Juniper Networks ScreenOS Release
Notes
Release 6.1.0r4
November 2008
Part Number: 530-028132-01
Revision 01

Products: Integrated Security Gateway (ISG) 1000, ISG 1000-IDP, ISG 2000, ISG
2000-IDP, Secure Services Gateway (SSG) 5, SSG 20, SSG 140, SSG 300M-series, SSG
500/500M-series, and NetScreen-5000 series (NS 5000–MGT2, NS 5000–MGT3).
Contents

Version Summary ............................................................................................4
New Features and Enhancements ...................................................................4
New Features and Enhancements Introduced in 6.1.0r3 ...........................5
New Features and Enhancements Introduced in 6.1.0r2 ...........................5
New Features and Enhancements Introduced in 6.1.0r1 ...........................8
Hardware Features ...................................................................................8
Software Features .....................................................................................9
Virtual Private Network (VPN) ............................................................9Firewall ..............................................................................................9Internet Protocol Version 6 (IPv6) Support .......................................10
Universal Threat Management (UTM) ...............................................10
IDP and GPRS ...................................................................................10
Authentication ..................................................................................11
Network Address Translation (NAT) ..................................................11
Virtual Router Redundancy Protocol (VRRP) .....................................11
Unified Access Control (UAC) ...........................................................11
Feature Extensions .................................................................................12
Application Layer Gateway (ALG) ......................................................12
Network Address Translation (NAT) ..................................................12
NetScreen Redundancy Protocol (NSRP) ...........................................12
Other ................................................................................................13
Changes to Default Behavior .........................................................................15■

1

ScreenOS 6.1.0 Release Notes

Addressed Issues in ScreenOS 6.1.0r4 ..........................................................19
Administration ........................................................................................19
Antivirus .................................................................................................19
DHCP ......................................................................................................19
GPRS .......................................................................................................19
HA and NSRP ..........................................................................................20
IDP .........................................................................................................20
Management ...........................................................................................21
NAT ........................................................................................................21
Other ......................................................................................................22
Performance ...........................................................................................24
Routing ...................................................................................................25
Security ...................................................................................................25
VoIP ........................................................................................................25
VPN ........................................................................................................26
WebUI ....................................................................................................27
Addressed Issues from ScreenOS 6.1.0r3 ......................................................28
Administration ........................................................................................28
Antivirus .................................................................................................28
DNS ........................................................................................................28
GPRS .......................................................................................................28
HA and NSRP ..........................................................................................28
IDP .........................................................................................................29
Management ...........................................................................................29
Other ......................................................................................................30
Performance ...........................................................................................30
Routing ...................................................................................................31
VoIP ........................................................................................................31
VPN ........................................................................................................31
WebUI ....................................................................................................32
Addressed Issues from ScreenOS 6.1.0r2 ......................................................33
Administration ........................................................................................33
Antivirus .................................................................................................33
DHCP ......................................................................................................33
HA and NSRP ..........................................................................................33
Management ...........................................................................................35
Other ......................................................................................................36
Performance ...........................................................................................38
Routing ...................................................................................................38
VoIP/H323 ..............................................................................................39
VPN ........................................................................................................39
WebUI ....................................................................................................40
Addressed Issues from ScreenOS 6.1.0r1 ......................................................41
VPN ........................................................................................................41
Firewall ...................................................................................................41
IDP .........................................................................................................41
Other ......................................................................................................41
Routing ...................................................................................................42
Management ...........................................................................................422■

Known Issues ................................................................................................43
Known Issues in ScreenOS 6.1.0r4 .........................................................43
Administration .................................................................................43
DNS ..................................................................................................43
HA and NSRP ...................................................................................43
Management ....................................................................................43
NAT ..................................................................................................44
Other ................................................................................................45
Performance ....................................................................................46
Routing .............................................................................................46
Security ............................................................................................46
VoIP .................................................................................................46
VPN ..................................................................................................46
WebUI ..............................................................................................47
Known Issues from ScreenOS 6.1.0r3 .....................................................47
Known Issues from ScreenOS 6.1.0r2 .....................................................47
Known Issues from ScreenOS 6.1.0r1 .....................................................48
Flow .................................................................................................48
HA and NSRP ...................................................................................48
IPv6 ..................................................................................................48
Other ................................................................................................49
Routing .............................................................................................50
VoIP .................................................................................................51
VPN ..................................................................................................52
Limitations and Compatibility .......................................................................53
Limitations of Features in ScreenOS 6.1.0 ..............................................53
Compatibility Issues in ScreenOS 6.1.0 ...................................................55
Documentation Changes ...............................................................................57
Getting Help for ScreenOS 6.1.0 Software .....................................................57■

3

ScreenOS 6.1.0 Release Notes

Version Summary
ScreenOS 6.1.0 firmware can be installed on the following products: Secure Services
Gateway (SSG) 5, SSG 20, SSG 140, SSG 320M/350M, SSG 520/520M, SSG 550/550M,
Integrated Services Gateway (ISG) 1000, ISG 1000-IDP, ISG 2000, ISG 2000-IDP, andNetScreen-5000 series with the N-5000–MGT2 and NS-5000-MGT3 module.
This release incorporates the ScreenOS maintenance releases up to 6.0r7, 5.4r11,
and 5.3r10.

NOTE:
■

If you are using an SSG 500-series device and an SSG 500M-series device in a
NetScreen Redundancy Protocol (NSRP) environment, all devices must be running
ScreenOS 6.0r1 or later.

■

NSRP clusters require the use of the same hardware products within a cluster.
Do not mix different product models in NSRP deployments.

New Features and Enhancements
The sections below describe new features and enhancements available in the
ScreenOS 6.1.0 release.

NOTE: You must register your product at http://support.juniper.net to activate licensedfeatures such as antivirus, deep inspection, and virtual systems on the device. To
register your product, you need the model and serial numbers of the device. At the
support page:■

If you already have an account, enter your user ID and password.

■

If you are a new Juniper Networks customer, first create an account, then enter
your ID and password.

After registering your product, confirm that your device has Internet connectivity.
Use the exec license-key update all command to connect the device to the Juniper
Networks server and activate the feature.

4■

Version Summary

New Features and Enhancements

NOTE:
■

You can use NetScreen-Security Manager (NSM) 2007.3 with the Forward Support
Update software to manage devices running ScreenOS 6.1. To do this, install aschema upgrade on the management server and user interface. The upgrade isavailable at http://www.juniper.net/customers/support/. Refer to the NSM Forward
Support for ScreenOS 6.1.0 Release Notes for installation instructions and thefeatures and platforms supported with this schema upgrade.

New Features and Enhancements Introduced in 6.1.0r3
The section below describes the new features introduced in the ScreenOS 6.1.0r3
release.
ISG-IDP Enhanced IDP Debug Feature Added
With ScreenOS 6.1.0r3 new IDP session and flow debug filters similar to ScreenOS
filters have been added to improve IDP debugging.

New Features and Enhancements Introduced in 6.1.0r2
The section below describes the new features introduced in the ScreenOS 6.1.0r2
release.
ISG-IDP Syslog Forwarding to Third-Party Servers
With ScreenOS release 6.1r2 and later, the ISG 1000/2000 device with IDP can send
syslogs to third-party syslog servers. With previous releases, IDP logs could only besent to an NSM server.
To enable and configure this feature:set syslog config IP_address_or_hostname logvalue
Options for value are:
1.

all

2.

event

3.

idp

4.

traffic

Example: set syslog config 10.1.1.2 log idp
To enable this feature from the WebUI:
Go to Configuration > Report Settings > Syslog
Here you will see a new option to enable and configure syslogs for IDP.

New Features and Enhancements■

5

ScreenOS 6.1.0 Release Notes

ISG-IDP Session Pass Under Heavy Throughput
An option to allow sessions to pass through without inspection under heavy throughput
conditions has been introduced in this release. This feature bypasses traffic inspection
for some sessions when the Intrusion Detection and Prevention (IDP) Security Module(SM) is unable to stay in lockstep with incoming traffic while continuing to inspect
other packets. You might use this feature when you are sensitive to packet drops
and want to enable an on/off switch to have packets inspected at the firewall level
instead of through the security module. By default, this feature is off; that is, as inprevious releases, all traffic is inspected by IDP and under heavy throughput, somepackets may be dropped.
To enable this feature, use the following command syntax:
exec sm sm_id ksh "scio const set sc_adapt_enable 1"

You need to run this command on each IDP SM. The valid sm_id values are 1, 2, 3.
To disable this feature, use the following command syntax:
exec sm sm_id ksh "scio const set sc_adapt_enable 0"

When enabled, throughput conditions are taken into account and bypassing packet
inspection is done using a set of criteria. Traffic conditions will result in IDP operatingin the following modes:■

Normal inspection—All traffic is inspected by IDP.

■

Basic cut-through mode—All new sessions will be marked as cut-through andwill be allowed to pass uninspected. The first packet of the session received by
the Security Module triggers the cut-through marking. It is possible for subsequent
packets to still be sent to the Security Module before the Management module
takes cut-through into effect. All these subsequent packets are sent out without
inspection.

■

Progressive cut-through mode—All sessions for which packets are being observedby the IDP security module will be bypassed.

Log messages are issued for any IDP bypass state. The six log types for session bypass
state changes are:■Normal to basic cut-through■Basic cut-through to normal■

Basic cut-through to progressive cut-through■Progressive cut-through to basic cut-through■Normal to progressive cut-through■Progressive cut-through to normal

Here are details of the log messages:■

6■

Category is NS_LOG_CATEGORY_ALARM

New Features and Enhancements

New Features and Enhancements■

Logtype is NS_LOG_ALARM_OTHERS■

Severity is NS_LOG_SEVERITY_WARNING■

Service is cutthrough_transit. Its values and means are:■

SC_LOG_CUTTHROUGH_NORM_TO_LOW = 1■

SC_LOG_CUTTHROUGH_LOW_TO_NORM = 2■

SC_LOG_CUTTHROUGH_LOW_TO_HIGH = 3■

SC_LOG_CUTTHROUGH_HIGH_TO_LOW = 4■

SC_LOG_CUTTHROUGH_NORM_TO_HIGH = 5■

SC LOG_CUTTHROUGH_HIGH_TO_NORM = 6

Here is a sample log message for status changes:
SM %d IDP (cpu %u) transits from %s. %u sessions was bypassed in the previous
state!
The log also includes log version, timestamp, device_domain_id, device_record_id,
device_domain_ver2, and policy_id.
You can use counter commands to get information about whether a CPU is in
cut-through mode and the number of sessions that were set to cut-through mode.
For example:
exec sm 1 ksh "scio counter get kpp…
sc_kpp_loopback
sc_kpp_norm2low
sc_kpp_low2highsc_kpp_high2low
sc_kpp_low2norm…
exec sm 1 ksh "scio counter get flow…
sc_flow_session_basic_cutthrough 0
sc_flow_session_progress_cutthrugh 0
sc_flow_cur_cutthrough_sessions 0

New Features and Enhancements■

7

ScreenOS 6.1.0 Release Notes

New Features and Enhancements Introduced in 6.1.0r1
The section below describes the new features introduced in the ScreenOS 6.1.0r1
release.

Hardware Features■

1X100/1000 SFP Ethernet uPIM—With ScreenOS 6.1.0, a new 1-port small
form-factor pluggable (SFP) Ethernet PIM is now available for the SSG 140, SSG
320M, SSG 350M, SSG 520, SSG 520M, SSG 550, and SSG 550M platforms. This
new Ethernet PIM supports the following transceivers: 1000Base-T; Gigabit
Ethernet LX, and SX; and 100Base-FX. This 1-port SFP Ethernet PIM does notsupport spanning tree, Jumbo frames, bridge groups, hot-swapping, or 802.3ad(Link Aggregation).

■

SSG 300M-series PIM Support—The following PIMs are now supported on the
SSG 300M-series devices: 6-port GE SFP uPIM, 8-port 10/100/1000 uPIM, 16-port
10/100/1000 uPIM, and ADSL2+ PIM.

■

New NetScreen-5000 Modules—The NS-5000-MGT3, NS-5000-8G2-G4, andNS-5000-2XGE-G4 are new modules that you can install in your NetScreen-5000
series device. These modules increase the performance of the device when it isrunning ScreenOS 6.1 or later software:

■

8

■

■

NS-5000-MGT3—Management (MGT) module for NetScreen-5000 series
devices with dual 1.4 GHz PowerPC processors. Comes preinstalled with
ScreenOS 6.1 software. Use only with either an NS-5000-8G2-G4 or
NS-5000-2XGE-G4 Secure Port Module (SPM).

■

NS-5000-8G2-G4—SPM for NetScreen-5000 series devices with eight 1-Gigabit
SFP sockets for hot-swappable transceivers. Use only with NS-5000-MGT3
modules.

■

NS-5000-2XGE-G4—SPM for NetScreen-5000 series devices with two
10-Gigabit XFP sockets for hot-swappable transceivers. Use only with
NS-5000-MGT3 modules.

1-port 10 Gigabit I/O Module—The 1-port small form-factor pluggable (XFP)
Ethernet I/O module is now available for the ISG 1000, ISG 2000, and ISG 2000
with IDP platforms. This new module supports the following transceivers:
10GBase-SR and LR, and supports jumbo frames (maximum packet size 9830
bytes).

New Features and Enhancements

New Features and Enhancements

Software Features
Virtual Private Network (VPN)■

IKEv2—ScreenOS 6.1.0 adds support for the Internet Key Exchange protocol
version 2 (IKEv2). Both IKEv1 and IKEv2 gateways can exist on a ScreenOS
device. Note, however, that both ends of a tunnel must use the same IKE version.
A tunnel may not be created that uses IKEv1 at one end and IKEv2 at the other.
The primary advantage of IKEv2 is that it permits different negotiations at bothends of a tunnel. IKEv2 avoids IKE denial of service (DoS) attacks by using astateless cookie and verifying the peer address before committing IKE negotiation
resources for the peer. IKEv2 supports Diffie-Hellman (DH) groups 1, 2, 5, andMore Modular Exponential (MODP)14 (RFC 3526).

■

IKEv2 with EAP—All platforms running ScreenOS 6.1.0 support IKEv2 with
Extensible Authentication Protocol (EAP).

■DSCP Marking per Phase-2 Proposal—Administrators can now configure theDifferentiated Services Code Point (DSCP) marking per phase-2 proposal tointeract with Multiprotocol Label Switching (MPLS) traffic engineering. After anadministrator has enabled DSCP marking per phase-2 proposal, he or she canconfigure traffic routing into different tunnels.

■

Session Rerouting Between Tunnels and Physical Interfaces—ScreenOS 6.1.0
allows the traffic to fail over between route-based VPN tunnels and physicalinterfaces in the same zone when the security devices are deployed in a fully
redundant network design consisting of dynamic routing and route-based VPNs.
Without this feature, if a session that originated over an Ethernet link traverses
a VPN link (or vice versa) as a result of routing changes, traffic flow will stop,
requiring you to restart your applications. This feature reroutes the session andavoids the need to restart applications.

■Customizable Reject Message for Integrated SurfControl—Administrators can
now create a custom reject message when Integrated SurfControl denies accessto a URL.

■

Apple iChat ALG—ScreenOS 6.1.0 provides an Application Layer Gateway (ALG)
for Apple iChat applications up to version 3.15 that facilitates text, audio, andvideo chat.

■

Per-Policy Source-IP Session-Rate Limit—Administrators can now set
session-rate limits for source IPs on a per-policy basis.

■

Traffic Shaping on WAN Interfaces—Traffic shaping is now supported on Frame
Relay and Multilink Frame Relay interfaces on SSG devices. This includes theT1/E1, T3/E3, and 2M-Serial interfaces on the SSG 5/20, SSG 140, SSG
320M/350M, and SSG 520/520M/550/550M devices.

Firewall

New Features and Enhancements■

9

ScreenOS 6.1.0 Release Notes

Internet Protocol Version 6 (IPv6) Support■

IPv6 Support—IPv6 is now supported on SSG 140, SSG 320M/350M, SSG
520/520M, and SSG 550/550M platforms.

■

ISG 1000 and ISG 2000 with 1GB Memory—The ISG 1000 and ISG 2000 bothsupport IPv6 with 512K sessions on devices with 1GB of memory.

■

Protection Against SYN-Flood DoS Attacks—SYN-Proxy and SYN-Cookie
mechanisms are now supported for IPv6 to protect against SYN-Flood DoS attacks.

■

IPv6 Support for WAN Interfaces—IPv6 is now supported on E1/T1, E3/T3, and
2M-Serial interfaces on the SSG 5, SSG 20, SSG 320M/350M, SSG 520/520M, and
SSG 550/550M platforms.

■

IPv6 ALGs—IPv6 support has been added for Sun and MS RPC ALGs, Session
Initiation Protocol (SIP), and Real-Time Streaming Protocol (RTSP) ALGs.

NOTE: ScreenOS 6.1.0 includes support for these ALGs in both IPv4 and IPv6
environments. The ALGs are not, however, triggered when doing network addresstranslation-port translation (NAT/PT) or in IPv4 to IPv6 and IPv6 to IPv4 translations.

Universal Threat Management (UTM)■

AV/DI Pattern Update Proxy—ScreenOS allows you to specify a proxy server
through which the security device can download antivirus (AV) and deep
inspection (DI) pattern updates in case your security device is not directly
connected to the Internet.

■

AV Maximum File Size Increase—In this release of ScreenOS, the maximum
file size that the AV engine is able to scan has increased from 10MB to 30MB on
all SSG devices.

■

IDP IPSec ESP-Null Encryption Inspection—ScreenOS 6.1.0 now supports
inspection of the traffic within IPSec tunnels that use the Null Encryption method.
This is supported on ISG 1000 and ISG 2000 with IDP Security Modules.

■

IDP Session Log Correlation—IDP logs sent to the NetScreen-Security Manager(NSM) server now contain the session ID to aid in correlating attack logs with
firewall session logs.

IDP and GPRS10■New Features and Enhancements

New Features and Enhancements

Authentication■

Captive Portal for WebAuth—In earlier releases of ScreenOS, if you wanted toaccess a protected resource behind WebAuth, you had to navigate to the WebAuth
address to authenticate and then navigate to the address of the protectedresource. Now you can navigate to the protected resource, and if you need toauthenticate via WebAuth, you will be redirected to the authentication page.
After the credentials are identified, you are forwarded to the original protectedresource.

Network Address Translation (NAT)■

PPTP ALG on ISG 1000/2000 and NS5x00—High-end devices now support Port
Address Translation (PAT) for Point-to-Point Tunneling Protocol (PPTP), allowing
multiple remote users to use PPTP through a ScreenOS device.

■

Multiple Non-Contiguous Subnets in a DIP Pool—ScreenOS 6.1.0 now allows
administrators to configure up to three non-contiguous subnets in a single
fixed-port DIP pool. It is no longer necessary to have a single large subnet withconsecutive IP addresses in order to configure a DIP pool. This will help withsituations where users were denied access when the DIP pool was exhausted
and no consecutive IP addresses were available. The feature is available on all
ScreenOS 6.1.0 platforms.

Virtual Router Redundancy Protocol (VRRP)■

Virtual Router Redundancy Protocol (VRRP) Support—ScreenOS 6.1.0 provides
support for VRRP (RFC 3768-VRRP version 2.0) on the SSG 5, SSG 20, SSG 140,
SSG 320M/350M, and SSG 520/520M/550/550M platforms. This feature allows
the security devices to interoperate with other vendors’ VRRP implementations.
When a device supports VRRP, it cannot support NSRP, as they are mutually
exclusive. The current implementation of VRRP does not support stateful failover,nor is VRRP supported through NSM.

Unified Access Control (UAC)■

Dynamic Discovery of Enforcers—ScreenOS 6.1.0 allows you to configure theInfranet Enforcer (firewall) to inform the Infranet Controller when a packet is
dropped because it originated from an unknown user. When the Infranet
Controller authenticates the identity of the user, it will then push thecorresponding rules down to the Infranet Enforcer. With earlier releases of
ScreenOS, the Infranet Controller would push the entire auth table to the firewall
even if the entries were not necessary. This feature will be available with therelease of UAC 2.2.

■

Enhanced Range of Roles per Auth Table Entry—ScreenOS supports a
maximum of 200 roles per auth table entry in order to limit the amount ofmemory occupied by the auth table. The role strings and role name arrays store
the first 200 roles configured by the Infranet Controller; any roles beyond thatare discarded with a warning message logged to the SSH session that sent thecommand and to the event log.

New Features and Enhancements■

11

ScreenOS 6.1.0 Release Notes

Feature Extensions
Application Layer Gateway (ALG)■

MS-RPC ALG Enhancements—ScreenOS 6.1.0 adds support for ISystemActivator(IRemoteSCMActivator) bind requests.

■

Avaya H.323 and SIP ALGs—ScreenOS has extended SIP ALG support for Avaya
H.323 and SIP.

■

SIP Trunking ALG—ScreenOS 6.1.0 has extended the SIP ALG to support SIP
trunking from vendors such as Lucent, Broadsoft, and AT&T.

■

PacketCable Extensions for MGCP ALG—ScreenOS 6.1.0 adds support for the
Network-based Call Signaling (NCS) protocol and Trunking Gateway Control
Protocol (TGCP). NCS/TGCP is used for delivering advanced, real-time multimedia
services over two-way cable deployments.

Network Address Translation (NAT)

ScreenOS 6.1.0 provides a uniform NAT functionality in Layer 3 (L3) among all
security devices as follows:■

You can configure the virtual IP (VIP) address as the same as the interface IP
address on any device in any zone.

■

You can configure the VIP and mapped IP (MIP) address on the same interface
using the same IP address. This allows you to selectively redirect traffic for
specific applications to designated servers.

■

You can configure VIP, MIP, and dynamic IP (DIP) addresses in any combination
on any interface.

NetScreen Redundancy Protocol (NSRP)

Enhanced Range of Cluster IDs and VSD IDs—ScreenOS now supports up to
64 cluster IDs or 64 VSD IDs or some combination equal to 64. In addition,
ScreenOS 6.1.0 provides increased cluster session ramp-up performance andlimited asymmetric routing support through an NSRP cluster. All devices in acluster must be set to the same value.

■

Cluster
ID:

0

8

16

32

64

0

default

default

supported*

supported*

supported*

8

default

default

supported*

supported*

supported*

16

supported*

supported*

supported*

supported*

unsupported

32

supported*

supported*

supported*

unsupported

unsupported

64

supported*

supported*

unsupported

unsupported

unsupported

VSD ID:12■

New Features and Enhancements

New Features and Enhancements* Using the environment variable to set the values. This is an example of how
to set the environment variables:
ssg5-serial-wlan-> set envar nsrp-max-cluster=32
nsrp cluster is set to 32
The system must be rebooted for new setting to take effect!
ssg5-serial-wlan-> set envar nsrp-max-vsd=16
nsrp vsd is set to 16
The system must be rebooted for new setting to take effect!
■

Active-Active Support for Transparent Mode—ScreenOS 6.1.0 adds support
for Active-Active configurations in Transparent mode on the ISG 1000/2000 andNS5x00 platforms.

■

SCTP Stateful Inspection—ScreenOS 6.1.0 supports stateful inspection of Stream
Control Transport Protocol (SCTP) traffic on all platforms. Supported maximum
concurrent SCTP sessions is 2000.

■

NSRD Support via USB—With the current release of ScreenOS, the NetScreen
Rapid Deployment (NSRD) feature allows you to load a configuration on a security
device with factory default configuration from a configlet file stored on a USB
storage device. Please see SSG 300-Series NSRD Support in the Limitations section
for more information about this feature on SSG 300-series devices.

■Ability to Keep Session Flow in CPU on ASIC-Based Platforms—On ISG
1000/2000 and NS5x00 platforms, you can retain the session flow in the CPU
itself based on a policy that you define, facilitating packet capture for debugging
purposes. In earlier releases, the CPU handled only the first packet of a session
with the subsequent packets of the flow sent to the ASIC.

■WebUI Enhancements for Opening a JTAC Case—The enhancements to the
WebUI allow you to open a Juniper Technical Assistance Center (JTAC) case fortechnical support where the WebUI automatically populates fields with
device-specific information.

■

Secondary Login Banner Acknowledgement—This version of ScreenOS allows
the creation of a secondary banner which requires users attempting to access a
device to positively acknowledge a banner before displaying a prompt for
credentials (such as a username/password or username/public key). If the user
does not acknowledge the banner, the device will not give them a login prompt
and will close the connection. This feature is consistent on various types ofmanagement sessions including those created via console, telnet, and SSH.

Other

To enable the feature, run the following command:
set admin auth banner ack-secondary

NOTE: This feature cannot be used on firewalls that are acting as an Infranet Enforcer
working in conjunction with UAC. This is because UAC communicates with the firewall
via SSH and does not have a method to accept the banner.

New Features and Enhancements■

13

ScreenOS 6.1.0 Release Notes

14

■

■

Ability to Use the Option 'deny' in Access Lists for Multicast—You can now
specify the option 'deny' in access lists to simplify access list configuration insteadof having to create permit-only lists.

■

Environment and Temperature MIBs—All platforms now support environmental
and temperature MIBs.

■

Ability to Accept/Discard Gratuitous ARP Requests and Responses—You can
now accept/discard gratuitous ARPs on a per interface basis in Layer 3 and ona per VLAN basis in Transparent mode.

■

Wildcard Mask Support in Policies—ScreenOS 6.1.0 allows you to configure
wildcard masks in policy entries, such as 10.10.10.10/0.0.255.0. There is apotential session ramp rate impact when enabling this feature.

■

Dynamic DNS Service Enhancements—ScreenOS 6.1.0 adds support for Static
DNS and Custom DNS from the Dynamic DNS from dyndns.com.

■

ICSA Compliance Updates to CLI—The set firewall log-self command now
includes four additional logging options: NSM, SSH, telnet, and web.

■

Dial-in Console Access Security Enhancements for SSG 5/20—The following
security enhancements have been added for dial-in console access on the SSG
5 and SSG 20 platforms:■

Log all dial-in attempts (success and failure) and include the caller numbers;■

Support for whitelists and blacklists for caller numbers;■

Deny access for a particular caller number after a configurable number offailed login attempts;■

Disconnect the call after a configurable number of failed login attempts;■

Disconnect the call after a configurable length of time without successfulauthentication;■

Specify whether to allow or deny calls from unknown caller numbers.

New Features and Enhancements

Changes to Default Behavior

Changes to Default Behavior
This section lists changes to default behavior in ScreenOS 6.1.0 from previous
ScreenOS firmware releases.

NOTE: If the ScreenOS version is not mentioned in this section, the change in behavior
was released with ScreenOS 5.4.0r1.
Changes to Default Behavior Introduced in 6.1.0r4■

DNS Port Randomization—The ability to enable random port assignment forpolicy-based DIP pools has been added; both interface-based DIP pools andpolicy-based DIP pools can now have ports randomly assigned. Interface-based
DIP pools have random port assignment by default. Policy-based DIP pools,
however, are default set to port translation, so random-port must be manuallyenabled by an admin.
The random-port keyword has been added to CLI syntax for both DIP pool andextended DIP pool:set interfaceifname ext ipip/mask dip dip_id ip_low ip_high [random-port]
set interface ifname dip dip_id ip_low ip_high [random-port]■

Load-threshold—The load-threshold setting for an ISDN interface supports therange 0~100. The zero value allows for always-up capability. Use the dialer
load-threshold load interface configuration command to configure the bandwidth
on demand for setting the maximum load.

■

ISG traffic dropping—Use the command set sat fin-close-aging num to control
the session age-outs on ISG. By default session age-out for ISG is 10 seconds.
Using the command prevents the packet dropping when the session inactivity
age-out timer expires before time.

■Multicast routing—An administrator can now configure a multicast address tothe unicast route table using the mroute command.

■

Traffic shaping—Multicast traffic can now be inspected for traffic shaping. Thisissue can be fixed with traffic shaping before flooding the multicast packets ina layer2 zone.

■

Port mapping—ScreenOS provides the port mapping for the unused management
ports 443 and 53 using the WebUI. The steps to be performed every time thedevice reboots includes the following:1.

Set a VIP on outgoing interface on a different IP.

2.

Set the port mappings for the VIP to the 443 and 53 ports. The admin SSL
to be re-allocated to another port other than 443. DNS proxy to be disabled
for the port 53.

3.

Modify the VIP back to the interface IP.

Changes to Default Behavior Introduced in 6.1.0r1

Changes to Default Behavior■

15

ScreenOS 6.1.0 Release Notes■[SSG 140] Maximum Number of Supported Zones—In previous releases, theadministrator was able to create more than the maximum amount of user-definedzones (30). With 6.1.0r1, this limit is now enforced on the SSG 140.

■

NSRP Active-Active Configuration in Transparent Mode—The virtual security
device (VSD) is determined by the VLAN tag in Transparent mode instead of the
VMAC in Route/NAT mode.

■

Consistent NAT Behavior Across Platforms—ScreenOS now provides a consistent
NAT behavior across all platforms. This includes the following:■

Allows VIP and MIP to be the same as interface on any Layer 3 zone insteadof only the Untrust zone■

Allows VIP and MIP to be on the same interface with the same IP■

Adds new CLI set interface interface-num vip interface-ip and change set
interface interface-num vip untrust-ip to a hidden command.

■

SA IDs Displayed Consistently in the Same Base—With this release of ScreenOS,
Security Association (SA) IDs are displayed in Hex both when using the get sa
command and in the displayed configuration.

■

Performance Enhancement—The ISG 1000 platform supports enhanced
performance to 2Gbps.

■

Increase in Limit of Entries in Routing Tables—With ScreenOS 6.1.0, runningon the SSG 520/520M/550/550M platforms, routing and forwarding tables canhave 250,000 entries, which is increased from the earlier limit of 20,000. The
routing tables accept 250,000 total routes including connected, static, imported,and those learned from the routing protocols.

■

Wildcard Masks—ScreenOS 6.1.0 provides an option to use wildcard masks in
IP addresses. If you configure a policy that uses wildcard masks, the systemprompts that a wildcard address or wildcard policy is configured because using
wildcard address/wildcard policy causes a performance penalty.

■“Deny” Option in Access Lists in Multicast Policies—ScreenOS provides anoption to include a deny option in access lists in the multicast policy. This might
appear as an increase in the number of multicast access lists.

■

Session Capacity Increases—Session capacity increases as listed below.

Platform

Sessions

SSG 5/SSG 20

8,000

SSG 5/SSG 20 - Adv

16,000

SSG 140

48,000

SSG 320M-

SSG 350M-

SSG 520/SSG 520M

128,000

SSG 550/SSG 550M

256,000

16■

Changes to Default Behavior

Changes to Default Behavior

Platform

Sessions

ISG 1000

512,000

ISG 1000-IDP-

ISG 2000

1,000,000
NOTE: 2 GB of RAM required. 1 GB of RAM will allow
512,000 sessions.

ISG 2000-IDP-

NS5200/MGT2-

NS5400/MGT2

2,000,000■

Increase in GTP Tunnels—ScreenOS 6.1.0 increases the maximum number ofactive GTP tunnels supported to 400,000 for the ISG 2000 platform and to200,000 for the ISG 1000 platform.

■

Increase in Roles per Auth Table Entry—ScreenOS 6.1.0 increases the numberof roles per auth table entry from 26 to 200.

■

Session Rerouting Between Tunnels and Physical Interfaces—ScreenOS 6.1.0
allows the traffic to fail over between route-based VPN tunnels and physicalinterfaces in the same zone when the security devices are deployed in a fully
redundant network design consisting of dynamic routing and route-based VPNs.
To restore the original behavior, use the set envar no-reroute-tunnel-physical=yes
command.

■Increase in Maximum Tunnel Interfaces—On the NS-5000 w/MGT2 platform,
ScreenOS 6.1.0 increases the maximum number of tunnel interfaces per device
from 4096 to 8192.

■

ETSI Standards Support—Currently, Juniper Networks security devices do notsupport the new wireless standard from European Telecommunications Standards
Institute (ETSI), DFS2. This will result in the disabling of the frequency ranges
5250-5350 MHz and 5470-5725 MHz for all SSG 5/20 wireless systems (region
ETSI) after March 2008.

■

UDP Flood Screen—Juniper Networks ASIC-based security devices (NS5400,
NS5200, ISG 1000, and ISG 2000) enforce configured screen options for asubinterface even when the physical interface of this subinterface is in a nullsecurity zone.

■

Packet Distribution Mode Setting—On an NS5200 MGT2 with 10GE blade, you
can now configure the packet distribution mode for ingress traffic as either hashor round-robin mode using the CLI command set interface interface-name mode.
Default is hash mode.

■

Virtual IP on Loopback Interfaces—With ScreenOS 6.1.0, you can configure
the virtual IP (VIP) and Track IP addresses for a loopback interface. Earlier releasesof ScreenOS did not provide this option.

■

Configurable Wait Time to Confirm NSM Connection—If you manage yoursecurity device with Juniper Networks NetScreen-Security Manager (NSM), you

Changes to Default Behavior■

17

ScreenOS 6.1.0 Release Notes

can load the security device with a configuration from NSM. If a configuration
upload fails for some reason, the security device may lose communication with
the NSM server. The device can reestablish the connection with NSM by rebooting
and loading the previous configuration. The device, however, is unable toimmediately detect that the connection is broken, so it is necessary to wait fora specified interval and then check the connection status. The new CLI toconfigure the wait interval to check the connection status is set nsm bulkcli
reboot-wait [seconds]. If the connection is broken, the device can be configured
to wait for another specified interval and then reboot.
■

Addition of HA and MGT Zones—ScreenOS 6.1.0 adds support for highavailability (HA) and management (MGT) zones on the SSG 5 and SSG 20 devices.
When you start these devices for the first time, the device adds the HA and MGTzones by default.

■

Option to Configure Email Virus Scanning Action—ScreenOS 6.1.0 provides
an option to configure the action that the security device should take if a virus
is found in an email. You can choose to have the security device drop the infectedemail or send a notification mail to the intended recipient with the infected email
replaced with an alert message.

■

Firmware Information—ScreenOS 6.1.0 adds information about the firmware
and its components to the output of the get system CLI command on an ISG
1000 or ISG 2000 device.

■

Bgroup PPS Counters—ScreenOS 6.1.0 now displays packet-per second counterson bgroup interfaces.

■

VLAN Capacity Increase—ScreenOS 6.1.0 now supports up to 4094 VLAN
interfaces on ISG 1000/2000, ISG 1000/2000-IDP, and NS5x00 series devices
when operating in Transparent mode.

■

TCP MSS Modified for Bidirectional VPN Traffic—The TCP Maximum Segment
Size (MSS) value for bidirectional VPN traffic can now be modified in the CLI.
The new CLI command set flow vpn-tcp-mss number sets the same MSS for both
inbound and outbound traffic. In prior ScreenOS releases, the CLI set flow tcp-mss
command worked only for outbound VPN traffic.

NOTE: The older command still works, but any value set using it will be overlaid if
the new command is run. Running unset flow vpn-tcp-mss will cause the device toonce again use the earlier value and permit use of the older command. When no
MSS value is given, the default setting is 1350; when the new command is used, an
MSS value configured by set flow tcp-mss will not be valid even if set flow tcp-mss is
run again. [261891]

18■

Changes to Default Behavior

Addressed Issues in ScreenOS 6.1.0r4

Addressed Issues in ScreenOS 6.1.0r4
The following operational issues were resolved in this release:
Administration■

283897—Instead of null, the SNMP counters for multilink interfaces are zero.

■

292227—The SSG 140 device does not load the operating system after a restart.

■

293248—Information of both source port and destination port in an event log
entry for WebUI access is not correct.

■

298873—When the Application ignore is configured on a policy, then the groupservice cannot be added.

■

299024—If the connection to the IC module breaks and if the IC module isconfigured with a DNS entry, then the DNS entry is updated.

■

299556—The event log does not log service timeout modification as aconfiguration change■

300282—When a policy is disabled, then the traffic shaping parameters of thatpolicy are lost■

306719—On authentication, the additional group information does not get
propagated to the backup device if the device is tied to multiple groups.

■

286714—In some cases, the Antivirus pattern files are missing and the new fileis not downloaded. The scan engine reports a File Not Found message.

■293490—In a web proxy environment when the antivirus is enabled, then theevent log prints the url twice.

■295023—The device fails when the non-written memory page is freed up andthe AV is enabled.

■

305062—The policy log for traffic matched by antivirus displays double theactual byte size received.

■

282543—In certain situations, the device is unable to send a DHCP client request.

■

292152—Device resets unexpectedly after configuring DHCP auto-config.

■

305504—In transparent mode, the CLI set zone <name> no-dhcp-relay does notcover the DHCP server service.

■277620—When the GTP inspection is enabled, packets could be dropped andfirewall ran out of available paths.

Antivirus

DHCP

GPRS

Addressed Issues in ScreenOS 6.1.0r4■

19

ScreenOS 6.1.0 Release Notes■

302910—GTP CreatePdpRequest packets are dropped when retransmitted. Thisis observed when the packets, before sending a DeletePdpRequest, use the same
teid_data to a different GGSN.

■

258242—In NSRP active and passive mode, the primary device restarts when
the pointer has an invalid value.

■

287173—When a new username and password is added, the NSRP configuration
goes out of sync.

■

288925—NSRP configurations are out of sync after unset multiple objects areapplied in a multi-cell policy.

■

289119—Creating interface description causes NSRP configurations to go out of
sync.

■

291970—[NetScreen 5000] The HA link shows UP when the HA interface of thepeer is set to phy link down.

■

298021—NSRP configurations may go out of sync if the DNS server specifies an
src-interface, which is a local interface, instead of a VSI interface.

■

300760—NSRP shows out of sync due to the password hash of the PPPoE
username being different on the two devices.

■

301156—Under high traffic load, the multicast traffic leak occurs on the secondary
device in the transparent mode.

■

306981—NSRP configurations go out of sync due to CLI configuration out oforder when one of the members is reset.

■

310384—In transparent mode, NSM is unable to manage the backup device inan NSRP cluster.

■

260215—When profiling smaller networks, the profiler on an ISG-IDP does notdetect new events. The profiler does not update old events.

■

276587—[ISG-IDP] VLAN tagged traffic is incorrectly handled and dropped by
ISG with IDP modules when IDP and tcp-syn-check is enabled.

■

292041—False positive detection can occur when accessing some of the web
sites with a particular combination of DI policies.

■

297722—When a packet with ACK set is received, the IDP might drop sessions
that are in half-connected state.

■299424—With FTP-pathname user-defined signatures, the device does not checkthe filename in FTP out and get commands.

■

300182—The IDP engine failed because of the corrupt data structure.

■301944—DI HTTP brute search function is not working properly.

HA and NSRP

IDP

20

■

Addressed Issues in ScreenOS 6.1.0r4

Addressed Issues in ScreenOS 6.1.0r4

Management■

281995—In some scenarios, all access to the management, except through theconsole, might be lost.

■

288625—A policy modification using Network and Security Manager might causea device reset.

■

292858—[SSG-320M/350M] SNMP Object Identifier (OID) ns TemperatureCur
returns incorrect values.

■

294506—NSM updates do not take effect when the loopback interface isgenerated into static mroute in the NSM config datafile.

■298916—An unnumbered tunnel interface can be configured on a custom tunnelzone. However, this interface is not supported and cannot be configured in NSM.

■

300219—[NetScreen 5000-8G2-G4] In an HA cluster in transparent mode, thedevice with SSH or telnet on the secondary device cannot be managed.

■

300298—If a loopback interface is used by route-map in a virtual router, then it
is not released while deleting a vsys.

■

300762—On certain interfaces incorrect display of ifAdminStatus and ifOperStatus
is observed.

■308356—Webtrends traffic log does not display VSYS name.

■

284672—DIP allocation fails on backup device of NSRP cluster when PPORT is
not released.

■

288045—The VIP on loopback interface that contains a serial interface does notlog traffic and Antivirus. Also, anti-spam scanning does not occur.

■

302566—When NAT source and destination is configured in the same policy,
passive FTP fails.

■

307364—Interface IP address can be unset even if its MIPs are still use in policies.
These MIPs are kept in the configuration and are only removed after device isreset.

NAT

Addressed Issues in ScreenOS 6.1.0r4■

21

ScreenOS 6.1.0 Release Notes

Other

22

■

■

235297—Source MAC is not cached in session for PIM traffic.

■

259334—A memory leak occurs when running FIPS mode.

■

271025—The memory allocated during the Certificate Revocation List (CRL)
check is not released properly after the check is complete.

■

276077—Non-RPC MS Exchange traffic is dropped due to incorrect timeout.

■279557—[SSG Series] The traffic still passes when the WAN serial interface witha backup interface is down.

■

283348—A device running Antivirus, URL Filtering, or VoIP does not function
due to an unexpected packet type.

■

284275—When running "debug flow basic", the format of UUID is not correct.

■

284851—The firewall authentication might fail when loopback session is involved.

■

286679—A memory leak occurs when NTP client cannot obtain a valid key idor key string.

■288938—The backup interface in a redundant interface setup is erroneously
forwarding packets and causes duplicate packets to be sent.

■

289413—WLAN LEDs are turned off when all wireless interfaces are shut down.

■

289435—[SSG 140] In transparent mode, the device might not pass throughtraffic when a host moves from one interface to another interface in the same
zone.

■

289671—A change in the tunnel binding causes failure in the WebUI.

■

290077—Under certain conditions, traffic fails to pass with user auth enabled.

■

290478—[NetScreen 5000, ISG] Packet is dropped due to internal congestion
control mechanism.

■

290501—When the Compact Flash (CF) card is formatted, the set core-dump
command freezes if there is not enough space on the CF.

■

290666—In an IPv6 deployment, a null interface could cause the device to faildue to an interface state check that has been added.

■

291728—Using the CLI or WebUI, the maximum length of scheduler object nameis 19 characters only.

■

294079—If the SYN-ACK packet does not contain the TCP MSS option, traffic
for the Integrated URL Filtering, Anti-SPAM, Anti-Virus, and VoIP modules might
be affected.

■

295694—Device might fail when PPORT pool is exhausted.

■

296850—RTSP media flow is disconnected after about a minute.

■297028—NTP pre-defined service is defined incorrectly.

■

298305—Twice the configuration is incorrectly reloaded causes a system busy
issue after start up.

■

301487—Snoop was not working properly when using redundant interface.

Addressed Issues in ScreenOS 6.1.0r4

Addressed Issues in ScreenOS 6.1.0r4■

301602—When the web filtering feature or Antivirus or VoIP is enabled, a Linux
host is not able to access a particular web site.

■

301709—With an UAC as an Infranet auth configured in a firewall, a host witha particular web site as its homepage is not able to through the firewall due tofragmentation of its packets.

■302271—Failed to create multicast session once it is timed out due to a downinterface.

■302382—In certain conditions, the firewall might reset if a session incorrectly
references a MAC address without route information.

■

302955—When PPTP xlate entries are not released in HA, PPTP VPN connection
fails.

■

302970—Device resets when issuing an mping.

■

304210—Device resets when inside a VSYS and issuing a ping request using an
IPv6 address.

■

304276—The configuration of the set int wireless0/0 shutdown command is not
saved in a wireless interface. Also, the wireless interface remains enabled after
reset.

■

305571—When using the combination of aggregate interface and cross ASIC
traffic, packet drop might happen due to SYN check errors.

■

306370—Device might reset if a custom layer 2 zone is unset.

■

306864—The SMTP header is now RFC2822 compliant and includes the timestamp.

■

309122—ASIC ARP is installed incorrectly with wrong VLAN ID.

Addressed Issues in ScreenOS 6.1.0r4■

23

ScreenOS 6.1.0 Release Notes

Performance

24

■

■

268006—The VPN traffic drops when the VPN is bound to a loopback interface
and traffic shaping is enabled.

■

278935—Random packet drops occur because ARP entries were not deleted
that in turn cause inconsistencies between hardware and software.

■

279442—The Flow and Task CPU utilization is high after a certain uptime if thedevice is heavily loaded with traffic.

■

281813—[NetScreen-5000] Performance on 10Gbps Ethernet is reduced fortransit traffic in and out of the same physical port.

■

282781—High task CPU utilization occurs when CTRL+C is typed while displaying
traffic logs in a CLI session.

■

282948—In a multicast environment, the backup device exhibits high CPU
utilization.

■

283336—Redirecting traffic logs to the TFTP server might cause high task CPU.

■

283748—Fragmented packets loop between the CPU and PPU causing high CPU
utilization.

■

284276—Performance of the VPN degrades when the DI is enabled on a policy.

■

284615—[SSG 500] The traffic throughput is slow when a copper gigabit Ethernet
interfaces is used.

■

285793—High CPU due to NSM task.

■

291748—Using pipe in a large search may result in high CPU. For example: getevent | i foo■

292576—An out of sequence error is induced when the window scaling factor
in SYN ACK packet is not updated in hardware session.

■

297574—When unset arp always-on-dest is configured on serial interface, thereturn traffic get dropped.

■

304334—High CPU causes "session scan" task ineffectively running due toconstant ARP changes in the network.

■

307727—[NetScreen-5000] TCP cross-chip sessions erroneously have a session
timeout of 20 seconds when there is non-cross-chip TCP background traffic and
TCP SYN check is enabled.

■

386735—When adding interface member to aggregate interface in null zone, if
aggregate sub-interface is in non-null zone, packet drops are caused due to loops
between ASIC and CPU.

Addressed Issues in ScreenOS 6.1.0r4

Addressed Issues in ScreenOS 6.1.0r4

Routing■257979—Device fails when interface is not enabled for BGP and administrator
requests TCP reconnection with BGP neighbor.

■

269410—High CPU due to RIP.

■

278718—Static default route on PPPoE interface fell back after power cycle.

■

287409—If an existing type 5 LSA exists in the OSPF database, new type 7 LSA
for the same network is not converted to type 5 LSA even if the new LSA has
better metric.

■

293332—Unable to configure the multicast candidate RP.

■

300214—When OSPF LSA database is large and firewall CPU is fairly busy, OSPF
adjacency may flap.

■

302011—The router does not learn the OSPF routes from the peer even if the
maximum number of routes is not reached.

■

304116—Unable to configure the router-id.

■

310349—When a static multicast wildcard route is deleted, all the associatedroutes that share the same iif, oif, and group are deleted.

■

310724—When a source specific mroute is configured, the multicast traffic is
dropped.

■310781—The multiple and duplicate entries of wildcard mroutes with source
0.0.0.0 are allowed in both the config and multicast routing table.

■

264366—UDP flooding is detected and the packets are dropped even when the
pps rate is less than the specified threshold.

■295452—When Integrated SurfControl is enabled , some web sites that get
re-directed to an https URL are not accessible.

■

281460—When using MIP or VIP video does not work properly.

■

288193—Under certain conditions, the device may reset when processing pinhole
for SIP traffic■

289724—When the transaction timer expires and results in operation failure,
SIP call are not cleared.

■

289774—When DIP-Incoming is configured for incoming calls, H.323 outgoingcalls fail.

■302418—A buffer overflow in SIP module may cause the device to reset.

■

305658—The RTP packets are lost when NAT-T is enabled.

Security

VoIP

Addressed Issues in ScreenOS 6.1.0r4■

25

ScreenOS 6.1.0 Release Notes

VPN

26

■

■

204717—When peer is identified by DNS address instead of IP address mainmode IKE negotiations may fail.

■285743—During Phase1 negotiation, the IKE-ID type with numeric IKE-ID froma third-party VPN device is correctly interpreted.

■

286723—VPN negotiation with enabled Xauth the Phase 2 SA is removed
incorrectly.

■

287368—IP configuration from RADIUS such as the DNS server setting may not
be configured properly to the Xauth client.

■

291524—If the outgoing interface is a loopback interface and traffic shaping isenabled, VPN traffic drops.

■

291993—Dead-Peer-Detection (DPD) failed to clear the IPSec Security Association(SA) after the Dial-up VPN client disconnected.

■

300430—Packets are dropped in a back-to-back GRE VPN scenario.

■

303538—When the physical and tunnel interface are in different zones, VPN
monitor reply packets may get dropped across a route-based VPN.

■

308251—Failure to remove SPI entry causes memory leak.

■

310331—Device in transparent mode, may reset when a VLAN 802.1x tagged
packet hits a VPN policy.

■

391494—VPN Interop using IKE v2 fails.

Addressed Issues in ScreenOS 6.1.0r4

Addressed Issues in ScreenOS 6.1.0r4

WebUI
■

281955—Unable to configure the route map using subinterface.

■

289628—Unable to define an Address Group using the WebUI for zones thathave an ampersand symbol in the name.

■

290761—When configuring the RP for PIM, the RP address does not appear in
the WebUI.

■

291948—If the device has many event log entries, refreshing the main WebUI
page or the report page using Report > System Log > Event causes high CPU
utilization.

■

293497—The WebUI shows less number of exported rules than the expected.

■

293528—In some cases, the device may restart during HTTPS WebUI access.

■293998—In the WebUI, some alarm level events are not sorted by log level
correctly.

■

294560—WebUI may result in high CPU when clicked on Refresh in Reports >System Log > Self in.

■

294594—In the WebUI, unable to see the non-trust-VR interface when configuring
the PBR.

■

296058—The WebUI does not allow the user to create a MIP with a different
subnet mask than the interface.

■

296660—Unable to add or change an existing configuration for TACACS Authserver using WebUI.

■

298501—Change in multi-address cell back to "Any" causes policy corruption.

■

299090—In the WebUI, the PCMCIA option for log settings is incorrectly shown
as option USB. Also, the PCMCIA option for log setting configured by the CLI is
not displayed correctly.

■

300920—Using the WebUI, Only 100 routes in the routing table are visible at a
time.

■

302622—When using the WebUI to configure DNS proxy server for a given
domain, the failover option is automatically selected.

Addressed Issues in ScreenOS 6.1.0r4■

27

ScreenOS 6.1.0 Release Notes

Addressed Issues from ScreenOS 6.1.0r3
The following operational issues were resolved in this release:
Administration■

257485—In certain situations the administrator was unable to add an address
book item to a multi-cell policy.

■

260995—The debug buffer may intermittently log messages even though no
debug commands are running.

■278125—When there are multiple policies using the same SRC/DST IP and ports,
and one is disabled, and one of the address book objects is modified, the device
may reset.

■

279094—Unsetting PPPoE auth-method will erroneously generate the message"Cannot unset idle-interval to default when auto connect is enabled".

■

282163—TFTP traffic sourced from the loopback interface fails.

■

282592—Enabling AV as an http proxy in transparent mode causes the packets
to use the MAC address of the VLAN interface as the source MAC address.

■

215889—DNS queries are sent to the dynamically-learned DNS servers, eventhough the DNS servers have been configured with an admin preference of 255.

■

261613—Proxy DNS fails if loopback interface is used as the outgoing-interface.

■270890—If GTP Sequence Number Validation was enabled, GTP traffic was
dropped due to 'bad sequence number' after two NSRP failovers.

■

262695—NSRP failover may cause some VPNs to fail.

■274948—In NSRP, when adding an interface to a L2 zone, it does not become
a VSI.

■

280217—[NetScreen 5000, ISG] When the device is in an Active/Passive NSRP
cluster, under a particular circumstance after a preempt primary device is reset,
traffic via VPN is dropped by its VPN peer.

■282261—NSRP failover from the backup to the primary taking longer than
expected.

■

300517—With "set flow tcp-syn-bit-check" enabled, after failing over the NSRP
cluster, TCP packets for existing sessions are dropped.

Antivirus

DNS

GPRS

HA and NSRP

28■

Addressed Issues from ScreenOS 6.1.0r3

Addressed Issues from ScreenOS 6.1.0r3

IDP■

270319—[ISG with IDP] The IDP process restarts when updating a policy with
attacks that was previously configured with no attacks.

■

255035—Redundant subinterfaces could not be imported properly from NSM.

■

271129—In some cases, all management access may be lost except through theconsole.

■290562—Unable to determine BGP aggregate status within NSM.

Management

Addressed Issues from ScreenOS 6.1.0r3■

29

ScreenOS 6.1.0 Release Notes

Other
■

235777—The command "unset admin hw-reset" was not saved to the config
file after a reset.

■

252398—Wireless connection instability occurs when using 802.1x with Intel
Pro/Wireless NIC with 802.1x auth.

■255301—TCP socket leak causes lost SSH management and BGP peering, resulting
in high task CPU utilization.

■

257812—NAS-Port-Type was "Wireless-Other" instead of "Wireless-IEEE-802-11"
for example when authenticating wireless clients via radius.

■

260307—Under certain conditions, the firewall seems to be corrupting UDP
checksums.

■

267891—A null pointer accessed in the ULR filtering , which caused the device
to reset.

■

269018—After enabling DI, when a syn-flood is detected, the device may restart.

■

269488—In transparent mode, unauthenticated users are not being redirectedto the Infranet Controller (IC).

■273879—Authentication entries in a pending or fail state, fails to be cleared.

■

276282—Device reset due to problem with hardware session pointer.

■279407—Memory leak occurred when a second user from the same user groupis authenticated.

■

280079—DSCP TOS bit was not being set correctly on the device.

■281722—A device reset occurred when running "debug ike" and "unset console
dbuf".

■

283182—Traffic through the SSG-500 stops intermittently.

■

285252—When traffic shaping is enabled, the MAC address is shifted on thesubinterfaces.

■

285333—Traffic may not pass if there is a duplex mismatch between the device
interface and the switch connected to the device.

■271349—With a low-quality connection, PPPoE may stop responding duringnegotiation.

■

221537—FTP downloads from dial up or slow links are failing when AV enabled.

■

254058—Bandwidth testing site via web shows lower bandwidth than actual
upload speed.

■

259126—Packet loss and TCP retransmissions occur when performing filetransfers across T1 WAN interface.

Performance30■

Addressed Issues from ScreenOS 6.1.0r3

Addressed Issues from ScreenOS 6.1.0r3

Routing■

267357—Permanent route attributes are not being exported from one VR to theother.

■

276971—Tunnel interfaces were being counted as an outgoing interface, which
exceeds the maximum number of interfaces allowed for multicast traffic.

■

278563—Child session for SIP could not be created correctly.

■

278773—H.323 ALG was unable to decode Q.931 using Avaya phones, due tonot enough OLC support.

■

279789—In some network topologies, VPN monitoring may bring the VPN tunnel
down.

■

280101—Dial-Up VPN traffic was dropped due to a change to the IP address on
the dialup client.

■

284756—In certain situations, the auto-connect acvpn-dynamic command could
not be completed.

■

285748—[NetScreen-5000] IPSec pass-through packets are being dropped when
the device is in transparent mode.

■

285935—VPN packet drop occurs due to traffic looping when aggregate interfaces
are used on the device.

VoIP

VPN

Addressed Issues from ScreenOS 6.1.0r3■

31

ScreenOS 6.1.0 Release Notes

WebUI

32

■

■

227316—Unable to configure DHCP on an interface from a trustee admin user
via the WebUI.

■

262490—Unable to manage a device from an untrust interface via a trustee
admin via the WebUI.

■

277589—When editing a subinterface, WebUI responds with an erroneous traffic
bandwidth message "0 is not within the valid range (1 - 1000000)".

■

277867—The RP Proxy setting is not removed when its corresponding RP
Candidate is deleted via WebUI.

■

279141—VPN policies created with the WebUI paired up incorrectly.

■

281505—In an NSRP environment, a fault error message "IP conflict" is shownin the WebUI when accessing a backup device to configure an interface.

Addressed Issues from ScreenOS 6.1.0r3

Addressed Issues from ScreenOS 6.1.0r2

Addressed Issues from ScreenOS 6.1.0r2
The following operational issues were resolved in this release:
Administration■

215340, 256010—Some log entries are not formatted properly in the WebTrend
output.

■223139—Task CPU becomes high when executing some CLI commands with alarge configuration, which triggers high overall CPU utilization, and reaches thealarm threshold.

■258225—The admin-preferences of the local DNS defined via the CLI gets reset
when any changes are made to DNS setting via the WebUI.

■

258522—Policy list in the root vsys may be blank when viewed from the WebUI.

■

259735—Incorrect information shown on the multilink and serial interface SNMP
report for MTU, link status, operation status, and link speed.

■261597—[NetScreen-5GT] Unable to set interface ethernet2 to the Null zone.

■

262685, 267506—Bridge Group interfaces would not go to full duplex, evenwhen the bgroup members are hard-coded to full duplex.

■

262912—Sync Serial card shows up as JXMBRI-ST in get chassis.

■

267997—Incorrect ifIndex in link-up/link-down SNMP trap for redundantinterfaces occurred.

■

275288—Device restarts when MIP configured with incorrect mapping from
IPv4 to IPv6.

■

276003—The "sess-limit" option is getting lost after a restart.

■

225931—ICAP AV may fail with error code 3 for running out of connection
objects due to incorrect freeing of ICAP connection.

■

266736—With Antivirus enabled, an email containing certain characters may
cause the POP3 or SMTP session to freeze.

■

263924—When using a PPPOE interface with a DHCP IP address as the tunnel
outgoing interface, the VPN tunnel session still has the old dynamic IP address
after the new address has been assigned or the firewall is restarted.

■

226031—Only the first IP Pool gets synchronized to the backup device.

■

227665—The NSRP vsd-group track-ip method CLI command is lost after a reset.

Antivirus

DHCP

HA and NSRP

Addressed Issues from ScreenOS 6.1.0r2■

33

ScreenOS 6.1.0 Release Notes

34

■

■

238578—Non-VSD sessions in an Active/Active NSRP configuration incorrectly
synchronize between cluster members if the session's egress subinterface differs
between cluster members.

■

251157—An NSRP cluster member received a corrupted HA message, causing
the device to reset.

■

252645—Gratuitous ARPs for the secondary IP address on an interface did not
work.

■

258989—[NetScreen-5000] Traffic is not forwarded when the packets are received
on an aggregate interface of the backup VSD in an NSRP Active/Active cluster
due to the TCP SYN check failing incorrectly.

■

260760—[SSG 5] NSRP failover not working properly when both NSRP interfaces
and a secondary path are enabled.

■

262533—[SSG 140] Alarm LED on the device was not displaying correctly when
an NSRP failover event occurred.

■

264768—Configurations are out of sync due PBR out of order set match-groupcommands.

■

267734—The primary ISG does not read the sequence number correctly fromthe ASIC for AES after failover.

■

268708—Traffic fails to pass after failover of a NSRP pair with devices configuredin transparent mode.

■

268809—When no-session-backup is enabled on a policy, traffic through theserial interface stops passing.

■274997—The commands set sm enable and set sm disable were erroneously
being synchronized to the other member in an NSRP cluster.

Addressed Issues from ScreenOS 6.1.0r2

Addressed Issues from ScreenOS 6.1.0r2

Management■224382—Task CPU spikes when the authentication result from the RADIUS
server does not arrive on time.

■252700—Unsupported "Far End" OIDs were modified so that they return a "nosuch object" response to an SNMP query.

■

252783—The 64-bit counter on an interface was showing incorrect information
after the "clear counter" command was performed.

■

258148—SNMP reports incorrect ifspeed on the serial interface.

■

260188—The device is only able to send 400 to 500 logs per second to NSM.

■

260243—When disabling the rate limit in a GTP object configuration, the limit
was not actually disabled.

■

261714—The NSRP failover event log is not sent to the syslog server.

■

262697—In certain conditions, the device may reset when a policy is pushedfrom NSM.

■

266873—In the event log, when the number of telnet and ssh connections to a
device are higher than its display limitation, the log entries of the telnet-cmd
number and ssh-cmd number are incorrectly displayed.

■

267372—The SNMP trap (OID) of the interface status is not correct.

■

269298—An invalid command appeared in the CLI: "exec admin".

■

270999—Hardware counter for out bytes always shows zero on the management
interface.

■271297—The get perf session detail command did not display the correct values.

■

273424—Under certain condition, device update after the creation of a newcustom vsys using NSM would result in the error: "unknown keyword unset".

Addressed Issues from ScreenOS 6.1.0r2■

35

ScreenOS 6.1.0 Release Notes

Other

36

■

■

224161—HDLC debug output was being sent to the dbuf buffer when any debug
flow was enabled, making troubleshooting difficult.

■224423—If a timeout is configured in one GTP object, this timeout is used for
all GTP objects.

■

224782—The transmit and receive counters on an HA interface between two
NSRP peers shows a mismatch, due to an incorrect byte count.

■

226075—[ISG 1000/2000, NetScreen-5000-8G2/8G2-G4] Device sending two
ESP packets with the same sequence number.

■

227438—CTS traffic incorrectly detected as "HTTP:Overflow:Content-Overflow"
and dropped.

■

231670—In certain environments, if only URL filtering is enabled in the policy,
the HTTP response might fail to be parsed.

■

233490—RTSP ALG does not translate addresses properly when in NAT mode.

■

235311—Transmission of the multicast data stream might stop for a while whenhandling a PIM fragment packet■

236768—Device may issue an ACK in response to a RST packet.

■

239594—The device may fail when AV is enabled and AIM traffic is passing
through.

■

240625—Memory utilization is high due to DI session leak when SYN protection
is enabled.

■

250504—A conflict over multiple tracked gateway routes caused the device to
fail.

■

252082—FTP session IPv4 to IPv6 session connects, but the client's FTP session
hangs when FTP commands are entered.

■

252224—The wireless client reports a different link speed than what the device
reports.

■

253965—Frame Relay clocking mode did not initialize properly.

■

254619—A MIB file issue occurred when high-availability(15) was removed from
the MIB files.

■

256589—When a large number of VPN policies are configured, the device may
fail to create a VPN policy when the tunnel ID is not specified.

■

256783—Device failed due to mishandling of null pointer.

■257095—The Antispam list would not display in alphabetical order due to asorting issue.

■

258336—The device restarts on its own when the Deep Inspection Signature
Pack is updated.

■

260087—PPTP traffic not working properly when source nat policy is enabled.

■

260626—[SSG 300] Device unable to pass packets greater than 1,468 bytes
across an 802.1q tagged subinterface.

Addressed Issues from ScreenOS 6.1.0r2

Addressed Issues from ScreenOS 6.1.0r2■

261543—[NS-5000-MGT2]Issuing the command get bridge word 0 may cause
the firewall to reset.

■

262448—The 'exec policy verify' command was not working when empty addressgroups are used in the policies.

■

262450—The WebAuth login page contained a script error after entering a user
name.

■

262666—When NTP is enabled, and set ntp server src-interface is used, NTP
communication cannot be checked in the policy when the traffic is sent out toan interface other than the one specified in the command■

262894—Device fails to connect to Websense server after the Websense server
IP address has changed.

■

263585—In certain situations, traffic that is NAT'd and uses the H.323 ALG
caused the device to reset.

■

263850—FTP ALG did not correctly create child sessions for cross-vsys flows,causing data packets to be dropped.

■

264263—Device failed due to Null pointer access in sunrpc.

■

265230—[SSG 140] The alarm LED on the device incorrectly displays as amber,instead of red, when an attack was detected.

■

266875—Interface MAC did not change correctly when the VSI interface was
assigned to the mgt zone.

■

267114—When URL filtering is enabled, permitted URLs are logged twice in thefirewall event log.

■

267255—Unset ALG not saved after reset.

■

267370—When generating a syslog message, the source port and destination
port are incorrectly interpreted from the event log.

■

267767—Running get dbuf stream prints out the message, “Return due to suspectloop”, with any debugs specified.

■

267994—CPU utilization is high after Virtual IP (VIP) is configured.

■269121—GRE keepalive is dropped when the recursion control bit is set.

■269668—Deleting multiple virtual systems at one time may prevent traffic frompassing through other virtual systems.

■

269922—With IPv6, an incorrect ICMP message is generated when the policy
is configured with action reject.

■

273021—The connection between the firewall and the external Surfcontrol server
was lost randomly several times a day.

■274187—Under certain circumstances, the first SYN packet is not matching thepolicy.

■274973—When get vr trust protocol pim rp proxy is executed, an exception dump
may occur.

■

278559—In certain conditions, clearing the auth table via IP address may cause
the device to reset.

Addressed Issues from ScreenOS 6.1.0r2■

37

ScreenOS 6.1.0 Release Notes■

280532—Websense is not working and displays the following error: "Unknown
message type: 8e".

■289248—FTP failed if there was a NO PASSV response and then the client tried
to use PORT mode.

■

234153—High flow CPU utilization caused by packet looping between CPU and
ASIC.

■

266111—Slow performance with Web traffic when URL filtering and the SYN
Proxy is enabled.

■

223180—Multicast traffic was not forwarded to both spokes in a hub-and-spoke
VPN.

■

225874—Creating a default route from one VR to the other VR caused the firewall
to reset.

■

259054—The BGP neighbor goes to idle after the BGP connection is reset.

■

260646—The device would not become the PIM designated router (DR) after
increasing the DR-priority.

■

262604—The first multicast packets in the flow get dropped.

■

263665—Routes learned via OSPF are not propagated to NSSA LSA after NSRP
failover is done.

■

264800—The default route advertised via BGP by the ISP's upstream router was
not propagating into the device's route table.

■

268471—BGP stops advertising the tunnel's static route after a reset.

■

269341—IGMP Join occurs 10 seconds after a unicast route has changed.

■

274788—Multicast route through GRE tunnel fails after the GRE routers do a
failover.

■282293—Routes are stuck in the RIP database in multiple custom VR
configurations.

Performance

Routing

38■

Addressed Issues from ScreenOS 6.1.0r2

Addressed Issues from ScreenOS 6.1.0r2

VoIP/H323■

256706—The device was not doing routing and policy lookup for IP addresses
with unknown contact bindings from the SIP server.

■

264625—[ISG 1000/2000] SCCP ALG logging messages in the event log, after
the ALG was disabled.

■

271315—SIP ALG did not support LWS.

■

274300—The "Can't allocate memory for SCCP call context" message appearsin event logs due to the timing between session age-out and call completion.

■

254357—Pings through VPN are dropped when IPSec SA is 0.

■255512—The command unset ike policy-checking only applied per device, andnot per VPN.

■

257708—When subjected to heavy GRE/IPSec traffic, the device may reset.

■

263126—The device did not send an Account-Stop message for the old Phase1
SA.

■

264713—Tunnel ID and hardware SA in an existing session do not update
properly after VPN change, which causes traffic to stop.

■

275108—NSP-tunnel (used in IPSec environments) was erroneously deleted but
still referenced by another module, and caused device to reset.

■

282310—The device may reset when a NetScreen Remote VPN connection is
made.

■

282564—Multiple dial-up VPN users could not login if the name in the certificate
is similar to the previous user.

VPN

Addressed Issues from ScreenOS 6.1.0r2■

39

ScreenOS 6.1.0 Release Notes

WebUI

40

■

■

222872—Access to the WebUI is very slow when opening the main home page.

■

256041—In a particular circumstance, the device may fail when an admin edits
a VPN configuration using the WebUI.

■

259582—When adding Antispam to an existing Antivirus profile via the WebUI,
FTP session disconnects occurs and result in abnormal behavior of FTP
commands (ls, dir).

■

262479—Read-Write admin account was incorrectly offered "Enable Web
Management Idle Timeout" option in the Admin Management page, causing the
page's Apply function to fail.

■262827—WebUI: Deleting an aggregate sub-interface erroneously gives you awarning that you are about to remove one aggregate interface.

■

264300—Config Merge from the WebUI fails.

■

265334—From the WebUI, if a RIP summary route is set to a metric of 1, it does
not get written to the config.

■

265413—Unable to specify u-fqdn IKE-ID type when creating a Dial-Up VPN
User.

■

266871—Custom RPC service is deleted from the policy when that policy isedited.

■267496—The WebUI reports that the gbw value is out of range when editing on
a subinterface.

■

267521—"Bypass authentication option" for XAuth can not be configured via
WebUI.

■

270630—Can not disable SSH2 management from the WebUI.

■

272946—Unable to create an IKE gateway on a device in transparent mode fromthe WebUI.

■

276288—When configuring an NSRP cluster ID with a value over 63 using the
WebUI, an incorrect error message is displayed.

Addressed Issues from ScreenOS 6.1.0r2

Addressed Issues from ScreenOS 6.1.0r1

Addressed Issues from ScreenOS 6.1.0r1
NOTE: Due to an update in the ScreenOS problem tracking system, some issues
listed here may have two bug numbers. The six-digit numeric code shown first is forthe new system; the “os” and “cs” numbers included in the listing for some issues
are provided as a reference to older Known Issues. Eventually the older reference
numbers will be phased out.
The following operational issues were resolved in this release:
VPN■

220334 (os70336)—When the IP address of a remote peer changed, IKE phase
1 failed to update correctly. This issue has been resolved.

■

236113—When you enabled TCP-SYN-Check on the NetScreen-5000 platform,
the device failed to establish a cross-chip TCP connection in Transparent mode.
This issue has been resolved.

■

225502—[ISG with IDP] The IDP drops legitimate HTTP traffic for very large
HTTP downloads.

■

226284—An ISG 2000-IDP intermittently stopped advertising prefixes to eBGP
peers after BGP peer refreshed from other devices. This issue has been resolved.

■

229742—In Transparent mode on an ISG 1000 with IDP enabled, if both Web
filtering and IDP were enabled in one policy, all Web browsing that used thepolicy stopped responding. This issue has been resolved.

■

232075—[ISG 1000/2000] Time binding attacks are not reporting logs to the
NSM server.

■

236437—[ISG 1000/2000] In certain situations, the traffic passing through an
inline mode IDP rule may experience excessive delay when other rules are
configured for TAP mode IDP.

■

237769—[ISG 1000/2000] There is high CPU utilization on a single SM (Security
Module) due to uneven session distribution.

■

239575—When both tcp-syn-check is set and IDP is enabled in the policy, theACK packet of a 3-way handshake is dropped when ISG is in transparent mode.

■

252958—[ISG 1000/2000] Login attempts with FTP brute force signature were
erroneously being logged as accepted.

Firewall

IDP

Other

Addressed Issues from ScreenOS 6.1.0r1■

41

ScreenOS 6.1.0 Release Notes■

225017—If you restarted an SSG 5 appliance after many hours of heavy traffic,
the device stopped forwarding all traffic. This issue has been resolved.

■

226651 (os70627)—When traffic reached 1Gbps (in each direction) through two
uPIMs, traffic was blocked in both directions after approximately one hour. Thisissue has been resolved.

■

233516—If you made a large number of configuration changes (especially inpolicies and virtual routers), an ISG 2000 stopped receiving IPv6 packets. Thisissue has been resolved.

■

231754—In Transparent mode, SIP traffic caused a device to fail. This issue has
been resolved.

■

227229 (os71064)—When you deployed NTP Server on ISG 1000 appliances,the device aged out a packet even if the hardware session was refreshed by the
packet. This issue has been resolved.

■228200—Adding an alternate route to the routing table and making it as active
after a tunnel failure was not possible. This issue occurred when you used theset interface tunnel_name protocol rip demand-circuit command. This issue has
been resolved.

■

231728—On the SSG 140 platform, DNS settings were not accepted through a
PPPoE connection. This issue has been resolved.

■

233428—In Transparent mode, the management feature on a v1-Untrust zone
was not added to the configuration, so it was disabled after a device reset. Thisissue has been resolved.

Routing

Management

42■

Addressed Issues from ScreenOS 6.1.0r1

Known Issues

Known Issues
The following are known deficiencies in features at the time of this release. Wheneverpossible, a workaround is suggested following the problem description, preceded by
W/A.

NOTE: Due to an update in the ScreenOS problem tracking system, some issues
listed here have two bug numbers. The six-digit numeric code shown first is for the
new system; the “os” and “cs” numbers included in the listing for some issues areprovided as a reference to older Known Issues. Eventually the older reference numbers
will be phased out.

Known Issues in ScreenOS 6.1.0r4
This section describes known issues with the listed release.
Administration■

306796—Using WebUI when the policy is created or edited, an incorrect"Anti-spam is detached from policy" message is generated.

■

309023—When using the OpenSSH 5.1p1, unable to manage the device using
SSH.

■

387163—Admin login fails when crossing vsys.

■

308106—The device might reset when the DNSA task was not processed on
time.

■

309725—The WebUI displays incorrect value of DNS cache TTL.

■

391177—Task CPU might go high due to DNS when an address book entry
modified from one domain name to another domain name.

■

302374—The CLI command unset admin hw-reset causes out of sync state
between the NSRP cluster members.

■

307921—[ISG] Both members of the NSRP HA cluster may become Master underheavy load.

■

312711—Device resets due to malformed IKE P1 NSRP RTO object.

■389357—NSRP configurations go out of sync due to VSYS profile configs.

■

389495—In transparent mode, the management traffic to backup firewall, which
passes through the master firewall might cause packet loop.

DNS

HA and NSRPManagement

Known Issues■

43ScreenOS 6.1.0 Release Notes■

266093—Unable to manage the custom URL category within the custom VSYS.

■

309253—Unable to ping the interface IP from inside device when the interface
IP and manage-IP are different.

■

309587—The Task CPU will become high for a long time and management of
the device can be lost when the SSH is enabled in a large number of VSYS in ashort time.

■

310298—When an interface inside a virtual system (vsys) is configured to be
NTP server, the NTP-server configuration line is incorrectly placed in the rootvsys configuration.

■

313417—When issuing "exec policy verify" on any SSG platforms, policy
verification fails.

■

303836—Device does not translate ICMP sequence number properly when
receiving ICMP echo response if both original ICMP ID and sequence number
are 0.

■

308572—Pinging a DIP IP address results in routing loop with upstream device.

■311682—Packet drops due to DIP allocation failure when the policy is modified
from fix-port to non fix-port.

■

389221—PPTP ALG does not clear xlate table when PPTP connection fails fromthe client.

NAT

44

■

Known Issues

Known Issues

Other
■

288649—[ISG, NetScreen-5000] Internal buffer leak causes some traffic drop.

■292941—Counter Statistics for the bgroup interface does not correctly reflect
the amount of traffic passing through the interface.

■301623—The integrated URL filtering does not work if the HTTP request header"hostname" includes port number.

■

304208—The device might reset when the illegal memory is accessed.

■

306168—When performing Run-Time Authentication, the firewall removes apart of the URL after the "&" sign.

■

307814—The HTTP 302 redirect fails to send out when the UAC authenticationis stuck in pending status.

■

309001—[SSG 500] The periodical down of the interface link might cause somepacket drops.

■

309986—The event “?DHCP server IP address pool changed?” is generated whenthe IP address of the untrust is changed.

■

310435—When installing the policy tree, access of an illegal memory mightcause the FW to fail.

■310566—With SSG5 (Country code of TELEC), Extended Channel might bedisabled after reset.

■

311743—Duplicate message is displayed when the configuration is saved using
the WebUI.

■

311907—When the CCRQ message is sent from server side, the PPTP session
closes and the child GRE sessions donot cleared .

■313379—The firewall does not accept an infranet auth table entry when it
contains ‘\o’ as a part of the user name.

■314353—[NetScreen-5000 M3] IPv6 does not pass through in transparent mode
unless the IPv6 envar is enabled. [W/A: Enable IPv6 envar]■

387143—The alarm LED is cleared automatically without issuing "clear led
alarm".

■

387902—The device resets when UAC changed its MTU and causes the SSL task
to access a closed null socket pointer.

■390285—When the attempt to remove an individual filter from the eight snoop
filters is unsuccessful, the error message “Max snoop filter number reached” isdisplayed.

■

391304—The duration of time reported by policy traffic logs is shorter than theactual time duration.

■

392767—The device might reset when SYN attack is sent using either subinterface
in route mode or VLAN trunk configured in transparent mode.

Known Issues■

45

ScreenOS 6.1.0 Release Notes

Performance■

313904—[NetScreen-5000–MGT3] Packet is dropped due to internal congestion
control mechanism.

■

314096—Heavy H.323 traffic might cause device to reset due to a null pointer.

■315217—[NetScreen-5000 10 Gig] The hardware sessions that are not loadbalanced in FPGA on backup device cause performance drop after failover.

■

312513—When the RIP demand-circuit is used on a tunnel interface, the RIPneighbors are lost after NSRP failover. [W/A: configure the RIP neighbors
statically].

■

312623—Firewall calculates an incorrect checksum for PIM register packets.

■

389669—Firewall fails to announce BGP network prefix if the same is configured
as BGP aggregate route.

■309216—In some scenarios, CRL renewal process fails when renewing CRL on
the last or first day of the month.

■276513—SIP application error “Due to stack unable to handle empty display
name”.

■

309859—PPORT paired ports were not released completely after an Avaya H.323
phone call was completed.

■313085—In some scenarios, SIP cancel messages fail through the firewall.

■

305067—Device incorrectly decrypts the VPN packet with certain TTL value.

■

308404—PPTP connections are aged out prematurely.

■

389414—Under a certain condition, decryption for incoming VPN packets fails.
This is due to incomplete incoming key installation when the commit bit isenabled.

Routing

Security

VoIP

VPN

46

■

Known Issues

Known Issues

WebUI
■

307314—The WebUI does not accept zero value for ISDN interface"load-threshold" setting.

■

311759—Using the WebUI, unable to configure traffic shaping parameters, PBW,
and GBW.

■313278—When connected through SSL VPN proxy, unable to manage the firewall
using WebUI.

Known Issues from ScreenOS 6.1.0r3
None

Known Issues from ScreenOS 6.1.0r2
None

Known Issues■

47

ScreenOS 6.1.0 Release Notes

Known Issues from ScreenOS 6.1.0r1
This section describes known issues with the listed release.
Flow■235781—Using Transparent mode, under high traffic conditions, sometimes asmall number of sessions cannot be cleared. The sessions appear to be "time 0"
but will remain in the session table. Running set sat session-clean will clear thesesessions from the table after one round of session cleaning.

■239631—If you configure the initial session timeout below the valid range(20—300 seconds), the system interprets these values as minutes instead of
seconds.

■

235303—Delay in the peripheral devices updating the forwarding table when afailover occurs in an NSRP cluster in Transparent mode. When the devices haveno gratuitous ARP mechanism as in NAT or Route mode, peripheral devices
update the forwarding table only when the active physical interface is restarted.
The update happens after five seconds by default.

HA and NSRP

W/A: Use the CLI command set nsrp link-hold-time to modify the link downtime.
■

236275—If the VSD group is not bound to a VLAN group, the security device
incorrectly reports the VSD as being in Active-Passive mode.

■

236634—In an Active-Passive configuration, if the active security device handles
a large number of FTP connections, the CPU utilization of the backup device
remains high even when the rate of the FTP connections per second on the
backup is low.

■

253467—If a device's SIP traffic is very heavy in an NSRP deployment, although
the master box works well, there will be some delays when resources on the
backup box are removed. Operational impact on the cluster is minimal, and the
backup box will automatically recover.

■

227934—SSG platforms incorrectly process the ICMPv6 error packet that theyreceive in response to a non-first fragment packet that exceeds the outgoinginterface MTU.

IPv6

W/A: Set the interface MTU at a value that accommodates all packets for all links
through a path.

48■

Known Issues■

236085—In Transparent mode, you cannot manage a zone that is on a vsys
using the zone nsrp manage CLI command, because it is a global setting basedon vlan1 interface. In root mode, you can manage only the related vsys.

■

236087—On SSG 320/350 devices, a 4-byte PVE tag is used to identify whichinterface the packet came from, limiting the maximum supported packet length
to 1514 bytes.

Known Issues■

236549—When deployed in Transparent mode, some high-end platforms suchas ISG 1000-IDP do not support more than 20 reassembled segments. If you try
to ping another device with data that requires more than 20 reassembled
segments (for example, 30,000 bytes), the ping request fails.

■

239285—ScreenOS does not verify the IP address that you enter when you
configure the security device.
W/A:You should verify the IP address that you enter for an interface. For example,
you must not assign a multicast or broadcast IP address as an interface's IP
address.

■

239598—On some high-end platforms, after you have enabled IPv6, the CLI
incorrectly allows you to enable parameters such as DSCP marking, IDP, and
NSRP Data Forwarding that are not supported in IPv6 mode.

■

267239—When modifying an IPv6 or a wildcard policy through the WebUI, allexisting sessions for the policy will be removed. However, existing sessions will
not be removed if you only modify some minor features—such as session-limit
or alarm-without-drop—of an ordinary IPv4 policy through the WebUI.

■

236210—In an IDP deployment, when a policy incorporating diffserv is createdthe security module does not mark the first attack packet. This is by design, andall subsequent packets are correctly marked.

■

255774—The debug command unset console dbuf might make the box unstable,
especially under heavy traffic. Administrators are advised to use care whenrunning this command.

■

258931—Due to a memory limitation, NS 5000 devices are currently unable tosupport 500 vsys when an advanced license key—such as for virtual router or
Layer 2 Active-Active support—is part of the deployment.

■

263512—ScreenOS 6.1.0 includes a new SSHv2 secondary login banner feature.
However, unless the feature is enabled, if the secondary banner is displayed
before a login prompt on a console or via a Telnet connection, no positive
acknowledgment to the secondary banner is required (applicable to console,
Telnet, SSHv1, and SSHv2 connections).

■

266022—Because the NS 5400 supports 2 million sessions by default in 6.1 (and6.0r2 and later), you must make sure that the device has a minimum of 450MB
of free memory when upgrading from 5.4 or 6.0r1 to 6.1 or 6.0r2. One million
sessions will require approximately 340MB of memory.

■

278668—[SSG 550/550M] An error in the boot-loader code caused the interface
references to be switched and the motherboard version to be incorrectly reported
while upgrading from boot mode.

Other

Known Issues■

49

ScreenOS 6.1.0 Release Notes

Routing

50■

Known Issues■

251874—ScreenOS does not limit the number of routing entries that are
distributed through Routing Information Protocol (RIP). This incorrectly allows
you to configure more static routing entries than are supported.

■

251875—ScreenOS does not limit the number of Open Shortest Path First (OSPF)
areas and virtual links. This incorrectly allows you to configure more OSPF areasand virtual links than are supported.

■

251879—ScreenOS does not limit the number of Open Shortest Path First (OSPF)
interfaces. This incorrectly allows you to configure more OSPF interfaces thanare supported.

■

251883—ScreenOS does not limit the number of static routing entries that are
redistributed through OSPF. This incorrectly allows you to configure more static
routing entries than are supported.

■

255815—The device does not check the destination MAC address for packets
when the SYN-cookie is triggered and responds with SYN-ACK whether thedestination MAC belongs to itself or not.

■258978—For the SSG 320M and 350M, the supported maximum number of
Border Gateway Protocol (BGP) redistributed routes is 4096. However, if a large
number of routes are added with an automated script, it is possible to exceed
the supported limit. Routes entered or redistributed manually should not be able
to exceed 4096.

■

258979—For the SSG 320M and 350M, the supported maximum number ofOpen Shortest Path First (OSPF) redistributed routes is 4096, but it may bepossible to exceed the maximum. OSPF redistributed routes are handled in two
parts: route task and OSPF task. The route task will add redistributed routes to
OSPF continuously during one CPU time slice. The redistributed routes counter
will not, however, be updated until the OSPF task is processed by the CPU, so
more routes may be added in OSPF when the routes are added using an
automated script. Routes entered or redistributed manually should not be able
to exceed 4096.

Known Issues

VoIP■

239517—During a VoIP call that uses the H.323 protocol, if you change themapped IP or virtual IP address assignments, subsequent calls lose the audio.
Child sessions that are required to provide audio are not established because thesecurity device does not recognize a matching policy with the changed MIP or
VIP assignments.
W/A:Create a policy similar to the one you had configured and add it to the global
zone.

■

240574—In standalone mode, if an alternative gatekeeper is initiated during a
VoIP call, sessions do not age out immediately after the call ends. In HA mode,
if an alternative gatekeeper is initiated during a VoIP call and there is a firewall
HA recycle, sessions only age out after a long time.

■241465—If a phone tries to register while SIP is disabled, SIP sessions must be
cleared once SIP is enabled. After SIP is enabled and SIP sessions have beencleared, all phones that tried to register prior to SIP being enabled will need tobe reset. Failure to reset a SIP phone that attempted to register before SIP was
enabled will result in that SIP phone being unable to place or receive calls.

■

250319—The SIP functionality does not support a customized port, so a SIP callthat uses custom ports might fail.
W/A:Use the default SIP port (5060).

■

261464—On NS 5400 devices, Media Gateway Control Protocol (MGCP) traffic
performance drops significantly when the number of active calls exceeds 8000.
The issue is the result of having sessions installed on both ASICs in the device
rather than on only one as is the case with single-ASIC platforms.

Known Issues■

51

ScreenOS 6.1.0 Release Notes

VPN■

240108—The security device does not allow a static DNS host entry to be
removed if the hostname has been used in an IKE gateway configuration, even
if the entry was entered in error or incorrectly and even if the IKE gateways had
since been removed.
W/A: Reboot the device to clear the DNS entry. Because the DNS entry iserroneous, rebooting will maintain the IKE configuration while clearing themistaken DNS entry.

52■

Known Issues■

241207—During IPSec SA rekeying, some packets may be dropped on theinitiator side because the packet is received before the SA table is created. Packets
will only be dropped for a very short time. There should not be any packets
dropped after the SA table is installed.

■253238—ScreenOS does not limit the number of GRE tunnels you can create.
This incorrectly allows you to create more GRE tunnels than are supported.

Limitations and Compatibility

Limitations and Compatibility
Limitations of Features in ScreenOS 6.1.0
This section describes the limitations of some features in the ScreenOS 6.1.0 release.
They apply to all platforms unless otherwise noted.
■

ISG and NetScreen 5000 series Multicast Hardware Support—Multicast sessions
can be handled by the ASIC only if there is a single output interface per virtualrouter. The mcast group address can be pushed to ASIC so frames are forwarded
in hardware. To use this feature run the set/unset flow multicast install-hw-sessioncommand.

■

ISG-IDP—An ISG 2000 device with IDP in Inline mode caused packets to be
dropped for return traffic if NAT and a mirror port were both configured.
Workaround: Do not use mirror ports in this scenario. [232420].

■

ISG 1000, ISG 1000-IDP, ISG 2000, ISG 200-IDP, NetScreen-5000 series—Someenvironments require that firewalls be able to log all dropped packets. The
ScreenOS command set flow log-dropped-packetswill enable this function and get
log flow-deny will display the dropped packet logs. Hardware limitations, however,prevent the devices listed above from logging packets without data and with theprotocol field set to 0, 1, 6, or 17 sent either to or through the device. Packets
that have data and where the protocol field is set to 0 or 6 sent to or through thedevice from any host are also not logged by these devices. Also, when DNS proxyis disabled, non-permitted dataless UDP packets with destination port 53 sent
through the device are dropped and not logged. [300152].

■

SSG 300-Series NSRD Support—Without running a slot configuration, NSM isunable to locate the source interface list when using NSRD on SSG 300-series
devices, and without the source interface list NSRD is unable to select a configlet
file. To use NSRD on an SSG 300-series device, do a slot config through NSM,
which will make it possible for the device to see the interface list and thenconfigure with NSRD. [259596].

■

SSG 300-Series and 500-Series—Bridge groups (bgroups) are supported on
Ethernet switch PIMs (uPIMs), including 16-port GE, 8-port GE, and 6-port SFP.
Bgroups are not supported on 1-port SFP, old enhanced PIMs (ePIMs), andon-board GE ports. Administrators can dynamically create or delete bgroupinterfaces. The maximum number of bgroup interfaces on each PIM is half thenumber of ports. You can configure bgroup interfaces only on the same PIM oron the system board.

■

SSG 140—Bgroups are supported on both on-board Ethernet ports and Ethernet
switch PIMs (uPIMs). You can dynamically create or delete bgroup interfaces.
The maximum number of bgroup interfaces on each PIM is half the number ofports. On-board ports have three preset bgroup interfaces. You can configurebgroup interfaces only on the same PIM or on the system board.

■

IPv6 ASIC Support in NetScreen-5000 Systems—Because NetScreen-5000
systems now support IPv6, per-ASIC session support has been decreased from
1M to 512K. This is caused by the increase in the session size in the session
table.
To achieve maximum session count on the NS-5000 series security devices, you
should design the network traffic to utilize multiple ports on the SPMs. This type

Limitations and Compatibility■

53

ScreenOS 6.1.0 Release Notesof network architecture would distribute the sessions to multiple ASICs. For
example, if only two ports on an 8G2 SPM card are used, the max session countvalue will be 512K.
■

Screens on Traffic Exiting Tunnels—has the following limitations:■This feature is not compatible with the new SYN-bit check in the PPU feature.
Screens for traffic exiting tunnels are performed by the CPU instead of the
PPU.

■

This feature will only apply if the screen is activated on the physical interface
where the tunnel is terminated if the screen is hardware accelerated.

■

AC-VPN—Dead peer detection (DPD) does not work on the spoke when set on
an AC VPN profile with global IKE heartbeat enabled.

■

Jumbo Frame Support on the ISGs—Only the 4-port SFP modules on the ISGs
support Jumbo frames. All other I/O cards in the device are disabled automatically(including the ISG 1000 built-in I/O card), when you enable Jumbo frames by
setting the max-frame-size setting in the range 1515–9830.

■

VRRP with NSM—ScreenOS 6.1.0 does not support VRRP with NSM. [262624]■

PIM Power and Thermal Requirements—If you install either 8-port or 16-port
uPIMs in your SSG 140, SSG 500-series, or SSG 500M-series device, you mustobserve the power and thermal guidelines. Please refer to the PIM and Mini-PIM
Installation and Configuration Guide for the power and thermal guidelines forall supported platforms, available at:
http://www.juniper.net/techpubs/hardware/pim_guide/pim_guide.pdf

WARNING: Exceeding the power or heat capacity of your device may cause thedevice to overheat, resulting in equipment damage and network outage.

54■

Limitations and Compatibility

Limitations and Compatibility

Compatibility Issues in ScreenOS 6.1.0
This section lists known compatibility issues with other products, including, but notlimited to, specific Juniper Networks appliances, other versions of ScreenOS, Web
browsers, Juniper Networks management software, and other vendor devices at thetime of this release.
■

Compatible Web Browsers—The WebUI for ScreenOS 6.1.0 was tested withand supports Microsoft Internet Explorer (IE) browser versions 5.5 and above,
Netscape Navigator 6.X for Microsoft Windows platforms, and Microsoft Internet
Explorer version 5.1 for MacOS X.

■

Upgrade Sequence—We recommend that you follow the upgrade instructions
described in the ScreenOS Upgrade Guide located at
http://www.juniper.net/techpubs/software/screenos/screenos6.1.0/upgrade_guide.pdf. If
you upgrade directly from ScreenOS 5.0.0 or ScreenOS 5.1.0 to ScreenOS 6.1.0,
you risk losing part of any existing configuration. For ISG 2000 devices, you must
upgrade to an intermediate firmware and upgrade the boot loader before
upgrading to the ScreenOS 6.1 firmware. Refer to “Upgrade Paths to ScreenOS
6.1” in the ScreenOS Upgrade Guide for intermediate software and boot loader
upgrade information.
Use the following procedure to upgrade the SSG 500/500M boot loader:1.

Download the boot loader (v.1.0.5) from the Juniper Networks Support site.
a.

Navigate your browser to http://www.juniper.net/customers/support/. The
Support page appears.

b.

Locate the DOWNLOAD SOFTWARE section, and click ScreenOS. Enter
your user ID and password in the LOGIN page that appears, and thenclick the LOGIN button. The ScreenOS page appears.

c.

In the table of software download versions, locate SSG-500 and click
version 6.1.

d.

In the Software tab (under Package), click SSG-500_Boot_loader.

2.

Save and extract the boot loader zip file and put it in the root directory of
your TFTP server.

3.

Start the TFTP server, if necessary.

4.

Make an Ethernet connection from the device hosting the TFTP server tothe MGT port on the SSG 500 and a serial connection from your workstation
to the console port on the SSG 500.

5.

Restart the SSG 500 by entering the reset command. When prompted toconfirm the system reset, press y. The following system output appears:
NetScreen SSG500 BootROM V1.0.2 (Checksum: 8796E2F3)
Copyright (c) 1997-2004 NetScreen Technologies, Inc.
Total physical memory: 512MB
Test - Pass
Initialization................ Done

Limitations and Compatibility■

55

ScreenOS 6.1.0 Release Notes

6.

Press the X and A keys sequentially to update the boot loader.

7.

Enter the filename for the boot loader software you want to load (for example,
loadssg500v105) and the IP addresses of the SSG 500 device and TFTP
server. The following system output appears:
File Name [boot2.1.0.2]: loadssg500v105
Self IP Address [10.150.65.152]:
TFTP IP Address [10.150.65.151]:

Press Enter to load the file. The following system output appears:

8.

Save loader config (112 bytes)... Done
Loading file " loadssg500v105"...
/Loaded successfully! (size = 125,512 bytes)
Ignore image authentication!
...
.......................
Done.

56

■

Limitations and Compatibility

Documentation Changes■

WebUI Upgrade—When upgrading from ScreenOS 5.2.0 to ScreenOS 6.1.0 using
the WebUI, you must upgrade the device to ScreenOS 5.4rX and then upgrade
the device directly to ScreenOS 6.1.0. Refer to “Upgrading to the New Firmware”
in the ScreenOS Upgrade Guide for instructions on performing the upgrade.

Documentation Changes■

To upgrade existing firmware to ScreenOS 6.1.0, refer to the ScreenOS Upgrade
Guide located at ScreenOS 6.1.0 Upgrade Guide. You may need to upgrade theboot loader of the SSG 300-series and SSG 500/500M-series devices. For more
information on the upgrade procedure, see “Upgrade Sequence” in the
Compatibility Issues in ScreenOS 6.1.0 section of this document.

■

The document formerly called ScreenOS Migration Guide has been renamed
ScreenOS Upgrade Guide. The content is updated for 6.1.0 but is otherwise
unchanged.

■

We have added a new document, JUNOS Software with Enhanced Services
Migration Guide, to support users who would like to migrate from ScreenOS
firmware to JUNOS software with enhanced services firmware for supported
platforms.

■

Starting with ScreenOS 6.0.0, we have removed information on configuring
Physical Interface Modules (PIMs) and Mini Physical Interface Modules (Mini-PIMs)
from the installation and configuration guides for SSG devices. This information
is now in a new guide, the PIM and Mini-PIM Installation and Configuration Guide.
Refer to that guide for information on configuring PIMs and Mini-PIMs.

■

We have added search capability to the online Help system for the WebUI andhave made some changes to the appearance of the online Help system.

Getting Help for ScreenOS 6.1.0 Software
For further assistance with Juniper Networks products, visit
http://www.juniper.net/support/.
Juniper Networks occasionally provides maintenance releases (updates and upgrades)
for ScreenOS firmware. To have access to these releases, you must register yoursecurity device with Juniper Networks at the above address.

Documentation Changes■

57