
•
•
•
•

257485—In certain situations the administrator was unable to add an
address book item to a multi-cell policy.
279094—Unsetting PPPoE auth-method will erroneously generate themessage "Cannot unset idle-interval to default when auto connect isenabled".
293248—Information of both source port and destination port in an event
log entry for WebUI access is not correct.
298873—Unable to add a group service when Application Ignore isconfigured on a policy.
299556—Modifying service timeout does not get logged as a configuration
change in the event log.
300282—Traffic shaping parameters on a policy disappears when thepolicy is disabled.
303181—SSH PKA authentication fails if password policy complexity isenabled.
299024—If the IC module has been configured with a DNS entry, the entry
will be updated if the connection to the IC has been broken.
306719—Additional group information from authentication does not get
propagated to the backup device if the user is tied to multiple groups.
308262—Device erroneously allows you to configure a policy id between
320000 and 320002, which are reserved policy id's.

Antivirus•••

228618—With AV enabled, downloading bz2 (bzip2) file may result insystem exemption.
286714—In some cases, the Antivirus pattern files are missing and no
new file is downloaded. The scan engine reports a File Not Foundmessage.
305062—Policy log for traffic matched by AV shows double the actual
amount of bytes received.

DHCP
•
•

253304—Device failed due to multiple DHCP renews.
292152—Device resets unexpectedly after configuring DHCP auto-config.

GPRS
•
•

277620—With GTP inspection enabled, packets could be dropped
because the firewall ran out of available GTP paths.
302910—GTP CreatePdpRequest packets are being dropped whenretransmitted if they use the same teid_data to a different GGSN without
first sending a DeletePdpRequest.

ScreenOS Release Notes

53

HA and NSRP
•
•
•
•
•
•
•

258128—[ISG/IDP] Device failing over to secondary device due toperformance issues on the primary.
258242—In NSRP active/passive mode, the primary device restarts
because the pointer has an illegal value.
291970—[NetScreen-5000] HA link shows up when peer's HA interface is
set to phy link down.
299710—NRSP configuration synchronization does not work for policies
with a MIP address as a source address. This causes synchronization to
fail for that policy and the devices become out of sync.
300760—NSRP was showing out of sync due to the password hash of the
pppoe username being different on the two devices.
301156—Multicast traffic leak occurs on the secondary device intransparent mode under high traffic load.
306981—NSRP configs go out of sync due to CLI config out of order after
a reset of one of the members.

IDP
•
•
•

276587—[ISG-IDP]VLAN tagged traffic is incorrectly handled and dropped
by ISG with IDP modules when IDP and tcp-syn-check is enabled.
299424—With Ftp-pathname user-defined signatures, the device does notcheck the filename in ftp out/get commands.
301944—DI HTTP brute search function is not working properly.

Management••••

291310—TTY and socket is not released after telnet service timeout on
the device has been reached.
294506—Loopback interface generated into static mroute in the NSM
config datafile, causing NSM updates to fail.
298916—An unnumbered tunnel interface may be configured on a custom
tunnel zone; however, this is not supported and cannot be configured in
NSM.
300298—While deleting a vsys, loopback interface will be not released if
it's used by route-map in a virtual router.

Other
•
•
•
•

257812—NAS-Port-Type was "Wireless-Other" instead of "Wireless-IEEE802-11" for example when authenticating wireless clients via radius.
259334—Memory leak occurs when running FIPS mode.
279557—[SSG Series] WAN serial interface with a backup interface
shows down, but traffic still passes.
283336—Redirecting traffic logs to the TFTP server could cause high task
CPU.

ScreenOS Release Notes

54

•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•

•
•

283348—A device running Antivirus, URL Filtering, or VoIP feature, could
fail due to an unexpected type of packet.
284472—Trace-route doesn't work when you specify interface explicitly.
284672—DIP allocation failed on backup device of NSRP cluster due topport not being released.
284851—Firewall authentication may fail when loopback session is
involved.
286679—Memory leak results when NTP client cannot obtain a valid key
id or key string.
289671—Changing tunnel bindings in WebUI caused a failure.
290666—In an IPv6 deployment, a null interface could cause the device tofail due to an interface state check that has been added.
291728—Scheduler object names are incorrectly stated to be limited to 20
characters, but in actuality, you are restricted to 19 via CLI or WebUI.
294079—If the SYN-ACK packet does not contain the TCP MSS option,
traffic for following modules may be affected: Integrated URL Filtering,Anti-SPAM, Anti-Virus, VoIP.
297028—Pre-defined service NTP was defined incorrectly.
298540—The load-threshold setting for an ISDN interface was incorrectly
limited to 1~100. This now supports the range 0~100, where a zero value
allows for always-up capability."
298672—The device may reset with "get conf" command if address groupobject contains "%" character.
301487—Snoop was not working properly when using redundantinterface.
301602—With the web filtering feature enabled, a Linux host is not able toaccess a particular web site. The same issue occurs when either Antivirus
or VoIP is enabled.
302271—Failed to create multicast session once it timed out due to adown interface.
302382—In certain conditions, the firewall may reset if a session
incorrectly references a MAC address with no route information.
302566—Passive FTP fails when NAT source and destination is
configured in the same policy.
302955—PPTP xlate entries were not released in HA setup.
302970—Device resets when issuing an mping.
304210—Device resets when inside a VSYS and issuing a ping request
using an IPv6 address.
304276—After setting up a wireless interface then running the set int
wireless0/0 shutdown command, the command was not saved to theconfig. After a restart the wireless interface is then enabled when it shouldhave remained down.
306370—Device may reset if a custom layer 2 zone is unset.
306864—The SMTP header is now RFC2822 compliant and includes thetime stamp.

ScreenOS Release Notes

55

•
•
•
•
•

235297—Source MAC is not cached in session for PIM traffic.
278718—Static default route on PPPoE interface was lost after power
cycle.
279442—The Flow and Task CPU utilization becomes high after several
days uptime if the device is heavily loaded with traffic.
298305—Configuration was incorrectly reloaded twice, which caused asystem busy issue after start up.
309122—ASIC ARP was installed incorrectly with wrong VLAN ID.

Performance
•
•
•
•
•
•
•
•
•
•
•
•

221537—FTP downloads from dial up or slow links are failing when AV
enabled.
250873—Backup device in NSRP cluster sees high CPU due to
upstream/downstream switch ARPing problems.
272759—CPU becomes high due to the ikmpd task.
274531—[NetScreen 5000-2XGE] Throughput degrades when sessions
are created on single ASIC.
278935—Random packet drops occur because ARP entries were notdeleted, causing inconsistencies between hardware and software.
284276—VPN performance degrades when DI is enabled on a policy.
285793—High CPU due to NSM task.
291748—Using pipe in a large search may result in high CPU. For
example: get event | i foo
292576—Packet dropped because window scaling factor in SYN ACK
packet was not being updated in hardware session, causing an out of
sequence error.
295452—Some web sites that get re-directed to an https URL are notaccessible when Integrated SurfControl is enabled.
296378—Multicast traffic does not get inspected for traffic shaping.
297574—Return traffic may get dropped on serial interface if "unset arp
always-on-dest" is configured.

Routing
•
•
•
•
•
•

277755—High CPU in task when deleting more than 30 RIP routes.
287409—If an existing type 5 LSA exists in the OSPF database, a new
type 7 LSA for the same network is not converted to type 5 LSA, even if
the new LSA has a better metric
293332—Unable to configure multicast candidate RP.
300214—When OSPF LSA database is large and firewall CPU is fairly
busy, OSPF adjacency may flap.
302011—OSPF routes are not learned from the peer, even though thetotal number of routes has not reached maximum capacity.
304116—Unable to configure router-id.

ScreenOS Release Notes

56

VOIP/H323•••

281460—Video does not work properly when using MIP or VIP.
288193—Under certain conditions, device may reset when processing
pinhole for SIP traffic.
305658—Lost RTP packets when NAT-T is enabled.

VPN
•
•
•

204717—Main mode IKE negotiations may fail when peer identified by
DNS address instead of IP address.
300430—Packets are dropped in a back-to-back GRE VPN scenario.
303538—VPN monitor reply packets may get dropped across a routebased VPN when the physical and tunnel interface are in different zones.

WebUI
•
•
•
•
•
•
•

281955—Unable to configure route map using subinterface.
294560—Clicking on Refresh in Reports -> System Log -> Self in WebUI
may result in high CPU.
294594—WebUI: Unable to see non-trust-VR interface when configuring
PBR.
298501—Changing a multi-address cell back to "Any" caused policy
corruption.
299090—In the WebUI, the option PCMCIA of log settings is incorrectly
shown as option USB. Also, the option PCMCIA of log setting configured
by CLI is not displayed correctly in the WebUI.
302622—When using the WebUI to configure DNS proxy server for agiven domain, the failover option is automatically selected.
296660, 259195—Unable to add or change an existing configuration for
TACACS Auth server via WebUI.

Known Issues from ScreenOS 6.0.0r6
The following are known deficiencies in features at the time of this release.
Whenever possible, a workaround is suggested following the problem
description, preceded by W/A.
CLI•

234400—The debug ike detail command was not following the filters
defined in sa-filter.

ScreenOS Release Notes

57

Performance•

283748—Fragmented packets loop between the CPU and PPU causing
high CPU utilization.

ScreenOS Release Notes

58

Known Issues in ScreenOS 6.0.0r5
The following are known deficiencies in features at the time of this release.
Whenever possible, a workaround is suggested following the problem
description, preceded by W/A.
GPRS•

259128—With GTP inspection enabled, CreatePdpRequest packets could
be dropped because the firewall ran out of available GTP paths.

Other
•

270342—In vsys environment, ping traffic from other vsys to local
interface failed.

Performance•

267324—[ISG, NetScreen-5000] Packets are being sent out of order whenusing aggregate interfaces on ASIC platforms.

Known Issues from ScreenOS 6.0.0r4
The following are known deficiencies in features at the time of this release.
Whenever possible, a workaround is suggested following the problem
description, preceded by W/A.
Management•217312 [cs11602]—Updating devices from NSM using supplemental CLIs
may cause cluster members to show incorrect status.
W/A: Run a check config sync status directive after the device isupdated.

Other•

231278—The device failed when the SNMP zone ID and address object
were mismatched.

Known Issues from ScreenOS 6.0.0r3
The following are known deficiencies in features at the time of this release.
Whenever possible, a workaround is suggested following the problem
description, preceded by W/A.
HA and NSRP•

235941—The NSRP configurations are out of sync, due to the different
ordering of AV parameters between master and backup devices.

ScreenOS Release Notes

59

Known Issues from ScreenOS 6.0.0r2
The following are known deficiencies in features at the time of this release.
Whenever possible, a workaround is suggested following the problem
description, preceded by W/A.
Note: Due to an update in the ScreenOS problem tracking system, someissues listed here have two bug numbers. The six-digit numeric code
shown first is for the new system; the “os” and “cs” numbers included in
the listing for some issues are provided as a reference to older Known
Issues. Eventually the older reference numbers will be phased out.
Antivirus•

226198 [os70325]—Under some conditions, AV supplemental CLIs
cannot be pushed to the device because NSM erroneously reports that the
AV license is not installed.

•

233302—Under unusual circumstances, when AV is enabled and there isheavy traffic through the device, an SSG 20 may fail and restart without
warning or any other indication that there is a problem.

HA and NSRP•

226337 [cs13767]—In an NSRP environment, if a policy has passed
infranet auth, when the session permitted by the policy is synced to the
backup device, the timeout of sessions on the backup is set to 10 seconds
and will quickly age out, terminating the connection.

•

227073 [os70785]—Under certain circumstances, an NSRP cold sync
may require half an hour to complete when processed under heavy traffic
conditions.

•

227728 [cs14043]—ScreenOS does not currently support redundant or
aggregate interfaces in an active-active HA pair of ISG 2000 systems.
Packets received on the backup device cannot pass through the cluster inan active-active ISG 2000 pair.
W/A: Avoid using the redundant interface to forward traffic.

•

228679—The command set syslog src-interface XXX is synced to the
backup device in an NSRP cluster even when the src-interface is a local
interface.

•234401—Under certain long-term heavy traffic circumstances, if VPN
traffic is running through an ISG 2000-IDP in an active-passive NSRP
cluster, the active device may reset.

ScreenOS Release Notes

60

IDP
•

226383 [os70393]—When major and minor attacks are configured in the
IDP rulebase, FTP attacks are not detected within a GTP tunnel.
W/A: 1. Configure a rule in the IDP rulebase with GTP service selected
and no attacks and action. Configure another rule with attacks selected(major and minor) and action. 2. Now, when FTP root attacks are
triggered, they will be detected in either direction.

•

228623—With FTP attacks configured in the IDP rulebase, the GTP tunnel
goes into the Ignored state, meaning that FTP attacks are not detected
within the GTP tunnel.
W/A: 1. Configure a rule in the IDP rulebase with GTP service selected
and no attacks and action. Configure another rule with attacks selected(FTP attacks category) and action. 2. Now, when FTP root attacks are
triggered, they will be detected in either direction.

•

229680—When running an ISG 1000 appliance in Transparent mode with
IDP in Tap mode, packet sizes larger than 1500 bytes cannot be
fragmented into the proper size. Some applications may fail under thesecircumstances.

•

229975—An ISG 2000-IDP may intermittently stop advertising prefixes to
eBGP peers after BGP peer refreshes from other devices.
W/A: Run the unset enable and set enable commands inside the BGP
protocol configuration.

•

232420—[ISG series] A device running ScreenOS 6.0.0 with IDP causes
packets to be dropped if a mirror port is configured. Note that this is not arecommended configuration.

•

232805—In Transparent mode on an ISG 1000 with IDP enabled, if both
Web filtering and IDP are enable in one policy, all Web browsing that uses
the policy will hang.

ScreenOS Release Notes

61

Management•226201 [os70328]—It is possible that during a configuration save, a“Read of flash block 193 failed before write” message will appear on the
console. If this happens, try to save the configuration again.

•

234025—On the SSG 140 platform, DNS settings cannot be accepted
through a PPPoE connection.

Other
•

226044 [os70254]—Under some circumstances, the warning message“st_demux_bad_sess_id_from_SM_proc is not support in this build” maydisplay on the console. This message is for debug purposes and can besafely ignored.

•

226115 [os70283]—Sometimes after a blacklist is unset, traffic may beblocked.
W/A: Restart the device and try again.

•

226193 [os70320]—Under some conditions, it may take up to 30 minutes
to load 8191 tunnel interfaces on NetScreen-5000 series platforms during
startup.

•

226217 [os70336]—When the IP address of a remote peer changes, IKE
phase 1 may fail to update correctly.
W/A: Clear the IKE cookies, SA, or DNS cache to force VPN to use thecorrect IP address.

•

226377 [os70387]—When creating a cpu-protection blacklist during heavy
traffic, it may take up to six seconds to make the blacklist work. During thisperiod, it is not possible to execute cpu-protection CLI commands. Under
normal traffic circumstances, this process should take less than one
second.

•226582 [os70558]—Under extreme circumstances, the device may crash
if a blacklist is set or unset repeatedly during heavy traffic.

•

226595 [os70571]—When a voice call is invoked from v1-trust to v1untrust under Transparent mode, it is possible that one session with timer
at 0 will be stuck in the register and unremovable.

•

226637 [os70613]—The ICMP signature with time-binding enabled is not
triggered when the number of attacks found is equal to the count specified
in the time-binding settings. For ICMP packets, there is no concept of asession. Therefore, on ISG platforms, the packets are distributed between
the two CPUs on the security module. As a result, the number of attacks
for ICMP packets is tracked separately on each CPU. Only if the numberof attacks found is equal to the count specified in the time-binding settings

ScreenOS Release Notes

62will the signature be triggered. This is unavoidable on an ISG device
because the memory is not shared between the processes.
W/A: One solution is to set the count in the time-binding settings to be half
the value of the number of attacks that need to be seen.
•

226651 [os70627]—When traffic reaches 1Gbps (in each direction)
through two uPIMs, traffic will be blocked in both directions after
approximately one hour.

•

227592 [os70992]—The environment variables nsrp-max-vsd and nsrpmax-cluster must be a power of 2 value from this release. Although thefunction still works, the current value may not be a power of 2 if it was set
using an earlier release.
W/A: Reset the environment variables after upgrading to this release.

•227641 [os71009]—Sometimes invalid session information will be readfrom the ASIC chip while executing get db s on the console and thepacket will be dropped. This happens very infrequently.

•

227782 [os71064]—Under some narrow circumstances when deploying
NTP server on ISG 1000 appliances, a hardware session is refreshed by apacket but will still be aged out immediately.

•

228479—When an SSG 550 is working between client and proxy servers
in Transparent mode with DI enabled, the device interprets the traffic fromclient to server on port 80 as an "HTTP:Overflow:Content-Overflow" attackand drops it.

•

228675—When configuring a track-ip object using ARP and binding it to a
special VSD group, the track-ip object will be lost after reset. In otherwords, the CLI command set nsrp vsd x track-ip ip x.x.x.x method arp
setting will be lost after a reset. The impact is limited to this track-ip object
and does not affect any other function.

•

229234—When setting a Web filtering profile name that includes a space,after reset the profile cannot be saved•.230155—The get fprofile command may cause a device crash when
packet profiling is enabled.

•

231101—After heavy HTTP/FTP/UDP mixed traffic, several sessions
could not be aged out. The sessions will only be cleaned up following adevice reset. The issue is caused by a PCI problem that causes thedevice to read a bad session index from the hardware.

•

231513—When configuring a policy with multi-cell service or a service
group that includes predefined services in the multi-cell or service group,
traffic that matches this policy may have an incorrect timeout value.

•

231754—In Transparent mode, SIP traffic may cause a device crash.

ScreenOS Release Notes

63

•233140—Under some circumstances when the RADIUS auth server isconfigured, the device will fail to execute the set auth-server xxxx
command after a restart.

•

233385—Packets may get dropped with the message ”dip with port
translate allocation fail” if an interface-based DIP (NAT-Src from theegress interface IP address) is applied.

•

233516—After a large number of configuration changes (policy and VR
changes particularly), an ISG 2000 may stop receiving IPv6 packets.

•

233872—After a restart followed by many hours of heavy traffic, an SSG 5
may stop forwarding all traffic.

•

234058—If an IKE gateway peer address is configured to be IPv4 but the
local address is an IPv6 address, the device will fail and need to be reset.

•

236113—On the NetScreen-5000 platform, if TCP-SYN-Check is enabled,a cross-chip TCP connection cannot be established in Transparent mode.
W/A: Disable TCP-SYN-Check.

•

238795— On SSG 300M-series devices, you cannot upgrade the bootloader v3.0.5 or upload firmware via the boot loader when the SSG 300Mseries device is connected to the TFTP server via an HP 1800-24G
switch.
W/A: Connect the TFTP server directly to the SSG 300M-series device.

Performance•

234168—When deleting a policy, there are many tasks that need to beaccomplished. For example, sessions must be scanned for policy
rematching and policies must be deleted from hardware. These operations
are CPU intensive, so CPU usage is very high when many policies are
simultaneously deleted.

VPN•

230357—When multiple users who belong to the same VPN group try toconnect via dialup VPN simultaneously, some connections will failbecause of concurrent IKE negotiation limits. An event log entry will bemade. Here is an example log entry:
Discarded peer's P1 request because there are currently<089> sessions--max is <075>. (2007-02-18
12:28:49)<000>

ScreenOS Release Notes

64•231887—When running a policy-based VPN together with Web filtering
configured on an SSG140, the device may crash under heavy traffic.

•

233217—In some situations, for example when an IPsec tunnel isconfigured, NetScreen-5000 devices cannot fragment 1500 byte VPN
packets to the proper size and will instead drop the traffic.

WebUI
•

230134—After creating an aggregation interface on an ISG 1000, the
WebUI shows all interfaces as one member of this aggregation interface.
This is only a Web display issue. The device will function properly.

•

232569—If quality of service (QoS) is configured on a Voice-over-IP(VoIP) policy via the WebUI, the setting cannot be saved.

Known Issues from ScreenOS 6.0.0r1
The following are known deficiencies in features at the time of release of
ScreenOS 6.0.0r1. Whenever possible, a workaround is suggested following the
problem description, preceded by W/A.
Note: Due to an update in the ScreenOS problem tracking system, someissues listed here have two bug numbers. The six-digit numeric code
shown first is for the new system; the “os” and “cs” numbers included in
the listing for some issues are provided as a reference to older Known
Issues. Eventually the older reference numbers will be phased out.
Antivirus•

220962 [os67933]—You may experience a lost or delayed file transfer
request if a MSN IM session is idle for more than 20 minutes.

•

225186 [os69903]—Running heavy IM traffic for over a day on SSG5/20
may cause memory issues.

•

225915 [os70202]—When Yahoo! Messenger instant messaging antivirus
is enabled and the action is set to pass if the file being examined is larger
than the configured value, then the event notifying that max-content-size
was exceeded is sent twice. The corresponding error counter is also
incremented by 2 instead of 1. The actual handling of the file transfer iscorrect and no packets are retransmitted.

•

225916 [os70203]—MSN users may experience apparent delay during
chatting if MSN network traffic load is low; for example, if there is no ongoing file transfer and not many users are chatting through the firewall.

ScreenOS Release Notes

65

HA and NSRP•

220335 [cs12194]—In some cases on the ISG 2000, FTP data transfers
do not complete in an active-passive NSRP failover.

•221391 [os68106]—FTP sometimes fails to complete in an NSRP activepassive setup. The data transfer fails when failover and fallback happen
frequently during the FTP transfer.

•

224082 [cs13209]—A backup device does not handle ARP requests
when the interface is in Inactive mode or when the interface isdisconnected and then reconnected.

IDP•

223283 [cs12951]—The command exec policy verify is used when DI isenabled on your device. On the ISG 2000/1000 IDP, the di command isavailable but is not supported.

•

225124 [os69887]—On ISG 1000/2000 devices, memory issues occur
and policy push fails if you continuously push IDP policies.
W/A: Unload the policy on the IDP security module prior to pushing a newpolicy. Enter the command, # exec sm <sm#> ksh "scio policy unloads0" on all the security modules. Replace "sm#" with the number of the
security module. For example, for security module 1, the command is#exec sm 1 ksh "scio policy unload s0".

•225442 [os69994]—On an ISG 1000 device, pushing “all attacks” using
NSM might fail after upgrading to ScreenOS 6.0.
W/A: Delete the policy.gz.v from the flash prior to upgrading to ScreenOS
6.0. To delete the policy prior to upgrading, enter the following commandfrom the CLI:
# del file flash:policy.gz.v
After you upgrade, push the new policy to the device.

Management•

221467 [os68130]—This is an NSM only issue. Import Configuration in
NSM may fail if your device has a backslash (\) in the parameter string.
The problem stems from a lack of escape sequence for commands, suchas set av mime-list where NSM considers backslash as a control
character.

•

222914 [cs12801]—In some cases, when you update the certificate forone vsys using NSM, another unrelated vsys certificate may be removed.

ScreenOS Release Notes

66

Other•214251 [os64521]—It is possible to create a subinterface for PPP and
HDLC connections even though it is not supported in ScreenOS.
ScreenOS supports subinterfaces for Frame Relay and Multi-Link Frame
Relay only.

•

219115 [cs11922]—If a very small fragmented packet is sent to the
FPGA, it is possible that it will be delayed until a larger packet is received
to trigger the FPGA hashing functionality.

•

222710 [os68704]—SSG 520, SSG 550, SSG 520M, and SSG 550M
devices have incorrect AUX port settings. The correct values are 9600, 8,
N, and 1. Currently, the default values are 115200, 8, N, and 1.

•

222850 [os68781]—On the SSG 5 device, if the debug modem all andunset console db commands are both enabled, the CPU utilization is toohigh to allow for modem dialout from the v.92 interface.

•223155 [os68925]—SSG 20 devices cannot resolve IPv6 domain names
for the IKE gateway.
W/A: Specify an IPv6 address instead of a domain name for the IKE
gateway.

•

223684 [cs13083]—When using the GTP feature in ScreenOS, the PDP
Request filtering checks the Access Point Name (APN) in the Information
Element (IE), which is sometimes not supplied.

•

223776 [cs13119]—After the backup firewall is started and if the NSM
server sends a FIN packet to it, the backup firewall, when sending resets,
uses virtual MAC rather than physical MAC. This causes traffic disruption
for short periods (~ 30 seconds) if this packet passes through a switch.

•

223996 [cs13176]—In scenarios using the ARP method for track-ip,
changing the track-ip interval may cause track-ip failure.

•224099 [cs13226]—Sometimes during flow processing, after the packet's
ARP entry is determined and before the packet is sent, the ARP entry is
freed, which causes the device to fail.

•224249 [os69430]—An SSG 20 device fails if you insert a write-protected
USB device followed by a get file command.

Performance•

222946 [os68825]—After long durations of heavy attack traffic conditions,the device may display “bad session id” messages incorrectly.

•

223070 [cs12838]—During heavy traffic, SSG devices show high CPU(99%) usage and a warning message is displayed on the console,"WARNING: insertion in tree failed when free a port. Possibly Node Poolexhausted!"

ScreenOS Release Notes

67•

224845 [os69772]—Memory issues may occur on the ISG 1000 with IDP
running in Transparent mode with all attacks installed.

Routing•215642 [cs11355]—ISG 1000 and ISG 2000 devices do not terminate a
TCP session immediately when a client sends an RST packet with anincorrect sequence number and with set flow check tcp-rst-sequenceand set flow tcp-rst-invalid-session commands enabled.

•

224606 [cs13366]—eBGP neighbor is displayed as an iBGP peer in the
get vr <vr_name> protocol bgp neighbor command.

VLAN•

223634 [cs13057]—Cannot create subinterfaces in two different zones
and VRs with the same IP address.

VPN•

223339 [cs12969]—Cannot FTP large files through a VPN to Cisco
devices, because the ISG devices change sequence numbers randomly,
causing issues with the VPN tunnel on the Cisco end.

WebUI
•

222963 [cs12816]—NetScreen-5200 systems with M2/8G2 modules
drops NAT-T UDP packets due to bad UDP checksum.

Limitations and Compatibility
This section describes limitations of features and compatibility issues with thecurrent release and includes the following sections:•

Limitations of Features in ScreenOS 6.0.0r1—identifies features thatare not fully functional at the present time and that will be unsupported forthis release.

•

Compatibility Issues in ScreenOS 6.0.0r1—describes known
compatibility issues with other products, including, but not limited to,specific Juniper Networks appliances, other versions of ScreenOS, Web
browsers, Juniper Networks management software, and other vendor
devices. Whenever possible, information is provided for ways to avoid theissue, minimize its impact, or in some manner work around it.

Limitations of Features in ScreenOS 6.0.0r1
This section describes the limitations of various features in ScreenOS. They
apply to all platforms unless otherwise noted.

ScreenOS Release Notes

68

•

ISG and NetScreen 5000 series Multicast Hardware Support—
Multicast sessions can be handled by the ASIC only if there is a single
output interface per virtual router. The mcast group address can be
pushed to ASIC so frames are forwarded in hardware. To use this feature
run the set/unset flow multicast install-hw-session command.

•

IDP ICMP—Due to a design limitation, large ICMP traffic volume may
cause high CPU utilization.

•

SSG 500-series—Bridge groups (bgroups) are supported on Ethernet
switch PIMs (uPIMs), including 16-port GE, 8-port GE, and 6-port SFP.
Bgroups are not supported on 1-port SFP, old enhanced PIMs (ePIMs),and on-board GE ports. Bgroup interfaces can be dynamically created anddeleted. The maximum number of bgroup interfaces on each PIM is half
the number of ports.

•

SSG 140—Bgroups are supported on both on-board Ethernet ports andEthernet switch PIMs (uPIMs). Bgroup interfaces can be dynamicallycreated and deleted. The maximum number of bgroup interfaces on each
PIM is half the number of ports. For the on-board ports, three bgroupinterfaces are precreated. Bgroup interfaces can be configured on thesame PIM or the system board only.

•

IPv6 ASIC support in NetScreen-5000 systems—Because
NetScreen-5000 systems now support IPv6, per-ASIC session support
has been decreased from 1M to 512K. This is caused by the increase in
the session size in the session table. This limitation should have minimal
impact on most customers. Note that to achieve maximum session counton the NetScreen-5000 series firewalls, it would be best to design the
network to utilize multiple ports on the SPMs. This type of networkarchitecture would distribute the sessions to multiple ASICs. For example,
if only two ports on an 8G2 SPM card are used, the max session countvalue will be 512K.

•

Screens on traffic exiting tunnels—has the following limitations:•This feature is not compatible with the new Syn-bit check in PPU
feature. Screens for traffic exiting tunnels are performed by the CPU
instead of the PPU.

•This feature will only apply if the screen is activated on the physicalinterface where the tunnel is terminated if the screen is hardware
accelerated.

•

AC-VPN—DPD does not work on the spoke when set on AC VPN profile
with global IKE heartbeat enabled.

•

Jumbo frame support on the ISGs—Only the 4-port SFP modules on
the ISGs support jumbo frames. All other I/O cards in the device aredisabled automatically (including the ISG 1000 built-in I/O card), when
max-frame-size is set in the jumbo range (1515~9830).

ScreenOS Release Notes

69•

Online Help—After upgrading to ScreenOS 6.0, you may have to either
clear your cookies in your browser or apply the default Help Link Pathbutton in the WebUI under Configuration>Admin>Management.
Because of the cookies Juniper Networks sets when managing a device,
you may receive the prior version’s Help files when selecting the online
Help from within the WebUI.

•

AV scan-extension mode—The AV scan-extension mode does not workfor Yahoo! Messenger (YMSG) IM because Yahoo! does not specify the
filename in the URL.

•

Device-specific values for AV scanning—The following table specifies
de device-specific values for AV scanning:
AV Command/Device
SSG 5/20
SSG 140
SSG 500
1 to 4
1 to 6
1 to 8
The Decompress Layer* CLI
option (set <protocol>
decompress-layer <number>)
specifies the number of layers ofnested compressed files theinternal AV scanner candecompress before it executes thevirus scan.
20-10000 KB
20-16000 KB
20-24000 KB
The Maximum Content Size# CLI
option (set av scan-mgr maxcontent-size <number> ) specifies
the maximum size of content for asingle message that the internal AV
scanner scans for virus patterns.
256
512
1024
Total number of messages
scanned concurrently.
* The default value on the device is dependent on the selected protocol.
# The default value for all devices is 10,000KB.

•

PIM Power and Thermal Requirements—If you install either 8-port or
16-port uPIMs in your SSG 140, SSG 500-series, or SSG 500M-series
device, you must observe the power and thermal guidelines. Refer to the
PIM and Mini-PIM Installation and Configuration Guide for the power andthermal guidelines for all supported platforms available at:
http://www.juniper.net/techpubs/hardware/pim_guide/pim_guide.pdf
Warning: Exceeding the power or heat capacity of your device may cause
the device to overheat, resulting in equipment damage and network
outage.

ScreenOS Release Notes

70

Compatibility Issues in ScreenOS 6.0
Below are the known compatibility issues at the time of this release. Wheneverpossible, a work-around has been provided for your convenience, preceded by
W/A.
•

Compatible Web browsers—The WebUI for ScreenOS 6.0 was tested
with and supports Microsoft Internet Explorer (IE) browser versions 5.5
and above, and Netscape Navigator 6.X for Microsoft Windows platforms,
and Microsoft Internet Explorer version 5.1 for MacOS X. Other versionsof these and other browsers were reported to display erroneous behavior.

•

Upgrade sequence—Juniper Networks recommends that you follow the
upgrade instructions described in the ScreenOS Upgrade Guide located at
http://www.juniper.net/techpubs/software/screenos/screenos6.0.0/upgrade_guide.pdf. If you upgrade directly from ScreenOS 5.0.0 or ScreenOS
5.1.0 to ScreenOS 6.0, you risk losing part of any existing configuration.
For ISG 2000 devices, you must upgrade to an intermediate firmware andupgrade the boot loader before upgrading to the ScreenOS 6.0 firmware.
Refer to “Upgrade Paths to ScreenOS 6.0” in the ScreenOS Upgrade
Guide for intermediate software and boot loader upgrade information.
Use the following procedure to upgrade the SSG 500/SSG500M bootloader:1. Download the boot loader image (v.1.0.3) from the Juniper
Networks support site to the root directory of your TFTP server.
2. Log into http://www.juniper.net/customers/support/.
3. In the Download Software section, click ScreenOS Software.
4. Download the latest SSG 500/SSG 500M boot loader and save it to
the root directory of your TFTP server.
5. If necessary, start the TFTP server.
6. Make an Ethernet connection from the device hosting the TFTP
server to the MGT port on the SSG 500 and a serial connection
from your workstation to the console port on the SSG 500.
7. Restart the SSG 500 by entering the reset command. When
prompted to confirm the command—System reset, are you sure?
y/[n] —press the Y key.
The following system output appears:
NetScreen SSG500 BootROM V1.0.2 (Checksum: 8796E2F3)
Copyright (c) 1997-2004 NetScreen Technologies, Inc.

ScreenOS Release Notes

71

Total physical memory: 512MB
Test - Pass
Initialization................ Done
8. Press the X and A keys sequentially to update the boot loader.
9. Enter the filename for the boot loader software you want to load (forexample, Boot2.1.0.3), the IP address of the SSG 500, and the IP
address of your TFTP server. The following system output appears:
File Name [boot2.1.0.2]: boot2.1.0.3
Self IP Address [10.150.65.152]:
TFTP IP Address [10.150.65.151]:
10. Press the Enter key to load the file. The following system output
appears:
Save loader config (112 bytes)... Done
Loading file "boot2.1.0.3"...
/Loaded successfully! (size = 125,512 bytes)
Ignore image authentication!
...
.......................
Done.
•

WebUI upgrade—When upgrading from ScreenOS 5.2.0 to ScreenOS
6.0 using the WebUI, you must upgrade the device to ScreenOS 5.2r3 andthen upgrade the device directly to ScreenOS 6.0. Refer to “Upgrading to
the New Firmware” in the ScreenOS Upgrade Guide for instructions on
performing the upgrade.

Documentation Changes
The sections below describe changes that pertain to the ScreenOS andsupported hardware documentation.

Changes in SSG Hardware Documentation
In the version of the SSG 300M-series Hardware Installation and Configuration
Guide that appears on some ScreenOS documentation CDs, the EMC Emissions
specifications for the SSG 350 are incorrect. The correct EMC Emissions
specifications for the SSG 350 are:•

FCC Part 15 Class A (USA)

ScreenOS Release Notes

72

•EN 55022 Class A (Europe, Australia, New Zealand)•

VCCI Class A (Japan)

Documentation Changes Introduced in 6.0.0r2
ScreenOS 6.0.0r2 includes minimal changes to the provided documentation.
Online help files have been updated to reflect Web user interface (WebUI)
modifications, and this release note document describes new features offered in
6.0.0r2. No other changes have been made to other volumes of ScreenOS
documentation for release 6.0.0r2. All new features available in 6.0.0r2 will befully documented in the next ScreenOS release.

Documentation Changes Introduced in 6.0.0r1
To upgrade existing firmware to ScreenOS 6.0, refer to the ScreenOS Upgrade
Guide located at
http://www.juniper.net/techpubs/software/screenos/screenos6.0.0/upgrade_guide.pdf. The SSG 500/500M-series devices require boot loader upgrade. For more
information on the upgrade procedure, see “Upgrade Sequence” in the
Compatibility Issues in ScreenOS 6.0 section.
Starting with ScreenOS 6.0.0, we have removed information on configuring
Physical Interface Modules (PIMs) and Mini Physical Interface Modules (MiniPIMs) from the installation and configuration guides for SSG devices. We have
moved this information into a new guide, the PIM and Mini-PIM Installation andConfiguration Guide. Refer to that guide for information on configuring PIMs andMini-PIMs.

ScreenOS Release Notes

73

Getting Help for ScreenOS 6.0 Software
For further assistance with Juniper Networks products, visit
http://www.juniper.net/support.
Juniper Networks occasionally provides maintenance releases (updates andupgrades) for ScreenOS firmware. To have access to these releases, you mustregister your security device with Juniper Networks at the above address.
Copyright © 2008, Juniper Networks, Inc. All rights reserved.
Juniper Networks, the Juniper Networks logo, NetScreen, and ScreenOS are
registered trademarks of Juniper Networks, Inc. in the United States and othercountries. All other trademarks, service marks, registered trademarks, or
registered service marks in this document are the property of Juniper Networks
or their respective owners. All specifications are subject to change without notice.
Juniper Networks assumes no responsibility for any inaccuracies in thisdocument or for any obligation to update information in this document. Juniper
Networks reserves the right to change, modify, transfer, or otherwise revise thispublication without notice.

ScreenOS Release Notes

74