Juniper Networks ScreenOS Release Notes
Products: Integrated Security Gateway (ISG) 1000, ISG 1000-IDP, ISG 2000, ISG 2000-IDP,
Secure Services Gateway (SSG) 5, SSG 20, SSG 140, SSG 300M-series, SSG 500/500Mseries, and NetScreen-5000 series (NS 5000–MGT2/SPM2).
Version: ScreenOS 6.1.0r1
Revision: Rev 01
Part Number: 530-022544-01
Date: January 22, 2008
Contents
Version Summary .............................................................................................................. 3
New Features and Enhancements...................................................................................... 4
Hardware Features......................................................................................................... 4
Software Features .......................................................................................................... 5
Virtual Private Network .............................................................................................. 5
Firewall ...................................................................................................................... 5
Internet Protocol Version 6 Support ........................................................................... 5
Universal Threat Management ................................................................................... 6
IDP and GPRS ............................................................................................................ 6
Authentication............................................................................................................ 6
Network Address Translation ..................................................................................... 6
Virtual Router Redundancy Protocol .......................................................................... 7
Unified Access Control ............................................................................................... 7
Feature Extensions ........................................................................................................ 7
Application Layer Gateway......................................................................................... 7
Network Address Translation ..................................................................................... 8
NetScreen Redundancy Protocol ................................................................................ 8
Other ......................................................................................................................... 8
Changes to Default Behavior ............................................................................................ 10
Addressed Issues in ScreenOS 6.1.0r1 ............................................................................. 13
VPN.......................................................................................................................... 13
Firewall .................................................................................................................... 13
IDP........................................................................................................................... 13
Other ....................................................................................................................... 13
Routing .................................................................................................................... 14
Management ............................................................................................................ 14
ScreenOS Release Notes1Known Issues................................................................................................................... 15
Known Issues in ScreenOS 6.1.0r1 .............................................................................. 15
VoIP ......................................................................................................................... 15
HA and NSRP ........................................................................................................... 15
Routing .................................................................................................................... 16
Flow ......................................................................................................................... 17
IPv6 ......................................................................................................................... 17
VPN.......................................................................................................................... 17
Other ....................................................................................................................... 18
Limitations and Compatibility .......................................................................................... 19
Limitations of Features in ScreenOS 6.1.0r1 ................................................................ 19
Compatibility Issues in ScreenOS 6.1.0........................................................................ 20
Documentation Changes.................................................................................................. 22
Getting Help for ScreenOS 6.1.0 Software........................................................................ 22

ScreenOS Release Notes

2Version Summary
ScreenOS 6.1.0 firmware can be installed on the following products: SecureServices Gateway (SSG) 5, SSG 20, SSG 140, SSG 320M/350M, SSG 520/520M, SSG
550/550M, Integrated Services Gateway (ISG) 1000, ISG 1000-IDP, ISG 2000, ISG
2000-IDP, and NetScreen-5000 series with MGT2/SPM2.
This release incorporates the ScreenOS maintenance releases up to 6.0r4, 5.4r8,
and 5.3r10.
Note: If you are using an SSG 500-series device and an SSG 500M-series device ina NetScreen Redundancy Protocol (NSRP) environment, all devices must be
running ScreenOS 6.0r1 or later.
Note: NSRP clusters require the use of the same hardware products within acluster. Do not mix different product models in NSRP deployments.

ScreenOS Release Notes



3New Features and Enhancements
The sections below describe new features and enhancements available in the
ScreenOS 6.1.0 release.
Note: You must register your product at http://support.juniper.net to activate
licensed features such as antivirus, deep inspection, and virtual systems on thedevice. To register your product, you need the model and serial numbers of thedevice. At the support page: If you already have an account, enter your user ID and password.
If you are a new Juniper Networks customer, first create an account, then enter
your ID and password.

After registering your product, confirm that your device has Internet connectivity.
Use the exec license-key update all command to connect the device to the Juniper
Networks server and activate the feature.

Hardware Features

1X100/1000 SFP Ethernet uPIM—With ScreenOS 6.1.0, a new 1-port small
form-factor pluggable (SFP) Ethernet PIM is now available for the SSG 140,
SSG 320M, SSG 350M, SSG 520, SSG 520M, SSG 550, and SSG 550M platforms.
This new Ethernet PIM supports the following transceivers: 1000Base-T;
Gigabit Ethernet LX, and SX; and 100Base-FX. This 1-port SFP Ethernet PIM
does not support spanning tree, Jumbo frames, bridge groups, hot-swapping,or 802.3ad (Link Aggregation).



SSG 300M-series PIM Support—The following PIMs are now supported on the
SSG 300M-series devices: 6-port GE SFP uPIM, 8-port 10/100/1000 uPIM, 16port 10/100/1000 uPIM, and ADSL2+ PIM.

New NetScreen-5000 Modules—The NS-5000-MGT3, NS-5000-8G2-G4, andNS-5000-2XGE-G4 are new modules that you can install in your NetScreen5000 series device. These modules increase the performance of the device
when it is running ScreenOS 6.1 or later software:oNS-5000-MGT3—Management (MGT) module for NetScreen-5000 series
devices with dual 1.4 GHz PowerPC processors. Comes preinstalled with
ScreenOS 6.1 software. Use only with either an NS-5000-8G2-G4 or NS5000-2XGE-G4 Secure Port Module (SPM).

o

NS-5000-8G2-G4—SPM for NetScreen-5000 series devices with eight 1Gigabit SFP sockets for hot-swappable transceivers. Use only with NS-5000MGT3 modules.

oNS-5000-2XGE-G4—SPM for NetScreen-5000 series devices with two 10Gigabit XFP sockets for hot-swappable transceivers. Use only with NS5000-MGT3 modules.

ScreenOS Release Notes



4Software Features
Virtual Private Network


IKEv2—ScreenOS 6.1.0 adds support for the Internet Key Exchange protocol
version 2 (IKEv2). Both IKEv1 and IKEv2 gateways can exist on a ScreenOS
device. Note, however, that both ends of a tunnel must use the same IKE
version. A tunnel may not be created that uses IKEv1 at one end and IKEv2 atthe other.
The primary advantage of IKEv2 is that it permits different negotiations at bothends of a tunnel. IKEv2 avoids IKE denial of service (DoS) attacks by using astateless cookie and verifying the peer address before committing IKE
negotiation resources for the peer. IKEv2 supports Diffie-Hellman (DH) groups
1, 2, 5, and More Modular Exponential (MODP)14 (RFC 3526).



IKEv2 with EAP—All platforms running ScreenOS 6.1.0 support IKEv2 with
Extensible Authentication Protocol (EAP).

DSCP Marking per Phase-2 Proposal—Administrators can now configure theDifferentiated Services Code Point (DSCP) marking per phase-2 proposal tointeract with Multiprotocol Label Switching (MPLS) traffic engineering. After anadministrator has enabled DSCP marking per phase-2 proposal, he or she canconfigure traffic routing into different tunnels.



Session Rerouting Between Tunnels and Physical Interfaces—ScreenOS
6.1.0 allows the traffic to fail over between route-based VPN tunnels andphysical interfaces in the same zone when the security devices are deployed ina fully redundant network design consisting of dynamic routing and routebased VPNs. Without this feature, if a session that originated over an Ethernet
link traverses a VPN link (or vice versa) as a result of routing changes, traffic
flow will stop, requiring you to restart your applications. This feature reroutes
the session and avoids the need to restart applications.

Firewall

Customizable Reject Message for Integrated SurfControl—Administrators
can now create a custom reject message when Integrated SurfControl denies
access to a URL.

Apple iChat ALG—ScreenOS 6.1.0 provides an Application Layer Gateway(ALG) for Apple iChat applications up to version 3.15 that facilitates text, audio,
and video chat.



Per-Policy Source-IP Session-Rate Limit—Administrators can now set
session-rate limits for source IPs on a per-policy basis.



Traffic Shaping on WAN Interfaces—Traffic shaping is now supported on
Frame Relay and Multilink Frame Relay interfaces on SSG devices. This
includes the T1/E1, T3/E3, and 2M-Serial interfaces on the SSG 5/20, SSG 140,
SSG 320M/350M, and SSG 520/520M/550/550M devices.

Internet Protocol Version 6 Support


IPv6 Support—IPv6 is now supported on SSG 320M/350M, SSG 520/520M,
and SSG 550/550M platforms.

ScreenOS Release Notes



5



ISG 1000 and ISG 2000 with 1GB Memory—The ISG 1000 and ISG 2000 bothsupport IPv6 with 512K sessions on devices with 1GB of memory.

Protection Against SYN-Flood DoS Attacks—SYN-Proxy and SYN-Cookie
mechanisms are now supported for IPv6 to protect against SYN-Flood DoS
attacks.



IPv6 Support for WAN Interfaces—IPv6 is now supported on E1/T1, E3/T3,
and 2M-Serial interfaces on the SSG 5, SSG 20, SSG 320M/350M, SSG
520/520M, and SSG 550/550M platforms.

IPv6 ALGs—IPv6 support has been added for Sun and MS RPC ALGs, Session
Initiation Protocol (SIP), and Real-Time Streaming Protocol (RTSP) ALGs.
Note: ScreenOS 6.1.0 includes support for these ALGs in both IPv4 and IPv6
environments. The ALGs are not, however, triggered when doing network
address translation-port translation (NAT/PT) or IPv4ÅÆIPv6 translations.

Universal Threat Management

AV/DI Pattern Update Proxy—ScreenOS allows you to specify a proxy server
through which the security device can download antivirus (AV) and deep
inspection (DI) pattern updates in case your security device is not directly
connected to the Internet.



AV Maximum File Size Increase—In this release of ScreenOS, the maximum
file size that the AV engine is able to scan has increased from 10MB to 30MB
on all SSG devices.

IDP and GPRSIDP IPSec ESP-Null Encryption Inspection—ScreenOS 6.1.0 now supports
inspection of the traffic within IPSec tunnels that use the Null Encryption
method. This is supported on ISG 1000 and ISG 2000 with IDP Security
Modules.



IDP Session Log Correlation—IDP logs sent to the NetScreen-Security
Manager (NSM) server now contain the session ID to aid in correlating attack
logs with firewall session logs.

AuthenticationCaptive Portal for WebAuth—In earlier releases of ScreenOS, if you wanted toaccess a protected resource behind WebAuth, you had to navigate to the
WebAuth address to authenticate and then navigate to the address of theprotected resource. Now you can navigate to the protected resource, and if you
need to authenticate via WebAuth, you will be redirected to the authentication
page. After the credentials are identified, you are forwarded to the original
protected resource.

Network Address Translation


PPTP ALG on ISG 1000/2000 and NS5x00—High-end devices now support
Port Address Translation (PAT) for Point-to-Point Tunneling Protocol (PPTP),
allowing multiple remote users to use PPTP through a ScreenOS device.

ScreenOS Release Notes



6



Multiple Non-Contiguous Subnets in a DIP Pool—ScreenOS 6.1.0 now allows
administrators to configure up to three non-contiguous subnets in a single
fixed-port DIP pool. It is no longer necessary to have a single large subnet withconsecutive IP addresses in order to configure a DIP pool. This will help withsituations where users were denied access when the DIP pool was exhausted
and no consecutive IP addresses were available. The feature is available on all
ScreenOS 6.1.0 platforms.

Virtual Router Redundancy Protocol


Virtual Router Redundancy Protocol (VRRP) Support—ScreenOS 6.1.0.
provides support for VRRP (RFC 3768-VRRP version 2.0) on the SSG 5, SSG 20,
SSG 320M/350M, and SSG 520/520M/550/550M platforms. This feature allows
the security devices to interoperate with other vendors’ VRRP
implementations. When a device supports VRRP, it cannot support NSRP, as
they are mutually exclusive. The current implementation of VRRP does notsupport stateful failover, nor is VRRP supported through NSM.

Unified Access Control

Dynamic Discovery of Enforcers—ScreenOS 6.1.0 allows you to configure theInfranet Enforcer (firewall) to inform the Infranet Controller when a packet is
dropped because it originated from an unknown user. When the Infranet
Controller authenticates the identity of the user, it will then push thecorresponding rules down to the Infranet Enforcer. With earlier releases of
ScreenOS, the Infranet Controller would push the entire auth table to thefirewall even if the entries were not necessary. This feature will be available
with the release of UAC 2.2.

Enhanced Range of Roles per Auth Table Entry—ScreenOS supports a
maximum of 200 roles per auth table entry in order to limit the amount ofmemory occupied by the auth table. The role strings and role name arrays
store the first 200 roles configured by the Infranet Controller; any roles beyond
that are discarded with a warning message logged to the SSH session that sent
the command and to the event log.

Feature Extensions
Application Layer Gateway
MS-RPC ALG Enhancements—ScreenOS 6.1.0 adds support for
ISystemActivator (IRemoteSCMActivator) bind requests.



Avaya H.323 and SIP ALGs—ScreenOS has extended SIP ALG support for
Avaya H.323 and SIP.

SIP Trunking ALG—ScreenOS 6.1.0 has extended the SIP ALG to support SIP
trunking from vendors such as Lucent, Broadsoft, and AT&T.



PacketCable Extensions for MGCP ALG—ScreenOS 6.1.0 adds support for the
Network-based Call Signaling (NCS) protocol and Trunking Gateway Control
Protocol (TGCP). NCS/TGCP is used for delivering advanced, real-time
multimedia services over two-way cable deployments.

ScreenOS Release Notes

7

Network Address Translation
ScreenOS 6.1.0 provides a uniform NAT functionality in Layer 3 (L3) among all
security devices as follows: You can configure the virtual IP (VIP) address as the same as the interface IP
address on any device in any zone.
You can configure the VIP and mapped IP (MIP) address on the same interface
using the same IP address. This allows you to selectively redirect traffic for
specific applications to designated servers.

You can configure VIP, MIP, and dynamic IP (DIP) addresses in any
combination on any interface.

NetScreen Redundancy Protocol
Enhanced Range of Cluster IDs and VSD IDs—ScreenOS now supports up to
64 cluster IDs or 64 VSD IDs or some combination equal to 64. In addition,
ScreenOS 6.1.0 provides increased cluster session ramp-up performance andlimited asymmetric routing support through an NSRP cluster. All devices in acluster must be set to the same value.

Cluster ID:
VSD ID:

0

8

16

32

64

0
8
16
32
64

default
default
supported*
supported*
supported*default
default
supported*
supported*
supported*

supported*
supported*
supported*
supported*
unsupported

supported*
supported*
supported*
unsupported
unsupported

supported*
supported*
unsupported
unsupported
unsupported* Using the environment variable to set the values. This is an example of how
to set the environment variables:
ssg5-serial-wlan-> set envar nsrp-max-cluster=32
nsrp cluster is set to 32
The system must be rebooted for new setting to take effect!
ssg5-serial-wlan-> set envar nsrp-max-vsd=16
nsrp vsd is set to 16
The system must be rebooted for new setting to take effect!

Active-Active Support for Transparent Mode—ScreenOS 6.1.0 adds support
for Active-Active configurations in Transparent mode on the ISG 1000/2000
and NS5x00 platforms.



SCTP Stateful Inspection—ScreenOS 6.1.0 supports stateful inspection ofStream Control Transport Protocol (SCTP) traffic on all platforms. Supported
maximum concurrent SCTP sessions is 2000.

Other

ScreenOS Release Notes



8



NSRD Support via USB—With the current release of ScreenOS, the NetScreen
Rapid Deployment (NSRD) feature allows you to load a configuration on asecurity device with factory default configuration from a configlet file stored ona USB storage device. Please see SSG 300-Series NSRD Support in the
Limitations section for more information about this feature on SSG 300-series
devices.



Ability to Keep Session Flow in CPU on ASIC-Based Platforms—On ISG
1000/2000 and NS5x00 platforms, you can retain the session flow in the CPU
itself based on a policy that you define, facilitating packet capture fordebugging purposes. In earlier releases, the CPU handled only the first packet
of a session with the subsequent packets of the flow sent to the ASIC.

WebUI Enhancements for Opening a JTAC Case—The enhancements to the
WebUI allow you to open a Juniper Technical Assistance Center (JTAC) case fortechnical support where the WebUI automatically populates fields with devicespecific information.

Secondary Login Banner Acknowledgement—This version of ScreenOS
allows the creation of a secondary banner which requires users attempting toaccess a device to positively acknowledge a banner before displaying a prompt
for credentials (such as a username/password or username/public key). If theuser does not acknowledge the banner, the device will not give them a login
prompt and will close the connection. This feature is consistent on various
types of management sessions including those created via console, telnet, andSSH.
To enable the feature, run the following command: set admin auth banner acksecondary

Note: This feature cannot be used on firewalls that are acting as an Infranet
Enforcer working in conjunction with UAC. This is because UAC communicateswith the firewall via SSH and does not have a method to accept the banner.
Ability to Use the Option 'deny' in Access Lists for Multicast—You can now
specify the option 'deny' in access lists to simplify access list configuration
instead of having to create permit-only lists.

Environment and Temperature MIBs—All platforms now support
environmental and temperature MIBs.



Ability to Accept/Discard Gratuitous ARP Requests and Responses—You can
now accept/discard gratuitous ARPs on a per interface basis in Layer 3 and ona per VLAN basis in Transparent mode.

Wildcard Mask Support in Policies—ScreenOS 6.1.0 allows you to configure
wildcard masks in policy entries, such as 10.10.10.10/0.0.255.0. There is apotential session ramp rate impact when enabling this feature.

Dynamic DNS Service Enhancements—ScreenOS 6.1.0 adds support for
Static DNS and Custom DNS from the Dynamic DNS from dyndns.com.

ICSA Compliance Updates to CLI—The set firewall log-self command now
includes four additional logging options: NSM, SSH, telnet, and web.

ScreenOS Release Notes



9



Dial-in Console Access Security Enhancements for SSG 5/20—The following
security enhancements have been added for dial-in console access on the
SSG 5 and SSG 20 platforms:o

Log all dial-in attempts (success and failure) and include the caller
numbers;o

Support for whitelists and blacklists for caller numbers;oDeny access for a particular caller number after a configurable number offailed login attempts;oDisconnect the call after a configurable number of failed login attempts;oDisconnect the call after a configurable length of time without successfulauthentication;oSpecify whether to allow or deny calls from unknown caller numbers.

Changes to Default Behavior
This section lists changes to default behavior in ScreenOS 6.1.0r1 from earlier
ScreenOS firmware releases.
 NSRP Active-Active Configuration in Transparent Mode—The virtual security
device (VSD) is determined by the VLAN tag in Transparent mode instead of
the VMAC in Route/NAT mode.
Consistent NAT Behavior Across Platforms—ScreenOS now provides aconsistent NAT behavior across all platforms. This includes the following:oAllows VIP and MIP to be the same as interface on any Layer 3 zone
instead of only the Untrust zoneoAllows VIP and MIP to be on the same interface with the same IPoAdds new CLI set interface interface-num vip interface-ip and change set
interface interface-num vip untrust-ip to a hidden command.



SA IDs Displayed Consistently in the Same Base—With this release of
ScreenOS, Security Association (SA) IDs are displayed in Hex both when using
the get sa command and in the displayed configuration.



Performance Enhancement—The ISG 1000 platform supports enhanced
performance to 2Gbps.



Increase in Limit of Entries in Routing Tables—With ScreenOS 6.1.0,
running on the SSG 520/520M/550/550M platforms, routing and forwarding
tables can have 250,000 entries, which is increased from the earlier limit of
20,000. The routing tables accept 250,000 total routes including connected,
static, imported, and those learned from the routing protocols.



Wildcard Masks—ScreenOS 6.1.0 provides an option to use wildcard masks in
IP addresses. If you configure a policy that uses wildcard masks, the systemprompts that a wildcard address or wildcard policy is configured because using
wildcard address/wildcard policy causes a performance penalty.

ScreenOS Release Notes



10



“Deny” Option in Access Lists in Multicast Policies—ScreenOS provides anoption to include a deny option in access lists in the multicast policy. Thismight appear as an increase in the number of multicast access lists.

Session Capacity Increases—Session capacity increases as listed below.
Platform

Sessions

Platform

Sessions

SSG 5/SSG 20

8,000

ISG 1000

SSG 5/SSG 20 Adv

16,000

ISG 1000-IDP

SSG 140

48,000

ISG 2000

SSG 320M--

ISG 2000-IDP--

SSG 350M--

NS5200/MGT2--

SSG 520/SSG
520M

128,000

NS5400/MGT2

2,000,000

SSG 550/SSG
550M

256,000

512,000-1,000,000Increase in GTP Tunnels—ScreenOS 6.1.0 increases the maximum number ofactive GTP tunnels supported to 400,000 for the ISG 2000 platform and to200,000 for the ISG 1000 platform.



Increase in Roles per Auth Table Entry—ScreenOS 6.1.0 increases thenumber of roles per auth table entry from 26 to 200.



Session Rerouting Between Tunnels and Physical Interfaces—ScreenOS
6.1.0 allows the traffic to fail over between route-based VPN tunnels andphysical interfaces in the same zone when the security devices are deployed ina fully redundant network design consisting of dynamic routing and routebased VPNs. To restore the original behavior, use the set envar no-reroute-tunnelphysical=yes CLI command.



Increase in Maximum Tunnel Interfaces—On the NS-5000 w/MGT2 platform,
ScreenOS 6.1.0 increases the maximum number of tunnel interfaces per
device from 4096 to 8192.



ETSI Standards Support—Currently, Juniper Networks security devices do notsupport the new wireless standard from European Telecommunications
Standards Institute (ETSI), DFS2. This will result in the disabling of thefrequency ranges 5250-5350 MHz and 5470-5725 MHz for all SSG 5/20
wireless systems (region ETSI) after March 2008.



UDP Flood Screen—Juniper Networks ASIC-based security devices (NS5400,
NS5200, ISG 1000, and ISG 2000) enforce configured screen options for asubinterface even when the physical interface of this subinterface is in a nullsecurity zone.

ScreenOS Release Notes



11



Packet Distribution Mode Setting—On an NS5200 MGT2 with 10GE blade,
you can now configure the packet distribution mode for ingress traffic as either
hash or round-robin mode using the CLI command set interface interface-namemode. Default is hash mode.



Virtual IP on Loopback Interfaces—With ScreenOS 6.1.0, you can configure
the virtual IP (VIP) and Track IP addresses for a loopback interface. Earlier
releases of ScreenOS did not provide this option.

Configurable Wait Time to Confirm NSM Connection—If you manage yoursecurity device with Juniper Networks NetScreen-Security Manager (NSM), you
can load the security device with a configuration from NSM. If a configuration
upload fails for some reason, the security device may lose communication with
the NSM server. The device can reestablish the connection with NSM byrebooting and loading the previous configuration. The device, however, isunable to immediately detect that the connection is broken, so it is necessary
to wait for a specified interval and then check the connection status. The new
CLI to configure the wait interval to check the connection status is set nsm bulkcli
reboot-wait [seconds]. If the connection is broken, the device can be configured to
wait for another specified interval and then reboot.

Addition of HA and MGT Zones—ScreenOS 6.1.0 adds support for highavailability (HA) and management (MGT) zones on the SSG 5 and SSG 20
devices. When you start these devices for the first time, the device adds the
HA and MGT zones by default.



Option to Configure Email Virus Scanning Action—ScreenOS 6.1.0 provides
an option to configure the action that the security device should take if a virus
is found in an email. You can choose to have the security device drop the
infected email or send a notification mail to the intended recipient with theinfected email replaced with an alert message.



Firmware Information—ScreenOS 6.1.0 adds information about the firmware
and its components to the output of the get system CLI command on an
ISG 1000 or ISG 2000 device.



Bgroup PPS Counters—ScreenOS 6.1.0 now displays packet-per second
counters on bgroup interfaces.



VLAN Capacity Increase—ScreenOS 6.1.0 now supports up to 4094 VLAN
interfaces on ISG 1000/2000, ISG 1000/2000-IDP, and NS5x00 series devices.



TCP MSS Modified for Bidirectional VPN Traffic—The TCP Maximum
Segment Size (MSS) value for bidirectional VPN traffic can now be modified in
the CLI. The new CLI command set flow vpn-tcp-mss number sets the same MSS
for both inbound and outbound traffic. In prior ScreenOS releases, the CLI set
flow tcp-mss command worked only for outbound VPN traffic.
Note: The older command still works, but any value set using it will be overlaid
if the new command is run. Running unset flow vpn-tcp-mss will cause the device
to once again use the earlier value and permit use of the older command.
When no MSS value is given, the default setting is 1350; when the newcommand is used, an MSS value configured by set flow tcp-mss will not be valid
even if set flow tcp-mss is run again. [261891]

ScreenOS Release Notes

12Addressed Issues in ScreenOS 6.1.0r1
Note: Due to an update in the ScreenOS problem tracking system, some issues
listed here may have two bug numbers. The six-digit numeric code shown first isfor the new system; the “os” and “cs” numbers included in the listing for someissues are provided as a reference to older Known Issues. Eventually the older
reference numbers will be phased out.
The following operational issues were resolved in this release:

VPN

226217 [os70336]—When the IP address of a remote peer changed, IKE phase
1 failed to update correctly. This issue has been resolved.

Firewall

236113—When you enabled TCP-SYN-Check on the NetScreen-5000 platform,
the device failed to establish a cross-chip TCP connection in Transparent
mode. This issue has been resolved.

232420—An ISG 2000 device running ScreenOS 6.0.0r1 with IDP in Inline
mode caused packets to be dropped for return traffic if NAT and a mirror port
were both configured. This issue has been resolved.



229975—An ISG 2000-IDP intermittently stopped advertising prefixes to eBGP
peers after BGP peer refreshed from other devices. This issue has been
resolved.

232805—In Transparent mode on an ISG 1000 with IDP enabled, if both Web
filtering and IDP were enabled in one policy, all Web browsing that used thepolicy stopped responding. This issue has been resolved.



226651 [os70627]—When traffic reached 1Gbps (in each direction) throughtwo uPIMs, traffic was blocked in both directions after approximately one
hour. This issue has been resolved.



233516—If you made a large number of configuration changes (especially inpolicies and virtual routers), an ISG 2000 stopped receiving IPv6 packets. Thisissue has been resolved.

231754—In Transparent mode, SIP traffic caused a device to fail. This issue
has been resolved.



227782 [os71064]—When you deployed NTP Server on ISG 1000 appliances,the device aged out a packet even if the hardware session was refreshed by the
packet. This issue has been resolved.

233872—If you restarted an SSG 5 appliance after many hours of heavy traffic,
the device stopped forwarding all traffic. This issue has been resolved.

IDP

Other

ScreenOS Release Notes



13Routing


228200—Adding an alternate route to the routing table and making it as active
after a tunnel failure was not possible. This issue occurred when you used theset interface tunnel_name protocol rip demand-circuit command. This issue has
been resolved.

Management233428—In Transparent mode, the management feature on a v1-Untrust zone
was not added to the configuration, so it was disabled after a device reset. Thisissue has been resolved.



234025—On the SSG 140 platform, DNS settings were not accepted through a
PPPoE connection. This issue has been resolved.

ScreenOS Release Notes

14Known Issues
The following are known deficiencies in features at the time of this release.
Whenever possible, a workaround is suggested following the problem description,
preceded by W/A.
Note: Due to an update in the ScreenOS problem tracking system, some issues
listed here have two bug numbers. The six-digit numeric code shown first is for the
new system; the “os” and “cs” numbers included in the listing for some issues areprovided as a reference to older Known Issues. Eventually the older reference
numbers will be phased out.

Known Issues in ScreenOS 6.1.0r1
This section describes known issues with the listed release.

VoIP






250319—The SIP functionality does not support a customized port, so a SIP
call that uses custom ports might fail.
W/A: Use the default SIP port (5060).
239517—During a VoIP call that uses the H.323 protocol, if you change themapped IP or virtual IP address assignments, subsequent calls lose the audio.
Child sessions that are required to provide audio are not established because
the security device does not recognize a matching policy with the changed MIP
or VIP assignments.
W/A: Create a policy similar to the one you had configured and add it to theglobal zone.
240574— In standalone mode, if an alternative gatekeeper is initiated during a
VoIP call, sessions do not age out immediately after the call ends. In HA mode,
if an alternative gatekeeper is initiated during a VoIP call and there is a firewall
HA recycle, sessions only age out after a long time.



261464—On NS 5400 devices, Media Gateway Control Protocol (MGCP) traffic
performance drops significantly when the number of active calls exceeds
8000. The issue is the result of having sessions installed on both ASICs in thedevice rather than on only one as is the case with single-ASIC platforms.

241465—If a phone tries to register while SIP is disabled, SIP sessions must be
cleared once SIP is enabled. After SIP is enabled and SIP sessions have beencleared, all phones that tried to register prior to SIP being enabled will need tobe reset. Failure to reset a SIP phone that attempted to register before SIP was
enabled will result in that SIP phone being unable to place or receive calls.

HA and NSRP


236275—If the VSD group is not bound to a VLAN group, the security device
incorrectly reports the VSD as being in Active-Passive mode.

ScreenOS Release Notes



15



236634—In an Active-Passive configuration, if the active security device
handles a large number of FTP connections, the CPU utilization of the backup
device remains high even when the rate of the FTP connections per second on
the backup is low.

235303—Delay in the peripheral devices updating the forwarding table when afailover occurs in an NSRP cluster in Transparent mode. When the devices
have no gratuitous ARP mechanism as in NAT or Route mode, peripheraldevices update the forwarding table only when the active physical interface isrestarted. The update happens after five seconds by default.



W/A: Use the CLI command set nsrp link-hold-time to modify the link downtime.
253467—If a device's SIP traffic is very heavy in an NSRP deployment,
although the master box works well, there will be some delays when resourceson the backup box are removed. Operational impact on the cluster is minimal,
and the backup box will automatically recover.

Routing

251874—ScreenOS does not limit the number of routing entries that are
distributed through Routing Information Protocol (RIP). This incorrectly allows
you to configure more static routing entries than are supported.

251875—ScreenOS does not limit the number of Open Shortest Path First(OSPF) areas and virtual links. This incorrectly allows you to configure more
OSPF areas and virtual links than are supported.

251879—ScreenOS does not limit the number of Open Shortest Path First(OSPF) interfaces. This incorrectly allows you to configure more OSPF
interfaces than are supported.

251883—ScreenOS does not limit the number of static routing entries that are
redistributed through OSPF. This incorrectly allows you to configure morestatic routing entries than are supported.



255815—The device does not check the destination MAC address for packets
when the SYN-cookie is triggered and responds with SYN-ACK whether thedestination MAC belongs to itself or not.

258978—For the SSG 320M and 350M, the supported maximum number of
Border Gateway Protocol (BGP) redistributed routes is 4096. However, if alarge number of routes are added with an automated script, it is possible toexceed the supported limit. Routes entered or redistributed manually should
not be able to exceed 4096.



258979—For the SSG 320M and 350M, the supported maximum number ofOpen Shortest Path First (OSPF) redistributed routes is 4096, but it may bepossible to exceed the maximum. OSPF redistributed routes are handled in
two parts: route task and OSPF task. The route task will add redistributed
routes to OSPF continuously during one CPU time slice. The redistributed
routes counter will not, however, be updated until the OSPF task is processedby the CPU, so more routes may be added in OSPF when the routes are addedusing an automated script. Routes entered or redistributed manually should
not be able to exceed 4096.

ScreenOS Release Notes



16

Flow


239631—If you configure the initial session timeout below the valid range(20—300 seconds), the system interprets these values as minutes instead of
seconds.



235781—Using Transparent mode, under high traffic conditions, sometimes asmall number of sessions cannot be cleared. The sessions appear to be "time0" but will remain in the session table. Running set sat session-clean will clear
these sessions from the table after one round of session cleaning.

239598—On some high-end platforms, after you have enabled IPv6, the CLI
incorrectly allows you to enable parameters such as DSCP marking, IDP, and
NSRP Data Forwarding that are not supported in IPv6 mode.



267239—When modifying an IPv6 or a wildcard policy through the WebUI, allexisting sessions for the policy will be removed. However, existing sessions
will not be removed if you only modify some minor features—such as sessionlimit or alarm-without-drop—of an ordinary IPv4 policy through the WebUI.



236087—On SSG 320/350 devices, a 4-byte PVE tag is used to identify whichinterface the packet came from, limiting the maximum supported packet
length to 1514 bytes.

236549—When deployed in Transparent mode, some high-end platforms suchas ISG 1000-IDP do not support more than 20 reassembled segments. If you
try to ping another device with data that requires more than 20 reassembled
segments (for example, 30,000 bytes), the ping request fails.



239285—ScreenOS does not verify the IP address that you enter when you
configure the security device.

IPv6





W/A: You should verify the IP address that you enter for an interface. For
example, you must not assign a multicast or broadcast IP address as aninterface's IP address.
236085—In Transparent mode, you cannot manage a zone that is on a vsys
using the zone nsrp manage CLI command, because it is a global setting basedon vlan1 interface. In root mode, you can manage only the related vsys.
227934—SSG platforms incorrectly process the ICMPv6 error packet that theyreceive in response to a non-first fragment packet that exceeds the outgoinginterface MTU.
W/A: Set the interface MTU at a value that accommodates all packets for all
links through a path.

VPN253238—ScreenOS does not limit the number of GRE tunnels you can create.
This incorrectly allows you to create more GRE tunnels than are supported.

ScreenOS Release Notes



17



241207—During IPSec SA rekeying, some packets may be dropped on theinitiator side because the packet is received before the SA table is created.
Packets will only be dropped for a very short time. There should not be any
packets dropped after the SA table is installed.

240108—The security device does not allow a static DNS host entry to be
removed if the hostname has been used in an IKE gateway configuration, even
if the entry was entered in error or incorrectly and even if the IKE gateways
had since been removed.
W/A: Reboot the device to clear the DNS entry. Because the DNS entry iserroneous, rebooting will maintain the IKE configuration while clearing themistaken DNS entry.

Other


255774—The debug command unset console dbuf might make the box
unstable, especially under heavy traffic. Administrators are advised to use carewhen running this command.



236210—In an IDP deployment, when a policy incorporating diffserv iscreated the security module does not mark the first attack packet. This is bydesign, and all subsequent packets are correctly marked.

258931—Due to a memory limitation, NS 5000 devices are currently unable tosupport 500 vsys when an advanced license key—such as for virtual router or
Layer 2 Active-Active support—is part of the deployment.

266022—Because the NS 5400 supports 2 million sessions by default in 6.1(and 6.0r2 and later), you must make sure that the device has a minimum of
450MB of free memory when upgrading from 5.4 or 6.0r1 to 6.1 or 6.0r2. One
million sessions will require approximately 340MB of memory.



263512—ScreenOS 6.1.0 includes a new SSHv2 secondary login bannerfeature. However, unless the feature is enabled, if the secondary banner isdisplayed before a login prompt on a console or via a Telnet connection, no
positive acknowledgment to the secondary banner is required (applicable toconsole, Telnet, SSHv1, and SSHv2 connections).

ScreenOS Release Notes

18

Limitations and Compatibility
Limitations of Features in ScreenOS 6.1.0r1
This section describes the limitations of some features in the ScreenOS 6.1.0
release. They apply to all platforms unless otherwise noted.
 SSG 300-Series NSRD Support—Without running a slot configuration, NSM isunable to locate the source interface list when using NSRD on SSG 300-series
devices, and without the source interface list NSRD is unable to select aconfiglet file. To use NSRD on an SSG 300-series device, do a slot config
through NSM, which will make it possible for the device to see the interface list
and then configure with NSRD. [259596].


SSG 300-Series and 500-Series—Bridge groups (bgroups) are supported on
Ethernet switch PIMs (uPIMs), including 16-port GE, 8-port GE, and 6-port SFP.
Bgroups are not supported on 1-port SFP, old enhanced PIMs (ePIMs), and onboard GE ports. Administrators can dynamically create or delete bgroupinterfaces. The maximum number of bgroup interfaces on each PIM is half thenumber of ports. You can configure bgroup interfaces only on the same PIM oron the system board.



SSG 140—Bgroups are supported on both on-board Ethernet ports andEthernet switch PIMs (uPIMs). You can dynamically create or delete bgroupinterfaces. The maximum number of bgroup interfaces on each PIM is half thenumber of ports. On-board ports have three preset bgroup interfaces. You canconfigure bgroup interfaces only on the same PIM or on the system board.

IPv6 ASIC Support in NetScreen-5000 Systems—Because NetScreen-5000
systems now support IPv6, per-ASIC session support has been decreased from
1M to 512K. This is caused by the increase in the session size in the session
table.



To achieve maximum session count on the NS-5000 series security devices,
you should design the network traffic to utilize multiple ports on the SPMs.
This type of network architecture would distribute the sessions to multiple
ASICs. For example, if only two ports on an 8G2 SPM card are used, the max
session count value will be 512K.
Screens on Traffic Exiting Tunnels—has the following limitations:oThis feature is not compatible with the new SYN-bit check in the PPU
feature. Screens for traffic exiting tunnels are performed by the CPU
instead of the PPU.

oThis feature will only apply if the screen is activated on the physicalinterface where the tunnel is terminated if the screen is hardware
accelerated.

AC-VPN—Dead peer detection (DPD) does not work on the spoke when set on
an AC VPN profile with global IKE heartbeat enabled.

ScreenOS Release Notes



19



Jumbo Frame Support on the ISGs—Only the 4-port SFP modules on the ISGs
support Jumbo frames. All other I/O cards in the device are disabled
automatically (including the ISG 1000 built-in I/O card), when you enable
Jumbo frames by setting the max-frame-size setting in the range 1515–9830.



VRRP with NSM—ScreenOS 6.1.0 does not support VRRP with NSM. [262624]



PIM Power and Thermal Requirements—If you install either 8-port or 16-port
uPIMs in your SSG 140, SSG 500-series, or SSG 500M-series device, you mustobserve the power and thermal guidelines. Please refer to the PIM and MiniPIM Installation and Configuration Guide for the power and thermal guidelines
for all supported platforms, available at:
http://www.juniper.net/techpubs/hardware/pim_guide/pim_guide.pdf
Warning: Exceeding the power or heat capacity of your device may cause thedevice to overheat, resulting in equipment damage and network outage.

Compatibility Issues in ScreenOS 6.1.0
This section lists known compatibility issues with other products, including, but
not limited to, specific Juniper Networks appliances, other versions of ScreenOS,
Web browsers, Juniper Networks management software, and other vendor devices
at the time of this release.
 Compatible Web Browsers—The WebUI for ScreenOS 6.1.0 was tested withand supports Microsoft Internet Explorer (IE) browser versions 5.5 and above,
Netscape Navigator 6.X for Microsoft Windows platforms, and Microsoft
Internet Explorer version 5.1 for MacOS X.


Upgrade Sequence—We recommend that you follow the upgrade instructions
described in the ScreenOS Upgrade Guide located at
http://www.juniper.net/techpubs/software/screenos/screenos6.1.0/upgrade_gui
de.pdf. If you upgrade directly from ScreenOS 5.0.0 or ScreenOS 5.1.0 to
ScreenOS 6.1.0, you risk losing part of any existing configuration. For
ISG 2000 devices, you must upgrade to an intermediate firmware and upgrade
the boot loader before upgrading to the ScreenOS 6.1 firmware. Refer to“Upgrade Paths to ScreenOS 6.1” in the ScreenOS Upgrade Guide forintermediate software and boot loader upgrade information.
Use the following procedure to upgrade the SSG 500/500M boot loader:
1. Download the boot loader image (v.1.0.3) from the Juniper Networks
Support site to the root directory of your TFTP server.
2. Log into http://www.juniper.net/customers/support/.
3. In the Download Software section, click ScreenOS Software.
4. Download the latest SSG 500/ 500M boot loader and save it to the root
directory of your TFTP server. If necessary, start the TFTP server.
5. Make an Ethernet connection from the device hosting the TFTP serverto the MGT port on the SSG 500 and a serial connection from yourworkstation to the console port on the SSG 500.
6. Restart the SSG 500 by entering the reset command. When prompted
to confirm the system reset, press the Y key.

ScreenOS Release Notes



20

The following system output appears:
NetScreen SSG500 BootROM V1.0.2 (Checksum: 8796E2F3)
Copyright (c) 1997-2004 NetScreen Technologies, Inc.
Total physical memory: 512MB
Test - Pass
Initialization................ Done
1. Press the X and A keys sequentially to update the boot loader.
2. Enter the filename of the boot loader software you want to load (forexample, Boot2.1.0.3) and the IP addresses of the SSG 500 device and
TFTP server. The following system output appears:
File Name [boot2.1.0.2]: boot2.1.0.3
Self IP Address [10.150.65.152]:
TFTP IP Address [10.150.65.151]:
3. Press the Enter key to load the file. The following system output
appears:
Save loader config (112 bytes)... Done
Loading file "boot2.1.0.3"...
/Loaded successfully! (size = 125,512 bytes)
Ignore image authentication!
...
.......................
Done.


WebUI Upgrade—When upgrading from ScreenOS 5.2.0 to ScreenOS 6.1.0
using the WebUI, you must upgrade the device to ScreenOS 5.4rX and thenupgrade the device directly to ScreenOS 6.1.0. Refer to “Upgrading to the New
Firmware” in the ScreenOS Upgrade Guide for instructions on performing the
upgrade.

ScreenOS Release Notes

21Documentation Changes










To upgrade existing firmware to ScreenOS 6.1.0, refer to the ScreenOS
Upgrade Guide located at ScreenOS 6.1.0 Upgrade Guide. You may need to
upgrade the boot loader of the SSG 300 M-series and SSG 500/500M-series
devices. For more information on the upgrade procedure, see “Upgrade
Sequence” in the Compatibility Issues in ScreenOS 6.1.0 section of thisdocument.
The document formerly called ScreenOS Migration Guide has been renamed
ScreenOS Upgrade Guide. The content is updated for 6.1.0 but is otherwise
unchanged.
We have added a new document, JUNOS Enhanced Services Migration Guide, tosupport users who would like to migrate from ScreenOS firmware to JUNOS
Enhanced Services firmware for supported platforms.
Starting with ScreenOS 6.0.0, we have removed information on configuring
Physical Interface Modules (PIMs) and Mini Physical Interface Modules (MiniPIMs) from the installation and configuration guides for SSG devices. This
information is now in a new guide, the PIM and Mini-PIM Installation andConfiguration Guide. Refer to that guide for information on configuring PIMs
and Mini-PIMs.
We have added search capability to the online Help system for the WebUI andhave made some changes to the appearance of the online Help system.

Getting Help for ScreenOS 6.1.0 Software
For further assistance with Juniper Networks products, visit
http://www.juniper.net/support
Juniper Networks occasionally provides maintenance releases (updates andupgrades) for ScreenOS firmware. To have access to these releases, you mustregister your security device with Juniper Networks at the above address.
Copyright © 2008, Juniper Networks, Inc. All rights reserved.
Juniper Networks, the Juniper Networks logo, NetScreen, and ScreenOS are
registered trademarks of Juniper Networks, Inc. in the United States and othercountries. All other trademarks, service marks, registered trademarks, or
registered service marks in this document are the property of Juniper Networks ortheir respective owners. All specifications are subject to change without notice.
Juniper Networks assumes no responsibility for any inaccuracies in this document
or for any obligation to update information in this document. Juniper Networks
reserves the right to change, modify, transfer, or otherwise revise this publication
without notice.

ScreenOS Release Notes22