Juniper Networks
Release Notes
Product: NetScreen Hardware Security Client, NetScreen-5XT, NetScreen-5GT,
NetScreen-5GT Wireless (ADSL), NetScreen-5GT ADSL, NetScreen-25,
NetScreen-50, NetScreen-204, NetScreen-208, NetScreen-500, ISG 1000, ISG
2000, NetScreen-5200, NetScreen-5400
Version: ScreenOS 5.3.0r4
Release Status: Rev 01
Part Number: 530-016858-01
Date: 08-07-06
Contents
1. Version Summary on page 2
2. Documentation Changes on page 2
3. New Features and Enhancements on page 2
4. Changes to Default Behavior on page 14
5. Migration Procedures on page 17
6. Addressed Issues on page 38
7. Known Issues on page 47
8. Getting Help on page 53

ScreenOS 5.3.0r4

Page 1 of 54

Juniper Networks

Release Notes

1. Version Summary
ScreenOS 5.3.0r4 is the latest release version of ScreenOS firmware for the NetScreen-5XT,NetScreen-5GT Series, NetScreen Hardware Security Client (HSC), NetScreen-25, NetScreen50, NetScreen-200 Series, and the NetScreen-500, ISG 1000, ISG 2000, NetScreen-5000
Series security systems.
The ScreenOS 5.3.0r4 release is interoperable with and provides basic support for all
versions of NetScreen Remote and ScreenOS 2.6.1 and later versions.
NetScreen-Security Manager, version 2005.2 and earlier, does not support ScreenOS
5.3.0r4.
This release incorporates the following ScreenOS maintenance releases:• 5.3.0r3• 5.2.0r3b• 5.1.0r4d• 5.0.0r11• 5.0.0-DSLWr10b• 5.0.0-ISGr10a• 5.0.0-M2r9b

2. Documentation Changes
2.1 Documentation Changes from 5.3.0r4
None.

2.2 Documentation Changes from 5.3.0r3
The following information is reflected in ScreenOS 5.3.0r3 documentation.
Changing the route preference with the set vrouter name preference protocol value CLI
command does not affect existing routes. This command only affects new corresponding
protocol routes. To apply changes to existing routes, you need to delete the routes then readd them. For dynamic routes, you need to disable the protocol then re-enable it or restartthe device.
The following correction applies to the Predefined Signature Packs section located in“Vol 4: Attack Detection and Defense Mechanisms” Chapter 5: Deep Inspection in theConcepts & Examples ScreenOS Reference Guide:The predefined server protection signature pack does not include threat coverage forOracle servers.

3. New Features and Enhancements
The following features and enhancements are new in this release. These features do noteffect migration.

ScreenOS 5.3.0r4

Page 2 of 54

Juniper Networks

Release Notes.

Note: You must register your product at http://support.juniper.net so that certain ScreenOSfeatures, such as antivirus or deep inspection, can be activated on the device. If you alreadyhave an account, enter your user ID and password; if you are a new Juniper Networks
customer, create your account first. To register your product, you need the model and serial
number of the device. After registering your product, confirm that your device has internet
connectivity. Issue the exec license-key update CLI command to make the device connect
to the Juniper Networks server to activate the feature.

3.1 New Features and Enhancements for ScreenOS 5.3.0r4
None.

3.2 New Features and Enhancements from ScreenOS 5.3.0r3
3.2.1 Service Timeout
To prevent using the wrong service timeout values, the port-based service timeout tablelookup is not used when the destination port is overloaded with multiple services withdifferent service timeouts. ScreenOS 5.3.0r3 uses service lookup within the service groupbased on the destination port to derive the correct service timeout value.
However, to minimize the performance impact due to the costly service lookup within aservice group, the port-based service timeout table is still maintained used as a shortcut
when service port overlapping is not an issue.

3.2.2 5000-M2 Management Module Support
ScreenOS 5.3.0r3 supports the 5000-M2 management module on a NetScreen-5000 Series
device.

3.3 New Features and Enhancements from ScreenOS 5.3.0r2
3.3.1 Antivirus
ScreenOS 5.3.0r2 supports an integrated antivirus (AV) solution on the NetScreen-5GT
Series and NetScreen-HSC devices.
In this release of the AV scan engine, you can:• Configure scanning profiles
The AV scan engine is enhanced to increase the flexibility and granularity of AV scans.
Profile-based scanning allows you to configure a profile to scan traffic and assign the
profile to a policy.
• Enable/disable scanning based on application protocol

ScreenOS 5.3.0r4

Page 3 of 54

Juniper Networks

Release Notes

The AV scan engine allows you to select the content (FTP, HTTP, IMAP, POP3, or
SMTP traffic) to scan. Scan performance can be enhanced due to not scanning certain
content.
Note: You need to assess the risk and determine the best trade-off between security andperformance.
• Enable/disable scanning based on file extension and content typeFor example, you can set up a profile that allows scanning of executable files (.exe),
but not documentation files (.doc or .pdf).
• Configure decompression layer for specific application protocols
In each profile, you can configure different decompression levels for each protocol(HTTP/SMTP/POP3/IMAP/FTP). Based on your network environment, you might
specify the number of embedded zips to unpack for each protocol.
• Use the Exclude option to define URL patterns for Webmail scanning
The internal AV scanner examines specific HTTP webmail patterns only. You can add
a pattern for a specific webmail type, so the content is scanned. The patterns for AOL,Yahoo!, and MSN mail services are predefined.
The optional exclude keyword can be specified if you want to match the pattern otherthan the specified URL string. For example, use the exclude option to examine forvirus patterns in all paths, except in paths containing the matching prefix string.
• Configure e-mail notification to sender/receiver on detected virus and scanning errors
New Juniper-Kaspersky AV Scan Engine
ScreenOS 5.3.0r2 supports either of two scan engines. In addition to supporting the existing
Trend Micro scan engine, ScreenOS 5.3.0 also offers support for a new enhanced scanengine from Kaspersky Lab.
The Juniper-Kaspersky scan engine by default provides the highest level of security. In
addition to screening viruses (including polymorphic and other advanced viruses), the newscan engine also provides inbound spyware and phishing protection.
• Spyware protection. The new spyware protection feature adds another layer ofprotection to Juniper Networks anti-spyware and anti-adware solutions by letting you
block incoming spyware, adware, keyloggers, and related malware to prevent it from
penetrating your enterprise.
This solution complements Juniper Networks IDP products, which provide spyware
phone-home protection (that is, stopping spyware from sending sensitive data froman infected computer workstation or server).
• Phishing protection. The phishing protection allows you to block emails that try to
entice users to fake (phishing) sites that steal sensitive data from them.
Default Security Level
The Standard default security level is the most secure of the three scanning level options.
However, you may choose to change the default security level of scanning with thefollowing two options:
ScreenOS 5.3.0r4

Page 4 of 54

Juniper Networks

Release Notes• Basic in-the-wild scanning. This level of scanning administers a lower degree of
security by scanning the most prevalent viruses. It provides increased performance.
• Extended scanning. This level of scanning traditionally includes more noisy pieces of
spyware/adware to the standard scan. It provides more spyware coverage, but
potentially can return more false positives.

3.3.2 Deep Inspection Signature Packs
In ScreenOS 5.3.0r2, Deep Inspection (DI) signatures are optimized into four signaturepacks for specific threat coverage and desired network deployment. This approach is ideal
because of the limited device memory and increased protocol support.
Table 1 describes the four available signature packs in ScreenOS 5.3.0r2.

Table 1: DI Signature Packs
Signature
Pack

Description

Threat Coverage*

A selected set of signatures
for client/server and worm
protection optimized forremote and branch offices
along with small/medium
businesses.

Includes a sample of worm, client-toserver, and server-to-client signatures forInternet-facing protocols and services,such as HTTP, DNS, FTP, SMTP, POP3,
IMAP, NetBIOS/SMB, MS-RPC, P2P,
and IM (AIM, YMSG, MSN, and IRC).

Serverprotection

For small/medium enterprises
and remote and branch
offices of large enterprises
needing perimeter defense
and compliance for server
infrastructure, such as IIS andExchange.

Primarily focuses on protecting a server
farm. It includes a comprehensive set ofserver-oriented protocols, such as HTTP,
DNS, FTP, SMTP, IMAP, MS-SQL, andLDAP. Also includes worm signaturesthat target servers.

Clientprotection

For small/medium enterprises
and remote and branch
offices of large enterprises
needing perimeter defense
and compliance for hosts(desktops, laptops, and soon.).

Primarily focuses on protecting users
from getting malware, Trojans, and so on
while surfing the Internet. Includes acomprehensive set of client-oriented
protocols, such as HTTP, DNS, FTP,
IMAP, POP3, P2P, and IM (AIM, YMSG,
MSN, and IRC). Also includes worm
signatures that target clients.

Wormmitigation

For remote and branch
offices of large enterprises
along with small/medium
businesses to provide themost comprehensive defense
against worm attacks.

Includes stream signatures and primarily
focuses on providing comprehensive
worm protection. Detects server-to-clientand client-to-server worm attacks for all
protocols.

Base

†

*. For NetScreen-5XT and NetScreen-5GT Series devices with ScreenOS 5.3.0, only DI
signatures of critical severity are provided due to memory allocation required for new
ScreenOS features.

ScreenOS 5.3.0r4

Page 5 of 54

Juniper Networks

Release Notes†. All the other DI signature packs support “Stream256,” in which only the first 256 bitsof the stream are inspected. The worm mitigation signature pack however, inspects all
packets in the stream.
Juniper Networks stores the signature packs on a database server. To use the predefined
attack objects, you must have already downloaded the signature pack from this server andloaded it on your security device.
Before you start downloading a signature pack from the URLs listed in Table 2, you must do
the following:
1. Register your security device and obtain an authorization code.
2. Purchase a license key and activate a subscription for Deep Inspection.
3. Verify that the system clock and the Domain Name Service (DNS) settings on
your security device are accurate.
After you install a DI license key on your security device, you may download any of the four
DI signature packs appropriate for your network needs. You can load the desired signaturepack one at a time as necessary.
To download one of the four signature packs, you must set the attack db url to one of the
URLs specified in Table 2 and then execute exec attack db update. The signature packdownloaded depends on the URL specified in the set command.

Table 2: URLs for Predefined Signature Packs
To download or
update theSpecify This URL

Base signaturepack (default)

https://services.netscreen.com/restricted/sigupdates

Server-protection
signature packhttps://services.netscreen.com/restricted/sigupdates/server

Client-protection
signature packhttps://services.netscreen.com/restricted/sigupdates/client

Worm-mitigation
signature packhttps://services.netscreen.com/restricted/sigupdates/worm

Table 3 lists the available DI signature packs on available security platforms.

ScreenOS 5.3.0r4

Page 6 of 54

Juniper Networks

Release Notes

Table 3: Supported DI Signature Packs for Juniper Networks Firewalls and VPNs
Platform

Base

NetScreen-5XTNetScreen-5GT
NetScreen-HSC

ServerClient*Worm
Mitigation#

NetScreen-25/50
NetScreen-204/208
NetScreen-500
ISG 1000/2000
NetScreen-5200/
5400* We recommend using this signature pack for small/medium businesses.
# We recommend using this signature pack for remote/branch offices

3.3.3 Anti-Spam
NetScreen-HSC, NetScreen-5XT, NetScreen-5GT Series, NetScreen-25, and NetScreen-50
devices – The anti-spam feature examines transmitted messages and decides which arespam and which are not. When the device detects a message deemed to be spam, it either
tags the message field with a pre-programmed string, or it drops the message. Anti-spam
uses a constantly-updated IP-based spam blocking service that uses information gathered
worldwide. Because this service is robust and yields few false positives, it is not mandatory
to tune or configure blacklists. However, the administrator has the option of adding specificdomains and IPs to local whitelists or blacklists, which the device can enforce locally. The
ScreenOS 5.3.or2 release supports anti-spam for SMTP protocol only.

3.3.4 QoS Enhancements
Quality of Service (QoS) enhancements in this release include the following:• Ingress policing• Traffic shaping on virtual interfaces• Use of all 6 bits of DiffServ Codepoint marking (DSCP).
Ingress Policing
Ingress policing is supported on the following platforms: NetScreen-5XT, NetScreen-5GT,
NetScreen-25, NetScreen-50, NetScreen-204, NetScreen-208, NetScreen-500. Ingresspolicing enables you to constrain the flow of traffic through the security device by limiting
bandwidth on the ingress side. You do this by setting the policing bandwidth (pbw) keyword
in a firewall policy to a maximum bandwidth value. Traffic exceeding the bandwidth setting
is dropped at the ingress side of the security device, thus conserving throughput resources.

ScreenOS 5.3.0r4

Page 7 of 54

Juniper Networks

Release Notes

Traffic shaping on virtual interfaces
Traffic shaping is supported on virtual interfaces on the following platforms: NetScreen-5XT,NetScreen-5GT Series, NetScreen-25, NetScreen-50, NetScreen-200 Series, andNetScreen-500. In the context of traffic shaping, the term virtual interfaces refers only tosubinterfaces and tunnel interfaces—not to other types of virtual interfaces, such as virtual
security interfaces (VSI), or aggregate or redundant interfaces.
Traffic shaping is not supported on loopback interfaces, because no traffic is actuallytransmitted on a loopback interface. However, a loopback interface is often used as ananchor point in a VPN, to derive the source IP address, while the data is transmitted on an
actual egress interface. When using a loopback interface in a VPN, therefore, you configure
traffic shaping on the outgoing interface. ScreenOS then associates the session with the real
outgoing interface, which it deduces from the routing table, dynamically updating theassociation as the routing table changes.
DSCP Marking
DSCP marking is supported on all platforms and can be configured with traffic shaping or
independently. The following tables show how DSCP marking works with the various
platforms. (See RFC 2401 for specific information about the handling of inner and outer IP
headers, extension headers, and options for AH and ESP tunnels.)

Table 4: DSCP Marking for Clear-Text Traffic
NetScreen-HSC,
NetScreen-5XT,NetScreen-5GT Series,
NetScreen-25, NetScreen-50,
NetScreen-200 Series,
NetScreen-500

NetScreen-5000 Series,
ISG 1000, ISG 2000

Clear packet withno marking on thepolicyNo marking.

No marking.

Clear packet withmarking on thepolicyThe packet is marked based on
the policy.

The packet is marked
based on the policy.

Pre-marked packet
with no marking on
the policy

Retain marking in the packet.

Retain marking in thepacket.

Pre-marked packet
with marking on thepolicyOverwrite marking in the packet
based on the policy.

Overwrite marking in thepacket based on the policy.

Description

ScreenOS 5.3.0r4

Page 8 of 54

Juniper Networks

Release Notes

Table 5: DSCP Marking for Policy-Based VPNs

Description

NetScreen-HSC,
NetScreen-5XT,NetScreen-5GT Series,
NetScreen-25, NetScreen-50,
NetScreen-200 Series,
NetScreen-500

NetScreen-5000 Series,
ISG 1000, ISG 2000

Clear packet into
policy-based VPN
with no marking on
the policy

No marking.

No marking.

Clear packet into
policy-based VPN
with marking on thepolicyOnly the ESP header is marked,
based on the policy.

Mark both the inner packet
and the ESP header basedon the policy.

Pre-marked packet
into policy-based
VPN with nomarking on thepolicyThe ESP header is not marked,
retain marking in the inner packet.

The ESP header is notmarked, retain marking in
the inner packet.

Pre-marked packet
into policy-based
VPN with marking
on the policy

The ESP header is marked,
based on the policy, retain
marking in the inner packet.

Overwrite the marking in
the inner packet based on
the policy and copy the
inner packet marking to the
ESP header.

Table 6: DSCP Marking for Route-Based VPNs

Description

ScreenOS 5.3.0r4

NetScreen-HSC,
NetScreen-5XT,NetScreen-5GT Series,
NetScreen-25, NetScreen-50,
NetScreen-200 Series,
NetScreen-500

NetScreen-5000 Series,
ISG 1000, ISG 2000

Clear packet into
route-based VPN
with no marking on
the policy

No marking.

No marking.

Clear packet into
route-based VPN
with marking on thepolicyThe inner packet and ESP header
are both marked, based on thepolicy.

The inner packet ismarked, based on thepolicy. The ESP header is
not marked.

Page 9 of 54

Juniper Networks

Release Notes

NetScreen-HSC,
NetScreen-5XT,NetScreen-5GT Series,
NetScreen-25, NetScreen-50,
NetScreen-200 Series,
NetScreen-500

NetScreen-5000 Series,
ISG 1000, ISG 2000

Pre-marked packet
into route-based
VPN with nomarking on thepolicyCopy the inner packet marking to
the ESP header, retain marking in
the inner packet.

The ESP header is notmarked, retain marking in
the inner packet.

Pre-marked packet
into route-based
VPN with marking
on the policy

Overwrite the marking in the inner
packet based on the policy, andcopy the inner packet marking to
the ESP header.

Overwrite marking in the
inner packet, based on thepolicy. The ESP header is
not marked.

Description

3.3.5 Media Gateway Control Protocol (MGCP) ALG for VoIP
The MGCP Application Layer Gateway (ALG) is supported on security devices in route mode,transparent mode, and network address translation (NAT) mode. The MGCP ALG performs
the following procedures:
Conducts VoIP signaling payload inspection. Conducts VoIP signaling payload
inspection. The payload of the incoming VoIP signaling packet is fully inspected basedon RFC 3435. Any malformed packet attack is blocked by the MGCP ALG.
Conducts MGCP signaling payload inspection. The payload of the incoming MGCP
signaling packet is fully inspected in accordance with RFC 3435. Any malformedpacket attack is blocked by the ALG.
Provides stateful processing. The corresponding VoIP protocol-based state machines
are invoked to process the parsed information. Any out-of-state or out-of-transaction
packet is identified and properly handled.
Performs Network Address Translation (NAT). Any embedded IP address and port
information in the payload is properly translated based on the existing routing
information and network topology, and is replaced with the translated IP address andport number, if necessary.
Manages pinholes for VoIP traffic. To keep the VoIP network secure, the IP address
and port information used for media or signaling is identified by the ALG, and any
needed pinhole is dynamically created and closed during call setup and subsequent
signalling.
MGCP Security
The MGCP ALG includes the following security features:• Denial of Service (DoS) attack protection – The ALG performs stateful inspection at the
UDP packet level, the transaction level, and at the call level. MGCP packets matching
the RFC3435 message format, transaction state, and call state, are processed. Allother messages are dropped.

ScreenOS 5.3.0r4

Page 10 of 54

Juniper Networks

Release Notes• Firewall policy enforcement between gateway and gateway controller (signaling
policy).
• Firewall policy enforcement between gateways (media policy).
• Per-gateway MGCP message flooding control – Any malfunctioning or hacked gateway
will not disrupt the whole VoIP network. Combined with per-gateway flooding control,
damage is contained within the impacted gateway.
• Per-gateway MGCP connection flooding control.
• Seamless switch-over/fail-over if calls, including calls in progress, are switched to thestandby firewall in case of system failure.

3.3.6 Gatekeeper Enhancement for H.323
The H.323 protocol ALG is enhanced to support incoming calls in NAT mode, and slow startin gatekeeper routed mode. In gatekeeper routed mode, all control channel negotiations(Q.931 and H.245) are performed between the gatekeeper and the end points. The media
channels, on the other hand, are opened directly between the end points. Support is also
provided for video conferences over IP, via Radvision ECS gatekeeper working in
conjunction with Polycom video endpoints.

3.3.7 SIP ALG Enhancements
Several enhancements have been made to the SIP ALG, including the ability to:• Allow music when the call is put on hold.
• Allow the NOTIFY method beyond dialog termination.
• Handle the OPTIONS method out of dialog.
• Handle the MESSAGE method out of dialog.

3.3.8 Service Timeout Enhancement
The custom service timeout feature has been enhanced to make service timeout behavior
more deterministic and predictable.

3.3.9 GTP Support
ISG 2000 devices only – ScreenOS provides GTP (GPRS Tunneling Protocol) firewall featuresthat address key security issues on the Gp, Gn, and Gi interfaces in GPRS (General Packet
Radio Services) networks.

3.3.10 Dead Peer Detection
Dead-Peer Detection (DPD) allows an IPSec device to verify the current existence andavailability of other IPSec peer devices. The device performs this verification by sending
encrypted IKE Phase 1 notification payloads (R-U-THERE) to the peers and waiting for DPD
acknowledgements (R-U-THERE-ACK).
Note: DPD conforms to RFC 3706.

ScreenOS 5.3.0r4

Page 11 of 54

Juniper Networks

Release Notes

3.3.11 BGP Route Refresh
The Border Gateway Protocol (BGP) route-refresh feature as defined in RFC 2918 provides asoft reset mechanism that allows the dynamic exchange of route refresh requests androuting information between BGP peers and the subsequent re-advertisement of theoutbound or inbound routing table. With this mechanism, it is not necessary to restart thedevice, and the device does not need to learn all BGP routes again.

3.3.12 Simple Network Management Protocol Enhancements
On the NetScreen-500, NetScreen-5400, and ISG 2000 devices, ScreenOS supports Simple
Network Management Protocol (SNMP) traps for power supply failures and to monitor DIP
utilization.
For example, the set dip alarm-raise number1 command sets a DIP utilization alarm
threshold, expressed as a percentage of possible DIP utilization. When DIP utilization
exceeds this threshold, the device triggers a SNMP trap.

3.3.13 Source-Based and Source Interface-Based Routing Enhancements
When setting up Source-Based Routing (SBR) and Source Interface-Based Routing (SIBR),
ScreenOS accepts a virtual router, such as trust-vr or untrust-vr, as the next hop.

3.3.14 Dial Enhancements
You can now configure a complete dial disaster recovery system for the NetScreen-5GT or
the NetScreen-5XT. You can configure two different types of trustee (limited access)administrative accounts for the monitoring of or changes to the in-band modem connection
only. This modem port is used to connect to an external modem or an ISDN terminal
adapter (TA) for dialup disaster recovery purposes. You can also specify a priority level foreach ISP (up to four) that you configure and specify the trigger mechanism (IP, tunnel, orroute tracking).

3.3.15 Juniper Networks Enterprise Infranet Solution
A Juniper Networks security device and an Infranet Controller (an IC 4000 platform) work
together to provide granular, context-specific end-point security and firewall services toconnect end users to protected resources. An end user running an Infranet Agent
communicates with the Infranet Controller over HTTPS (HyperText Transfer ProtocolSecure) using SSL (Secure Socket Layer) to encrypt the transfer of authentication data. Onceauthenticated, the user connects to the security device through a policy configured by theInfranet Controller. When the end user logs out the policy is removed from the security
device.

3.3.16 802.1q VLAN Tag Support on NetScreen-5GT
New supported platforms for VLAN tags are the NetScreen-5GT Series devices.
802.1Q vlan-tagged sub-interfaces are now available on the Trust-Untrust port mode.
Juniper Networks security devices support up to a maximum of ten (10) 802.1Q vlan-tagged
sub-interfaces.

ScreenOS 5.3.0r4

Page 12 of 54

Juniper Networks

Release Notes

3.3.17 Port Modes Support Wireless Interfaces
Juniper Networks NetScreen-5GT Wireless (ADSL) devices support up to four wirelessinterfaces. The wireless interfaces that are available are dependant on which port mode isconfigured on your device.

3.3.18 New Dual/DMZ Port Mode
The NetScreen-5GT Series supports Dual/DMZ port mode. Dual/DMZ mode binds interfaces
to the Untrust, Trust, DMZ, and DMZ2 security zones, allowing all security zones to passincoming and outgoing traffic simultaneously. This port mode requires that you purchase an
extended license key.

3.3.19 Increased Route Redistribution
OSPF and BGP route redistribution capacity has increased on some platforms.

Table 7: Maximum Route Redistribution
NetScreen-5200

4,096 to 6,000

NetScreen-5400

4,096 to 6,000

ISG 2000

4,096 to 6,000

3.3.20 Local DNS Resolution Table
All Juniper Networks security devices support a local DNS resolution table (similar to the“host” file on Unix systems).
This feature allows the creation of dynamic policies. You can set a local host name on asecurity device, add it to the address book, and then use it in policies. Devices under thesame administrative domain can use a single policy referring to a local host name; that local
host name may have a different IP address depending on the local host name resolutiontable of each device.
To set a local host name, use the set dns host name host_name ip_address CLI command.
This feature can be used in conjunction with Proxy-DNS functionality. For instance, multiple
security devices from different locations may be resolving the same DNS name, but theresulting IP address may be different based on their respective local host name resolutiontable.

ScreenOS 5.3.0r4

Page 13 of 54

Juniper Networks

Release Notes

3.3.21 Web Filtering
Integrated Web Filtering (with SurfControl) is supported on the following platforms.
Note: Web Filtering using an external SurfControl server is supported on all platforms.

Device Model

Integrated Web Filtering
SupportExternal Support

NetScreen HSC
NetScreen-5GT Series
NetScreen-25
NetScreen-50

YES

YES

NetScreen-200 Series
NetScreen-500
NetScreen-5000 Series
ISG 1000,
ISG 2000NOYES

4. Changes to Default Behavior
This section lists changes to default behavior between ScreenOS 5.3.0r4 and the previous
ScreenOS firmware releases.

4.1 Trace Dumps
Prior to ScreenOS 5.3.0r4, the clear log sys save CLI command did not clear old trace
dumps.

4.2 IKE Attack
In ScreenOS 5.3.0r4, the anti-ike-id enumeration attack CLI commands were changed frombeing available at the vsys level to only available when at the root vsys level.
The following commands are affected:
set/unset/get ike ikeid-enumeration

4.3 IP Checksum
In ScreenOS 5.3.0r4, the IP checksum verification was disabled on additional platforms in
the NetScreen-5000 series (using 5000-8G and 5000-2G24FE SPM) because the algorithm
was not fully RFC compliant and cannot differentiate between 0xffff and 0x0000.

4.4 CPU Calculation
In ScreenOS 5.3.0r4, CPU utilization calculation could display high CPU cases even though
the CPU load is similar to previous ScreenOS version.

ScreenOS 5.3.0r4

Page 14 of 54

Juniper Networks

Release Notes

4.5 IP Classification
In ScreenOS 5.3.0r4, after an IP classification returns a new vsys, the device selects theincoming virtual router on the shared interface as the main virtual router instead of theclassified vsys.

4.6 Remote Authentication
In ScreenOS 5.3.0r4, the remote authentication server is queried when an admin does notappear in the local database.

4.7 TCP Reset
In ScreenOS 5.3.0r4, TCP reset packets are dropped if they do not match any existing
sessions instead of creating a new session.

4.8 Policy Lookup in VoIP ALG
Prior to 5.3.0r4, the VoIP ALG policy lookup module would bypass the Global zone, causing
traffic to be classified as MIP instead of non-ALG. 5.3.0r4 has fixed this problem so that ALG
correctly emulates a regular traffic policy search.

4.9 SSL Connection Option
In ScreenOS 5.3.0r4, SSL has an option to connect clients even though the certification pathverification failed.

4.10Password Authentication
In ScreenOS 5.3.0r4, password authentication attempts are not longer accepted when
password authentication is disabled for SSH admins.

4.11HA Interface
In ScreenOS 5.3.0r4, sometimes the HA port will hang. When this port hangs, change themonitoring period to 2 seconds to reset the port.

4.12Anti-Spam
In ScreenOS 5.3.0r4, after the anti-spam license key expires, only the basic white and blacklists are functional.

4.13TrendMicro Scan Engine
In ScreenOS 5.3.0r4, the TrendMicro scan engine was upgraded to VSAPI 8.0.
The Scan-Intelligent scan mode is treated as scan-all during a real file scan.

ScreenOS 5.3.0r4

Page 15 of 54

Juniper Networks

Release Notes

4.14Kaspersky AV Scan Engine
In ScreenOS 5.3.0r4, when an Kaspersky AV scan engine returns a scan code of password
protected file or corrupted file, the device will always pass traffic instead of using the failmode setting.
ScreenOS has been integrated with the latest Kaspersky AV scan engine and has also beenenhanced for AV database file integrity check.

4.15ICMP Redirect Packets
The ICMP redirect packets are dropped without a session match in all modes except
Transparent mode. In Transparent mode, the packets will match the existing session, if any.

4.16SSH Version 2
In ScreenOS 5.3.0r3, administrative users whose accounts were defined in the local(internal) authentication server failed to authenticate when authentication was attemptedfrom an SSHv2 client application.

4.17NetScreen-200 Series Virtual Routers
Prior to ScreenOS 5.3.0r4, devices using the additional virtual router (VR) key had four extra
VRs instead of five.

4.18SCEP Enrollment
In ScreenOS 5.3.0r4, Digital Signature Algorithm (DSA) is unsupported for Simple Certificate
Enrollment Protocol (SCEP).

4.19Route-based VPNs
Prior to 5.3.0r2, if traffic is initiated from the tunnel (encrypted) side, even when there is noreverse route (the route that points to the tunnel interface), traffic would pass through thedevice. In this release, the reverse route must exist, otherwise packets are dropped.

4.20Deep Inspection
In ScreenOS 5.3.0, the memory pool on an NetScreen-5GT Series device is reduced to 7 MB.
When you upgrade to 5.3.0, you might see the following message during initial restart: (Thesame message is displayed when you upgrade from ScreenOS 5.1 to 5.3.0 on the
NetScreen-5XT device.)
Attack DB failed to load. File is too large to load

Download the latest DI signature pack by entering the exec attack db update CLI
command. You will get a reduced pack containing only critical signatures.

ScreenOS 5.3.0r4

Page 16 of 54

Juniper Networks

Release Notes

4.21AV Scanner File Size Reduced
The maximum file size, for all email protocols, the AV scanner can examine is 10
megabytes (MB), as opposed to 16 MB in versions prior to ScreenOS 5.3.0. The default filesize is also 10 MB.
If the setting on your security device is greater than 10 MB, we recommend that you change
the setting to 10 MB before you upgrade the security device to ScreenOS 5.3.0.

4.22BGP Peers
On the NetScreen-5GT Series, NetScreen-5XT, NetScreen-50 devices, the number of BGP
peers increased to 10.

4.23Interface MTU
The interface MTU value range changed from 800-1500 bytes to 1280-1500 bytes.

4.24XAuth on the NetScreen-Remote
Previously, a new login window reappeared every time attempts to connect to the Radius
server failed (up to 5 times). Currently, only the original login window displays when there
is a failed attempt.

5. Migration ProceduresThis section includes the migration and upgrade procedures that were part of the Migration
Guide in previous releases of ScreenOS. The Migration Guide as a standalone document has
been discontinued and its information incorporated in the Release Notes.
Before you begin a security device upgrade, you must have the most recent ScreenOS
firmware. If you upgrade from 5.2.0r3 or later to 5.3.0rx, you also require the interim
firmware “xxxx.5.3.0-up” (where xxxx corresponds to the device model). You must upgrade
first to the xxx.5.3.0-up firmware then upgrade to 5.3.0rx. Refer to 5.3 Downloading the
New Firmware on page 21 for more download information.

Caution!
• For NetScreen-5GT Wireless (ADSL) and ISG 1000 device users: You can go directly to the ScreenOS
5.3.0r2 version because there are no 5.1.0 or 5.2.0 ScreenOS images for these devices.
• For NetScreen-500 and ISG 2000 device users: You must upgrade the boot loader/OS loader before
proceeding to ScreenOS 5.2.0 or above.

The following diagram shows the firmware upgrade path.

ScreenOS 5.3.0r4

Page 17 of 54

Juniper Networks

Release Notes

Figure 1: Firmware Upgrade Path
4.XXrx5.0.0rx

5.1.0rx

5.2.0r1
5.2.0r2

For NetScreen-500 and ISG 2000 device users:
You must upgrade the boot loader/OS loader
before proceeding to ScreenOS 5.2.0 or above.

5.2.0r3or
5.3-up

5.3.0r4

5.3.0r4

5.3.0r1

5.0.0rx

5.3.0r4

5.3.0r4

5.3.0r4

This section contains the following information:
Caution! Before upgrading or downgrading a security device, save the existing configuration file
to avoid losing any data. When downgrading a security device, the configuration file will be lost.
5.1 Requirements to Upgrade and Downgrade Device Firmware on page 18
5.2 Special Boot-ROM or Boot-Loader Requirements on page 20
5.3 Downloading the New Firmware on page 21
5.4 Upgrading to the New Firmware on page 22
5.5 Upgrading and Downgrading the NetScreen-500 on page 25
5.6 Upgrading the ISG 2000 OS Loader on page 27
5.7 Upgrading Security Devices in an NSRP Configuration on page 29
5.8 Upgrading or Migrating the AV Scanner on page 36

5.1 Requirements to Upgrade and Downgrade Device Firmware
This section lists what is required to perform the upgrade or the downgrade of security
device firmware. You can use one of three methods to upgrade a security device or todowngrade a device from ScreenOS 5.3.0 to ScreenOS 5.2.0: the WebUI, the CLI, or
through the Boot Loader or ScreenOS Loader.
Note: You can upgrade or downgrade some security devices locally or remotely, but werecommend that you perform the upgrade or downgrade of a security device at the device
location. For NetScreen-500 and ISG 2000 devices, both of these operations require console
access, therefore you must be at the device location.

ScreenOS 5.3.0r4

Page 18 of 54

Juniper Networks

Release Notes

To use the WebUI, you must have:• Root or read-write privileges to the security device• Network access to the security device from a computer that has an Internet browser• The new ScreenOS firmware (downloaded from the Juniper Networks website andsaved locally)
To use the CLI, you must have:• Root or read-write privileges to the security device• A console connection or Telnet access to the security device from a computer• A TFTP server installed locally and to which the security device has access• The new ScreenOS firmware (downloaded from the Juniper Networks website andsaved to a local TFTP server directory).
To upgrade or downgrade through the boot loader, you must have:• Root or read-write privileges to the security device• A TFTP server installed locally that has an IP address in the same subnet as the
security device (255.255.255.0)• An Ethernet connection from a computer to the security device (to transfer data,
namely from a local TFTP server)• A console connection from the computer to the security device (to manage thesecurity device)• The new ScreenOS firmware saved to a local TFTP server directory
The illustration below show the three different ways by which you can upgrade or
downgrade a security device.
.

Using the WebUI:

Using the CLI:

Through the boot loader:security device

security device

security device

Internet

via serial
console OR

via serial
consoleSerial Console
9600, 8 , N, 1

Serial Console
ConsoleSerial
9600,8 N,N, 119600,8Internetor
TFTP server
TFTP Server
ServerTFTP

via Telnet or
SSH
Telnet ,, SSH
SSH
TelnetTFTP server
TFTP Server

ebUI WebUI using a browser
viaWtheNote: For NetScreen-500 and ISG 2000 devices, you can upgrade or downgrade only through theboot loader.

ScreenOS 5.3.0r4

Page 19 of 54

Juniper Networks

Release Notes

To upgrade or downgrade a security device, see the step-by-step procedures in the following
sections: “Upgrading to the New Firmware” on page 22 or “Upgrading Security Devices in
an NSRP Configuration” on page 29.

5.2 Special Boot-ROM or Boot-Loader Requirements
Some devices require upgrade of the boot-ROM or boot-loader before or during upgrade.

5.2.1 NetScreen-500 Boot-ROM
Installation of this release on a NetScreen-500 device requires the new boot-ROM(ns500.upgrade6M). To do this, you perform the version upgrade twice. The first time
installs the boot-ROM, the second time installs the new ScreenOS image.

5.2.2 ISG 2000 Boot Loader
Before upgrading an ISG 2000 system to the ScreenOS 5.3.0 release firmware, you must
upgrade the OS loader to v1.1.5. You can see the OS loader version scroll by during thebootup process or by entering the get envar command.
1. Download the OS loader from the Juniper Networks support site to the root
directory of your TFTP server.
2. Visit www.juniper.net/support and log in.
3. In the Download Software section, click ScreenOS Software.
4. Download the latest OS loader and save it to the root directory of your TFTP
server.
5. If necessary, start the TFTP server.
6. Make an Ethernet connection from the device hosting the TFTP server to the
MGT port on the ISG 2000 and a serial connection from your workstation to theconsole port on the ISG 2000.
7. Restart the ISG 2000 by entering the reset command. When prompted toconfirm the command— System reset, are you sure? y/[n] — press the Y key.
8. When you see the following prompt, press the X key, and then the A key:
NetScreen NS-ISG 2000 BootROM V0.9.0 (Checksum: 8796E2F3)
Copyright (c) 1997-2004 NetScreen Technologies, Inc.
Total physical memory: 1024MB
Test - Pass
Initialization................ Done

9. Hit key 'X' and 'A' sequentially to update OS Loader.
10. Enter the filename for the OS loader software you want to load (for example,
load2000v115.d.S ), the IP address of the ISG 2000, and the IP address of your
TFTP server:
Serial Number [0079112003000031]: READ ONLY
BOM Version [C06]: READ ONLY
Self MAC Address [0010-db58-c900]: READ ONLY

ScreenOS 5.3.0r4

Page 20 of 54

Juniper Networks

Release Notes

OS Loader File Name [boot2000v090.ld.S]: load2000v115.d.S
Self IP Address [10.150.65.152]:
TFTP IP Address [10.150.65.151]:

11. Press the Enter key, and the file loads.
Save loader config (112 bytes)... Done
Loading file "load2000v115.d.S"...
rtatatatatata ...
Loaded successfully! (size = 383,222 bytes)
Ignore image authentication!
Program OS Loader to on-board flash memory...
++++++++++++++++++++++++Done!
Start loading...
.......................
Done.

You have completed the upgrade of the OS loader.

5.3 Downloading the New Firmware
You can obtain the firmware from the Juniper Networks website. To access firmware
downloads, you must be a registered customer with an active user ID and password. If you
have not yet registered your Juniper Networks product, then you must do so at the Juniper
Networks website before proceeding.

Note: Before you begin a security device upgrade, you must have the most recent ScreenOS
firmware. If you upgrade from 5.2.0r2 or later to 5.3.0rx, you also require the interim firmware“xxxx.5.3.0-up” (where xxxx corresponds to the device model). You must upgrade first to thexxx.5.3.0-up firmware then upgrade to 5.3.0rx. The following diagram shows the firmware
upgrade path.
1. To get the latest ScreenOS firmware, enter http://www.juniper.net/support inyour Web browser, click Support > Customer Support Center, then performthe following steps:
a. Log in by entering your user ID and password, then click LOGIN.
b. Select Download Software or pick the actual product you want to download
for from the Quicklink picker.
A list of available downloads appears.
c. Click Continue.
The File Download page appears.
d. Click the product link for the firmware you want to download.
The Upgrades page appears.
e. Click the link for the ScreenOS version you want to download.

ScreenOS 5.3.0r4

Page 21 of 54

Juniper Networks

Release Notes

The Upgrades page appears.
f. Click the upgrade link.
The Download File dialog box appears.
2. Click Save and then navigate to the location where you want to save thefirmware Zip file.
Note: Before loading the firmware image, you must unzip the file.
You must save the firmware onto the computer from which you want to perform theupgrade.
If you want to upgrade the security device using the WebUI, then save the firmware
anywhere on the computer.
If you want to upgrade the security devices using the CLI, then save the firmware to the root
TFTP server directory on the computer. If you do not have a TFTP server installed on yourcomputer, then you can download one from the Internet. If no TFTP server is available,
then you must use the WebUI to load the new firmware onto the security device.

5.4 Upgrading to the New Firmware
Caution! Before upgrading a security device, save the existing configuration file to avoid losing
any data.
You can upgrade any device from ScreenOS 5.0.0 and ScreenOS 5.1.0 directly to
ScreenOS 5.3.0 using the WebUI or CLI.
You can upgrade any device from ScreenOS 5.2.0 directly to ScreenOS 5.3.0 using the CLI.
If you wish to upgrade from ScreenOS 5.2.0 to ScreenOS 5.3.0 using the WebUI, however,you first have to upgrade to an interim firmware. This is due to a buffer size issue.
The following section describes how to perform the upgrade using the WebUI and CLI.

5.4.1 Using the WebUITo upgrade the firmware using the WebUI, perform the following steps:
1. Log in to the security device by opening a Web browser and then entering theManagement IP address in the Address field. Log in as the root admin or an
admin with read-write privileges.
2. Save the existing configuration:a. Go to Configuration > Update > Config File, then click Save to File.
b. In the File Download dialog box, click Save.
c. Navigate to the location where you want to save the configuration file (cfg.txt),
and then click Save.
Upgrading to the Interim Firmware (for upgrading from ScreenOS 5.2.0 only)
If you are upgrading security devices from ScreenOS 5.0.0 or ScreenOS 5.1.0, skip to
step 9.

ScreenOS 5.3.0r4

Page 22 of 54

Juniper Networks

Release Notes

3. Go to Configuration > Update > ScreenOS/Keys and select Firmware Update.
4. Click Browse to navigate to the location of the interim firmware “xxxx.5.3.0-up’(where xxxx corresponds to the device model) or type the path to its location in
the Load File field.
5. Click Apply.
Note: This process takes some time. DO NOT click Cancel or the upgrade will fail. If you
click Cancel and the upgrade fails, power off the device and then power it on again.
Restart the upgrade procedure from step 4.
6. Click OK to continue.
The security device restarts automatically. The upgrade is complete when the device
displays the login page in the browser.
7. Log in to the security device. You can verify the version of the security device
ScreenOS firmware in the Device Information section of the WebUI Home page.
Upgrading to the New ScreenOS Firmware
8. Go to Configuration > Update > ScreenOS/Keys and select Firmware Update.
9. Click Browse to navigate to the location of the new ScreenOS firmware or typethe path to its location in the Load File field.
10. Click Apply.
A message box appears with information on the upgrade time.
11. Click OK to continue.
The security device restarts automatically. The upgrade is complete when the device
displays the login page in the browser.
12. Log in to the security device. You can verify the version of the security device
ScreenOS firmware in the Device Information section of the WebUI Home page.

5.4.2 Using the CLI
To upgrade the firmware using the CLI, perform the following steps:
1. Make sure that you have the new ScreenOS firmware and the interim firmware“xxxx.5.3.0-up” (where xxxx corresponds to the device model). For information on
obtaining the new firmware, see “Downloading the New Firmware” on page 21.
2. Run the TFTP server on your computer by double-clicking on the TFTP server
application.
3. Log in to the security device using an application such as Telnet or Secure Shell(SSH) or Hyper Terminal if directly connected through the console port. Log inas the root admin or an admin with read-write privileges.
4. Save the existing configuration by executing the command:save config to { flash | slot1 | tftp }...
5. On the security device, enter the save soft from tftp ip_addr filename to flash
command.
ScreenOS 5.3.0r4

Page 23 of 54

Juniper Networks

Release Notes

where ip_addr is the IP address of your computer and filename is the name of the
ScreenOS firmware.
6. When the upgrade or downgrade is complete, you must reset the security device.
Execute the reset command and enter y at the prompt to reset the device.
7. Wait a few minutes, and then log in to the security device again.
8. Use the get system command to verify the version of the security device
ScreenOS firmware.
9. Upload the configuration file that you saved in step 3 with the save config to{flash | slot1 | tftp}... command.

5.4.3 Using the Boot/OS Loader
The Boot/OS Loader brings up the hardware system, performs basic and sometimes critical
hardware configurations, and loads system software used to run a security device.

Note: On the NetScreen-500, you cannot use this process to save firmware, ScreenOS 5.1.0 or
previous, to flash memory. Use the WebUI or CLI to save ScreenOS 5.1.0 firmware to flash
memory.
To load firmware with the Boot/OS Loader, perform the following steps:
1. Connect your computer to the security device using one of the following methods:
a. Using a serial cable, connect the serial port on your computer to the console
port on the security device. This connection, in combination with a terminal
application, enables you to manage the security device.
b. Using an Ethernet cable, connect the network port on your computer to port 1
or to the management port on the security device. This connection enables thetransfer of data between the computer, the TFTP server, and the security
device.
2. Make sure that you have the new ScreenOS firmware stored in the TFTP server
directory on your computer. For information on obtaining the new firmware, see“Downloading the New Firmware” on page 21.
3. Run the TFTP server on your computer by double-clicking on the TFTP server
application. You can minimize its window but it must be active in the
background.
4. Log in to the security device using a terminal emulator such as Hyper Terminal.
Log in as the root admin or an admin with read-write privileges.
5. Restart the security device.
6. When you see “Hit any key to run loader” or “Hit any key to load new firmware”
on the console display, press any key on the keyboard to interrupt the bootup
process.
Note: If you do not interrupt the security device in time, it proceeds to load the firmware
saved in flash memory.
7. At the Boot File Name prompt, enter the file name of the ScreenOS firmwarethat you want to load.
ScreenOS 5.3.0r4

Page 24 of 54

Juniper Networks

Release Notes

If you type slot1: before the specified file name, then the loader reads the specified filefrom the external Compact Flash or memory card. If you do not type slot1: before thefilename, then the file is instead downloaded from the TFTP server. If the security
device does not support a Compact Flash card, then an error message is displayed andthe console prompts you to retype the filename.
8. At the Self IP Address prompt, enter an IP address that is on the same subnet as
the TFTP server.
9. At the TFTP IP Address prompt, enter the IP address of the TFTP server.
Note: The Self IP address and TFTP IP address must be in the same subnet; otherwise, the
TFTP loader rejects the Self IP address and then prompts you to re-enter it.
An indication that the firmware is loading successfully is the display of a series of“rtatatatatatata...” running on the terminal emulator screen and a series of symbols
running on the TFTP server window. When the firmware installation is complete, amessage informs you that the installation was successful.

5.4.4 Saving Multiple Firmware Images with Boot Loader
After the firmware is downloaded successfully, the console displays the following:
Save to on-board flash disk? (y/[n]/m)

Answering y (yes) saves the file as the default firmware. This image runs automatically if
you do not interrupt the bootup process.
On some security devices, you can answer m (multiple) to save multiple firmware. You
must select a file name at the following prompt:
Please input multiple firmware file name [BIMINITE.D]: test.d

The name in brackets is the recommended name automatically generated after you input
the name in the TFTP server. If you do not enter a name, then the recommended name isused.

Note: You must enter a name that is DOS 8.3 compatible. The maximum length of the boot filename used by the Loader cannot exceed 63 characters.

5.5 Upgrading and Downgrading the NetScreen-500
Before the NetScreen-500 platform can support ScreenOS 5.3.0, you must upgrade the OSboot loader and file system to accommodate the larger image size. The previous OS loader
and file system supported a smaller image size.
The NetScreen-500 platform has 16 MB of total flash, with 4MB reserved for the OS loader
and 12 MB for the file system and system image. In order to load the 5.3.0 image
successfully, the file system must not exceed 5.6MB. Do the following to check the size ofthe file system:• If you are running ScreenOS 4.X, use the get file extension command to list the files
and their sizes. You can add up the individual file sizes to get the total size of the filesystem.
ScreenOS 5.3.0r4

Page 25 of 54

Juniper Networks

Release Notes• If you are running ScreenOS 5.x, use the get file info command to display the total
and available number of bytes.
The file system contains the configuration file, certificates, local logs and other files. If thefile system is greater than 5.66M, you can reduce its size by reducing the configuration filesize and deleting unnecessary files and logs.

Caution! Before you upgrade the OS loader and file system, we strongly recommend that you
back up the configuration file.
To upgrade the OS loader and file system, perform the following steps:
1. Download the upgrade image, ns500.upgrade, onto your computer.
2. Visit juniper.net and log in.
3. In the Download Software section, download ns500.upgrade from the ScreenOS
5.2 folder.
4. Load the ns500. upgrade software onto the NetScreen-500 through the WebUI,
CLI or Boot Loader.
For information on loading the software, see “Upgrading to the New Firmware” onpage 22.
If you used the WebUI to upgrade the NetScreen-500 platform, it automaticallyrestarts. If you used the CLI or the Boot Loader, use the reset command to restart thedevice.
The security device restarts, using the ns500.upgrade image. You have completed theupgrade of the OS loader and file system. You can now upgrade the firmware to ScreenOS
5.3.0.
For information on upgrading the firmware, see “Upgrading to the New Firmware” onpage 22.

5.5.1 Downgrading a NetScreen-500 Device
Caution! Before downgrading a security device, back up the existing configuration file. The
configuration file will be lost when downgrading the device.
If you need to downgrade the device to a version prior to ScreenOS 5.0.0, downgrade using
the boot/OS loader (see Using the Boot/OS Loader on page 27).
To downgrade a NetScreen-500 device from ScreenOS 5.3.0 to ScreenOS 5.0.0 or above,
use the CLI or Boot Loader:

ScreenOS 5.3.0r4

Page 26 of 54

Juniper Networks

Release Notes

Using the CLI
To downgrade using the CLI, perform the following steps:
1. Download the firmware from the Juniper Networks website. You must load thefirmware on the security device using the CLI. Therefore, save the firmware to
the root TFTP server directory on the computer.
For information on downloading the firmware, see “Downloading the New Firmware”
on page 21.
2. Load the firmware with the CLI. For information on using the CLI to load
firmware, see “Using the CLI” on page 23.
3. Enter the exec downgrade command.
The security device automatically restarts with the firmware you loaded.
Using the Boot/OS Loader
To downgrade using the boot/OS loader, perform the following steps:
1. Download the firmware from the Juniper Networks website. You must load thefirmware on the security device using the CLI. Therefore, save the firmware to
the root TFTP server directory on the computer.
For information on downloading the firmware, see “Downloading the New Firmware”
on page 21.
2. Enter the CLI command, exec downgrade.
The security device automatically restarts.
3. Load the firmware using the boot/OS loader. For information on using the boot/OS loader, see “Using the Boot/OS Loader” on page 24.

5.6 Upgrading the ISG 2000 OS Loader
Before the ISG 2000 can support ScreenOS 5.3.0, you must upgrade the OS loader if it is notv1.1.5. You can see the OS loader version scroll by during the bootup process or by entering
the get envar CLI command.
1. Download the OS loader from the Juniper Networks support site to the root
directory of your TFTP server.
2. Go to http://juniper.net/support then log in to the support center using youruser credentials.
3. In the Download Software section, download the software from the ScreenOS
5.3.0 folder.
4. Download the latest OS loader and save it to the root directory of your TFTP
server.
5. If necessary, start the TFTP server.
6. Make an Ethernet connection from the device hosting the TFTP server to the
MGT port on the ISG 2000 and a serial connection from your workstation to theconsole port on the ISG 2000.

ScreenOS 5.3.0r4

Page 27 of 54

Juniper Networks

Release Notes

7. Restart the ISG 2000 by entering the reset CLI command. When prompted toconfirm the command—System reset, are you sure? y/[n]—press the Y key.
8. When you see the following prompt, press the X key, and then the A key:
NetScreen NS-ISG 2000 BootROM V0.9.0 (Checksum: 8796E2F3)
Copyright (c) 1997-2004 NetScreen Technologies, Inc.
Total physical memory: 1024MB
Test - Pass
Initialization................ Done

9. Hit key 'X' and 'A' sequentially to update OS Loader.
10. Enter the filename for the OS loader software you want to load (for example,
load2000v115.d.S), the IP address of the ISG 2000, and the IP address of your
TFTP server:
Serial Number [0079112003000031]: READ ONLY
BOM Version [C06]: READ ONLY
Self MAC Address [0010-db58-c900]: READ ONLY
OS Loader File Name [boot2000v090.ld.S]: load2000v115.d.S
Self IP Address [10.150.65.152]:
TFTP IP Address [10.150.65.151]:

11. Press the Enter key, and the file loads.
Save loader config (112 bytes)... Done
Loading file "load2000v115.d.S"...
rtatatatatata ...
Loaded successfully! (size = 383,222 bytes)
Ignore image authentication!
Program OS Loader to on-board flash memory...
++++++++++++++++++++++++Done!
Start loading..........................
Done.

You have completed the upgrade of the OS loader.

ScreenOS 5.3.0r4

Page 28 of 54

Juniper Networks

Release Notes

5.7 Upgrading Security Devices in an NSRP Configuration
For security devices in a NetScreen Redundancy Protocol (NSRP) configuration, you must
upgrade each device individually. This section describes two different upgrade procedures
addressing two different NSRP configurations: NSRP active/passive and NSRP active/active.
Note: If your security device has a basic configuration, you can upgrade from ScreenOS 5.0.0 or
ScreenOS 5.1.0 directly to ScreenOS 5.3.0. However, you risk losing part of the configuration.
For NetScreen-500 and ISG 2000 devices, you must follow the version-specific upgrade sequence(see “Upgrading to the New Firmware” on page 22).
Caution! Before upgrading a security device, back up the existing configuration file to avoid
losing any data.

5.7.1 Upgrading Devices in an NSRP Active/Passive Configuration
The following illustrates a basic NSRP active/passive configuration where device A is themaster and device B is the backup.
Before you begin, read “Requirements to Upgrade and Downgrade Device Firmware” onpage 18. Also, make sure that you download the ScreenOS firmware to which you areupgrading each device.

Note: Do not power off your security device while it is upgrading to new firmware. Doing so
could result in permanent damage to your device.
To upgrade two devices in an NSRP active/passive configuration, follow these steps (someof these steps are exclusive to the CLI):
A. “Upgrade Device B to ScreenOS 5.3.0” on page 29
B. “Fail Over Device A to Device B (CLI only)” on page 30
C. “Upgrade Device A to ScreenOS 5.3.0” on page 31
D. “Synchronize Device A (CLI only)” on page 32
E. “Fail Over Device B to Device A (CLI only)” on page 32
Upgrade Device B to ScreenOS 5.3.0
WebUI
If upgrading from 5.2.0r1 or 2 to 5.3.0, make sure that you have the new ScreenOS
firmware and the interim firmware “xxxx.5.3.0-up” (where xxxx corresponds to the device
model). For information on obtaining the firmware, see “Downloading the New Firmware”
on page 21.
1. Log in to device B by opening a Web browser (for example Internet Explorer or
Netscape) and entering the Management IP address in the Address field. Log inas the root admin or an admin with read-write privileges.
2. Save the existing configuration:a. Go to Configuration > Update > Config File, then click Save to File.
ScreenOS 5.3.0r4

Page 29 of 54

Juniper Networks

Release Notes

b. In the File Download dialog box, click Save.
c. Navigate to the location where you want to save the configuration file (cfg.txt),
then click Save.
3. Go to Configuration > Update > ScreenOS/Keys and select Firmware Update.
4. Click Browse to navigate to the location of the ScreenOS 5.3.0 firmware or typethe path to its location in the Load File field.
5. Click Apply.
A message box appears with information on the upgrade time.
6. Click OK to continue.
The security device restarts automatically. The upgrade is complete when the device
displays the login page in the browser.
7. Log in to the security device. You can verify the version of the security device
ScreenOS firmware in the Device Information section of the WebUI Home page.
CLI
Make sure that you have the ScreenOS 5.3.0 firmware. For information on obtaining thefirmware, see “Downloading the New Firmware” on page 21.
1. Log in to device B using an application such as Telnet or Secure Shell (SSH) or
Hyper Terminal if directly connected through the console port. Log in as the root
admin or an admin with read-write privileges.
2. Save the existing configuration by executing the following command:save config to { flash | slot1 | tftp }...
3. Run the TFTP server on your computer by double-clicking on the TFTP server
application.
4. On the security device, enter save soft from tftp ip_addr filename to flash.
Where the IP address is that of your computer and the filename is that of the
ScreenOS 5.3.0 firmware.
5. When the upgrade is complete, you must reset the security device. Execute thereset command and enter y at the prompt to reset the device.
6. Wait a few minutes, and then log in to the security device again.
7. Use the get system command to verify the version of the security device
ScreenOS firmware.
Fail Over Device A to Device B (CLI only)
1. Manually fail over the master device to the backup device.
2. Log in to the master device.
3. Issue one of the following CLI commands. The command that you need to
execute depends on whether or not the preempt option is enabled on the masterdevice.
– If the preempt feature is enabled: exec nsrp vsd-group 0 mode ineligible– If the preempt option is not enabled: exec nsrp vsd-group 0 mode backup

ScreenOS 5.3.0r4

Page 30 of 54

Juniper Networks

Release Notes

Either command forces the master device to step down and the backup device toimmediately assume mastership.
Upgrade Device A to ScreenOS 5.3.0
WebUI
Make sure that you have the 5.3.0 ScreenOS firmware and the interim firmware“xxxx.5.3.0-up” (where xxxx corresponds to the device model). For information on
obtaining the firmware, see “Downloading the New Firmware” on page 21.
1. Log in to security device A.
2. Save the existing configuration:a. Go to Configuration > Update > Config File, and then click Save to File.
b. In the File Download dialog box, click Save.
c. Navigate to the location where you want to save the configuration file (cfg.txt),
and then click Save.
3. Go to Configuration > Update > ScreenOS/Keys and select Firmware Update.
4. Click Browse to navigate to the location of the ScreenOS 5.3.0 firmware or typethe path to its location in the Load File field.
5. Click Apply.
A message box appears with information on the upgrade time.
6. Click OK to continue.
The security device restarts automatically. The upgrade is complete when the device
displays the login page in the browser.
7. Log in to the security device. You can verify the security device ScreenOS
firmware version on the WebUI Home page, in the Device Information section.
CLI
Make sure that you have the ScreenOS 5.3.0 firmware. For information on obtaining thefirmware, see “Downloading the New Firmware” on page 21.
1. Log in to security device A.
2. Save the existing configuration by executing the following command:save config to {flash | slot1 | tftp}...
3. Run the TFTP server on your computer by double-clicking on the TFTP server
application.

ScreenOS 5.3.0r4

Page 31 of 54

Juniper Networks

Release Notes

4. On the security device, execute the following command:save soft from tftp ip_addr filename to flash
where:
ip_addr is the IP address of your computer.
filename is the name of the ScreenOS 5.3.0 firmware file.
When the upgrade is complete, you must reset the security device. Execute the reset
command and enter y at the prompt to reset the device.
5. Wait a few minutes, and then log in to the security device again.
You can verify the security device ScreenOS firmware version by using the get systemcommand.
Synchronize Device A (CLI only)
After you complete the upgrade of device A to ScreenOS 5.3.0, manually synchronize thetwo devices. On device A (backup), issue the exec nsrp sync rto all command from peer
CLI command to synchronize the RTOs from device B (master).
Fail Over Device B to Device A (CLI only)
After synchronizing the devices, manually fail over the master device to the backup device.
Follow the same steps as in “B. Fail Over Device A to Device B (CLI only)” on page 22,
except that you log in to device B and fail over device B instead of failing over device A.

5.7.2 Upgrading Devices in an NSRP Active/Active Configuration
This upgrade section applies to an NSRP configuration where you paired two security
devices into two Virtual Security Devices (VSD) groups, with each physical device being themaster in one group and the backup in the other. To upgrade, you first have to fail over oneof the devices so that only one physical device is master of both VSD groups. You thenupgrade the backup device first and the master device second.
The following illustrates a typical NSRP active/active configuration where device A is masterof VSD 0 and backup for VSD 1, and device B is master of VSD 1 and backup for VSD 0.
Before you begin, please read the requirements to perform an upgrade (“Requirements toUpgrade and Downgrade Device Firmware” on page 10). Also, make sure that you
download the ScreenOS 5.3.0 firmware.

Warning: Do not power off your security device while it is upgrading to new firmware. Doing so
could result in permanent damage to your device.
To upgrade two devices in an NSRP active/active configuration, follow these steps (note thatfor some of these steps you can only use the CLI):
A. “Fail Over Device B in VSD 1 to Device A in VSD 1 (CLI only)” on page 33
B. “Upgrade Device B to ScreenOS 5.3.0” on page 33
C. “Fail Over Device A to Device B (CLI only)” on page 34

ScreenOS 5.3.0r4

Page 32 of 54

Juniper Networks

Release Notes

D. “Upgrade Device A to ScreenOS 5.3.0” on page 34
E. “Synchronize Device A (CLI only)” on page 35
F. “Fail Over Device B in VSD 0 to Device A in VSD 0 (CLI only)” on page 35
Fail Over Device B in VSD 1 to Device A in VSD 1 (CLI only)
1. Manually fail over the master device B in VSD group 1 to the backup device A in
VSD group 1.
2. Log in to device B using an application such as Telnet or Secure Shell (SSH) or
Hyper Terminal if directly connected through the console port. Log in as the root
admin or an admin with read-write privileges.
3. Issue one of the following CLI commands. The command you need to execute
depends on whether or not the preempt option is enabled on the master device.
– If the preempt feature is enabled: exec nsrp vsd-group 1 mode ineligible– If the preempt option is not enabled: exec nsrp vsd-group 1 mode backup
Either command forces device B to step down and device A to immediately assume
mastership of VSD 1. At this point, device A is master of both VSD 0 and 1 and device B isbackup for both VSD 0 and 1.
Upgrade Device B to ScreenOS 5.3.0
WebUI
Make sure that you have the 5.3.0 ScreenOS firmware and the interim firmware“xxxx.5.3.0-up” (where xxxx corresponds to the device model). For information on
obtaining the firmware, see “Downloading the New Firmware” on page 21.
1. Log in to security device B by opening a Web browser (for example Internet
Explorer or Netscape) and entering the Management IP address in the Address
field. Log in as the root admin or an admin with read-write privileges.
2. Save the existing configuration:a. Go to Configuration > Update > Config File, and then click Save to File.
b. In the File Download dialog box, click Save.
c. Navigate to the location where you want to save the configuration file (cfg.txt),
and then click Save.
3. Go to Configuration > Update > ScreenOS/Keys and select Firmware Update.
4. Click Browse to navigate to the location of the ScreenOS 5.3.0 firmware or typethe path to its location in the Load File field.
5. Click Apply.
A message box appears with information on the upgrade time.
6. Click OK to continue.
The security device restarts automatically. The upgrade is complete when the device
displays the login page in the browser.
7. Log in to the security device. You can verify the security device ScreenOS
firmware version on the WebUI Home page, in the Device Information section.

ScreenOS 5.3.0r4

Page 33 of 54

Juniper Networks

Release Notes

CLI
Make sure that you have the ScreenOS 5.3.0 firmware. For information on obtaining thefirmware, see “Downloading the New Firmware” on page 21.
1. Log in to device B.
2. Save the existing configuration by executing the following command:save config to {flash | slot1 | tftp}...
3. Run the TFTP server on your computer by double-clicking on the TFTP server
application.
4. On the security device, enter save soft from tftp ip_addr filename to flash. Wherethe IP address is that of your computer and the filename is that of the ScreenOS
5.0.0 firmware.
5. When the upgrade is complete, you must reset the security device. Execute thereset command and enter y at the prompt to reset the device.
6. Wait a few minutes, and then log in to the security device again.
You can verify the security device ScreenOS firmware version by using the get systemcommand.
Fail Over Device A to Device B (CLI only)
1. Manually fail over device A completely to device B.
2. Log in to device A.
3. Fail over master device A in VSD 0 to backup device B in VSD 0 by issuing one of
the following CLI commands. The command you need to execute depends onwhether or not the preempt option is enabled on the master device.
– If the preempt feature is enabled: exec nsrp vsd-group 0 mode ineligible– If the preempt option is not enabled: exec nsrp vsd-group 0 mode backup
4. Fail over master device A in VSD 1 to backup device B in VSD 1 by issuing one of
the following CLI commands. The command you need to execute depends onwhether or not the preempt option is enabled on the master device.
– If the preempt feature is enabled: exec nsrp vsd-group 1 mode ineligible– If the preempt option is not enabled: exec nsrp vsd-group 1 mode backup
At this point, device B is master of both VSD 0 and 1 and device A is backup for both
VSD 0 and 1.
Upgrade Device A to ScreenOS 5.3.0
WebUI
Make sure that you have the 5.3.0 ScreenOS firmware and the interim firmware“xxxx.5.3.0-up” (where xxxx corresponds to the device model). For information on
obtaining the firmware, see “Downloading the New Firmware” on page 21.
1. Log in to security device A.
2. Save the existing configuration:a. Go to Configuration > Update > Config File, and then click Save to File.

ScreenOS 5.3.0r4

Page 34 of 54

Juniper Networks

Release Notes

b. In the File Download dialog box, click Save.
c. Navigate to the location where you want to save the configuration file (cfg.txt),
and then click Save.
3. Go to Configuration > Update > ScreenOS/Keys and select Firmware Update.
4. Click Browse to navigate to the location of the ScreenOS 5.3.0 firmware or typethe path to its location in the Load File field.
5. Click Apply.
A message box appears with information on the upgrade time.
6. Click OK to continue.
The security device restarts automatically. The upgrade is complete when the device
displays the login page in the browser.
7. Log in to the security device. You can verify the security device ScreenOS
firmware version on the WebUI Home page, in the Device Information section.
CLI
Make sure that you have the ScreenOS 5.3.0 firmware. For information on obtaining thefirmware, see “Downloading the New Firmware” on page 21.
1. Log in to device A.
2. Save the existing configuration by executing the following command:save config to {flash | slot1 | tftp}...
3. Run the TFTP server on your computer by double-clicking on the TFTP server
application.
4. On the security device, use the save soft from tftp ip_addr filename to flash
CLI command, where ip_addr is the IP address is of your computer. andfilename is the name of the ScreenOS 5.3.0 firmware file.
5. When the upgrade is complete, you must reset the security device. Execute thereset command and enter y at the prompt to reset the device.
6. Wait a few minutes, and then log in to the security device again.
You can verify the security device ScreenOS firmware version by using the get systemcommand.
Synchronize Device A (CLI only)
After you complete the upgrade of device A to ScreenOS 5.3.0, manually synchronize thetwo devices. On device A, issue the exec nsrp sync rto all command from peer CLI
command to synchronize the RTOs from device B.
Fail Over Device B in VSD 0 to Device A in VSD 0 (CLI only)
As the final step, you have to reinstate the two security devices in an NSRP active/active
configuration.
1. Log in to device A.

ScreenOS 5.3.0r4

Page 35 of 54

Juniper Networks

Release Notes

2. Fail over master device B in VSD 0 to backup device A in VSD 0 by issuing one of
the following CLI commands. The command you need to execute depends onwhether or not the preempt option is enabled on the master device.
– If the preempt feature is enabled: exec nsrp vsd-group 1 mode ineligible– If the preempt option is not enabled: exec nsrp vsd-group 1 mode backup
At this point, device A is master of VSD 0 and backup for VSD 1, and device B ismaster of VSD 1 and backup for VSD 0.

5.8 Upgrading or Migrating the AV Scanner
Refer to Table 8 and follow the procedure below for step-by-step instructions on upgrading
your existing antivirus scanner or migrating to a new antivirus scanner:

Table 8: Upgrading to ScreenOS 5.3.0
If you are upgrading from a previous
release of ScreenOS

Follow this procedure

With antivirus(AV license installed)

Save your current configuration.
Install the AV license.
Upgrade to ScreenOS 5.3.0*.

Without antivirus(without AV license installed)

Upgrade to ScreenOS 5.3.0.
Install the AV license.

*. Select the ScreenOS version which supports the AV scan engine as shown in Table 5.
1. Save your current configuration.
2. Install your AV license key.
To access your AV license key, refer to the Concepts & Examples ScreenOS Reference
Guide. You must install the license key before you upgrade to ScreenOS 5.3.0, or you
might lose some of your current configuration.
ScreenOS 5.3.0 supports two scan engines, Juniper-Kaspersky and Trend Micro. Make
sure you have the correct AV license key for your scan engine. The two license keys,
however, can coexist on your security device.

Table 9: AV Scan Engines
AV Scan Engine

License Key

ScreenOS version

Trend Micro

av_keyns5gttmav.5.3.0r4

Juniper-Kaspersky

av_v2_key

ns5gt.5.3.0r4

where <device_name> refers to the hardware security device and xx refers to theletters identifying the build.
3. Upgrade to ScreenOS 5.3.0.
There are two versions of ScreenOS 5.3.0 as shown in Table 9. A single version of
ScreenOS does not support both scan engines.

ScreenOS 5.3.0r4

Page 36 of 54

Juniper Networks

Release Notes

Make sure you select the ScreenOS version which supports the AV scan engine thatwas installed in Step 2. For example, the file names for NetScreen-5GT are of theformat,– Trend Micro image: ns5gttmav.5.3.0r1– Juniper-Kaspersky image: ns5gt.5.3.0r1
4. Check config file (especially policies) to ensure it is intact.

5.8.1 Scan Manager Profile
The global scan-mgr CLI command controls the embedded scan manage, which is the
AV component that interacts with the scan engine. For example, the set or get av
scan-mgr CLI command sets the global commands that control parameters, such as
max-content-size, max-msgs, pattern-type, pattern-update, and queue-size.
In ScreenOS 5.3.0, some of the previously global settings are now configured fromwithin a profile context as shown in Table 10. For example, global commands such as
timeout and max-decompress-layer are no longer global; they are now set within the
profile for each protocol. Commands such as max-content-size and max-msgs which
configure the embedded scan manager, are global and are set using the set av scanmgr CLI command.
When you upgrade to ScreenOS 5.3.0, a scan manager profile named scan-mgr is
automatically generated to migrate the global scan-mgr CLI commands. The scanmgr profile executes the following commands:
set ftp decompress-layer 2
set http decompress-layer 2
set imap decompress-layer 2
set pop3 decompress-layer 2
set smtp decompress-layer 2
set http skipmime enable
set http skipmime mime-list ns-skip-mime-list
Table 6 shows the updated commands in ScreenOS 5.3.0. The following commands
are now invoked from within a profile context:

Table 10: Command Updates
Commands previous to
ScreenOS 5.3.0

ScreenOS 5.3.0r4

ScreenOS 5.3.0 commands invoked fromwithin a profile context

set av http skipmime

set av profile scan-mgr
set http skipmime mime-list ns-skip-mime-list
set http skipmime enable
exit

unset av http skipmime

set av profile scan-mgr
unset http skipmime enable
exit

Page 37 of 54

Juniper Networks

Release Notes

Commands previous to
ScreenOS 5.3.0

ScreenOS 5.3.0 commands invoked fromwithin a profile context

set av scan-mgr content { FTP |HTTP | IMAP | POP3 | SMTP }[timeout number] }set av profile scan-mgr
set { FTP | HTTP | IMAP | POP3 | SMTP
{ enable | timeout number } }exit

unset av scan-mgr content { FTP |HTTP | IMAP | POP3 | SMTP }set av profile scan-mgr
unset { FTP | HTTP | IMAP | POP3 | SMTP }enableexit

5.8.2 Anti-virus Pattern Update URL
Trend Micro Inc. will stop hosting AV pattern file updates at URL
http://5gt-t.activeupdate.trendmicro.com/activeupdate/server.ini and the new pattern
update URL location is http://5gt-p.activeupdate.trendmicro.com/activeupdate/server.ini.
After you upgrade the ScreenOS image, the running image automatically uses the newserver URL for AV pattern update operation; but the URL in the saved configuration will notchange unless you explicitly issued a save command.
Upgrade to a newer release or manually change the AV pattern update URL to the newlocation. To verify if the pattern update URL is modified during the upgrade process, enter
the following command:
5gt1-> get av scan-mgr
Embedded AV Management Info:
Pattern Management:
AV Key Expire Date: 12/31/2005 00:00:00
Update Server: http://5gt-p.activeupdate.trendmicro.com/activeupdate/server.ini

6. Addressed Issues
The following sections identify which major bugs have been fixed in each release of
ScreenOS 5.3.0.

6.1 Addressed Issues in ScreenOS 5.3.0r4
This release incorporates the following ScreenOS maintenance releases:• 5.3.0r3• 5.2.0r3b• 5.1.0r4d• 5.0.0r11• 5.0.0-DSLWr10b• 5.0.0-ISGr10a• 5.0.0-M2r9b

ScreenOS 5.3.0r4

Page 38 of 54

Juniper Networks

Release Notes

Admin• cs07271, cs09504 – When using RADIUS Authentication, after the third firewall login
try, an error occurred when the device was reset.
• cs07855 – Unable to unset a user when a user was in use. This restriction was due tothe user entry being improperly removed if the user group was deleted before deletingthe user.
• cs08084 – (ISG 2000) In an NSRP environment, excessive NSRP session messages
sometimes caused an error on the backup device when it was rebooted.
• cs08188 – In some cases, an internal error occurred when SSH was enabled, causing
device failure.
• cs08222 – The system clock lost time.
• cs08507 – The error message system error 00556 UF-MGR: UF key expired wasposted to the event log every 20 minutes after the default URL Filtering key expired.
• cs08670 – The unset admin hw-rest CLI command was not saved after a device was
rebooted.
• cs09055 – The error too many entries was received when a new service group was
created and the error set service failed was received when a new policy with multiple
services was created.
• cs09174 – When an admin hung up a dial connection through the WebUI, the pop-up
message You do not have the privilege was incorrectly displayed.
• cs09468 – When a member was added to a group and the ASIC rules were exhausted,
an error or warning was not returned. This addition would cause some policy ASIC
rules to not be installed and packets to be dropped from the configuration.
• cs10349 – The NTP maximum adjustment incorrectly calculated the difference
between the local clock and the time received through the NTP update, which resulted
in an inaccurate clock reading.
Antivirus• cs08993 – The device was unable to download AV signatures using HTTPS in FIPS
mode. This action caused an update failure with a non-specific error (-11).
• cs09559 – (NetScreen-5GT Series) A new Kaspersky AV pattern file would not
download if an existing pattern file of greater than 10 MB existed in flash memory.
HA & NSRP• cs04991 – An NSRP cluster did not recover from failover when a Run Time Objects(RTO) sync was used.
• cs07086 – An admin user with the all privilege could not configure NSRP.
• cs07279 – In an NSRP Active-Backup configuration, a message was displayed on the
console every 5 to 10 minutes indicating a session corruption pointer on a backup
system.
• cs07737 – In a dual-untrust NSRP VPN configuration, unplugging one of the untrustinterfaces could generate high CPU usage until the next rekey occurred.
• cs08937 – (ISG-2000) In an NSRP cluster, unsetting a sub-interface could change the
MAC address from the virtual MAC to the physical MAC.
• cs09523 – In an NSRP environment, Real Time Streaming Protocol (RTSP) packets
sometimes caused an error when the device was reset.

ScreenOS 5.3.0r4

Page 39 of 54

Juniper Networks

Release Notes• cs10187 – When sub-directories exist, the data displayed when using the exec vfs ls
flash: CLI command was displayed incorrectly.
Management• cs03147 – In some cases, when a device was in Transparent mode, clicking on thepolicy screen caused device failure.
• cs07029 – The device had high CPU usage when syslog and policy logging wereenabled.
• cs07107 – The devices would not connect to the NetScreen-Security Manager server
after the DevSvr MIP IP was changed.
• cs07433 – (NetScreen-HSC) The get log sys save CLI command improperly displayed
trace dumps.
• cs07863 – Issuing the bulkcli CLI command to change a device configuration
sometimes broke the NetScreen-Security Manager connection.
• cs08183 – An SSH login attempt stopped the debug process.
• cs08237 – The Untrust interface did not return to the original state after failover whentrack-ip was enabled.
• cs08408 – The user could not connect to a device using SSH when RADIUS
authentication was enabled.
• cs08878 – An internal NetScreen-Security Manager configuration error caused device
failure.
• cs08978 – Time stamp was incorrect in the Websense log report.
• cs09825 – After a device was upgraded from firmware version 5.1.0 to 5.3.0, theVLAN zone changed to a shared resource. The zone could be changed back to nonshared, but if the device was managed using NetScreen-Security Manager, theadministrator should ignore the validation error.
• os60977 – Serverity information for Deep Inspection (DI) was categorized incorrectly.
Other• cs02529 – The VLAN capacity increased to 128 VLANs when an extended license key
was used.
• cs05221 – Issuing the delete ssh device all CLI command when troubleshooting an
SSH issue could cause the device to reset.
• cs05461 – (NetScreen-5000 Series using the 5000-M2 management module) Sessions
with Time To Live (TTL) of 0 would not age out.
• cs06917 – In some cases, specific fragmented traffic caused device failure.
• cs07724 – Traffic was dropped if designated for a multi-cell policy that followed an
Remote Procedure Call (RPC) deny policy.
• cs08087 – In a PPPoE environment, the device could occasionally reset with an error
when receiving large packets of IPv6, IPX, etc.
• cs08119, cs09399 – With MSRPC ALG enabled, a device reset with an error when verylarge actual_count MSRPC messages occurred.
• cs08427 – (NetScreen-5XT) In a dial-backup configuration, connection using themodem port was not always successful when the modem idle time was set to 0.
• cs08439 – Network Time Protocol (NTP) on the device would be incorrectly updated if
an NTP server replied twice to a single NTP update request.

ScreenOS 5.3.0r4

Page 40 of 54

Juniper Networks

Release Notes• cs08554 – (NetScreen-5200 using 5000-M2) Sometimes, an active FTP connection
intermittently stopped.
• cs08722 – RTSP traffic passing through a device could cause the device to hang andthe error ###wrong rms buf len, Trace to be displayed on the console.
• cs08787 – In rare cases, having sequence checking enabled caused device failure.
• cs08804 – A PPPoE interface failed to establish connection when there were two
PPPoE instances configured on different physical interfaces. For example, one
interface was bound to ethernet3 (Untrust zone), and the other was bound toethernet2 (DMZ zone). Under this configuration, once the PPPoE connection on theethernet2 was terminated, it could never be re-established when the error message
failed to set PPPoE interface gateway occurred.
• cs07418, cs07754, cs07921 – SQLnet V2 traffic was dropped when a specific SQL
policy was configured.
• cs09036 – The device reset with an error when SecurID was used with the New PIN
Mode.
• cs09108 – The create PDP context response packet was incorrectly dropped.
• cs09431 – (NetScreen-5000 Series using 5000-8G or 5000-2G24FE SPMs) In somecases, both devices in an NSRP environment tried to become the primary device. Thisaction occurred because an internal queue was incorrectly re-initialized.
• cs09478 – Random high task CPU occurred after GPRS Tunneling Protocol (GTP) was
configured.
• cs09841 – (NetScreen-5GT Series) The device incorrectly interpreted the 802.1q tag of
the incoming packet and placed the the packets into the wrong interface buffer queue,
therefore ARP works incorrectly.
• cs10146 – While a PPP issue was being debugged, the device reset with an error if the
PPP access profile contained characters that could not be displayed in the debug
output. For example, Chinese characters.
Performance• cs02916 – A device would have poor performance when URL scanning and AV wererunning simultaneously.
• cs07605, cs08157 – (NetScreen-5200 using 5000-M management module)
Sometimes, the device gradually ran out of memory.
• cs07944 – In some cases, certain traffic delayed the device until it was rebooted.
• cs09025 – (NetScreen-5200) Some traffic configurations could lead to a mismatch
between sessions maintained in the software and in the ASIC, which then resulted indevice failure.
Routing• cs02991 – A static route, which was configured as the preferred route, did not takeprecedence over a connected route.
• cs08681 – With Internet Group Membership Protocol (IGMP) Proxy configured,multicast connections would timeout after 10 seconds.
• cs08895 – Routes were improperly removed from vsys sub-interfaces, until the device
was rebooted.
• cs09290 – Changes to an access-list that was used for route-export, resulted in a flap
for each route exported. Therefore, the Link State (LS) update was sent with LS age set

ScreenOS 5.3.0r4

Page 41 of 54

Juniper Networks

Release Notes

to 3600 before another update was sent with the age set to 1. This led to a brief
disruption in traffic flow.
• cs09820 – In a vsys configuration using IP-classification, the device incorrectly
handled a vsys route lookup.
Security• cs05561 – Patch to provide support for latest version of Verisign OSCP certificate.
• cs07747 – The RADIUS authentication failed if the Access Accept authentication string
exceeded approximately 700 bytes.
• cs08510 – A device might reset with an error when the initial NetScreen-Security
Manager configuration push included URL filtering.
• cs08754 – In Transparent mode, the Syn Cookie feature worked incorrectly.
VOIP/H323• cs06575 – In some cases, fax communication with H.323 failed but voice worked.
• cs08370 – In some VoIP environments, the device stopped passing traffic after
approximately 2 to 3 days, then the ARP table might only contain a few entries.
• cs08922 – In some cases, H.323 sessions were not cleared in the session table.
VPN• cs07903 – VPN traffic failed to pass when a route-based VPN had the loopback
interface configured as the outgoing interface and put a sub-interface as part of theloopback group.
• cs08074 – A device might drop VPN traffic when replay protection was enabled.
• cs08221 – A NetMeeting session might not connect across a policy-based VPN
between a security device and a PIX device.
• cs08786 – A device might fail if a VPN tunnel was removed while other tunnels wereusing the same Security Association (SA).
• cs08792 – (NetScreen-5000 Series) In a GPRS environment, the device reset with anerror when a new VPN gateway was configured.
• cs08905 – Memory resources were improperly reclaimed after VPN phase2
negotiations.
• cs08913 – For configurations with a large number of IKE ID users, the device might
reset with an error when a CLI command was entered.
• cs08975 – Memory resources were improperly reclaimed when using PKI certificates.
• cs09123 – Dial-up VPN peers with Source Interface-Based Routing (SIBR) and Src-NAT
were unable to communicate with each other.
Web UI• cs04359 – In a dual-untrust NSRP VPN configuration, unplugging one of the untrustinterfaces could generate high CPU usage until the next rekey occurred.
• cs06422 – Editing an SNMP community host configured with a non /32 subnet mask
resulted in an Invalid Address error.
• cs06889 – A device failed when the policy counter graph was viewed using the
WebUI.
• cs07859 – HTTP requests decreased and sometimes failed when surfcontrol was
enabled because there was not enough sockets being allocated on the device.

ScreenOS 5.3.0r4

Page 42 of 54

Juniper Networks

Release Notes• cs08169 – Only the first 20 multicast routes were displayed even though the numberof entries to be displayed was changed.
• cs08856 – With DI enabled, after device startup, the device cannot be managed using
the WebUI.
• cs08894 – Configuring a VPN policy with a pre-defined service group (for example,
H.323 or SIP) conflicted with a VPN policy using ANY as the service. The following
error message might occur during configuration, The new policy id<14> has
identical IKE ID as that of policy <12>.
• cs10145 – In some cases, when configuring the device using HTTPS WebUI, an ISP
account password became corrupt.
• cs10239 – If an alternate telephone number is used in a dial-up connection to the ISP,
the WebUI incorrectly indicates that the primary number was used.

6.2 Addressed Issues from ScreenOS 5.3.0r3• 04092 – When converting a policy to a set of rules, the ASIC sometimes used aconversion algorithm that created a different number of rules than had previously
been generated for the same policy.
• 04221 – (WebUI) The remove option did not remove a CA certificate.
• 04334 – Setting traffic to a vsys had problems. Debugging the device would show
traffic that was going to the vsys was incorrectly classified to the root vsys.
• 04457 – A disabled IKE user could successfully connect through the VPN.
• 04522 – Incoming mail did not pass through a MIP when AV was enabled.
• 04553 – Occasionally, packets were not routed correctly even though they matched
the session.
• 04819 – An IGMP proxy to multiple host interfaces for the same group was
disallowed.
• 04978 – (WebUI) Antivirus information was incorrectly contained as Recent Event
information.
• 05284 – After a reboot, policy-based VPN tunnel, with SRC-NAT and DIP configured,
was inactivate due to an incorrectly set proxy-ID.
• 05471 – The discard counter did not increment properly.
• 05515 – The get service any CLI command displayed the default timeout value as one
minute.
• 05733 – In some cases, a track-ip ping response was lost.
• 05738 – (WebUI) The Local Auth server timeout field was incorrectly limited to a three
digit value when the value should have been four digits.
• 05903 – A session failed when DI was enabled and the DI was unable to handle halfclose state.
• 05981 – (WebUI) An error occurred when deleting an aggregate interface orsubinterface.
• 06161 – (ISG-2000) In transparent mode, configuring a large number of policies
resulted in a policy look up timeout and dropped packets.
• 06240 – Source-based NAT did not occur on traffic from Trust to DMZ security zones.
• 06295 – Incorrectly adding a proxy-id in a VPN policy caused device failure.

ScreenOS 5.3.0r4

Page 43 of 54

Juniper Networks

Release Notes• There was intermittent device failure due to policy database failure.
• 06297 – In some cases, the RADIUS authentication over policy based tunnels stopped
working.
• 06441 – The antivirus option was unavailable when a policy was configured for multicell context.
• 06990 – Corrupt mis-interpreted and mis-directed HA message caused the backup
device to coredump and loose connectivity with the primary device.
• 06991 – (NetScreen-50) Coredump and reboot occurred in an active/passive NSRP
configuration, when secure-ID user inserted a long user name and password.
• 07059 – DHCP requests from clients on untrust side of any NS device in X-mode
acting as VPN initiator will be relayed to DHCP server behind the VPN responder
through the VPN tunnel.
• 07101 – DSCP marking for IPSec pass through traffic in route mode did not work
properly on some platforms.
• 07132 – Dial backup did not work (modem does not return dial) due to PPPLCP
keepalives not being sent.
• 07133 – Sometimes there were a few differences on SA's SPI between Master's SA
and Backup's SA when running the NSRP hot-sync.
• 07177 – After an IGMP configured subinterface had participated in multicast, it could
no longer be deleted or assigned to the null zone.
• 07178 – In some cases, IPSec sessions were not cleaned up in the session table
resulting in VPN failure.
• 07217 – Modifying or adding an L2TP policy corrupted the system configuration.
• 07218 – (WebUI) When modifying a policy ID and adding a service of ICMP-any to theuntrust to trust policy, the device reloaded with a software forced error.
• 07259 – (NetScreen-200 Series) Sometimes a device failed due to an ALG cookie
between MSRPC and H.323 because the NAT cookie allocation and free process were
not protected.
• 07279 – A message, indicating that there was a corrupted session, was displayed on
the console every 5 to 10 minutes on a backup device in an active/passive NSRP
configuration.
• 07295 – The exec policy verify CLI command returned incorrect results.
• 07301 – (NetScreen ISG-2000) When using slow speed links, latency caused
fragmented packets to be re-assembled incorrectly in the device because small
fragments arrived fast but large fragment takes too long.
• 07354 – (NetScreen-5XT) Issues occurred when a device was upgraded from 4.0 to
5.3.
• 07402 – (NetScreen-5GT) When a device was configured as a DHCP client andconnected to DHCP Server A but was disconnected from DHCP server A andconnected to DHCP server B on a different network, the system continued to try to
renew its IP address with the older network to which it was previously connected.
• 07425 – Under certain circumstances in an NSRP configuration, the device suddenly
stopped forwarding traffic, and the ARP table was empty. The device was unable toping other hosts. This problem also caused the NSRP configuration to not failover tothe backup device.
• 07462 – SSL based FTP server was inaccessible when AV was enabled on the policy.
ScreenOS 5.3.0r4

Page 44 of 54

Juniper Networks

Release Notes• 07488 – NetScreen-Security Manager returned a error when trying to set physical linkdown of any interface on an ISG device.
• 07508 – In some cases, during IKE negotiation, device failure occurred when the IP ID
was generated• 07519 – In an ECMP configuration, when devices were connected through more than
one point-to-point physical link, OSPF advertised next-hop as 0.0.0.0 instead of theactual IP address.
• 07562 – In some situations, when processing BGP updates, a second withdrawn
message was sent 30s after the first withdrawn message.
• 07614 – When multiple services were added to a policy, a hidden service group was
created, members of which were the services attached to the policy. When a user
removed the custom defined service, a hidden service group without a member wasleft. Under this circumstance, when a user tried to access a member, the device failed.
• 07623 – Inter vsys routing was handled improperly.
• 07627 – In a route based VPN multi-VR environment, the security device incorrectly
performed a route lookup in the wrong VR.
• 07633 – Out of order TCP packets caused a lot of TCP Seq check failed error
messages. These messages led the debug buffer to fill up because the debugging
capability was hindered.
• 07637 – When an FTP client established the connection with an FTP server throughthe device, the device created a stand-alone FTP data session, but did not create FTP
control sessions for the child session.
• 07660 – Passive FTP traffic was translated incorrectly.
• 07661 – Interface last_change attribute was sometimes displayed incorrectly and did
not get updated when the interface state was changed to up.
• 07729 – An ARP packet buffer was increased to improve performance.
• 07760 – (WebUI) Having the same IP address for interface track IP & NSRP track-IP
was not permitted.
• 07772 – Internal mishandling of H.323 traffic caused device failure.
• 07803 – While using Web Authentication, the vsys pointer for a secure-id path was set
improperly, causing the response failure. This action resulted in a Web Auth failure
inside a vsys.
• 07814 – A device failure occurred when user configured the ninth DHCP server.
• 07816 – In some cases, CPU utilization displayed a spike due to ARP aging out
incorrectly.
• 07839, 54021 – In some cases, invalid or malformed VLAN packets caused device
failure.
• 07871 – The device failed while handling ISAKMP packets with invalid and/or
abnormal contents.
• 07884 – (NetScreen-5200) The get log sys saved CLI command sometimes displayed
trace dump on the device console.
• 07887 – (NetScreen-25) The device failed to ping to a local interface due to failure in
freeing the allocated net-pak and caused failure in getting ICMP response from local
subnets.
• 07888 – In some cases, outbound SIP calls caused device failure.

ScreenOS 5.3.0r4

Page 45 of 54

Juniper Networks

Release Notes• 07931 – The device passed traffic incorrectly when using address groups.
• 07964 – In some cases, the device failed when issuing the debug flow CLI command.
• 07995 – When a user upgraded from 5.1.0pw7.0 to 5.3, there were problems passing
traffic to a VPN site behind a NAT firewall.
• 08032 – Internal mishandling of RADIUS traffic caused device failure.
• 08053 – (NetScreen-204) The unset nsrp vsd-group id 0 CLI command required thatthe device be reset if there was any interface assigned to the management zone.
• 08066 – Unresolved unicast route had a missing null ptr check which caused device
failure.
• 08073 – An internal task incorrectly increased the CPU usage.
• 08077 – large number of VPN tunnels and traffic caused the device to fail.
• 08079 – Dial Line remained open even though there was no interesting traffic as idle
timer was reset every few seconds.
• 08080 – (WebUI) When a user clicked the hangup button on the Modem-Trustee
page, the serial interface was brought down. This button should only disconnect themodem, not bring down the interface.
• 08085 – (WebUI) While entering a TCP port with a trailing blank into the custom
service page, the firewall set the port to 0 without providing errors.
• 08109 – The device accepted the default route on the serial interface through the PPP
connection made which resulted in the leakage of data through the default route if noother route was available to send traffic.
• 08113 – In some cases, the device management was delayed after about an hour.
• 08161 – Syn cookie mechanism was working incorrectly on logical interfaces.
• 08164 – Due to incorrect storage of buffer packet for reassembly, a device reset anddisplayed the console error ### No DIMM found on board ###.
• 08256 – (NetScreen-5000 Series) The get flow CLI command incorrectly displayedthat the rcp-rst-invalid session was unsupported.
• 08257 – (NetScreen-5GT) Due to possible zero length option or EOL which processing
TCP header options, the device performed a coredump on the console after
downloading an image/file from any TFTP server.
• 08265 – Overlapping UDP customer service port range with IKE port (UDP port 500)
caused incorrect session timeout for IKE sessions.
• 08279 – (WebUI) After configuring an Xauth local authentication user group, theCHAP Only was automatically selected and it was impossible to disable it.
• 08293 – Sometimes an internal error page was displayed when a page was browsedwith a zero byte content length and the connection was closed by the server.

6.3 Addressed Issues in ScreenOS 5.3.0r2• 07871 – A check was added to address vulnerability issue with implementation of the
ISAKMP protocol.
• 07979 – When generating a P1 gateway, it was impossible to select dynamic mode
VPN and a distinguished name from the WebUI.
• 53319 – When using a Linux FTP client/server, FTP timeout occurred when sending
files larger than 5 MB.

ScreenOS 5.3.0r4

Page 46 of 54

Juniper Networks

Release Notes• 53388 – Established VPN UDP sessions kept using the old route even after the route
was changed.

7. Known Issues
This section describes known issues with the current release.
• section 7.1 “Limitations of Features in ScreenOS 5.3.0r4 on page 47 identifies featuresthat are not fully functional at the present time, and will be unsupported for thisrelease.
• section 7.2 “Compatibility Issues in ScreenOS 5.3.0r4 on page 48 describes known
compatibility issues with other products, including but not limited to specific Juniper
Networks appliances, other versions of ScreenOS, Internet browsers, Juniper
Networks management software and other vendor devices. Whenever possible,
information is provided for ways to avoid the issue, minimize its impact, or in somemanner work around it.
• section 7.3 “Known Issues In ScreenOS 5.3.0r4 on page 49 describes deviations from
intended product behavior as identified by Juniper Networks Test Technologies
through their verification procedures. Again, whenever possible, information isprovided to assist the customer in avoiding or otherwise working around the issue.

7.1 Limitations of Features in ScreenOS 5.3.0r4
This section describes the limitations in various features in ScreenOS. They apply to all
platforms, unless otherwise noted.

7.1.1 Limitations in ScreenOS 5.3.0r4
None.

7.1.2 Limitations in ScreenOS 5.3.0r3• The FTP extended passive mode is not supported.

7.1.3 Limitations in ScreenOS 5.3.0r2• 500 NSM with DI enabled – Users may experience issues when downloading
configuration files larger than 1.7 M.
• 5000 Series Vsys Capacity – The following table describes the number of virtual
systems ScreenOS supports for each 5000 series device.

ScreenOS

ScreenOS 5.3.0r4

NetScreen5200-MGT1

NetScreen5200-MGT2

NetScreen5400-MGT1

NetScreen-5400MGT2

4.0x

500

N/A

500

N/A

5.0x

500

500

500

500

5.1x

500

N/A

500

N/A

5.2x

500

500

500

500

5.3x

500

500

100

500

Page 47 of 54

Juniper Networks

Release Notes• Limitations of the AV Scanner – The following lists basic troubleshooting items andlimitations of the AV scanner:– AV session is aborted.

Symptom
Device runs out of packets

Solution
Change the max content size option to a smaller
value. For example,
set av scan-mgr max-content-size <number in
KB>

Excessive use of av resources Increase user resource limit. For example,
set av all resource <number in percent>Memory allocation failure when Restart your device
processing an AV session– Default route is required for AV to function in transparent mode.
– The av scan engine may not be able to detect a virus if the virus is fragmented
and transferred into multiple network objects.
– If a virus is found in an element on an HTML page, the contents of theelement is replaced by white space.
– “The maximum size file inspected by the integrated AV feature defaults to
10MB. If AV and Deep Inspection (DI) are enabled, it is advisable to reducethe maximum size file to 6 MB. If AV, DI, and Web filtering are all enabled, it
is advisable to reduce the maximum size file to 4MB.
• Dead Peer Protection – When DPD detects a dead peer, the device should deactivate
any existing VPN with that peer. However, if a tunnel interface is bound to the VPN,
the device does not make any state changes on that interface, or on any Phase 2
tunnel associated with the interface. Consequently, DPD only works correctly when
the VPN is not bound to a tunnel interface.
• (NetScreen-200 Series) Deep Inspection – Installing the Deep Inspection (DI) license
key on the NetScreen-200 in advanced mode decreases the maximum number ofsessions to 64,000 sessions. To restore the number of sessions supported to 128,000
sessions, remove the DI license key and reboot the security device.

7.2 Compatibility Issues in ScreenOS 5.3.0r4
Below are the known compatibility issues at the time of this release. Wheneverpossible, a work-around (starting with “W/A:”) has been provided for yourconvenience.
• Compatible web browsers – The WebUI for ScreenOS 5.3.0r4 was tested withand supports Microsoft Internet Explorer (IE) browser versions 5.5 and above,and Netscape Navigator 6.X for Microsoft Windows platforms, and Microsoft
Internet Explorer version 5.1 for MacOS 10.x. Other versions of these and otherbrowsers, were reported to display erroneous behavior.

ScreenOS 5.3.0r4

Page 48 of 54

Juniper Networks

Release Notes

7.2.1 Upgrade Paths from Previous Releases
Upgrade sequence – We recommend that you follow the upgrade instructions
described in section 5. “Migration Procedures on page 17. If you upgrade directly from
ScreenOS 5.0.0 or ScreenOS 5.1.0 to ScreenOS 5.3.0, you risk losing part of any
existing configuration. For NetScreen-500 and ISG 2000 devices, you must upgrade to
an interim firmware image before upgrading to the 5.3.0 firmware image.
WebUI upgrade – Due to a buffer size issue when upgrading from ScreenOS 5.2.0 to
ScreenOS 5.3.0 using the WebUI, you must upgrade to an interim firmware image
before upgrading to the 5.3.0 release image. Refer to section 5.4 “Upgrading to the
New Firmware on page 22 for instructions on how to perform the upgrade.

7.3 Known Issues In ScreenOS 5.3.0r4
The following are known deficiencies in features at the time of this release. Wheneverpossible, a workaround is suggested following the problem description. Workaroundinformation starts with “W/A:” If there is no subsection for a particular ScreenOS release, no
new known issues were identified for that release.

7.3.1 Known Issues in ScreenOS 5.3.0r4
Admin• cs09436 – (NetScreen-5000 series using 5000-2G24FE SPM) The system can have up
to 100 screen options configured. Exceeding this limit could cause network
interruptions. Currently, there is no way to warn or limit the administrator fromexceeding the limit.
• cs09826 – When a global deny policy is created, with a service group and a FTP-GETor FTP-PUT is added, the policy behavior changes. FTP-GET and FTP-PUT must be
used in individual policies. For additional information, refer to the Knowledge basearticle KB3692.
CLI• cs04112 – In an NSRP environment, the interfaces would sometimes use the physical
MAC address instead of the virtual MAC address.
• cs04430 – In an NSRP Active-Passive environment, with tcp-syn-check and holddown
time configured, FTP traffic might stop when reverting from a backup to a primarydevice.
• cs05206 – A Transparent mode device running an NSRP Active-Passive configuration
could incorrectly handle VPN decrypted packets, causing the device to restart.
• cs05703 – In rare cases, an NSRP backup unit experienced message corruption,
causing the device to restart.
• cs08380 – A DIP configured on the loopback interface is not visible when using theCLI.
• cs09760 – Issuing the save config all CLI command from an NSRP peer device
generates only a global configuration. Non-global configuration commands, such as
manage-ip, are lost.
Management• cs01627 – Traffic using src-port 1503 is not logged.

ScreenOS 5.3.0r4

Page 49 of 54

Juniper Networks

Release Notes• cs05462 – In the NetScreen-Security Manager User Interface, the NSRP state isincorrectly displayed on the NSRP Monitor after device failover.
• cs06832 – SNMP works correctly if it is sent to the manage-ip of the interface.
However, if the request is sent to the interface IP, the response uses the interface
manage-ip as the reply packet source address.
• cs07434 – The counter statistics returned from an SNMP query, displays incorrect
values for the ethernet2 interface.
• cs07702 – (ISG-1000 and ISG-2000) The MGT interface reports up and down statuschanges even though there is no physical connection, which is caused by noise.
W/A: Physically connect the MGT interface.
• cs09589 – In an NSRP Active-Active environment, the device does not send
WebTrend logs when it is configured with the Use Trust Zone Interface as Source IP
for VPN option.
• os60968 – (WebUI) Radio button, Enable NSM, works incorrectly.
W/A: Configure NetScreen-Scecurity Manager using the CLI.
Other
• cs08570 – SQLv2 traffic does not pass through the device with ALG enabled.
• cs08897 – (ISG 2000) GTP version 0 functions incorrectly.
Performance• cs02161 – The set flow max-frag-pkt-size CLI command is inapplicable for high-end
firewall devices.
• cs08776 – Slow performance occurs when media files are transferred using HTTP
from an Apple Mac client.
• cs09062 – An incorrect route lookup occurs for traffic destined for Trust sub-interface.
Routing• cs09553 – (ISG1000) The device does not forward PIM-BSR messages over a tunnel.
• cs10029 – (ISG1000 and ISG 2000) A Contivity device is unable to establish a BGP
peer because the unsupported optional parameters response is incorrectly handled.
Security• cs07443 – If the RADIUS accounting port is closed, an XAuth authentication will fail.
Currently authentication only of an XAuth user is unsupported. Authentication
requires accounting as well.
• cs08136 – For a device in Transparent mode, the Drop If No Reverse Path RouteFound screen option is incorrectly listed.
VOIP/H323• cs07333 – A device might fail due to a Q931 session being setup incorrectly.
• cs08143 – A device fails with error ###SIP callinfo dead loop when the H.323 ALG isenabled.
• cs09655 – An internal error caused the device to fail when processing VoIP traffic.
VPN• cs09045 – LAN to LAN VPN fails when the name resolution of one gateway (via DDNS)
expires.

ScreenOS 5.3.0r4

Page 50 of 54

Juniper Networks

Release Notes• cs09518 – In some route based VPN configurations, packets destined for a MIP are
dropped, requiring the device to be started.

7.3.2 Known Issues from ScreenOS 5.3.0r3• 07833 – (NetScreen-5GT Series) A device with Trend Micro Antivirus enabled does notproperly handle the Active X screen option.

7.3.3 Known Issues from ScreenOS 5.3.0r2• 07523 – (NetScreen-5GT Series) The Guaranteed bandwidth feature on the device
does not work properly, and causes traffic shaping failure. Low priority traffic may
starve without even getting their allocated gbw in case traffic starts a little later after
the device boots up.
• 07816 – In some cases, CPU utilization may show a spike due to ARP not aging out
correctly.
• 07833 – (NetScreen-5GT Series) A device with Trend Micro Antivirus enabled does notproperly handle the Active X screen option.
• 07866 – Web-filtering does not work correctly with the set flow no-tcp-seq check CLI
command enabled.
• 07880 – A device could fail when viewing the log entries with the WebUI.
• 07893 – (NetScreen-HSC) The device may stop passing traffic when AV is enabled.
• 07931 – The device may not pass traffic correctly when using address groups.
• 07964 – In some cases, the device may fail when the debug flow command is issued.
• 08014 – The device cannot establish a VPN due to port 4500 being incorrectlyinterpreted.

7.3.4 Known Issues From ScreenOS 5.3.0r1• 07663 – Unable to download attack db for NetScreen-25 or NetScreen-50 platforms
W/A: Replace NetScreen25-50 with NetScreen25 or NetScreen50 in the databaseserver path. For example, with an NetScreen-25 platform you need to enter: https://
services.netscreen.com/restricted/sigupdates/5.3/ns25/attacks.bin?sn=<serial>• 48563 – With devices that have DI enabled and experience prolonged periods of hightraffic, it may occur that some sessions are not removed from the session table.
• 48581 – With a device that has a large VSYS configuration, if a user changes theconfiguration in the vsys, it might disrupt traffic.
• 48603 – In an NSRP active/passive configuration with route-based VPN and UDP
traffic, the traffic flow could stop after a failover to the secondary device.
• 48642 – (NetScreen-5GT Series) The Multitech CDMA wireless modem does not work
properly due to inter-operability issues.
• 49670 – If a security device passes frames larger than 1518 bytes while connected toa Cisco switch, it may increase the Out Discard (internal) counter.
• 51841 – In Transparent mode, DHCP Relay Agent works even though the server
resides in the v1-trust zone and the client resides in the v1-untrust zone.
• 51953 – Video Conference calls across the firewall system using Tandberg Equipmentfail.
• 52798 – In a policy-based VPN setup, if a user configures a MIP on a Tunnel interface,a device located at the other end of the VPN tunnel will not be able to ping that MIP.
ScreenOS 5.3.0r4

Page 51 of 54

Juniper Networks

Release Notes• 53100 – In a scenario where the device is operating normally, when the VPN monitor
detects a failure to connect, the device may use existing sessions with the wrong destmac resulting in failed IKE negotiation.
• 53675 – A security device generates an alarm even though the packet rate is lower
than the alarm threshold, because the attack counter (syn threshold count) increases
by 2 every time a syn packet is proxied.
• 53727 – In an NSRP active/passive scenario with a large volume of SIP calls, SIP callnumbers in the primary and secondary devices may not be in sync.
• 53904 – A user cannot configure the OSPF Neighbor List using the WebUI.
W/A: Use the CLI.
• 53927 – When setting up a BGP peer group using the WebUI, the device needlessly
requests for a EBGP Multihop value.
W/A: Use the CLI to configure a BGP peer group.
• 53928 – Juniper Networks does not recommend adding a new BGP peer to a BGP peergroup using the WebUI. The operation might fail.
W/A: Use the CLI to configure BGP peers.
• 53930 – A user cannot configure a BGP network command using the WebUI.
W/A: Use the CLI.
• 53932 – On a device configured with BGP aggregate address, an attempt to access theaggregate address WebUI page causes the device to fail.
• 53991 – A slow speed WAN connection causes fragmented packets to be reassembled incorrectly because small fragments arrive faster than large fragments.
• 54013 – In a stressful NSRP active/passive scenario in NAT mode, after a failover, if auser terminates all SIP calls and executes the clear sip all CLI command on bothdevices, the devices might not release sip calls, gates, and resources.
• 54181 – The AV scan engine may restart when browsing certain Web sites.
• 54221 – When using an Avaya IP Phone, the device may fail when the Avaya phonerestarts.
• 54223 – The AV scanner currently drops SMTP emails over 7 MB.
• 54373 – The device may experience a slowing down of SMTP traffic, which may cause
a timeout when sending files larger than 7MB.
• 54689 – Configuring a MIP through the WebUI does not allow subnet definition
W/A: Use the command line interface.

ScreenOS 5.3.0r4

Page 52 of 54

Juniper Networks

Release Notes

8. Getting Help
For further assistance with Juniper Networks products, visit
www.juniper.net/support

Juniper Networks occasionally provides maintenance releases (updates and upgrades) for
ScreenOS firmware. To have access to these releases, you must register your security
device with Juniper Networks at the above address.
Copyright © 2005, Juniper Networks, Inc. All rights reserved.
Juniper Networks and the Juniper Networks logo are registered trademarks ofJuniper Networks, Inc. in the United States and other countries. All othertrademarks, service marks, registered trademarks, or registered service marks in thisdocument are the property of Juniper Networks or their respective owners. All
specifications are subject to change without notice. Juniper Networks assumes noresponsibility for any inaccuracies in this document or for any obligation to update
information in this document. Juniper Networks reserves the right to change, modify,transfer, or otherwise revise this publication without notice.

ScreenOS 5.3.0r4

Page 53 of 54

Juniper Networks

Release Notes

ScreenOS 5.3.0r4

Page 54 of 54