Juniper Networks ScreenOS Release
Notes
Release 6.1.0r7
December 2009
Revision 02

Products: Integrated Security Gateway (ISG) 1000, ISG 1000-IDP, ISG 2000, ISG
2000-IDP, Secure Services Gateway (SSG) 5, SSG 20, SSG 140, SSG 300M-series, SSG
500/500M-series, and NetScreen-5000 series (NS 5000–MGT2, NS 5000–MGT3).
Contents

Version Summary ............................................................................................5
New Features and Enhancements ...................................................................5
New Features and Enhancements Introduced in 6.1.0r7 ...........................5
New Features and Enhancements Introduced in 6.1.0r3 ...........................6
New Features and Enhancements Introduced in 6.1.0r2 ...........................6
New Features and Enhancements Introduced in 6.1.0r1 ...........................8
Hardware Features ...................................................................................9
Software Features ...................................................................................10
Authentication ..................................................................................10
Firewall ............................................................................................10
IDP and GPRS ...................................................................................10
Internet Protocol Version 6 (IPv6) Support .......................................10
Network Address Translation (NAT) ..................................................11
Unified Access Control (UAC) ...........................................................11
Universal Threat Management (UTM) ...............................................12
Virtual Private Network (VPN) ..........................................................12
Virtual Router Redundancy Protocol (VRRP) .....................................13
Feature Extensions .................................................................................13
Application Layer Gateway (ALG) ......................................................13
Network Address Translation (NAT) ..................................................13
NetScreen Redundancy Protocol (NSRP) ...........................................13
Other ................................................................................................14■

1

ScreenOS 6.1.0 Release Notes

Changes to Default Behavior .........................................................................16
Changes to Default Behavior Introduced in 6.1.0r7 .................................16
Changes to Default Behavior Introduced in 6.1.0r6 .................................16
Changes to Default Behavior Introduced in 6.1.0r5 .................................17
Changes to Default Behavior Introduced in 6.1.0r4 .................................17
Changes to Default Behavior Introduced in 6.1.0r1 .................................18
NSM Compatibility ........................................................................................21
Detector and Attack Objects Update (only for ISG-IDP) ..................................21
Addressed Issues in ScreenOS 6.1.0r7 ..........................................................21
Administration ........................................................................................21
Application Layer Gateway (ALG) ............................................................22
Antivirus .................................................................................................22
Authentication ........................................................................................22
CLI ..........................................................................................................22
DI ...........................................................................................................23
DNS ........................................................................................................23
GPRS .......................................................................................................23
HA and NSRP ..........................................................................................23
IDP .........................................................................................................24
Management ...........................................................................................24
NAT ........................................................................................................24
Other ......................................................................................................25
Performance ...........................................................................................26
Routing ...................................................................................................26
Security ...................................................................................................27
VoIP ........................................................................................................27
VPN ........................................................................................................27
WebUI ....................................................................................................28
Addressed Issues from ScreenOS 6.1.0r6 ......................................................28
Administration ........................................................................................28
Antivirus .................................................................................................29
Authentication ........................................................................................29
DHCP ......................................................................................................29
DI ...........................................................................................................29
GPRS .......................................................................................................29
HA and NSRP ..........................................................................................29
IDP .........................................................................................................30
Management ...........................................................................................30
NAT ........................................................................................................30
Other ......................................................................................................31
Performance ...........................................................................................33
Routing ...................................................................................................33
Security ...................................................................................................33
VoIP ........................................................................................................34
VPN ........................................................................................................34
WebUI ....................................................................................................34
Addressed Issues from ScreenOS 6.1.0r5 ......................................................35
Administration ........................................................................................35
Antivirus .................................................................................................36
CLI ..........................................................................................................36
DNS ........................................................................................................362■

HA and NSRP ..........................................................................................36
Management ...........................................................................................36
NAT ........................................................................................................37
Other ......................................................................................................37
Performance ...........................................................................................39
Routing ...................................................................................................39
VoIP ........................................................................................................39
VPN ........................................................................................................40
WebUI ....................................................................................................40
Addressed Issues from ScreenOS 6.1.0r4 ......................................................41
Administration ........................................................................................41
Antivirus .................................................................................................41
DHCP ......................................................................................................41
GPRS .......................................................................................................41
HA and NSRP ..........................................................................................42
IDP .........................................................................................................42
Management ...........................................................................................43
NAT ........................................................................................................43
Other ......................................................................................................43
Performance ...........................................................................................45
Routing ...................................................................................................46
Security ...................................................................................................46
VoIP ........................................................................................................46
VPN ........................................................................................................47
WebUI ....................................................................................................47
Addressed Issues from ScreenOS 6.1.0r3 ......................................................49
Administration ........................................................................................49
Antivirus .................................................................................................49
DNS ........................................................................................................49
GPRS .......................................................................................................49
HA and NSRP ..........................................................................................49
IDP .........................................................................................................50
Management ...........................................................................................50
Other ......................................................................................................50
Performance ...........................................................................................51
Routing ...................................................................................................51
VoIP ........................................................................................................51
VPN ........................................................................................................51
WebUI ....................................................................................................52
Addressed Issues from ScreenOS 6.1.0r2 ......................................................53
Administration ........................................................................................53
Antivirus .................................................................................................53
DHCP ......................................................................................................53
HA and NSRP ..........................................................................................53
Management ...........................................................................................54
Other ......................................................................................................55
Performance ...........................................................................................57
Routing ...................................................................................................57
VoIP/H323 ..............................................................................................58
VPN ........................................................................................................58
WebUI ....................................................................................................58■

3

ScreenOS 6.1.0 Release Notes

Addressed Issues from ScreenOS 6.1.0r1 ......................................................60
VPN ........................................................................................................60
Firewall ...................................................................................................60
IDP .........................................................................................................60
Other ......................................................................................................61
Routing ...................................................................................................61
Management ...........................................................................................61
Known Issues ................................................................................................62
Known Issues in ScreenOS 6.1.0r7 .........................................................62
Application Layer Gateway (ALG) ......................................................63
Authentication ..................................................................................63
DNS ..................................................................................................63
HA and NSRP ...................................................................................63
NAT ..................................................................................................63
Other ................................................................................................63
Performance ....................................................................................63
VoIP .................................................................................................63
WebUI ..............................................................................................63
Known Issues from ScreenOS 6.1.0r6 .....................................................64
Known Issues from ScreenOS 6.1.0r5 .....................................................64
Other ................................................................................................64
Known Issues from ScreenOS 6.1.0r4 .....................................................64
Other ................................................................................................64
Known Issues from ScreenOS 6.1.0r3 .....................................................64
Known Issues from ScreenOS 6.1.0r2 .....................................................64
Known Issues from ScreenOS 6.1.0r1 .....................................................64
Flow .................................................................................................64
HA and NSRP ...................................................................................65
IPv6 ..................................................................................................65
Other ................................................................................................66
Routing .............................................................................................66
VoIP .................................................................................................67
VPN ..................................................................................................67
Errata ............................................................................................................68
Deep Inspection (DI) ...............................................................................68
Limitations and Compatibility .......................................................................68
Limitations of Features in ScreenOS 6.1.0 ..............................................68
Compatibility Issues in ScreenOS 6.1.0 ...................................................70
Documentation Changes ...............................................................................72
Getting Help for ScreenOS 6.1.0 Software .....................................................72

4■

Version Summary

Version Summary
ScreenOS 6.1.0 firmware can be installed on the following products: Secure Services
Gateway (SSG) 5, SSG 20, SSG 140, SSG 320M/350M, SSG 520/520M, SSG 550/550M,
Integrated Services Gateway (ISG) 1000, ISG 1000-IDP, ISG 2000, ISG 2000-IDP, andNetScreen-5000 series with the N-5000–MGT2 and NS-5000-MGT3 module.
This release incorporates the ScreenOS maintenance releases up to 6.0r8, 5.4r14,
and 5.3r10.

NOTE:
■

If you are using an SSG 500-series device and an SSG 500M-series device in a
NetScreen Redundancy Protocol (NSRP) environment, all devices must be running
ScreenOS 6.0r1 or later.

■

NSRP clusters require the use of the same hardware products within a cluster.
Do not mix different product models in NSRP deployments.

New Features and Enhancements
The sections below describe new features and enhancements available in the
ScreenOS 6.1.0 release.

NOTE: You must register your product at http://support.juniper.net to activate licensedfeatures such as antivirus, deep inspection, and virtual systems on the device. To
register your product, you need the model and serial numbers of the device. At the
support page:■

If you already have an account, enter your user ID and password.

■

If you are a new Juniper Networks customer, first create an account, then enter
your ID and password.

After registering your product, confirm that your device has Internet connectivity.
Use the exec license-key update all command to connect the device to the Juniper
Networks server and activate the feature.

New Features and Enhancements Introduced in 6.1.0r7
The section below describes the new features introduced in the ScreenOS 6.1.0r7
release.
Sophos Anti-Spam to replace Symantec Anti-Spam—Beginning mid-September
2009, Sophos Anti-Spam service is made available to the ScreenOS-based products;
SSG, and ISG. The Sophos Anti-Spam service will replace the Symantec Anti-Spam.

Version Summary■

5

ScreenOS 6.1.0 Release Notes

There will be no impact to customers running any version of ScreenOS. No
configuration changes are required. The redirection to Sophos servers will be
automatic and transparent to the end-user. The security devices will be pointed to
the Sophos servers.

New Features and Enhancements Introduced in 6.1.0r3
The section below describes the new features introduced in the ScreenOS 6.1.0r3
release.
ISG-IDP Enhanced IDP Debug Feature Added
With ScreenOS 6.1.0r3 new IDP session and flow debug filters similar to ScreenOS
filters have been added to improve IDP debugging.

New Features and Enhancements Introduced in 6.1.0r2
The section below describes the new features introduced in the ScreenOS 6.1.0r2
release.
ISG-IDP Syslog Forwarding to Third-Party Servers
With ScreenOS release 6.1r2 and later, the ISG 1000/2000 device with IDP can send
syslogs to third-party syslog servers. With previous releases, IDP logs could only besent to an NSM server.
To enable and configure this feature:set syslog config IP_address_or_hostname logvalue
Options for value are:
1.

all

2.

event

3.

idp

4.

traffic

Example: set syslog config 10.1.1.2 log idp
To enable this feature from the WebUI:
Go to Configuration > Report Settings > Syslog
Here you will see a new option to enable and configure syslogs for IDP.
ISG-IDP Session Pass Under Heavy Throughput
An option to allow sessions to pass through without inspection under heavy throughput
conditions has been introduced in this release. This feature bypasses traffic inspection
for some sessions when the Intrusion Detection and Prevention (IDP) Security Module(SM) is unable to stay in lockstep with incoming traffic while continuing to inspect
other packets. You might use this feature when you are sensitive to packet drops

6■

New Features and Enhancements

New Features and Enhancements

and want to enable an on/off switch to have packets inspected at the firewall level
instead of through the security module. By default, this feature is off; that is, as inprevious releases, all traffic is inspected by IDP and under heavy throughput, somepackets may be dropped.
To enable this feature, use the following command syntax:
exec sm sm_id ksh "scio const set sc_adapt_enable 1"

You need to run this command on each IDP SM. The valid sm_id values are 1, 2, 3.
To disable this feature, use the following command syntax:
exec sm sm_id ksh "scio const set sc_adapt_enable 0"

When enabled, throughput conditions are taken into account and bypassing packet
inspection is done using a set of criteria. Traffic conditions will result in IDP operatingin the following modes:■

Normal inspection—All traffic is inspected by IDP.

■

Basic cut-through mode—All new sessions will be marked as cut-through andwill be allowed to pass uninspected. The first packet of the session received by
the Security Module triggers the cut-through marking. It is possible for subsequent
packets to still be sent to the Security Module before the Management module
takes cut-through into effect. All these subsequent packets are sent out without
inspection.

■

Progressive cut-through mode—All sessions for which packets are being observedby the IDP security module will be bypassed.

Log messages are issued for any IDP bypass state. The six log types for session bypass
state changes are:■Normal to basic cut-through■Basic cut-through to normal■

Basic cut-through to progressive cut-through■Progressive cut-through to basic cut-through■Normal to progressive cut-through■Progressive cut-through to normal

Here are details of the log messages:■

Category is NS_LOG_CATEGORY_ALARM■

Logtype is NS_LOG_ALARM_OTHERS■

Severity is NS_LOG_SEVERITY_WARNING■

Service is cutthrough_transit. Its values and means are:■

SC_LOG_CUTTHROUGH_NORM_TO_LOW = 1■

SC_LOG_CUTTHROUGH_LOW_TO_NORM = 2

New Features and Enhancements■

7

ScreenOS 6.1.0 Release Notes■

SC_LOG_CUTTHROUGH_LOW_TO_HIGH = 3■

SC_LOG_CUTTHROUGH_HIGH_TO_LOW = 4■

SC_LOG_CUTTHROUGH_NORM_TO_HIGH = 5■

SC LOG_CUTTHROUGH_HIGH_TO_NORM = 6

Here is a sample log message for status changes:
SM %d IDP (cpu %u) transits from %s. %u sessions was bypassed in the previous
state!
The log also includes log version, timestamp, device_domain_id, device_record_id,
device_domain_ver2, and policy_id.
You can use counter commands to get information about whether a CPU is in
cut-through mode and the number of sessions that were set to cut-through mode.
For example:
exec sm 1 ksh "scio counter get kpp…
sc_kpp_loopback
sc_kpp_norm2low
sc_kpp_low2highsc_kpp_high2low
sc_kpp_low2norm…
exec sm 1 ksh "scio counter get flow…
sc_flow_session_basic_cutthrough 0
sc_flow_session_progress_cutthrugh 0
sc_flow_cur_cutthrough_sessions 0

New Features and Enhancements Introduced in 6.1.0r1
The section below describes the new features introduced in the ScreenOS 6.1.0r1
release.

8■

New Features and Enhancements

New Features and Enhancements

Hardware Features■

1X100/1000 SFP Ethernet uPIM—With ScreenOS 6.1.0, a new 1-port small
form-factor pluggable (SFP) Ethernet PIM is now available for the SSG 140, SSG
320M, SSG 350M, SSG 520, SSG 520M, SSG 550, and SSG 550M platforms. This
new Ethernet PIM supports the following transceivers: 1000Base-T; Gigabit
Ethernet LX, and SX; and 100Base-FX. This 1-port SFP Ethernet PIM does notsupport spanning tree, Jumbo frames, bridge groups, hot-swapping, or 802.3ad(Link Aggregation).

■

SSG 300M-series PIM Support—The following PIMs are now supported on the
SSG 300M-series devices: 6-port GE SFP uPIM, 8-port 10/100/1000 uPIM, 16-port
10/100/1000 uPIM, and ADSL2+ PIM.

■

New NetScreen-5000 Modules—The NS-5000-MGT3, NS-5000-8G2-G4, andNS-5000-2XGE-G4 are new modules that you can install in your NetScreen-5000
series device. These modules increase the performance of the device when it isrunning ScreenOS 6.1 or later software:■■

NS-5000-MGT3—Management (MGT) module for NetScreen-5000 series
devices with dual 1.4 GHz PowerPC processors. Comes preinstalled with
ScreenOS 6.1 software. Use only with either an NS-5000-8G2-G4 or
NS-5000-2XGE-G4 Secure Port Module (SPM).

■

NS-5000-8G2-G4—SPM for NetScreen-5000 series devices with eight 1-Gigabit
SFP sockets for hot-swappable transceivers. Use only with NS-5000-MGT3
modules.

■

NS-5000-2XGE-G4—SPM for NetScreen-5000 series devices with two
10-Gigabit XFP sockets for hot-swappable transceivers. Use only with
NS-5000-MGT3 modules.

1-port 10 Gigabit I/O Module—The 1-port small form-factor pluggable (XFP)
Ethernet I/O module is now available for the ISG 1000, ISG 2000, and ISG 2000
with IDP platforms. This new module supports the following transceivers:
10GBase-SR and LR, and supports jumbo frames (maximum packet size 9830
bytes).

New Features and Enhancements■

9

ScreenOS 6.1.0 Release Notes

Software Features
Authentication■

Captive Portal for WebAuth—In earlier releases of ScreenOS, if you wanted toaccess a protected resource behind WebAuth, you had to navigate to the WebAuth
address to authenticate and then navigate to the address of the protectedresource. Now you can navigate to the protected resource, and if you need toauthenticate via WebAuth, you will be redirected to the authentication page.
After the credentials are identified, you are forwarded to the original protectedresource.

■

Customizable Reject Message for Integrated SurfControl—Administrators can
now create a custom reject message when Integrated SurfControl denies accessto a URL.

■

Apple iChat ALG—ScreenOS 6.1.0 provides an Application Layer Gateway (ALG)
for Apple iChat applications up to version 3.15 that facilitates text, audio, andvideo chat.

■

Per-Policy Source-IP Session-Rate Limit—Administrators can now set
session-rate limits for source IPs on a per-policy basis.

■

Traffic Shaping on WAN Interfaces—Traffic shaping is now supported on Frame
Relay and Multilink Frame Relay interfaces on SSG devices. This includes theT1/E1, T3/E3, and 2M-Serial interfaces on the SSG 5/20, SSG 140, SSG
320M/350M, and SSG 520/520M/550/550M devices.

■

IDP IPSec ESP-Null Encryption Inspection—ScreenOS 6.1.0 now supports
inspection of the traffic within IPSec tunnels that use the Null Encryption method.
This is supported on ISG 1000 and ISG 2000 with IDP Security Modules.

■

IDP Session Log Correlation—IDP logs sent to the NetScreen-Security Manager(NSM) server now contain the session ID to aid in correlating attack logs with
firewall session logs.

Firewall

IDP and GPRSInternet Protocol Version 6 (IPv6) Support

10

■

■

IPv6 Support—IPv6 is now supported on SSG 140, SSG 320M/350M, SSG
520/520M, and SSG 550/550M platforms.

■

ISG 1000 and ISG 2000 with 1GB Memory—The ISG 1000 and ISG 2000 bothsupport IPv6 with 512K sessions on devices with 1GB of memory.

■

Protection Against SYN-Flood DoS Attacks—SYN-Proxy and SYN-Cookie
mechanisms are now supported for IPv6 to protect against SYN-Flood DoS attacks.

New Features and Enhancements

New Features and Enhancements■

IPv6 Support for WAN Interfaces—IPv6 is now supported on E1/T1, E3/T3, and
2M-Serial interfaces on the SSG 5, SSG 20, SSG 320M/350M, SSG 520/520M, and
SSG 550/550M platforms.

■

IPv6 ALGs—IPv6 support has been added for Sun and MS RPC ALGs, Session
Initiation Protocol (SIP), and Real-Time Streaming Protocol (RTSP) ALGs.

NOTE: ScreenOS 6.1.0 includes support for these ALGs in both IPv4 and IPv6
environments. The ALGs are not, however, triggered when doing network addresstranslation-port translation (NAT/PT) or in IPv4 to IPv6 and IPv6 to IPv4 translations.

■

IPv6 Screen Function—The ScreenOS supports the following screen features
for IPv6 traffic on the SSG and ISG platforms:■

Source IP limit■

UDP flood prevention■

Per policy session limit■

DNS-ALG

Network Address Translation (NAT)■

PPTP ALG on ISG 1000/2000 and NS5x00—High-end devices now support Port
Address Translation (PAT) for Point-to-Point Tunneling Protocol (PPTP), allowing
multiple remote users to use PPTP through a ScreenOS device.

■

Multiple Non-Contiguous Subnets in a DIP Pool—ScreenOS 6.1.0 now allows
administrators to configure up to three non-contiguous subnets in a single
fixed-port DIP pool. It is no longer necessary to have a single large subnet withconsecutive IP addresses in order to configure a DIP pool. This will help withsituations where users were denied access when the DIP pool was exhausted
and no consecutive IP addresses were available. The feature is available on all
ScreenOS 6.1.0 platforms.

Unified Access Control (UAC)■

Dynamic Discovery of Enforcers—ScreenOS 6.1.0 allows you to configure theInfranet Enforcer (firewall) to inform the Infranet Controller when a packet is
dropped because it originated from an unknown user. When the Infranet
Controller authenticates the identity of the user, it will then push thecorresponding rules down to the Infranet Enforcer. With earlier releases of
ScreenOS, the Infranet Controller would push the entire auth table to the firewall
even if the entries were not necessary. This feature will be available with therelease of UAC 2.2.

■

Enhanced Range of Roles per Auth Table Entry—ScreenOS supports a
maximum of 200 roles per auth table entry in order to limit the amount ofmemory occupied by the auth table. The role strings and role name arrays store
the first 200 roles configured by the Infranet Controller; any roles beyond thatare discarded with a warning message logged to the SSH session that sent thecommand and to the event log.

New Features and Enhancements■

11

ScreenOS 6.1.0 Release Notes

Universal Threat Management (UTM)■

AV/DI Pattern Update Proxy—ScreenOS allows you to specify a proxy server
through which the security device can download antivirus (AV) and deep
inspection (DI) pattern updates in case your security device is not directly
connected to the Internet.

■

AV Maximum File Size Increase—In this release of ScreenOS, the maximum
file size that the AV engine is able to scan has increased from 10MB to 30MB on
all SSG devices.

Virtual Private Network (VPN)■

IKEv2—ScreenOS 6.1.0 adds support for the Internet Key Exchange protocol
version 2 (IKEv2). Both IKEv1 and IKEv2 gateways can exist on a ScreenOS
device. Note, however, that both ends of a tunnel must use the same IKE version.
A tunnel may not be created that uses IKEv1 at one end and IKEv2 at the other.
The primary advantage of IKEv2 is that it permits different negotiations at bothends of a tunnel. IKEv2 avoids IKE denial of service (DoS) attacks by using astateless cookie and verifying the peer address before committing IKE negotiation
resources for the peer. IKEv2 supports Diffie-Hellman (DH) groups 1, 2, 5, andMore Modular Exponential (MODP)14 (RFC 3526).

12

■

■

IKEv2 with EAP—All platforms running ScreenOS 6.1.0 support IKEv2 with
Extensible Authentication Protocol (EAP).

■DSCP Marking per Phase-2 Proposal—Administrators can now configure theDifferentiated Services Code Point (DSCP) marking per phase-2 proposal tointeract with Multiprotocol Label Switching (MPLS) traffic engineering. After anadministrator has enabled DSCP marking per phase-2 proposal, he or she canconfigure traffic routing into different tunnels.

■

Session Rerouting Between Tunnels and Physical Interfaces—ScreenOS 6.1.0
allows the traffic to fail over between route-based VPN tunnels and physicalinterfaces in the same zone when the security devices are deployed in a fully
redundant network design consisting of dynamic routing and route-based VPNs.
Without this feature, if a session that originated over an Ethernet link traverses
a VPN link (or vice versa) as a result of routing changes, traffic flow will stop,
requiring you to restart your applications. This feature reroutes the session andavoids the need to restart applications.

New Features and Enhancements

New Features and Enhancements

Virtual Router Redundancy Protocol (VRRP)■

Virtual Router Redundancy Protocol (VRRP) Support—ScreenOS 6.1.0 provides
support for VRRP (RFC 3768-VRRP version 2.0) on the SSG 5, SSG 20, SSG 140,
SSG 320M/350M, and SSG 520/520M/550/550M platforms. This feature allows
the security devices to interoperate with other vendors’ VRRP implementations.
When a device supports VRRP, it cannot support NSRP, as they are mutually
exclusive. The current implementation of VRRP does not support stateful failover,nor is VRRP supported through NSM.

Feature Extensions
Application Layer Gateway (ALG)■

MS-RPC ALG Enhancements—ScreenOS 6.1.0 adds support for ISystemActivator(IRemoteSCMActivator) bind requests.

■

Avaya H.323 and SIP ALGs—ScreenOS has extended SIP ALG support for Avaya
H.323 and SIP.

■

SIP Trunking ALG—ScreenOS 6.1.0 has extended the SIP ALG to support SIP
trunking from vendors such as Lucent, Broadsoft, and AT&T.

■

PacketCable Extensions for MGCP ALG—ScreenOS 6.1.0 adds support for the
Network-based Call Signaling (NCS) protocol and Trunking Gateway Control
Protocol (TGCP). NCS/TGCP is used for delivering advanced, real-time multimedia
services over two-way cable deployments.

Network Address Translation (NAT)

ScreenOS 6.1.0 provides a uniform NAT functionality in Layer 3 (L3) among all
security devices as follows:■

You can configure the virtual IP (VIP) address as the same as the interface IP
address on any device in any zone.

■

You can configure the VIP and mapped IP (MIP) address on the same interface
using the same IP address. This allows you to selectively redirect traffic for
specific applications to designated servers.

■

You can configure VIP, MIP, and dynamic IP (DIP) addresses in any combination
on any interface.

NetScreen Redundancy Protocol (NSRP)■

Enhanced Range of Cluster IDs and VSD IDs—ScreenOS now supports up to
64 cluster IDs or 64 VSD IDs or some combination equal to 64. In addition,
ScreenOS 6.1.0 provides increased cluster session ramp-up performance and

New Features and Enhancements■

13

ScreenOS 6.1.0 Release Notes

limited asymmetric routing support through an NSRP cluster. All devices in acluster must be set to the same value.

Cluster
ID:

0

8

16

32

64

0

default

default

supported*

supported*

supported*

8

default

default

supported*

supported*

supported*

16

supported*

supported*

supported*

supported*

unsupported

32

supported*

supported*

supported*

unsupported

unsupported

64

supported*

supported*

unsupported

unsupported

unsupported

VSD ID:* Using the environment variable to set the values. This is an example of how
to set the environment variables:
ssg5-serial-wlan-> set envar nsrp-max-cluster=32
nsrp cluster is set to 32
The system must be rebooted for new setting to take effect!
ssg5-serial-wlan-> set envar nsrp-max-vsd=16
nsrp vsd is set to 16
The system must be rebooted for new setting to take effect!
■

Active-Active Support for Transparent Mode—ScreenOS 6.1.0 adds support
for Active-Active configurations in Transparent mode on the ISG 1000/2000 andNS5x00 platforms.

■

SCTP Stateful Inspection—ScreenOS 6.1.0 supports stateful inspection of Stream
Control Transport Protocol (SCTP) traffic on all platforms. Supported maximum
concurrent SCTP sessions is 2000.

■

NSRD Support via USB—With the current release of ScreenOS, the NetScreen
Rapid Deployment (NSRD) feature allows you to load a configuration on a security
device with factory default configuration from a configlet file stored on a USB
storage device. Please see SSG 300-Series NSRD Support in the Limitations
section for more information about this feature on SSG 300-series devices.

■Ability to Keep Session Flow in CPU on ASIC-Based Platforms—On ISG
1000/2000 and NS5x00 platforms, you can retain the session flow in the CPU
itself based on a policy that you define, facilitating packet capture for debugging
purposes. In earlier releases, the CPU handled only the first packet of a session
with the subsequent packets of the flow sent to the ASIC.

■WebUI Enhancements for Opening a JTAC Case—The enhancements to the
WebUI allow you to open a Juniper Technical Assistance Center (JTAC) case for

Other

14

■

New Features and Enhancements

New Features and Enhancements

technical support where the WebUI automatically populates fields with
device-specific information.
■

Secondary Login Banner Acknowledgement—This version of ScreenOS allows
the creation of a secondary banner which requires users attempting to access a
device to positively acknowledge a banner before displaying a prompt for
credentials (such as a username/password or username/public key). If the user
does not acknowledge the banner, the device will not give them a login prompt
and will close the connection. This feature is consistent on various types ofmanagement sessions including those created via console, telnet, and SSH.
To enable the feature, run the following command:
set admin auth banner ack-secondary

NOTE: This feature cannot be used on firewalls that are acting as an Infranet Enforcer
working in conjunction with UAC. This is because UAC communicates with the firewall
via SSH and does not have a method to accept the banner.

■

Ability to Use the Option 'deny' in Access Lists for Multicast—You can now
specify the option “deny” in access lists to simplify access list configuration
instead of having to create permit-only lists.

■

Environment and Temperature MIBs—All platforms now support environmental
and temperature MIBs.

■

Ability to Accept/Discard Gratuitous ARP Requests and Responses—You can
now accept/discard gratuitous ARPs on a per interface basis in Layer 3 and ona per VLAN basis in Transparent mode.

■

Wildcard Mask Support in Policies—ScreenOS 6.1.0 allows you to configure
wildcard masks in policy entries, such as 10.10.10.10/0.0.255.0. There is apotential session ramp rate impact when enabling this feature.

■

Dynamic DNS Service Enhancements—ScreenOS 6.1.0 adds support for Static
DNS and Custom DNS from the Dynamic DNS from dyndns.com.

■

ICSA Compliance Updates to CLI—The set firewall log-self command now
includes four additional logging options: NSM, SSH, telnet, and web.

■

Dial-in Console Access Security Enhancements for SSG 5/20—The following
security enhancements have been added for dial-in console access on the SSG
5 and SSG 20 platforms:■

Log all dial-in attempts (success and failure) and include the caller numbers;■

Support for whitelists and blacklists for caller numbers;■

Deny access for a particular caller number after a configurable number offailed login attempts;■

Disconnect the call after a configurable number of failed login attempts;■

Disconnect the call after a configurable length of time without successfulauthentication;■

Specify whether to allow or deny calls from unknown caller numbers.

New Features and Enhancements■

15

ScreenOS 6.1.0 Release Notes

Changes to Default Behavior
This section lists changes to default behavior in ScreenOS 6.1.0 from previous
ScreenOS firmware releases.

NOTE: If the ScreenOS version is not mentioned in this section, the change in behavior
was released with ScreenOS 5.4.0r1.

Changes to Default Behavior Introduced in 6.1.0r7■“Too many loopback, maybe caused by misconfiguration”, message in debug
flow basic—Packets with destination IP 0.0.0.0 are dropped silently instead ofbeing looped in the firewall.

■

Confirm behavior of remote authentication—Local authentication is tried only
if the remote server is down and no response is received in time when the remoteauthentication is primary. Remote authentication is tried only if the user namedoes not exist in the local server when the local authentication is primary.

■

Resolution of hostname to IP address of syslog or webtrends—In previous
ScreenOS releases, ScreenOS resolves the hostname to IP address of syslog or
webtrends only when the service is enabled. The new behavior is to resolve thehostname to IP address of syslog or webtrends immediately after being
configured, the get dns host cache command displays a DNS cache entry before
the service is enabled.

Changes to Default Behavior Introduced in 6.1.0r6

16

■

■

Message flooding in event log—The event log gets flooded with messages when
the DNS Proxy is used. A new command set dns proxy log-dns-request to enable
or disable the DNS Proxy messages log is added. This change does not impact
CLI.

■

NAT cookies and H.323 calls—For the SSG-300 and SSG-500 devices, the valueof max_nat_cookies_num and max_h323_call_num is increased to 1024.

■

Peer-to-peer ALG vector—Peer-to-peer ALG vector has been disabled by default
on ISG and NetScreen-5000 platforms.

■

Policy Limit—The policy count is changed to less than 125.

■

SNMP reports the wrong information for Serial and ML interface—In previous
ScreenOS versions, trunked interfaces being polled using SNMP RFC MIBS for
the ifOper status was showed as UP. After the upgrade, the ifOper status wasshowed as DOWN. For more information, see the JTAC knowledge base number
KB 13962 located at http://kb.juniper.net

Changes to Default Behavior

Changes to Default Behavior

Changes to Default Behavior Introduced in 6.1.0r5■

OSPF MD5 authentication password—The OSPF MD5 authentication password
shown in clear text on syslog server is resolved. Enable the OSPF MD5
authentication and re-enter the auth password to store the OSPF MD5
authentication password in crypt text on syslog server.

Changes to Default Behavior Introduced in 6.1.0r4■

DNS Port Randomization—The ability to enable random port assignment forpolicy-based DIP pools has been added; both interface-based DIP pools andpolicy-based DIP pools can now have ports randomly assigned. Interface-based
DIP pools have random port assignment by default. Policy-based DIP pools,
however, are default set to port translation, so random-port must be manuallyenabled by an admin.
The random-port keyword has been added to CLI syntax for both DIP pool andextended DIP pool:set interfaceifname ext ipip/mask dip dip_id ip_low ip_high [random-port]
set interface ifname dip dip_id ip_low ip_high [random-port]■

Load-threshold—The load-threshold setting for an ISDN interface supports therange 0~100. The zero value allows for always-up capability. Use the dialer
load-threshold load interface configuration command to configure the bandwidth
on demand for setting the maximum load.

■

ISG traffic dropping—Use the command set sat fin-close-aging num to control
the session age-outs on ISG. By default session age-out for ISG is 10 seconds.
Using the command prevents the packet dropping when the session inactivity
age-out timer expires before time.

■Multicast routing—An administrator can now configure a multicast address tothe unicast route table using the mroute command.

■

Traffic shaping—Multicast traffic can now be inspected for traffic shaping. Thisissue can be fixed with traffic shaping before flooding the multicast packets ina layer2 zone.

■

Port mapping—ScreenOS provides the port mapping for the unused management
ports 443 and 53 using the WebUI. The steps to be performed every time thedevice reboots includes the following:1.

Set a VIP on outgoing interface on a different IP.

2.

Set the port mappings for the VIP to the 443 and 53 ports. The admin SSL
to be re-allocated to another port other than 443. DNS proxy to be disabled
for the port 53.

3.

Modify the VIP back to the interface IP.

Changes to Default Behavior■

17

ScreenOS 6.1.0 Release Notes

Changes to Default Behavior Introduced in 6.1.0r1■[SSG 140] Maximum Number of Supported Zones—In previous releases, theadministrator was able to create more than the maximum amount of user-definedzones (30). With 6.1.0r1, this limit is now enforced on the SSG 140.

■

NSRP Active-Active Configuration in Transparent Mode—The virtual security
device (VSD) is determined by the VLAN tag in Transparent mode instead of the
VMAC in Route/NAT mode.

■

Consistent NAT Behavior Across Platforms—ScreenOS now provides a consistent
NAT behavior across all platforms. This includes the following:■

Allows VIP and MIP to be the same as interface on any Layer 3 zone insteadof only the Untrust zone■

Allows VIP and MIP to be on the same interface with the same IP■

Adds new CLI set interface interface-num vip interface-ip and change set
interface interface-num vip untrust-ip to a hidden command.

■

SA IDs Displayed Consistently in the Same Base—With this release of ScreenOS,
Security Association (SA) IDs are displayed in Hex both when using the get sa
command and in the displayed configuration.

■

Performance Enhancement—The ISG 1000 platform supports enhanced
performance to 2Gbps.

■

Increase in Limit of Entries in Routing Tables—With ScreenOS 6.1.0, runningon the SSG 520/520M/550/550M platforms, routing and forwarding tables canhave 250,000 entries, which is increased from the earlier limit of 20,000. The
routing tables accept 250,000 total routes including connected, static, imported,and those learned from the routing protocols.

■

Wildcard Masks—ScreenOS 6.1.0 provides an option to use wildcard masks in
IP addresses. If you configure a policy that uses wildcard masks, the systemprompts that a wildcard address or wildcard policy is configured because using
wildcard address/wildcard policy causes a performance penalty.

■“Deny” Option in Access Lists in Multicast Policies—ScreenOS provides anoption to include a deny option in access lists in the multicast policy. This might
appear as an increase in the number of multicast access lists.

■

Session Capacity Increases—Session capacity increases as listed below.

Platform

Sessions

SSG 5/SSG 20

8,000

SSG 5/SSG 20 - Adv

16,000

SSG 140

48,000

SSG 320M-

SSG 350M-

18■

Changes to Default Behavior

Changes to Default Behavior

Platform

Sessions

SSG 520/SSG 520M

128,000

SSG 550/SSG 550M

256,000

ISG 1000

512,000

ISG 1000-IDP-

ISG 2000

1,000,000
NOTE: 2 GB of RAM required. 1 GB of RAM will allow
512,000 sessions.

ISG 2000-IDP-

NS5200/MGT2-

NS5400/MGT2

2,000,000■

Increase in GTP Tunnels—ScreenOS 6.1.0 increases the maximum number ofactive GTP tunnels supported to 400,000 for the ISG 2000 platform and to200,000 for the ISG 1000 platform.

■

Increase in Roles per Auth Table Entry—ScreenOS 6.1.0 increases the numberof roles per auth table entry from 26 to 200.

■

Session Rerouting Between Tunnels and Physical Interfaces—ScreenOS 6.1.0
allows the traffic to fail over between route-based VPN tunnels and physicalinterfaces in the same zone when the security devices are deployed in a fully
redundant network design consisting of dynamic routing and route-based VPNs.
To restore the original behavior, use the set envar no-reroute-tunnel-physical=yes
command.

■Increase in Maximum Tunnel Interfaces—On the NS-5000 w/MGT2 platform,
ScreenOS 6.1.0 increases the maximum number of tunnel interfaces per device
from 4096 to 8192.

■

ETSI Standards Support—Currently, Juniper Networks security devices do notsupport the new wireless standard from European Telecommunications Standards
Institute (ETSI), DFS2. This will result in the disabling of the frequency ranges
5250-5350 MHz and 5470-5725 MHz for all SSG 5/20 wireless systems (region
ETSI) after March 2008.

■

UDP Flood Screen—Juniper Networks ASIC-based security devices (NS5400,
NS5200, ISG 1000, and ISG 2000) enforce configured screen options for asubinterface even when the physical interface of this subinterface is in a nullsecurity zone.

■

Packet Distribution Mode Setting—On an NS5200 MGT2 with 10GE blade, you
can now configure the packet distribution mode for ingress traffic as either hashor round-robin mode using the CLI command set interface interface-name mode.
Default is hash mode.

Changes to Default Behavior■

19

ScreenOS 6.1.0 Release Notes■

Virtual IP on Loopback Interfaces—With ScreenOS 6.1.0, you can configure
the virtual IP (VIP) and Track IP addresses for a loopback interface. Earlier releasesof ScreenOS did not provide this option.

■

Configurable Wait Time to Confirm NSM Connection—If you manage yoursecurity device with Juniper Networks NetScreen-Security Manager (NSM), you
can load the security device with a configuration from NSM. If a configuration
upload fails for some reason, the security device may lose communication with
the NSM server. The device can reestablish the connection with NSM by rebooting
and loading the previous configuration. The device, however, is unable toimmediately detect that the connection is broken, so it is necessary to wait fora specified interval and then check the connection status. The new CLI toconfigure the wait interval to check the connection status is set nsm bulkcli
reboot-wait [seconds]. If the connection is broken, the device can be configured
to wait for another specified interval and then reboot.

■

Addition of HA and MGT Zones—ScreenOS 6.1.0 adds support for highavailability (HA) and management (MGT) zones on the SSG 5 and SSG 20 devices.
When you start these devices for the first time, the device adds the HA and MGTzones by default.

■

Option to Configure Email Virus Scanning Action—ScreenOS 6.1.0 provides
an option to configure the action that the security device should take if a virus
is found in an email. You can choose to have the security device drop the infectedemail or send a notification mail to the intended recipient with the infected email
replaced with an alert message.

■

Firmware Information—ScreenOS 6.1.0 adds information about the firmware
and its components to the output of the get system CLI command on an ISG
1000 or ISG 2000 device.

■

Bgroup PPS Counters—ScreenOS 6.1.0 now displays packet-per second counterson bgroup interfaces.

■

VLAN Capacity Increase—ScreenOS 6.1.0 now supports up to 4094 VLAN
interfaces on ISG 1000/2000, ISG 1000/2000-IDP, and NS5x00 series devices
when operating in Transparent mode.

■

TCP MSS Modified for Bidirectional VPN Traffic—The TCP Maximum Segment
Size (MSS) value for bidirectional VPN traffic can now be modified in the CLI.
The new CLI command set flow vpn-tcp-mss number sets the same MSS for both
inbound and outbound traffic. In prior ScreenOS releases, the CLI set flow tcp-mss
command worked only for outbound VPN traffic.

NOTE: The older command still works, but any value set using it will be overlaid if
the new command is run. Running unset flow vpn-tcp-mss will cause the device toonce again use the earlier value and permit use of the older command. When no
MSS value is given, the default setting is 1350; when the new command is used, an
MSS value configured by set flow tcp-mss will not be valid even if set flow tcp-mss is
run again. [261891]

20■

Changes to Default Behavior

NSM Compatibility

NSM Compatibility
This section provides information about updates required to complementary Juniper
Networks products to ensure compatibility with ScreenOS 6.1.
Netscreen-Security Manager (NSM) 2008.1 and successive versions support devices
running ScreenOS 6.1 natively.
Netscreen-Security Manager (NSM) 2007.3 requires the Forward Support Update
software to manage devices running ScreenOS 6.1.
To do this, install a schema upgrade on the management server and user interface.
The upgrade is available at http://www.juniper.net/customers/support/.
Refer to the NSM Forward Support for ScreenOS 6.1.0 Release Notes for installation
instructions and the features and platforms supported with this schema upgrade.

Detector and Attack Objects Update (only for ISG-IDP)The Detector Engine shipped with this ScreenOS version is 3.4.121591. Refer to the
Detector release notes for more information on the availability of new releases.
To update the detector and attack objects database:1.

Download the latest detector and attack database to the NSM GUI server. From
NSM, select Tools > View/Update NSM attack database and complete the wizard
steps.

2.

Push the detector update to ISG-IDP devices. From NSM, select Devices > IDP
Detector Engine > Load IDP Detector Engine and complete the wizard steps.

3.

Push a policy update to ISGIDP devices. From NSM, select Devices >Configuration > Update Device Config and complete the wizard steps.

Addressed Issues in ScreenOS 6.1.0r7
The following operational issues were resolved in this release:
Administration■

405317—The device erroneously reports the user was in use by L2TP, but it isnot, and prevents editing of the user.

■

412352—Net-buffer leak caused multiple SSH tasks to compete for the same
resource and series of dots appeared on the console.

■

432014—The authorized user with read and write privileges was able to issue
the set admin password command due to which some user privileges were lost.

■

433456—The original source and destination address were missing from the log
to USB flash.

NSM Compatibility■

21

ScreenOS 6.1.0 Release Notes■

445431—After a reboot, local configuration setting such as manage-ip or
hostname were lost.

■

456056—An warning message was displayed when the service with more than
16 dst ports was specified.

■

456101—[ISG, NetScreen-5000 ] The port mirror command displayed erroneousFailed command - set mirror port source ethernet4/1 destination ethernet1/1
message on console bootup, even though the command exists in configuration
file and was working.

Application Layer Gateway (ALG)■

427463—New SQL, RTSP, H.323, SIP, SCCP connections failed due to an RM
group leak.

■432666—The device reboots unexpectedly due to improper handling of RTSP
ALG.

■

446420—Microsoft WMI control service failed in some scenario.

■

447395—MS-RPC ALG mapping sometimes skipped an entry.

■

436526—Under certain condition, FTP PASV communication failed in control
session when UTM was enabled.

■

440546—The antivirus scanning process stuck-up the SMTP sessions if the client
was using SMTP DSN (Delivery Status Notification) and the recipient's e-mailaddress contains word QUIT.

■

444440—The firewall might reset if antivirus scanning was turned on for thelatest version of AIM service.

■393301—During Web authentication, when an ACK packet was received, thefirewall erroneously sent out a FIN packet to end the session.

■

416043—The device does not clear the existing System Information Block (SIB)
while the associated radio caused authentication to fail.

■429374—Re-authentication for dot1x was not handled as expected.

■

454779—Authentication fallback to local database failed for trustee administration
users.

■

425920—The set smtp drop-virus-infected-email command was not saved into
the configuration.

■

432204—After executing the IDP command and on pressing Ctrl+C, the debug
data was missing and displaying only the timestamp.

Antivirus

Authentication

CLI

22

■

Addressed Issues in ScreenOS 6.1.0r7

Addressed Issues in ScreenOS 6.1.0r7■

435979—[SSG 500] Output of the get chassis command does not include PIM
name.

■

447541—[NetScreen-5000 M3] The clear session frag command was not working
as expected.

■

410393—Automatic DI Signature update failed when tried to update offline fromthe local server.

■

439093—Unable to update attack db for worm sigpack.

■449213—[ISG 1000/2000] Using VSI interface, unable to pass the traffic throughback-to-back VPN after IDP was enabled.

■

400824—DNS dynamic cache table does not display correct information.

■

436514—No sanity check for time-to-live on DNS host caused abnormal condition.

■

444576—DNS proxy was case sensitive for Domain Names.

■

447199—The DNS configured on the device using source-interface does not getapplied when configured using WebUI.

■

432267—The MS-timezone GTP Information Element was not removed when
set remove-r6 was configured.

■

437975—When GTP inspection was enabled, occasionally a GTP Echo Response
might drop and the message bad state (message) was showed in the log.

■

438896—With GTP inspection enabled, a CreatePdpResponse that contains a
duplicate TEID for the control or data plane was dropped.

■

422747—[ISG] In Active/Active mode, Fin packet in NSRP data path was notcorrectly processed when SYN-CHECK was enabled.

■

424242—When performing an NSRP failover, the route pointed to a different
tunnel interface. However, the synchronized session continued to point to the
old SA tunnel.

■

437661—The RIP and OSPF MD5 authentication results in NSRP configuration
were not in synchronization.

■

438794—Backup NSRP firewall lost synchronized OSPF routes.

■

439450—On certain occasions, the interface flap messages were triggered
incorrectly.

■

447031—Backup device in NSRP cluster received corrupted HA packet and thatcaused some bits to be processed incorrectly, and the device to reset.

DI

DNS

GPRS

HA and NSRP

Addressed Issues in ScreenOS 6.1.0r7■

23

ScreenOS 6.1.0 Release Notes■

450083—In certain situations, with IPv6 enabled, NSRP data forwarding of IPv4
would have failed.

■461079—[NetScreen-5000] The Backup firewall would prematurely remove thesessions on the Master in a VSD-less NSRP cluster and cross-ASIC traffics.

■

463752—In NSRP Active/Active mode, if tcp syn-check was enabled, could not
update the session after the 3-way TCP handshake was completed.

■

427754—IDP engine core dump occurred when invalid memory resources wereaccessed.

■

428910—Packets re-ordered after IDP inspection with syn-check enabled due
to delay in 3 way handshake.

■

431797—Packets were dropped when the TCP Error Reassembler Packet
Memory Exhausted signature was enabled.

■

401157—Unable to log on to the master device when NSRP failover occurs withIC configured.

■

424853—The get config datafile command does not support for Update From
Upstream DHCP Client on Int. interface.

■432393—IPv6 policies were not being verified correctly using exec policy verify.

■

438684—The set flow mac-cache-mgt command was not working for managementof the backup firewall using the Master firewall.

■

439271—If Ping was initiated from the firewall and the destination was notreachable, the task CPU was high during the ping.

■

439970—Firewall reported wrong H.323 port information in NSM Protocol
Distribution.

■

440766—NSM Agent caused negative session count in NSM.

■

443213—In some scenarios, TFTP control block would be freed in other taskthat caused crash or stimer list broken.

■

447726—Parser error message StreamSetListParser was displayed on NSM
while updating the device.

■

448761—Unable to set password complexity scheme using NSM.

■

289915—The reserved dip ID is checked incorrectly when a policy was configured
with wildcard or group in NSM.

■

403509—DIP leaked when a loopback interface for cross-Vsys was usedsimultaneously with a loopback group in the destination vsys for outgoing DIP
NAT.

IDP

Management

NAT

24

■

Addressed Issues in ScreenOS 6.1.0r7

Addressed Issues in ScreenOS 6.1.0r7■

442461—Service mapping for Sun or MS RPC showed incorrect IP mapping
when dst-nat was used.

■

443304—[NetScreen-5000, ISG series] Peer-to-Peer and ichat ALGs wereincorrectly enabled on reboot and therefore MSN, Yahoo Messenger and AIM
traffic was not processed by ASIC in hardware sessions. This situation could
cause high CPU utilization if the traffic load for these services was high. This ALG
is not applicable to these platforms and was disabled.

■403895—[ISG 2000] There is no ALG to handle REXEC traffic.

■

426875—The device got disconnected from IC, even though the device wasreceiving CLI commands from the IC.

■

427094—Occasionally, the connection between the Catalyst switch and the
Copper Gigabit Interface with Manual duplex setting was down.

■

429634—Fragmented packets entering the VPN were dropped when theipsec-dscp-mark environment variable was set to yes.

■

430210—The device rebooted unexpectedly when a SQL server with TCP
fragments was accessed.

■

431675—Defragmentation limit changed to support up to 65535 bytes of IP
packet.

■431944—In transparent mode, MPLS pass-through traffic was dropped.

■

431994—The DHCP server ignored the broadcast bit in DHCPDISCOVER.

■

432190—[NetScreen-5000 M3] VLAN re-tag does not work properly with 10 Gig
interfaces.

■

433329—Websense failed due to incorrect session flag for URL_BLOCK and the
debug message "Unknow message type: 8e" appeared in debug flow basic.

■

434988—The device rebooted due to IPSec pass-through traffic.

■

435161—The get led command showed wrong LED power status.

■

435348—[SSG 5/20, SSG 140, SSG 500] Firewall would reset due to an exception
dump before the bootup process.

■436214—The device rebooted while running in a high memory condition.

■

436622—[SSG 140] The alarm LED did not turn red when large ICMP was
detected.

■

437101—Unable to renew certificate using SCEP with samekey option.

■

437164—Interface flapping occurred on some versions of NS-ISG-SX2 card.

■

437660—Firewall rebooted due to MGCP traffic.

■

438488—The firewall would reboot during the certificate validation process if
the certificate was used for IPsec peer authentication and PKI source interface
was not defined.

■

439211—The pause frames sent from a switch on 4 port FE PIM card would
erroneously be detected as in misc.

Other

Addressed Issues in ScreenOS 6.1.0r7■

25

ScreenOS 6.1.0 Release Notes■

440103—The device reboots when an IP-Classification of an unused zone wasdeleted.

■440113—IPv6 Neighbor solicitation messages from source "::" were dropped
by IP Spoofing.

■

441723—The firewall did not sent the TCP RST for the traffic that matched IPv6REJECT policies.

■

442251—The device reboots due to keepalive sent between firewall and Infranet
Controller.

■

445511—The device was unstable and a net-pak leak occurred when an internal
flag was changed abnormally.

■

448711—The device reboots as the antivirus task exists when accessed an invalid
address.

■

449801—VRRP Traffic did not appear in self-log.

■

450141—[SSG 500] The FCB timeout can be set from 1 to 300 seconds using
the set fragage command.

■

450681—System instability would result in ScreenOS if the DHCP client on thefirewall interface value was Null.

■

450819—[ISG] Interface does not get updated with new MTU value when Jumbo
frame was enabled.

■

456237—Unable to handle the EPSV command in the firewall.

■

458280—In Configuration > Report Settings > Log Settings, the USB link
redirects the user to wrong page.

■462783—Under certain conditions, sessions with timeout of 0 or 1 were neveraged out of the firewall.

■

429821—TCP 3-way handshake packets were randomly dropped due to a
problem in TCP SYN-check feature.

■443567—When the FTP activity through the firewall was high, the backup firewallin the NSRP cluster would go high in CPU.

■416966—When a route was displayed by get route command some of the flags
were not freed, and the firewall rebooted. The route was frequently added anddeleted by changing dynamic routing.

■

427872—When OSPF demand was enabled or disabled, the SPF database was
not in synchronization.

■

429461—For the default route, access-list 0.0.0.0/32 could be configured
incorrectly instead of 0.0.0.0/0.

■

430932—Secondary VPN Tunnel configured with point to multi-point OSPF
stopped in ExStart.

Performance

Routing

26■

Addressed Issues in ScreenOS 6.1.0r7

Addressed Issues in ScreenOS 6.1.0r7■

433904—The OSPF route update failed due to wrong cost value used for external
type 2 routes.

■

437283—The NSRP route synchronization failed if the master device’s next hop
was a virtual router.

■

439759—Firewall would reboot, when an access-list that is tied to a RP
configuration for multicast was unset.

■

442034—Status change of tunnel or VSI interface should be handled for route
advertisement.

■

433848—Synchronization of flood source and destination threshold failed with
IPv6 traffic.

■

420306—H.323 Avaya VoIP calls failed due to an ASN.1 decoding error.

■

431762—During an upgrade to ScreenOS 6.1.0r5, MGCP-related messages weredisplayed on the console.

■

431830—SIP communications failed as the RPORT parameter was not taken
into consideration in the ALG.

■

442660—VoIP calls using SIP failed randomly due to incorrect format of INVITE
message.

■443259—SIP ALG cannot parse the quoted boundary in content-type:multipart.
For example, content-type: multipart/mixed;boundary="boundary3".

■

443828—H323 phone did not function because of H323 ALG mishandling.

■

430028—The device rebooted when SCEP auto renewal of the same key was
performed.

■

432400—The IKE/IPSec pass-through ALG did not work when the loopback
interface was used as source for NAT.

■

433589—Global settings for IKE timers were not propagated to individual IKE
gateways.

■439332—[SSG 5, SSG 20] VPN using AES-SHA dropped unexpectedly due to a
hardware specific cache problem.

■

442719—Unable to configure a C Class Broadcast IP address for the IKE Gateway
address.

■

451210—VPN traffic failed when IPv6 was enabled in an NSRP Active/Activemode with NSRP Data Forwarding enabled.

Security

VoIP

VPN

Addressed Issues in ScreenOS 6.1.0r7■

27

ScreenOS 6.1.0 Release Notes

WebUI
■

418815—In WebUI, editing a multi-cell policy gave unexpected results.

■

444967—The WebUI erroneously allowed options to configure VIP in non-root
VSYS on a non-shared zone that was not supported. This option was removed
from the WebUI.

■

453298—Advanced Policy Settings could not be configured using WebUI.

■

446866—Global settings for IKE timers were not propagated to individual IKE
gateways.

Addressed Issues from ScreenOS 6.1.0r6
The following operational issues were resolved in this release:
Administration

28

■

■

202421—After a reboot, the unset admin hw-reset command was not saved.

■

309090—The SSH session dropped due to Cygwin OpenSSH client having active
setting.

■

403134—RFC MIB for ifAliasm FW returned an empty space character (“ ”),
instead of a null string.

■403310—A URL category name with string “BL” could not be removed.

■

412072—After the “Ctrl+C” and “Ctrl+Z” actions, some event log entries were
blank .

■

414839—The policy logs in the syslog did not show the correct FTP data thatwas sent or received.

■

416873—After a reboot, some event log entries were not recorded in the syslog
file, when the syslog was configured using UDP.

■

416915—Incorrect metrics were returned when queried for the SNMP MIB
variable NsVrOspfIfMetricEntry.

■

418197—The traffic logs sent using e-mail reported an incorrect port number.

■

420873—The forbidden command unset int tun.1 zone could not be executed.
The command is removed from the CLI.

■

421033—The forbidden command unset int tun.1 zone could not be executed.
The command is removed from the CLI.

■

428631—In the Transparent mode, bandwidth option for interfaces in layer 2
zones were missing.

■428795—The ADSL interface showed incorrect physical downstream bandwidth.

■

429883—The MSS-based sockets were changed on the new accepted socket.

Addressed Issues from ScreenOS 6.1.0r6

Addressed Issues from ScreenOS 6.1.0r6

Antivirus■

402935—The system failed when the Antivirus module issues floated point
instruction.

■

424606—Firewall was not able to connect to Infranet Controller (IC) when the
IC name instance was configured instead of Internet Explorer (IP).

■422196—The device was unable to obtain the DHCP address as the device used
the wrong option in the offer packet.

■

408269—The Deep Inspection (DI) database failed to update due to a memory
leakage introduced in the DI update process.

■426280—The attack db rollback command did not work on some platforms. For
the other platforms, the result of the command was logged as either successful
or failed in event log.

■

417630—When GTP inspection was enabled, the CrPdpResponse packet was
not inspected when SGSN used a high source port and the GGSN used GTP
pooling.

■420613—When GTP inspection was enabled, ICMP Destination Unreachable
packets of the GTP session were dropped.

■

422979—When GTP inspection was enabled, occasionally a DeletePdpResponseor EchoResponse dropped and the message “non-existent gsn” appeared in thelog.

■

426075—With GTP inspection enabled, a CreatePdpRequest that contains a
duplicate TEID for the control or data plane was dropped.

■

285992—The output of the exec nsrp sync global-config save command was notsent to the debug buffer get db stream.

■

402911—In Transparent mode, under a high traffic load, a multicast traffic leakedon the secondary device.

■404981—When the DHCP server mode was set to “auto” in the NSRP cluster,
the standby box transmitted DHCP discover when a corresponding interface wasactive. This packet caused a traffic interruption by confusing the MAC tableconnection to the L2 switch.

Authentication

DHCP

DI

GPRS

HA and NSRP

Addressed Issues from ScreenOS 6.1.0r6■

29

ScreenOS 6.1.0 Release Notes■

408567—With the method “arp”, Track IP failure time was longer than theconfigured “interval” and “threshold”.

■

423780—When high availability (HA) synchronization was blocked internally,
the firewall would reboot multiple times.

■

408401—[ISG 1000/2000] The device failed due to access to a null pointer whenboth the NSRP and IDP features were used.

■

415094—[ISG-IDP] IDP engine core dump occurred due to buffer overrun
condition.

■

392249—The SNMP read-only queries returned read-write strings.

■

394595—New policy would not take effect if managed using the NSM and CLI.

■

398568—The SNMP query of MIB the object vrRouted in NETSCREEN-VR-MIB
returned an IP address instead of an integer.

■

400183—When unnumbered tunnel interfaces were used in a route-based VPN,
the nsVrOspfIfIpAddress could not be queried .

■411075—If the hash value for the SSL certificate used for https management
starts with a zero, the delta configuration from the NSM would occasionally reportconfiguration difference between the device and the NSM.

■

411209—NSM get config datafile was not in synchronization with the firewall
get config saved due to the route table next hop.

■411492—When users saved the traffic log of the policy using WebUI, the “Close
Reason” did not appear in the log data.

■

411862—The get config datafile that included radius attribute “calling-station-id”,
caused NSM synchronization problem with the firewall configuration.

■

414778—[SSG-5, SSG-20] The access to a bgroup0 interface manage-IP failed
when bgroup0 interface had a new port binding.

■

415871—When the get config datafile command was issued, a trace dump
appeared on the console preventing NSM import.

■

412278—The internal algorithm used to allocate resources for interface NAT(Pport) did not allocate the resources evenly.

■

419638—The RTSP ALG failed to allocate an RTSP cookie due to a memory leak.

■

427480—NAT DST failed when IP was included in an existing DIP pool.

IDP

Management

NAT

30

■

Addressed Issues from ScreenOS 6.1.0r6

Addressed Issues from ScreenOS 6.1.0r6

Other
■

257164—URL filtering using Websense failed as the source and destination
addresses in the Websense packet were reversed on the SSG platform.

■

305815—The fragmented ICMP packets that were out-of-order were dropped.

■

307357—[SSG 300M-Series] The status of fan in get chassis was not accurate.

■

310021—The IGMPv3 report packet was delayed when the state of the hostinterface changed.

■

314819—The device failed if VPN traffic was asymmetrically routed using a selfinterface.

■

314846—DIP sticky could not use DIP pools that had sizes greater than one halfof the maximum size of the device.

■

389098—Unexpected results were displayed when the AIM module considered
IPv6 addresses as IPv4 addresses.

■

389786—The “no arp entry” counter was not displayed in the get counter stat
output.

■392208—The flow CPU value increased as a result of packet looping.

■

394959—The device unexpectedly rebooted due to a failure in the memory
allocation.

■

395323—The device was reset when a malformed VPN packet with a destination
address as multicast, unexpectedly went through a high availability interface.

■395341—The device would occasionally fail when RPC traffic was handled.

■398117—HTTP Redirect to an Infranet Controller failed when the client used an
HTTP proxy.

■402228—When UDP flood protection reached the threshold, the firewall leaked
one extra UDP packet.

■

402919—Under a high traffic load, the interface counter on the ASIC platform
was not accurate.

■

403350—In some situations, NSM was not able to update the policy on the device
and the device reported the “invalid dip id 2” error.

■

404582—The RTCP packets did not prevent the RTSP session from timing out.

■

405788—The PPTP ALG caused the firewall to reset.

■

406336—The device rebooted due to an internal error when an NTP task wasprocessed.

■

406495—Invalid entries related to the “bgp snmp” were logged and displayedby the get log sys command.

■

407396—The DIP table erroneously showed 100% utilization, even though there
were DIP resources available.

■

407881—Some RTSP traffic failed when connected to an odd numbered RTP
port.

Addressed Issues from ScreenOS 6.1.0r6■

31

ScreenOS 6.1.0 Release Notes

32

■

■

408134—The device was reset unexpectedly when an HTTP session was released
while receiving a response from the Websense server.

■

408158—The device was reset due to a corrupted ASIC session pointer.

■

408184—When scripts with CLI commands using more stack space were run,the device automatically rebooted.

■

410010—Removing a VSI or subinterface from a bridge group removed theentire bridge group configuration.

■

411770—When a L2TP packet was received, the dump data was erroneously
sent to dbuf.

■

412156—The firewall did not accept Gratuitous ARP requests when the “arpnat-dst” option was set.

■

412160—[NetScreen-5000] VPN fragmented traffic for cross-ASIC sessions was
dropped■413443—When the firewall issued multiple pings, there was a delay in response.

■

413449—In certain situations, an edit duplicated the VPN policy caused a systemcrash.

■

413775—[ISG] The set sat sess-close [0|1] command did not function as
expected.

■

414357—After a certain time, TCP socket leak caused loss to the management
access as a result, the CLI output for the get tcp socket showed sockets in “close”
or “closing” state.

■416573—When the debug command was run, the redundant debug information
was removed.

■

419654—[NetScreen-5000] Fragmented packets of cross-chip ASIC VPN traffic
were dropped.

■

420541—The number of spaces in the syslog message was inconsistent.

■

420676—When a FTP client sent data, the PASV FTP client was unable to open
a gate.

■421293—[SSG-5, SSG-20] An interface failover or fallback did not occur when
multi-link interfaces were used.

■

422068—Clearing the authentication table entry based on the IP cleared theentire authentication table.

■

422340—The Webauth redirection failed when the HTTP request HOST-LINE
was split to two packets.

■

422710—In Transparent mode, when the manage-IP address differs from thatof the VLAN1 IP address, only the VLAN1-IP address was pinged. The ping did
not include the manage-IP address.

■

423471—[NetScreen-5000, ISG] In certain situations, session in Transparent
mode never aged out.

■

423540—When loopback function was checked, the device rebooted due toincorrect status of outgoing interface.

Addressed Issues from ScreenOS 6.1.0r6

Addressed Issues from ScreenOS 6.1.0r6■

424182—The CPU did not decrement the TCP RST packet ttl, resulting in an
infinite loop.

■

424649—Multicast fragmented traffic was unnecessarily merged and dropped
on the firewall.

■

425461—When Webauth was enabled on the firewall and the user was redirected
to a framed Web page, Internet Explorer (IE) 7.0 went into a loop if pop-ups
were disabled.

■

425564—The second ISDN channel status was not set to UP.

■

427730—[NetScreen-5000 MGT3] In Transparent mode, cross-ASIC TCP traffic
using a VLAN tag was dropped.

■

431212—In Transparent mode, the device rebooted because the VLAN interface
did not have a backup.

■

394094—On an ISG platform with Jumbo frame support enabled, only one FIFO
channel was enabled instead of two FIFO channels.

■

405001—[NetScreen-5000, ISG] UDP fragments dropped due to malfunction in
the ASIC chip (PPUC) .

■417766—Interface bandwidth to multiple tunnel interfaces could not be
configured.

■

417872—Traffic did not pass due to a problem in handling the ESP-Null packet
in ASIC.

■

268031—The number of OSPF routes were unexpectedly reduced as a result of
an internal function failure.

■402531—The IGMP session was refreshed unexpectedly when the IGMP proxyshared the same mroute with a static mroute.

■

404458—The device rebooted when an invalid BGP origin attribute was received.

■

416416—The access list was enforced in the Policy-based routing after it wasdeleted.

■417320—When an attempt was made to initialize a type 7 LSA, some OSPF
routes were lost.

■

418152—Gateway tracking in the Vsys created duplicate routing entries.

■

425573—When the device restarted, the OSPF demand-circuit or reduce flooding
caused partial loss of the routing table.

■

410696—For the account-type 802.1X, the auth-server src-interface traffic wasoriginated as “self” instead of the specified interface.

Performance

Routing

Security

Addressed Issues from ScreenOS 6.1.0r6■

33

ScreenOS 6.1.0 Release Notes■

413037—The firewall considered the link-local IPv6 address of the peer as IP
spoofing.

■

464534—CVE-2008-5077 OpenSSL incorrect checks for malformed signatures
were addressed.

■

297158—The device was reset unexpectedly as the endpoint deletion was nothandled properly with MGCP.

■

393140—When the SIP ALG was disabled, the device resets unexpectedly withheavy SIP traffic.

■

406871—An MGCP ALG call transfer did not work as expected.

■

410097—When a SIP register request was processed, the device rebooted due
to an internal error.

■

421768—When the H323 ALG was enabled, the H323 RAS admissionConfirm
packets were dropped.

■304277—If there was heavy IPSec traffic, the ISG firewall would drop packets
incorrectly.

■

395312—When Baltimore Unitrust CA was used, the PKI negotiation using the
SCEP failed.

■397917—In Transparent mode, the device was reset when a tunnel packet withan incorrect destination MAC address was received.

■

403260—The proxy-ID in a dial-up VPN did not match with multiple VPN policies.

■

411673—DH keys triggered a firewall crash.

■

422327—[SSG] The IPv4 address was set incorrectly in an IPv6-in-IPv4 tunnel.

■

400895—The outgoing interface of proxy DNS could not be modified.

■403443—Gateway Tracking could not be configured using the WebUI.

■

405079—High CPU utilization and packet loss resulted when an object was unset
from a multi-cell policy using a software policy search.

■409068—In the Security menu, an IP address port field could not be set in theproxy settings.

■

413447—The proxy settings for a DI Attack Signature update was not displayed
as expected.

■

414310—In event log entries, for “logged out” of Web (http, https) management,
both the src.port and dst.port were incorrect.

■

416971—[SSG-5, SSG-20] The output for the get chassis command was missing
when the “get tech” command was issued from the WebUI.

VoIP

VPN

WebUI

34

■

Addressed Issues from ScreenOS 6.1.0r6

Addressed Issues from ScreenOS 6.1.0r5■

424074—The DNS Proxy checkbox on the loopback interface was removed fromthe WebUI.

■

425929—The ScreenOS CLI allowed the creation of a policy with DSCP-marking
enabled and no DSCP value defined. However, when the policy was createdusing WebUI, a DSCP value had to be set.

Addressed Issues from ScreenOS 6.1.0r5
The following operational issues were resolved in this release:
Administration■

223845—An interface assignment to a zone cannot be changed when the
traffic-shaping is enabled.

■

255412—[SSG 500] Unable to upgrade bootloader remotely. The save boot fromtftp <ipaddress> <filename> to <destination> command allows the administrator
to upgrade the bootloader remotely using tftp.

■

306796—An incorrect "Anti-spam is detached from policy" message is generated
when the policy is created or edited using the WebUI.

■

309023—Unable to manage the device using OpenSSH 5.1p1.

■

314252—[SSG] Onboard interfaces on a SSG firewall might randomly show
half-duplex, even after manually configured as 100 MB/Full.

■

387163—Admin login fails when crossing Vsys.

■

388689—TACACS authentication does not send auth-server connect_origin field.

■

390553—OSPF MD5 authentication password shows up in event logs in clear
text.

■

392254—The WebUI idle timeout cannot be changed when using external Authserver with Auth admin users.

■

395477—Device does not authenticate to backup external authentication server.

■

398432—For the type TACACS, "auth-server scr-interface" does not work andtakes the IP address of the outgoing interface instead of the configured
scr-interface.

Addressed Issues from ScreenOS 6.1.0r5■

35

ScreenOS 6.1.0 Release Notes

Antivirus■

299978—Antivirus scanning of MSN Instant Messaging might cause task CPU
high.

■

392417—The command set tag <number> under Vsys gets configured incorrectly.

■

308106—The device might reset when the DNSA task is not processed on time.

■391177—Task CPU might go high due to DNS when an address book entry is
modified from one domain name to another domain name.

■251324—Primary and backup interface keeps flapping after track-ip has failed
until the firewall is rebooted.

■

295846—The device in an NSRP cluster resets when the device is trying to update
and resolve the DNS entry.

■

302374—The CLI command unset admin hw-reset causes out of sync state
between the NSRP cluster members.

■

307921—[ISG] Under heavy load, both members of the NSRP HA cluster might
become Master.

■

312711—The device resets due to malformed IKE P1 NSRP RTO object.

■389357—NSRP configurations went out of synchronization due to Vsys profile
configurations.

■

389495—In Transparent mode, the management traffic to backup firewall, which
passes through the master firewall might cause packet loop.

■

401403—A change in the NSRP VSD group init hold time is not saved to the
flash. Hence, the configuration is not retained after reboot.

■266093—Unable to manage the custom URL category within the custom Vsys.

■

309253—Unable to ping the interface IP from inside device when the interface
IP and manage-IP are different.

■

309587—When the SSH is enabled in a large number of Vsys in a short time,
the Task CPU becomes high for a long time and management of the device might
be lost.

■310298—When an interface inside a virtual system (Vsys) is configured to be
NTP server, the NTP-server configuration line is incorrectly placed in the root
Vsys configuration.

CLI

DNS

HA and NSRPManagement

36■

Addressed Issues from ScreenOS 6.1.0r5

Addressed Issues from ScreenOS 6.1.0r5■

313417—When the command exec policy verify is executed on any SSG platforms,
the policy verification fails.

■

387338—When the SSH from an HP-UX client to the firewall fails, the task CPU
becomes high.

■391304—The duration of time reported by policy traffic logs is shorter than theactual time duration.

■

391755—Device loses connectivity to NSM for every 8 minutes.

■

394878—Hardware counters are not collected correctly.

■

303836—Device does not translate ICMP sequence number properly when
receiving ICMP echo response if both original ICMP ID and sequence number
are 0.

■

308572—Pinging a DIP IP address results in routing loop with upstream device.

■311682—Packet drops due to DIP allocation failure when the policy is modified
from fix-port to non fix-port.

■

311907—When the CCRQ message is sent from server side, the PPTP session
closes and the child GRE sessions are not cleared.

■

389221—PPTP ALG does not clear xlate table when PPTP connection fails fromthe client.

■

277712—When using snoop command, “ip6hdr_info_extract: extract failed”
messages are filling up the debug buffer.

■

288649—[ISG, NetScreen-5000] Internal buffer leak causes some traffic drop.

■292941—Counter Statistics for the bgroup interface does not correctly reflect
the amount of traffic passing through the interface.

■301623—The integrated URL filtering does not work if the HTTP request header"hostname" includes port number.

■

303202—Device might reset due to long loop in one of the RTSP ALG's internalbuffer.

■304208—The device might reset when the illegal memory is accessed.

■

306168—After the Web Authentication with a "&" in the URL, the "&" characteris removed by the firewall.

■

307814—The HTTP 302 redirect fails to send out when the UAC authenticationis stuck in pending status.

■

308408—The ICMP flood protection option in the Screen feature allows one
packet more than the configured threshold.

■309001—[SSG 500] Interface link might go down intermittently causing somepacket drops.

NAT

Other

Addressed Issues from ScreenOS 6.1.0r5■

37

ScreenOS 6.1.0 Release Notes

38

■

■

309168—Device displays the erroneous messages regarding the connectivity
status of the Juniper 1GE LX Optics SFP transceiver.

■

309986—The event "DHCP server IP address pool changed" is generated whenthe IP address of the untrust is changed.

■

310435—When installing the policy tree, access of an illegal memory mightcause the firewall to fail.

■310566—With SSG5 (Country code of TELEC), Extended Channel might bedisabled after reset.

■

311743—Duplicate message is displayed when the configuration is saved using
the WebUI.

■

312442—Under certain conditions, the packet might gets dropped for RSG traffic,
as the child session is aged out when its parent is closed.

■

313379—The firewall does not accept an infranet auth table entry when it
contains '\o' as a part of the user name.

■314353—[NetScreen-5000 M3] IPv6 does not pass through in transparent mode
unless the IPv6 envar is enabled.

■

314402—The tranceivers JX-SFP-1GE-T with the part number 740-013111 always
show link up even when the cable is disconnected.

■

315248—Wireless interface cannot initialize when scheduler is enabled in config.

■

387143—The alarm LED is cleared automatically without issuing the "clear led
alarm" command.

■

387902—When the UAC changes its MTU, the SSL task accesses a closed nullsocket pointer and the device resets.

■

390285—When the attempt to remove an individual filter from the eight snoop
filters is unsuccessful, the error message “Max snoop filter number reached” isdisplayed.

■

391558—Under certain conditions, for the same packet, the interface flow
counters might increment twice and the hardware counter might increment
once.

■

392411—The BRI interface configured as backup does not come up when primaryinterface is down.

■

392767—The device might reset when SYN attack is sent using either subinterface
in route mode or VLAN trunk configured in transparent mode.

■

395279—Execution of the command exec policy verify holds on to the CPU forlong time. This causes device to reboot.

■395491—Web task goes high when receiving the wrong rcv_window condition.
This causes high CPU on the device.

■

396878—The "auth-server src-interface" traffic is originated as "self" instead of
the specified interface.

■

397423—Traffic fails when there is a duplex mismatch between firewall andsome switches.

■

399247—The set alarm snapshot CPU trigger command does not produce an
output in the get alarm snapshot CPU all command.

Addressed Issues from ScreenOS 6.1.0r5

Addressed Issues from ScreenOS 6.1.0r5■

401773—ISG chassis might have problems detecting some of the mini-GBIC
interface status when under heavy traffic.

■

417286—[NetScreen–5000, ISG series] Data corruption might cause ASIC chipto get stuck and stop forwarding traffic.

■

297405—Inter-Vsys traffic gets dropped unless it goes through an ALG or is ICMP.

■

299621—Task CPU runs high once for every other second.

■313904—[NetScreen-5000 MGT3] Packet is dropped due to internal congestion
control mechanism.

■

314096—Heavy H.323 traffic might cause device to reset due to a null pointeraccessing.

■

315217—[NetScreen–5000-2XGE/2XGE-G4] The hardware sessions that are notload balanced in FPGA on backup device cause performance drop after failover.

■386698—Syslog causes more miscellaneous error and discard packets that causes
packet drops.

■

256473—Traceroute across an intrazone route based VPN fails.

■

277755—High CPU in task when deleting more than 30 RIP routes.

■

312513—When the RIP demand-circuit is used on a tunnel interface, the RIPneighbors are lost after NSRP failover.
W/A: Configure the RIP neighbors statically.

■

312623—Firewall calculates an incorrect checksum for PIM register packets.

■

389669—Firewall fails to announce BGP network prefix if the same is configured
as BGP aggregate route.

■

394777—Device incorrectly allows the configuration of PBR next-hop of 0.0.0.0
with no interface specified.

■395594—PBR entry ID greater than 128 does not take effect.

■398075—When connected networks are redistributed into RIPng, the advertised
address contains the host part instead of subnet only.

■

398277—OSPF adjacencies were lost due to an FPGA error.

■

398950—End of DST (Daylight Savings Time) caused OSPF to flap.

■

400333—Device reboots due to an invalid pointer when clearing mroute object.

■276513—SIP application error, “Due to stack unable to handle empty display
name”.

■

309859—PPORT paired ports were not released completely after an Avaya H.323
phone call was completed.

Performance

Routing

VoIP

Addressed Issues from ScreenOS 6.1.0r5■

39

ScreenOS 6.1.0 Release Notes■

310081—Device changes remote IP address within SCCP payload, causes a silent
listener of an agent's call to fail.

■313085—In some scenarios, SIP cancel messages fail through the firewall.

■

393342—SIP ALG complaining about "policy not found" might result high CPU.

■394454—Device might reset due to SIP ALG complaining about "policy notfound".

■

405078—Device resets due to SIP ALG doing an extra NAT translation.

■

305067—Device incorrectly decrypts the VPN packet with certain TTL value.

■

308404—PPTP connections are aged out prematurely.

■

309216—In some scenarios, CRL renewal process fails when renewing CRL on
the last or first day of the month.

■

387544—When peer_entry for ID payload is checked, then the nat_traversal
VPN fails to establish the VPN. This is due to usage of wrong logic.

■

389414—Under a certain condition, decryption for incoming VPN packets fails.
This is due to incomplete incoming key installation when the commit bit isenabled.

■395216—Fragmented packets of cross-chip ASIC VPN traffic are dropped.

■

307314—The WebUI does not accept zero value for ISDN interface"load-threshold" setting.

■

309725—The WebUI displays incorrect value of DNS cache TTL.

■

311759—Using the WebUI, unable to configure traffic shaping parameters, PBW,
and GBW.

■313278—When connected through SSL VPN proxy, unable to manage the firewall
using WebUI.

■

408978—Unable to unset the address in a multi-cell policy from WebUI.

VPN

WebUI

40

■

Addressed Issues from ScreenOS 6.1.0r5

Addressed Issues from ScreenOS 6.1.0r4

Addressed Issues from ScreenOS 6.1.0r4
The following operational issues were resolved in this release:
Administration■

283897—Instead of null, the SNMP counters for multilink interfaces are zero.

■

292227—The SSG 140 device does not load the operating system after a restart.

■

293248—Information of both source port and destination port in an event log
entry for WebUI access is not correct.

■

298873—When the Application ignore is configured on a policy, then the groupservice cannot be added.

■

299024—If the connection to the IC module breaks and if the IC module isconfigured with a DNS entry, then the DNS entry is updated.

■

299556—The event log does not log service timeout modification as aconfiguration change■

300282—When a policy is disabled, then the traffic shaping parameters of thatpolicy are lost■

306719—On authentication, the additional group information does not get
propagated to the backup device if the device is tied to multiple groups.

■

286714—In some cases, the Antivirus pattern files are missing and the new fileis not downloaded. The scan engine reports a File Not Found message.

■293490—In a web proxy environment when the antivirus is enabled, then theevent log prints the url twice.

■295023—The device fails when the non-written memory page is freed up andthe AV is enabled.

■

305062—The policy log for traffic matched by antivirus displays double theactual byte size received.

■

282543—In certain situations, the device is unable to send a DHCP client request.

■

292152—Device resets unexpectedly after configuring DHCP auto-config.

■

305504—In transparent mode, the CLI set zone <name> no-dhcp-relay does notcover the DHCP server service.

■277620—When the GTP inspection is enabled, packets could be dropped andfirewall ran out of available paths.

Antivirus

DHCP

GPRS

Addressed Issues from ScreenOS 6.1.0r4■

41

ScreenOS 6.1.0 Release Notes■

302910—GTP CreatePdpRequest packets are dropped when retransmitted. Thisis observed when the packets, before sending a DeletePdpRequest, use the same
teid_data to a different GGSN.

■

258242—In NSRP active and passive mode, the primary device restarts when
the pointer has an invalid value.

■

287173—When a new username and password is added, the NSRP configuration
goes out of sync.

■

288925—NSRP configurations are out of sync after unset multiple objects areapplied in a multi-cell policy.

■

289119—Creating interface description causes NSRP configurations to go out of
sync.

■

291970—[NetScreen–5000] The HA link shows UP when the HA interface of thepeer is set to phy link down.

■

298021—NSRP configurations may go out of sync if the DNS server specifies an
src-interface, which is a local interface, instead of a VSI interface.

■

300760—NSRP shows out of sync due to the password hash of the PPPoE
username being different on the two devices.

■

301156—Under high traffic load, the multicast traffic leak occurs on the secondary
device in the transparent mode.

■

306981—NSRP configurations go out of sync due to CLI configuration out oforder when one of the members is reset.

■

310384—In transparent mode, NSM is unable to manage the backup device inan NSRP cluster.

■

260215—When profiling smaller networks, the profiler on an ISG-IDP does notdetect new events. The profiler does not update old events.

■

276587—[ISG-IDP] VLAN tagged traffic is incorrectly handled and dropped by
ISG with IDP modules when IDP and tcp-syn-check is enabled.

■

292041—False positive detection can occur when accessing some of the web
sites with a particular combination of DI policies.

■

297722—When a packet with ACK set is received, the IDP might drop sessions
that are in half-connected state.

■299424—With FTP-pathname user-defined signatures, the device does not checkthe filename in FTP out and get commands.

■

300182—The IDP engine failed because of the corrupt data structure.

■301944—DI HTTP brute search function is not working properly.

HA and NSRP

IDP

42

■

Addressed Issues from ScreenOS 6.1.0r4

Addressed Issues from ScreenOS 6.1.0r4

Management■

281995—In some scenarios, all access to the management, except through theconsole, might be lost.

■

288625—A policy modification using Network and Security Manager might causea device reset.

■

292490—NSM update fails when configuring the IKE v2 soft lifetime buffer.

■

292858—[SSG 320M/350M] SNMP Object Identifier (OID) ns TemperatureCur
returns incorrect values.

■

294506—NSM updates do not take effect when the loopback interface isgenerated into static mroute in the NSM config datafile.

■298916—An unnumbered tunnel interface can be configured on a custom tunnelzone. However, this interface is not supported and cannot be configured in NSM.

■

300219—[NetScreen–5000-8G2-G4] In an HA cluster in transparent mode, thedevice with SSH or telnet on the secondary device cannot be managed.

■

300298—If a loopback interface is used by route-map in a virtual router, then it
is not released while deleting a vsys.

■

300762—On certain interfaces incorrect display of ifAdminStatus and ifOperStatus
is observed.

■308356—Webtrends traffic log does not display VSYS name.

■

284672—DIP allocation fails on backup device of NSRP cluster when PPORT is
not released.

■

288045—The VIP on loopback interface that contains a serial interface does notlog traffic and Antivirus. Also, anti-spam scanning does not occur.

■

302566—When NAT source and destination is configured in the same policy,
passive FTP fails.

■

307364—Interface IP address can be unset even if its MIPs are still use in policies.
These MIPs are kept in the configuration and are only removed after device isreset.

■

235297—Source MAC is not cached in session for PIM traffic.

■

259334—A memory leak occurs when running FIPS mode.

■

271025—The memory allocated during the Certificate Revocation List (CRL)
check is not released properly after the check is complete.

■

276077—Non-RPC MS Exchange traffic is dropped due to incorrect timeout.

■279557—[SSG Series] The traffic still passes when the WAN serial interface witha backup interface is down.

NAT

Other

Addressed Issues from ScreenOS 6.1.0r4■

43

ScreenOS 6.1.0 Release Notes

44

■

■

283348—A device running Antivirus, URL Filtering, or VoIP does not function
due to an unexpected packet type.

■

284275—When running "debug flow basic", the format of UUID is not correct.

■

284851—The firewall authentication might fail when loopback session is involved.

■

286679—A memory leak occurs when NTP client cannot obtain a valid key idor key string.

■288938—The backup interface in a redundant interface setup is erroneously
forwarding packets and causes duplicate packets to be sent.

■

289413—WLAN LEDs are turned off when all wireless interfaces are shut down.

■

289435—[SSG 140] In transparent mode, the device might not pass throughtraffic when a host moves from one interface to another interface in the same
zone.

■

289671—A change in the tunnel binding causes failure in the WebUI.

■

290077—Under certain conditions, traffic fails to pass with user auth enabled.

■

290478—[NetScreen–5000, ISG] Packet is dropped due to internal congestion
control mechanism.

■

290501—When the Compact Flash (CF) card is formatted, the set core-dump
command freezes if there is not enough space on the CF.

■

290666—In an IPv6 deployment, a null interface could cause the device to faildue to an interface state check that has been added.

■

291728—Using the CLI or WebUI, the maximum length of scheduler object nameis 19 characters only.

■

294079—If the SYN-ACK packet does not contain the TCP MSS option, traffic
for the Integrated URL Filtering, Anti-SPAM, Anti-Virus, and VoIP modules might
be affected.

■

295694—Device might fail when PPORT pool is exhausted.

■

296850—RTSP media flow is disconnected after about a minute.

■297028—NTP pre-defined service is defined incorrectly.

■

298305—Twice the configuration is incorrectly reloaded causes a system busy
issue after start up.

■

301487—Snoop was not working properly when using redundant interface.

■301602—When the web filtering feature or Antivirus or VoIP is enabled, a Linux
host is not able to access a particular web site.

■

301709—With an UAC as an Infranet auth configured in a firewall, a host witha particular web site as its homepage is not able to through the firewall due tofragmentation of its packets.

■302271—Failed to create multicast session once it is timed out due to a downinterface.

■302382—In certain conditions, the firewall might reset if a session incorrectly
references a MAC address without route information.

Addressed Issues from ScreenOS 6.1.0r4

Addressed Issues from ScreenOS 6.1.0r4■

302955—When PPTP xlate entries are not released in HA, PPTP VPN connection
fails.

■

302970—Device resets when issuing an mping.

■

304210—Device resets when inside a VSYS and issuing a ping request using an
IPv6 address.

■

304276—The configuration of the set int wireless0/0 shutdown command is not
saved in a wireless interface. Also, the wireless interface remains enabled after
reset.

■

305571—When using the combination of aggregate interface and cross ASIC
traffic, packet drop might happen due to SYN check errors.

■

306370—Device might reset if a custom layer 2 zone is unset.

■

306864—The SMTP header is now RFC2822 compliant and includes the timestamp.

■

309122—ASIC ARP is installed incorrectly with wrong VLAN ID.

■

268006—The VPN traffic drops when the VPN is bound to a loopback interface
and traffic shaping is enabled.

■

278935—Random packet drops occur because ARP entries were not deleted
that in turn cause inconsistencies between hardware and software.

■

279442—The Flow and Task CPU utilization is high after a certain uptime if thedevice is heavily loaded with traffic.

■

281813—[NetScreen-5000] Performance on 10Gbps Ethernet is reduced fortransit traffic in and out of the same physical port.

■

282781—High task CPU utilization occurs when CTRL+C is typed while displaying
traffic logs in a CLI session.

■

282948—In a multicast environment, the backup device exhibits high CPU
utilization.

■

283336—Redirecting traffic logs to the TFTP server might cause high task CPU.

■

283748—Fragmented packets loop between the CPU and PPU causing high CPU
utilization.

■

284276—Performance of the VPN degrades when the DI is enabled on a policy.

■

284615—[SSG 500] The traffic throughput is slow when a copper gigabit Ethernet
interfaces is used.

■

285793—High CPU due to NSM task.

■

291748—Using pipe in a large search may result in high CPU. For example: getevent | i foo■

292576—An out of sequence error is induced when the window scaling factor
in SYN ACK packet is not updated in hardware session.

■

297574—When unset arp always-on-dest is configured on serial interface, thereturn traffic get dropped.

Performance

Addressed Issues from ScreenOS 6.1.0r4■

45

ScreenOS 6.1.0 Release Notes■

304334—High CPU causes "session scan" task ineffectively running due toconstant ARP changes in the network.

■

307727—[NetScreen-5000] TCP cross-chip sessions erroneously have a session
timeout of 20 seconds when there is non-cross-chip TCP background traffic and
TCP SYN check is enabled.

■

386735—When adding interface member to aggregate interface in null zone, if
aggregate sub-interface is in non-null zone, packet drops are caused due to loops
between ASIC and CPU.

■

257979—Device fails when interface is not enabled for BGP and administrator
requests TCP reconnection with BGP neighbor.

■

269410—High CPU due to RIP.

■

278718—Static default route on PPPoE interface fell back after power cycle.

■

287409—If an existing type 5 LSA exists in the OSPF database, new type 7 LSA
for the same network is not converted to type 5 LSA even if the new LSA has
better metric.

■

293332—Unable to configure the multicast candidate RP.

■

300214—When OSPF LSA database is large and firewall CPU is fairly busy, OSPF
adjacency may flap.

■

302011—The router does not learn the OSPF routes from the peer even if the
maximum number of routes is not reached.

■

304116—Unable to configure the router-id.

■

310349—When a static multicast wildcard route is deleted, all the associatedroutes that share the same iif, oif, and group are deleted.

■

310724—When a source specific mroute is configured, the multicast traffic is
dropped.

■310781—The multiple and duplicate entries of wildcard mroutes with source
0.0.0.0 are allowed in both the config and multicast routing table.

■

264366—UDP flooding is detected and the packets are dropped even when the
pps rate is less than the specified threshold.

■295452—When Integrated SurfControl is enabled , some web sites that get
re-directed to an https URL are not accessible.

■

281460—When using MIP or VIP video does not work properly.

■

288193—Under certain conditions, the device may reset when processing pinhole
for SIP traffic

Routing

Security

VoIP

46

■

Addressed Issues from ScreenOS 6.1.0r4

Addressed Issues from ScreenOS 6.1.0r4■

289724—When the transaction timer expires and results in operation failure,
SIP call are not cleared.

■

289774—When DIP-Incoming is configured for incoming calls, H.323 outgoingcalls fail.

■302418—A buffer overflow in SIP module may cause the device to reset.

■

305658—The RTP packets are lost when NAT-T is enabled.

■

204717—When peer is identified by DNS address instead of IP address mainmode IKE negotiations may fail.

■285743—During Phase1 negotiation, the IKE-ID type with numeric IKE-ID froma third-party VPN device is correctly interpreted.

■

286723—VPN negotiation with enabled Xauth the Phase 2 SA is removed
incorrectly.

■

287368—IP configuration from RADIUS such as the DNS server setting may not
be configured properly to the Xauth client.

■

291524—If the outgoing interface is a loopback interface and traffic shaping isenabled, VPN traffic drops.

■

291993—Dead-Peer-Detection (DPD) failed to clear the IPSec Security Association(SA) after the Dial-up VPN client disconnected.

■

300430—Packets are dropped in a back-to-back GRE VPN scenario.

■

303538—When the physical and tunnel interface are in different zones, VPN
monitor reply packets may get dropped across a route-based VPN.

■

308251—Failure to remove SPI entry causes memory leak.

■

310331—Device in transparent mode, may reset when a VLAN 802.1x tagged
packet hits a VPN policy.

■

391494—VPN Interop using IKE v2 fails.

■

281955—Unable to configure the route map using subinterface.

■

289628—Unable to define an Address Group using the WebUI for zones thathave an ampersand symbol in the name.

■

290761—When configuring the RP for PIM, the RP address does not appear in
the WebUI.

■

291948—If the device has many event log entries, refreshing the main WebUI
page or the report page using Report > System Log > Event causes high CPU
utilization.

■

293497—The WebUI shows less number of exported rules than the expected.

■

293528—In some cases, the device may restart during HTTPS WebUI access.

VPN

WebUI

Addressed Issues from ScreenOS 6.1.0r4■

47

ScreenOS 6.1.0 Release Notes

48

■

■

293998—In the WebUI, some alarm level events are not sorted by log level
correctly.

■

294560—WebUI may result in high CPU when clicked on Refresh in Reports >System Log > Self in.

■

294594—In the WebUI, unable to see the non-trust-VR interface when configuring
the PBR.

■

296058—The WebUI does not allow the user to create a MIP with a different
subnet mask than the interface.

■

296660—Unable to add or change an existing configuration for TACACS Authserver using WebUI.

■

298501—Change in multi-address cell back to "Any" causes policy corruption.

■

299090—In the WebUI, the PCMCIA option for log settings is incorrectly shown
as option USB. Also, the PCMCIA option for log setting configured by the CLI is
not displayed correctly.

■

300920—Using the WebUI, Only 100 routes in the routing table are visible at a
time.

■

302622—When using the WebUI to configure DNS proxy server for a given
domain, the failover option is automatically selected.

Addressed Issues from ScreenOS 6.1.0r4

Addressed Issues from ScreenOS 6.1.0r3

Addressed Issues from ScreenOS 6.1.0r3
The following operational issues were resolved in this release:
Administration■

257485—In certain situations the administrator was unable to add an address
book item to a multi-cell policy.

■

260995—The debug buffer may intermittently log messages even though no
debug commands are running.

■278125—When there are multiple policies using the same SRC/DST IP and ports,
and one is disabled, and one of the address book objects is modified, the device
may reset.

■

279094—Unsetting PPPoE auth-method will erroneously generate the message"Cannot unset idle-interval to default when auto connect is enabled".

■

282163—TFTP traffic sourced from the loopback interface fails.

■

282592—Enabling AV as an http proxy in transparent mode causes the packets
to use the MAC address of the VLAN interface as the source MAC address.

■

215889—DNS queries are sent to the dynamically-learned DNS servers, eventhough the DNS servers have been configured with an admin preference of 255.

■

261613—Proxy DNS fails if loopback interface is used as the outgoing-interface.

■270890—If GTP Sequence Number Validation was enabled, GTP traffic was
dropped due to 'bad sequence number' after two NSRP failovers.

■

262695—NSRP failover may cause some VPNs to fail.

■274948—In NSRP, when adding an interface to a L2 zone, it does not become
a VSI.

■

280217—[NetScreen–5000, ISG] When the device is in an Active/Passive NSRP
cluster, under a particular circumstance after a preempt primary device is reset,
traffic via VPN is dropped by its VPN peer.

Antivirus

DNS

GPRS

HA and NSRP

Addressed Issues from ScreenOS 6.1.0r3■

49

ScreenOS 6.1.0 Release Notes■

282261—NSRP failover from the backup to the primary taking longer than
expected.

■

300517—With "set flow tcp-syn-bit-check" enabled, after failing over the NSRP
cluster, TCP packets for existing sessions are dropped.

■

270319—[ISG with IDP] The IDP process restarts when updating a policy with
attacks that was previously configured with no attacks.

■

255035—Redundant subinterfaces could not be imported properly from NSM.

■

271129—In some cases, all management access may be lost except through theconsole.

■290562—Unable to determine BGP aggregate status within NSM.

■

235777—The command "unset admin hw-reset" was not saved to the config
file after a reset.

■

252398—Wireless connection instability occurs when using 802.1x with Intel
Pro/Wireless NIC with 802.1x auth.

■255301—TCP socket leak causes lost SSH management and BGP peering, resulting
in high task CPU utilization.

■

257812—NAS-Port-Type was "Wireless-Other" instead of "Wireless-IEEE-802-11"
for example when authenticating wireless clients via radius.

■

260307—Under certain conditions, the firewall seems to be corrupting UDP
checksums.

■

267891—A null pointer accessed in the ULR filtering , which caused the device
to reset.

■

269018—After enabling DI, when a syn-flood is detected, the device may restart.

■

269488—In transparent mode, unauthenticated users are not being redirectedto the Infranet Controller (IC).

■273879—Authentication entries in a pending or fail state, fails to be cleared.

■

276282—Device reset due to problem with hardware session pointer.

■279407—Memory leak occurred when a second user from the same user groupis authenticated.

■

280079—DSCP TOS bit was not being set correctly on the device.

■281722—A device reset occurred when running "debug ike" and "unset console
dbuf".

■

283182—Traffic through the SSG-500 stops intermittently.

IDP

Management

Other

50

■

Addressed Issues from ScreenOS 6.1.0r3

Addressed Issues from ScreenOS 6.1.0r3■

285252—When traffic shaping is enabled, the MAC address is shifted on thesubinterfaces.

■

285333—Traffic may not pass if there is a duplex mismatch between the device
interface and the switch connected to the device.

■271349—With a low-quality connection, PPPoE may stop responding duringnegotiation.

■

221537—FTP downloads from dial up or slow links are failing when AV enabled.

■

254058—Bandwidth testing site via web shows lower bandwidth than actual
upload speed.

■

259126—Packet loss and TCP retransmissions occur when performing filetransfers across T1 WAN interface.

■

267357—Permanent route attributes are not being exported from one VR to theother.

■

276971—Tunnel interfaces were being counted as an outgoing interface, which
exceeds the maximum number of interfaces allowed for multicast traffic.

■

278563—Child session for SIP could not be created correctly.

■

278773—H.323 ALG was unable to decode Q.931 using Avaya phones, due tonot enough OLC support.

■

279789—In some network topologies, VPN monitoring may bring the VPN tunnel
down.

■

280101—Dial-Up VPN traffic was dropped due to a change to the IP address on
the dialup client.

■

284756—In certain situations, the auto-connect acvpn-dynamic command could
not be completed.

■

285748—[NetScreen-5000] IPSec pass-through packets are being dropped when
the device is in transparent mode.

■

285935—VPN packet drop occurs due to traffic looping when aggregate interfaces
are used on the device.

Performance

Routing

VoIP

VPN

Addressed Issues from ScreenOS 6.1.0r3■

51

ScreenOS 6.1.0 Release Notes

WebUI

52

■

■

227316—Unable to configure DHCP on an interface from a trustee admin user
via the WebUI.

■

262490—Unable to manage a device from an untrust interface via a trustee
admin via the WebUI.

■

277589—When editing a subinterface, WebUI responds with an erroneous traffic
bandwidth message "0 is not within the valid range (1 - 1000000)".

■

277867—The RP Proxy setting is not removed when its corresponding RP
Candidate is deleted via WebUI.

■

279141—VPN policies created with the WebUI paired up incorrectly.

■

281505—In an NSRP environment, a fault error message "IP conflict" is shownin the WebUI when accessing a backup device to configure an interface.

Addressed Issues from ScreenOS 6.1.0r3

Addressed Issues from ScreenOS 6.1.0r2

Addressed Issues from ScreenOS 6.1.0r2
The following operational issues were resolved in this release:
Administration■

215340, 256010—Some log entries are not formatted properly in the WebTrend
output.

■223139—Task CPU becomes high when executing some CLI commands with alarge configuration, which triggers high overall CPU utilization, and reaches thealarm threshold.

■258225—The admin-preferences of the local DNS defined via the CLI gets reset
when any changes are made to DNS setting via the WebUI.

■

258522—Policy list in the root vsys may be blank when viewed from the WebUI.

■

259735—Incorrect information shown on the multilink and serial interface SNMP
report for MTU, link status, operation status, and link speed.

■261597—[NetScreen-5GT] Unable to set interface ethernet2 to the Null zone.

■

262685, 267506—Bridge Group interfaces would not go to full duplex, evenwhen the bgroup members are hard-coded to full duplex.

■

262912—Sync Serial card shows up as JXMBRI-ST in get chassis.

■

267997—Incorrect ifIndex in link-up/link-down SNMP trap for redundantinterfaces occurred.

■

275288—Device restarts when MIP configured with incorrect mapping from
IPv4 to IPv6.

■

276003—The "sess-limit" option is getting lost after a restart.

■

225931—ICAP AV may fail with error code 3 for running out of connection
objects due to incorrect freeing of ICAP connection.

■

266736—With Antivirus enabled, an email containing certain characters may
cause the POP3 or SMTP session to freeze.

■

263924—When using a PPPOE interface with a DHCP IP address as the tunnel
outgoing interface, the VPN tunnel session still has the old dynamic IP address
after the new address has been assigned or the firewall is restarted.

■

226031—Only the first IP Pool gets synchronized to the backup device.

■

227665—The NSRP vsd-group track-ip method CLI command is lost after a reset.

Antivirus

DHCP

HA and NSRP

Addressed Issues from ScreenOS 6.1.0r2■

53

ScreenOS 6.1.0 Release Notes■

238578—Non-VSD sessions in an Active/Active NSRP configuration incorrectly
synchronize between cluster members if the session's egress subinterface differs
between cluster members.

■

251157—An NSRP cluster member received a corrupted HA message, causing
the device to reset.

■

252645—Gratuitous ARPs for the secondary IP address on an interface did not
work.

■

258989—[NetScreen-5000] Traffic is not forwarded when the packets are received
on an aggregate interface of the backup VSD in an NSRP Active/Active cluster
due to the TCP SYN check failing incorrectly.

■

260760—[SSG 5] NSRP failover not working properly when both NSRP interfaces
and a secondary path are enabled.

■

262533—[SSG 140] Alarm LED on the device was not displaying correctly when
an NSRP failover event occurred.

■

264768—Configurations are out of sync due PBR out of order set match-groupcommands.

■

267734—The primary ISG does not read the sequence number correctly fromthe ASIC for AES after failover.

■

268708—Traffic fails to pass after failover of a NSRP pair with devices configuredin transparent mode.

■

268809—When no-session-backup is enabled on a policy, traffic through theserial interface stops passing.

■274997—The commands set sm enable and set sm disable were erroneously
being synchronized to the other member in an NSRP cluster.

■

224382—Task CPU spikes when the authentication result from the RADIUS
server does not arrive on time.

■252700—Unsupported "Far End" OIDs were modified so that they return a "nosuch object" response to an SNMP query.

■

252783—The 64-bit counter on an interface was showing incorrect information
after the "clear counter" command was performed.

■

258148—SNMP reports incorrect ifspeed on the serial interface.

■

260188—The device is only able to send 400 to 500 logs per second to NSM.

■

260243—When disabling the rate limit in a GTP object configuration, the limit
was not actually disabled.

■

261714—The NSRP failover event log is not sent to the syslog server.

■

262697—In certain conditions, the device may reset when a policy is pushedfrom NSM.

■

266873—In the event log, when the number of telnet and ssh connections to a
device are higher than its display limitation, the log entries of the telnet-cmd
number and ssh-cmd number are incorrectly displayed.

Management

54■

Addressed Issues from ScreenOS 6.1.0r2

Addressed Issues from ScreenOS 6.1.0r2■

267372—The SNMP trap (OID) of the interface status is not correct.

■

269298—An invalid command appeared in the CLI: "exec admin".

■

270999—Hardware counter for out bytes always shows zero on the management
interface.

■271297—The get perf session detail command did not display the correct values.

■

273424—Under certain condition, device update after the creation of a newcustom vsys using NSM would result in the error: "unknown keyword unset".

■

224161—HDLC debug output was being sent to the dbuf buffer when any debug
flow was enabled, making troubleshooting difficult.

■224423—If a timeout is configured in one GTP object, this timeout is used for
all GTP objects.

■

224782—The transmit and receive counters on an HA interface between two
NSRP peers shows a mismatch, due to an incorrect byte count.

■

226075—[ISG 1000/2000, NetScreen-5000-8G2/8G2-G4] Device sending two
ESP packets with the same sequence number.

■

227438—CTS traffic incorrectly detected as "HTTP:Overflow:Content-Overflow"
and dropped.

■

231670—In certain environments, if only URL filtering is enabled in the policy,
the HTTP response might fail to be parsed.

■

233490—RTSP ALG does not translate addresses properly when in NAT mode.

■

235311—Transmission of the multicast data stream might stop for a while whenhandling a PIM fragment packet■

236768—Device may issue an ACK in response to a RST packet.

■

239594—The device may fail when AV is enabled and AIM traffic is passing
through.

■

240625—Memory utilization is high due to DI session leak when SYN protection
is enabled.

■

250504—A conflict over multiple tracked gateway routes caused the device to
fail.

■

252082—FTP session IPv4 to IPv6 session connects, but the client's FTP session
hangs when FTP commands are entered.

■

252224—The wireless client reports a different link speed than what the device
reports.

■

253965—Frame Relay clocking mode did not initialize properly.

■

254619—A MIB file issue occurred when high-availability(15) was removed from
the MIB files.

■

256589—When a large number of VPN policies are configured, the device may
fail to create a VPN policy when the tunnel ID is not specified.

■

256783—Device failed due to mishandling of null pointer.

Other

Addressed Issues from ScreenOS 6.1.0r2■

55

ScreenOS 6.1.0 Release Notes

56

■

■

257095—The Antispam list would not display in alphabetical order due to asorting issue.

■

258336—The device restarts on its own when the Deep Inspection Signature
Pack is updated.

■

260087—PPTP traffic not working properly when source nat policy is enabled.

■

260626—[SSG 300] Device unable to pass packets greater than 1,468 bytes
across an 802.1q tagged subinterface.

■

261543—[NS-5000-MGT2] Issuing the command get bridge word 0 may cause
the firewall to reset.

■

262448—The 'exec policy verify' command was not working when empty addressgroups are used in the policies.

■

262450—The WebAuth login page contained a script error after entering a user
name.

■

262666—When NTP is enabled, and set ntp server src-interface is used, NTP
communication cannot be checked in the policy when the traffic is sent out toan interface other than the one specified in the command■

262894—Device fails to connect to Websense server after the Websense server
IP address has changed.

■

263585—In certain situations, traffic that is NAT'd and uses the H.323 ALG
caused the device to reset.

■

263850—FTP ALG did not correctly create child sessions for cross-vsys flows,causing data packets to be dropped.

■

264263—Device failed due to Null pointer access in sunrpc.

■

265230—[SSG 140] The alarm LED on the device incorrectly displays as amber,instead of red, when an attack was detected.

■

266875—Interface MAC did not change correctly when the VSI interface was
assigned to the mgt zone.

■

267114—When URL filtering is enabled, permitted URLs are logged twice in thefirewall event log.

■

267255—Unset ALG not saved after reset.

■

267370—When generating a syslog message, the source port and destination
port are incorrectly interpreted from the event log.

■

267767—Running get dbuf stream prints out the message, “Return due to suspectloop”, with any debugs specified.

■

267994—CPU utilization is high after Virtual IP (VIP) is configured.

■269121—GRE keepalive is dropped when the recursion control bit is set.

■269668—Deleting multiple virtual systems at one time may prevent traffic frompassing through other virtual systems.

■

269922—With IPv6, an incorrect ICMP message is generated when the policy
is configured with action reject.

■

273021—The connection between the firewall and the external Surfcontrol server
was lost randomly several times a day.

Addressed Issues from ScreenOS 6.1.0r2

Addressed Issues from ScreenOS 6.1.0r2■

274187—Under certain circumstances, the first SYN packet is not matching thepolicy.

■274973—When get vr trust protocol pim rp proxy is executed, an exception dump
may occur.

■

278559—In certain conditions, clearing the auth table via IP address may cause
the device to reset.

■

280532—Websense is not working and displays the following error: "Unknown
message type: 8e".

■289248—FTP failed if there was a NO PASSV response and then the client tried
to use PORT mode.

■

234153—High flow CPU utilization caused by packet looping between CPU and
ASIC.

■

266111—Slow performance with Web traffic when URL filtering and the SYN
Proxy is enabled.

■

223180—Multicast traffic was not forwarded to both spokes in a hub-and-spoke
VPN.

■

225874—Creating a default route from one VR to the other VR caused the firewall
to reset.

■

259054—The BGP neighbor goes to idle after the BGP connection is reset.

■

260646—The device would not become the PIM designated router (DR) after
increasing the DR-priority.

■

262604—The first multicast packets in the flow get dropped.

■

263665—Routes learned via OSPF are not propagated to NSSA LSA after NSRP
failover is done.

■

264800—The default route advertised via BGP by the ISP's upstream router was
not propagating into the device's route table.

■

268471—BGP stops advertising the tunnel's static route after a reset.

■

269341—IGMP join occurs 10 seconds after a unicast route has changed.

■

274788—Multicast route through GRE tunnel fails after the GRE routers do a
failover.

■282293—Routes are stuck in the RIP database in multiple custom VR
configurations.

Performance

Routing

Addressed Issues from ScreenOS 6.1.0r2■

57

ScreenOS 6.1.0 Release Notes

VoIP/H323■

256706—The device was not doing routing and policy lookup for IP addresses
with unknown contact bindings from the SIP server.

■

264625—[ISG 1000/2000] SCCP ALG logging messages in the event log, after
the ALG was disabled.

■

271315—SIP ALG did not support LWS.

■

274300—The "Can't allocate memory for SCCP call context" message appearsin event logs due to the timing between session age-out and call completion.

■

254357—Pings through VPN are dropped when IPSec SA is 0.

■255512—The command unset ike policy-checking only applied per device, andnot per VPN.

■

257708—When subjected to heavy GRE/IPSec traffic, the device may reset.

■

263126—The device did not send an Account-Stop message for the old Phase1
SA.

■

264713—Tunnel ID and hardware SA in an existing session do not update
properly after VPN change, which causes traffic to stop.

■

275108—NSP-tunnel (used in IPSec environments) was erroneously deleted but
still referenced by another module, and caused device to reset.

■

282310—The device may reset when a NetScreen Remote VPN connection is
made.

■

282564—Multiple dial-up VPN users could not login if the name in the certificate
is similar to the previous user.

■

222872—Access to the WebUI is very slow when opening the main home page.

■

256041—In a particular circumstance, the device may fail when an admin edits
a VPN configuration using the WebUI.

■

259582—When adding Antispam to an existing Antivirus profile via the WebUI,
FTP session disconnects occurs and result in abnormal behavior of FTP
commands (ls, dir).

■

262479—Read-Write admin account was incorrectly offered "Enable Web
Management Idle Timeout" option in the Admin Management page, causing the
page's Apply function to fail.

■262827—From the WebUI, deleting an aggregate sub-interface erroneously gives
you a warning that you are about to remove one aggregate interface.

■

264300—Config Merge from the WebUI fails.

■

265334—From the WebUI, if a RIP summary route is set to a metric of 1, it does
not get written to the config.

VPN

WebUI

58

■

Addressed Issues from ScreenOS 6.1.0r2

Addressed Issues from ScreenOS 6.1.0r2■

265413—Unable to specify u-fqdn IKE-ID type when creating a Dial-Up VPN
User.

■

266871—Custom RPC service is deleted from the policy when that policy isedited.

■267496—The WebUI reports that the gbw value is out of range when editing on
a subinterface.

■

267521—"Bypass authentication option" for XAuth can not be configured via
WebUI.

■

270630—Can not disable SSH2 management from the WebUI.

■

272946—Unable to create an IKE gateway on a device in transparent mode fromthe WebUI.

■

276288—When configuring an NSRP cluster ID with a value over 63 using the
WebUI, an incorrect error message is displayed.

Addressed Issues from ScreenOS 6.1.0r2■

59

ScreenOS 6.1.0 Release Notes

Addressed Issues from ScreenOS 6.1.0r1
NOTE: Due to an update in the ScreenOS problem tracking system, some issues
listed here may have two bug numbers. The six-digit numeric code shown first is forthe new system; the “os” and “cs” numbers included in the listing for some issues
are provided as a reference to older Known Issues. Eventually the older reference
numbers will be phased out.
The following operational issues were resolved in this release:
VPN■

220334 (os70336)—When the IP address of a remote peer changed, IKE phase
1 failed to update correctly. This issue has been resolved.

■

236113—When you enabled TCP-SYN-Check on the NetScreen-5000 platform,
the device failed to establish a cross-chip TCP connection in Transparent mode.
This issue has been resolved.

■

225502—[ISG with IDP] The IDP drops legitimate HTTP traffic for very large
HTTP downloads.

■

226284—An ISG 2000-IDP intermittently stopped advertising prefixes to eBGP
peers after BGP peer refreshed from other devices. This issue has been resolved.

■

229742—In Transparent mode on an ISG 1000 with IDP enabled, if both Web
filtering and IDP were enabled in one policy, all Web browsing that used thepolicy stopped responding. This issue has been resolved.

■

232075—[ISG 1000/2000] Time binding attacks are not reporting logs to the
NSM server.

■

236437—[ISG 1000/2000] In certain situations, the traffic passing through an
inline mode IDP rule may experience excessive delay when other rules are
configured for TAP mode IDP.

■

237769—[ISG 1000/2000] There is high CPU utilization on a single SM (Security
Module) due to uneven session distribution.

■

239575—When both tcp-syn-check is set and IDP is enabled in the policy, theACK packet of a 3-way handshake is dropped when ISG is in transparent mode.

■

252958—[ISG 1000/2000] Login attempts with FTP brute force signature were
erroneously being logged as accepted.

Firewall

IDP

60

■

Addressed Issues from ScreenOS 6.1.0r1

Addressed Issues from ScreenOS 6.1.0r1

Other
■

225017—If you restarted an SSG 5 appliance after many hours of heavy traffic,
the device stopped forwarding all traffic. This issue has been resolved.

■

226651 (os70627)—When traffic reached 1Gbps (in each direction) through two
uPIMs, traffic was blocked in both directions after approximately one hour. Thisissue has been resolved.

■

233516—If you made a large number of configuration changes (especially inpolicies and virtual routers), an ISG 2000 stopped receiving IPv6 packets. Thisissue has been resolved.

■

231754—In Transparent mode, SIP traffic caused a device to fail. This issue has
been resolved.

■

227229 (os71064)—When you deployed NTP Server on ISG 1000 appliances,the device aged out a packet even if the hardware session was refreshed by the
packet. This issue has been resolved.

■228200—Adding an alternate route to the routing table and making it as active
after a tunnel failure was not possible. This issue occurred when you used theset interface tunnel_name protocol rip demand-circuit command. This issue has
been resolved.

■

231728—On the SSG 140 platform, DNS settings were not accepted through a
PPPoE connection. This issue has been resolved.

■

233428—In Transparent mode, the management feature on a v1-Untrust zone
was not added to the configuration, so it was disabled after a device reset. Thisissue has been resolved.

Routing

Management

Addressed Issues from ScreenOS 6.1.0r1■

61

ScreenOS 6.1.0 Release Notes

Known Issues
The following are known deficiencies in features at the time of this release. Wheneverpossible, a workaround is suggested following the problem description, preceded by
W/A.

NOTE: Due to an update in the ScreenOS problem tracking system, some issues
listed here have two bug numbers. The six-digit numeric code shown first is for the
new system; the “os” and “cs” numbers included in the listing for some issues areprovided as a reference to older Known Issues. Eventually the older reference numbers
will be phased out.

Known Issues in ScreenOS 6.1.0r7
This section describes known issues with the listed release.

62■

Known Issues

Known Issues

Application Layer Gateway (ALG)■

455373—The device might reset when some SQL ALG registers access an odd
address.

■

455865—After a reboot of the firewall, 802.1x authentication fails.

■

458316—A device might reset if a vsys that contains address book objects with
DNS names is deleted.

■454981—[SSG 300M] When the NSRP failover occurs, the red alarm LED is
triggered.

■

455943—When the PPTP service and GRE service timeout are configured tonever, the PPTP xlate fills up unless the PPTP connection is shutdown.

■

458125—The VLAN tag information is lost on preparing a child session in ALG
traffic when the UTM is enable.

■

455350—For the interface, MTU is set to 1500 when a tunnel interface is addedthat might cause performance issues.

■

422611—Power Cycling H.323 IP Phone results in NAT pport leak.

■

458341—The SIP ALG is not handling the SIP calls that use multi-part message
as expected.

■

455462—When an aggregate BGP route is added using WebUI, new option
summary-only is added that is not specified in the WebUI.

■

459894—Unable to remove the address book object DMZ Any after it isconfigured.

Authentication

DNS

HA and NSRP

NAT

Other

Performance

VoIP

WebUI

Known Issues■

63

ScreenOS 6.1.0 Release Notes

Known Issues from ScreenOS 6.1.0r6
This section describes known issues with the listed release.
None.

Known Issues from ScreenOS 6.1.0r5
This section describes known issues with the listed release.
Other■419564—The ppp multi link bundle supports only two BRI channels.

■

427467—[SSG 140] The device reboots unexpectedly due to ARP traffic acrossbgroup interfaces.

Known Issues from ScreenOS 6.1.0r4
This section describes known issues with the listed release.
Other■391304—The duration of time reported by policy traffic logs is shorter than theactual time duration.

Known Issues from ScreenOS 6.1.0r3
None

Known Issues from ScreenOS 6.1.0r2
None

Known Issues from ScreenOS 6.1.0r1
This section describes known issues with the listed release.
Flow

64

■

Known Issues■

235781—Using Transparent mode, under high traffic conditions, sometimes asmall number of sessions cannot be cleared. The sessions appear to be "time 0"
but will remain in the session table. Running set sat session-clean will clear thesesessions from the table after one round of session cleaning.

■239631—If you configure the initial session timeout below the valid range(20—300 seconds), the system interprets these values as minutes instead of
seconds.

Known Issues

HA and NSRP■

235303—Delay in the peripheral devices updating the forwarding table when afailover occurs in an NSRP cluster in Transparent mode. When the devices haveno gratuitous ARP mechanism as in NAT or Route mode, peripheral devices
update the forwarding table only when the active physical interface is restarted.
The update happens after five seconds by default.
W/A: Use the CLI command set nsrp link-hold-time to modify the link downtime.

■

236275—If the VSD group is not bound to a VLAN group, the security device
incorrectly reports the VSD as being in Active-Passive mode.

■

236634—In an Active-Passive configuration, if the active security device handles
a large number of FTP connections, the CPU utilization of the backup device
remains high even when the rate of the FTP connections per second on the
backup is low.

■

253467—If a device's SIP traffic is very heavy in an NSRP deployment, although
the master box works well, there will be some delays when resources on the
backup box are removed. Operational impact on the cluster is minimal, and the
backup box will automatically recover.

■

227934—SSG platforms incorrectly process the ICMPv6 error packet that theyreceive in response to a non-first fragment packet that exceeds the outgoinginterface MTU.
W/A: Set the interface MTU at a value that accommodates all packets for all links
through a path.

■236085—In Transparent mode, you cannot manage a zone that is on a vsys
using the zone nsrp manage CLI command, because it is a global setting basedon vlan1 interface. In root mode, you can manage only the related vsys.

■

236087—On SSG 320/350 devices, a 4-byte PVE tag is used to identify whichinterface the packet came from, limiting the maximum supported packet length
to 1514 bytes.

■

236549—When deployed in Transparent mode, some high-end platforms suchas ISG 1000-IDP do not support more than 20 reassembled segments. If you try
to ping another device with data that requires more than 20 reassembled
segments (for example, 30,000 bytes), the ping request fails.

■

239285—ScreenOS does not verify the IP address that you enter when you
configure the security device.
W/A: You should verify the IP address that you enter for an interface. For
example, you must not assign a multicast or broadcast IP address as an interface's
IP address.

■

239598—On some high-end platforms, after you have enabled IPv6, the CLI
incorrectly allows you to enable parameters such as DSCP marking, IDP, and
NSRP Data Forwarding that are not supported in IPv6 mode.

■

267239—When modifying an IPv6 or a wildcard policy through the WebUI, allexisting sessions for the policy will be removed. However, existing sessions will

IPv6

Known Issues■

65

ScreenOS 6.1.0 Release Notes

not be removed if you only modify some minor features—such as session-limit
or alarm-without-drop—of an ordinary IPv4 policy through the WebUI.
Other■

236210—In an IDP deployment, when a policy incorporating diffserv is createdthe security module does not mark the first attack packet. This is by design, andall subsequent packets are correctly marked.

■

255774—The debug command unset console dbuf might make the box unstable,
especially under heavy traffic. Administrators are advised to use care whenrunning this command.

■

258931—Due to a memory limitation, NS 5000 devices are currently unable tosupport 500 vsys when an advanced license key—such as for virtual router or
Layer 2 Active-Active support—is part of the deployment.

■

263512—ScreenOS 6.1.0 includes a new SSHv2 secondary login banner feature.
However, unless the feature is enabled, if the secondary banner is displayed
before a login prompt on a console or via a Telnet connection, no positive
acknowledgment to the secondary banner is required (applicable to console,
Telnet, SSHv1, and SSHv2 connections).

■

266022—Because the NS 5400 supports 2 million sessions by default in 6.1 (and6.0r2 and later), you must make sure that the device has a minimum of 450MB
of free memory when upgrading from 5.4 or 6.0r1 to 6.1 or 6.0r2. One million
sessions will require approximately 340MB of memory.

■

278668—[SSG 550/550M] An error in the boot-loader code caused the interface
references to be switched and the motherboard version to be incorrectly reported
while upgrading from boot mode.

■

251874—ScreenOS does not limit the number of routing entries that are
distributed through Routing Information Protocol (RIP). This incorrectly allows
you to configure more static routing entries than are supported.

■

251875—ScreenOS does not limit the number of Open Shortest Path First (OSPF)
areas and virtual links. This incorrectly allows you to configure more OSPF areasand virtual links than are supported.

■

251879—ScreenOS does not limit the number of Open Shortest Path First (OSPF)
interfaces. This incorrectly allows you to configure more OSPF interfaces thanare supported.

■

251883—ScreenOS does not limit the number of static routing entries that are
redistributed through OSPF. This incorrectly allows you to configure more static
routing entries than are supported.

■

255815—The device does not check the destination MAC address for packets
when the SYN-cookie is triggered and responds with SYN-ACK whether thedestination MAC belongs to itself or not.

■258978—For the SSG 320M and 350M, the supported maximum number of
Border Gateway Protocol (BGP) redistributed routes is 4096. However, if a large
number of routes are added with an automated script, it is possible to exceed

Routing

66■

Known Issues

Known Issues

the supported limit. Routes entered or redistributed manually should not be able
to exceed 4096.
■

258979—For the SSG 320M and 350M, the supported maximum number ofOpen Shortest Path First (OSPF) redistributed routes is 4096, but it may bepossible to exceed the maximum. OSPF redistributed routes are handled in two
parts: route task and OSPF task. The route task will add redistributed routes to
OSPF continuously during one CPU time slice. The redistributed routes counter
will not, however, be updated until the OSPF task is processed by the CPU, so
more routes may be added in OSPF when the routes are added using an
automated script. Routes entered or redistributed manually should not be able
to exceed 4096.

■

239517—During a VoIP call that uses the H.323 protocol, if you change themapped IP or virtual IP address assignments, subsequent calls lose the audio.
Child sessions that are required to provide audio are not established because thesecurity device does not recognize a matching policy with the changed MIP or
VIP assignments.
W/A: Create a policy similar to the one you had configured and add it to theglobal zone.

■

240574—In standalone mode, if an alternative gatekeeper is initiated during a
VoIP call, sessions do not age out immediately after the call ends. In HA mode,
if an alternative gatekeeper is initiated during a VoIP call and there is a firewall
HA recycle, sessions only age out after a long time.

■241465—If a phone tries to register while SIP is disabled, SIP sessions must be
cleared once SIP is enabled. After SIP is enabled and SIP sessions have beencleared, all phones that tried to register prior to SIP being enabled will need tobe reset. Failure to reset a SIP phone that attempted to register before SIP was
enabled will result in that SIP phone being unable to place or receive calls.

■

250319—The SIP functionality does not support a customized port, so a SIP callthat uses custom ports might fail.
W/A: Use the default SIP port (5060).

■

261464—On NS 5400 devices, Media Gateway Control Protocol (MGCP) traffic
performance drops significantly when the number of active calls exceeds 8000.
The issue is the result of having sessions installed on both ASICs in the device
rather than on only one as is the case with single-ASIC platforms.

■

240108—The security device does not allow a static DNS host entry to be
removed if the hostname has been used in an IKE gateway configuration, even
if the entry was entered in error or incorrectly and even if the IKE gateways had
since been removed.
W/A: Reboot the device to clear the DNS entry. Because the DNS entry iserroneous, rebooting will maintain the IKE configuration while clearing themistaken DNS entry.

■

241207—During IPSec SA rekeying, some packets may be dropped on theinitiator side because the packet is received before the SA table is created. Packets

VoIP

VPN

Known Issues■

67ScreenOS 6.1.0 Release Notes

will only be dropped for a very short time. There should not be any packets
dropped after the SA table is installed.
■253238—ScreenOS does not limit the number of GRE tunnels you can create.
This incorrectly allows you to create more GRE tunnels than are supported.

ErrataThis section lists outstanding issues with the documentation.
Deep Inspection (DI)DI for peer-to-peer (P2P) networking application is not supported. The Concepts &Examples ScreenOS Reference Guide erroneously states DI supports the P2P
networking application.

Limitations and Compatibility
Limitations of Features in ScreenOS 6.1.0
This section describes the limitations of some features in the ScreenOS 6.1.0 release.
They apply to all platforms unless otherwise noted.

NOTE: Transceiver Compatibility—Juniper Networks strongly recommends that
only Juniper-provided transceivers be used on interface modules. Different transceiver
types (long-range, short-range, copper, and so on) can be used together on multi-port
SFP interface modules as long as they are Juniper-provided transceivers.
Juniper Networks cannot guarantee that the interface module will operate correctly
if third-party transceivers are used.
Please contact Juniper Networks for the correct transceiver part number for yourdevice.

68■

Errata■

ISG and NetScreen 5000 series Multicast Hardware Support—Multicast sessions
can be handled by the ASIC only if there is a single output interface per virtualrouter. The mcast group address can be pushed to ASIC so frames are forwarded
in hardware. To use this feature run the set/unset flow multicast install-hw-sessioncommand. [309007, 427260]■

ISG-IDP—An ISG 2000 device with IDP in Inline mode caused packets to be
dropped for return traffic if NAT and a mirror port were both configured.
Workaround: Do not use mirror ports in this scenario. [232420].

■

ISG 1000, ISG 1000-IDP, ISG 2000, ISG 200-IDP, NetScreen-5000 series—Someenvironments require that firewalls be able to log all dropped packets. The
ScreenOS command set flow log-dropped-packetswill enable this function and get
log flow-deny will display the dropped packet logs. Hardware limitations, however,prevent the devices listed above from logging packets without data and with theLimitations and Compatibility

protocol field set to 0, 1, 6, or 17 sent either to or through the device. Packets
that have data and where the protocol field is set to 0 or 6 sent to or through thedevice from any host are also not logged by these devices. Also, when DNS proxyis disabled, non-permitted dataless UDP packets with destination port 53 sent
through the device are dropped and not logged. [300152].
■

SSG 300-Series NSRD Support—Without running a slot configuration, NSM isunable to locate the source interface list when using NSRD on SSG 300-series
devices, and without the source interface list NSRD is unable to select a configlet
file. To use NSRD on an SSG 300-series device, do a slot config through NSM,
which will make it possible for the device to see the interface list and thenconfigure with NSRD. [259596].

■

SSG 300-Series and 500-Series—Bridge groups (bgroups) are supported on
Ethernet switch PIMs (uPIMs), including 16-port GE, 8-port GE, and 6-port SFP.
Bgroups are not supported on 1-port SFP, old enhanced PIMs (ePIMs), andon-board GE ports. Administrators can dynamically create or delete bgroupinterfaces. The maximum number of bgroup interfaces on each PIM is half thenumber of ports. You can configure bgroup interfaces only on the same PIM oron the system board.

■

SSG 140—Bgroups are supported on both on-board Ethernet ports and Ethernet
switch PIMs (uPIMs). You can dynamically create or delete bgroup interfaces.
The maximum number of bgroup interfaces on each PIM is half the number ofports. On-board ports have three preset bgroup interfaces. You can configurebgroup interfaces only on the same PIM or on the system board.

■

IPv6 ASIC Support in NetScreen-5000 Systems—Because NetScreen-5000
systems now support IPv6, per-ASIC session support has been decreased from
1M to 512K. This is caused by the increase in the session size in the session
table.
To achieve maximum session count on the NS-5000 series security devices, you
should design the network traffic to utilize multiple ports on the SPMs. This typeof network architecture would distribute the sessions to multiple ASICs. For
example, if only two ports on an 8G2 SPM card are used, the max session countvalue will be 512K.

■

Screens on Traffic Exiting Tunnels—has the following limitations:■This feature is not compatible with the new SYN-bit check in the PPU feature.
Screens for traffic exiting tunnels are performed by the CPU instead of the
PPU.

■

This feature will only apply if the screen is activated on the physical interface
where the tunnel is terminated if the screen is hardware accelerated.

■

AC-VPN—Dead peer detection (DPD) does not work on the spoke when set on
an AC VPN profile with global IKE heartbeat enabled.

■

Jumbo Frame Support on the ISGs—Only the 4-port SFP modules on the ISGs
support Jumbo frames. All other I/O cards in the device are disabled automatically(including the ISG 1000 built-in I/O card), when you enable Jumbo frames by
setting the max-frame-size setting in the range 1515–9830.

■

VRRP with NSM—ScreenOS 6.1.0 does not support VRRP with NSM. [262624,
439315]

Limitations and Compatibility■

69

ScreenOS 6.1.0 Release Notes■

UDP and ICMP Flood Screening—ScreenOS 6.1.0 does not support UDP and
ICMP flood screening for aggregate interfaces in ISG and NetScreen–5000 series.
[428057]■

PIM Power and Thermal Requirements—If you install either 8-port or 16-port
uPIMs in your SSG 140, SSG 500-series, or SSG 500M-series device, you mustobserve the power and thermal guidelines. Please refer to the PIM and Mini-PIM
Installation and Configuration Guide for the power and thermal guidelines forall supported platforms, available at:
http://www.juniper.net/techpubs/hardware/pim_guide/pim_guide.pdf

WARNING: Exceeding the power or heat capacity of your device may cause thedevice to overheat, resulting in equipment damage and network outage.

■

NSRP—NSRP is not supported on WAN interfaces. Devices with WAN interfaces
can use NSRP, but the WAN ports do not automatically failover as the Ethernet
ports do.

■Flood Screens—On ISG 1000, ISG 2000, NetScreen-5000 Series devices, the
UDP and ICMP flood screens apply to the physical interface and therefore requirethat the zone be bound to a physical interface. The following limitations apply:■■

When zones are bound to a sub-interface, the ICMP and UDP flood screens
are not enforced unless the zone is also bound to a physical interface.

■

When ICMP and UDP flood screen options are configured for different zones
and on the same physical interface, the flood threshold is applied based on
the last configured zone threshold.

■

When ICMP and UDP flood screen options are applied to a zone tied tomultiple physical interfaces, the entire threshold value is applied to each of
the physical interfaces.

■

For reference, the High Availability (HA) zone does not allow any flood screenfeatures to be configured.

Configuration file downloads through WebUI without authentication—Using
the WebUI firewall downloads the configuration file without authentication. For
more information, see the JTAC knowledge base number KB 12943 located at
http://kb.juniper.net.

Compatibility Issues in ScreenOS 6.1.0
This section lists known compatibility issues with other products, including, but notlimited to, specific Juniper Networks appliances, other versions of ScreenOS, Web
browsers, Juniper Networks management software, and other vendor devices at thetime of this release.
■

70

■

Compatible Web Browsers—The WebUI for ScreenOS 6.1.0 was tested withand supports Microsoft Internet Explorer (IE) browser versions 5.5 and above,
Netscape Navigator 6.X for Microsoft Windows platforms, and Microsoft Internet
Explorer version 5.1 for MacOS X.

Limitations and Compatibility

Limitations and Compatibility■

Upgrade Sequence—We recommend that you follow the upgrade instructions
described in the ScreenOS Upgrade Guide located at
http://www.juniper.net/techpubs/software/screenos/screenos6.1.0/upgrade_guide.pdf. If
you upgrade directly from ScreenOS 5.0.0 or ScreenOS 5.1.0 to ScreenOS 6.1.0,
you risk losing part of any existing configuration. For ISG 2000 devices, you must
upgrade to an intermediate firmware and upgrade the boot loader before
upgrading to the ScreenOS 6.1 firmware. Refer to “Upgrade Paths to ScreenOS
6.1” in the ScreenOS Upgrade Guide for intermediate software and boot loader
upgrade information.
Use the following procedure to upgrade the SSG 500/500M boot loader:1.

Download the boot loader (v.1.0.5) from the Juniper Networks Support site.
a.

Navigate your browser to http://www.juniper.net/customers/support/. The
Support page appears.

b.

Locate the DOWNLOAD SOFTWARE section, and click ScreenOS. Enter
your user ID and password in the LOGIN page that appears, and thenclick the LOGIN button. The ScreenOS page appears.

c.

In the table of software download versions, locate SSG-500 and click
version 6.1.

d.

In the Software tab (under Package), click SSG-500_Boot_loader.

2.

Save and extract the boot loader zip file and put it in the root directory of
your TFTP server.

3.

Start the TFTP server, if necessary.

4.

Make an Ethernet connection from the device hosting the TFTP server tothe MGT port on the SSG 500 and a serial connection from your workstation
to the console port on the SSG 500.

5.

Restart the SSG 500 by entering the reset command. When prompted toconfirm the system reset, press y. The following system output appears:
NetScreen SSG500 BootROM V1.0.2 (Checksum: 8796E2F3)
Copyright (c) 1997-2004 NetScreen Technologies, Inc.
Total physical memory: 512MB
Test - Pass
Initialization................ Done

6.

Press the X and A keys sequentially to update the boot loader.

7.

Enter the filename for the boot loader software you want to load (for example,
loadssg500v105) and the IP addresses of the SSG 500 device and TFTP
server. The following system output appears:
File Name [boot2.1.0.2]: loadssg500v105
Self IP Address [10.150.65.152]:
TFTP IP Address [10.150.65.151]:

8.

Press Enter to load the file. The following system output appears:

Limitations and Compatibility■

71

ScreenOS 6.1.0 Release Notes

Save loader config (112 bytes)... Done
Loading file " loadssg500v105"...
/Loaded successfully! (size = 125,512 bytes)
Ignore image authentication!
...
.......................
Done.
■

WebUI Upgrade—When upgrading from ScreenOS 5.2.0 to ScreenOS 6.1.0 using
the WebUI, you must upgrade the device to ScreenOS 5.4rX and then upgrade
the device directly to ScreenOS 6.1.0. Refer to “Upgrading to the New Firmware”
in the ScreenOS Upgrade Guide for instructions on performing the upgrade.

Documentation Changes■

To upgrade existing firmware to ScreenOS 6.1.0, refer to the ScreenOS Upgrade
Guide located at ScreenOS 6.1.0 Upgrade Guide. You may need to upgrade theboot loader of the SSG 300-series and SSG 500/500M-series devices. For more
information on the upgrade procedure, see “Upgrade Sequence” in the
Compatibility Issues in ScreenOS 6.1.0 section of this document.

■

The document formerly called ScreenOS Migration Guide has been renamed
ScreenOS Upgrade Guide. The content is updated for 6.1.0 but is otherwise
unchanged.

■

We have added a new document, JUNOS Software Migration Guide, to support
users who would like to migrate from ScreenOS firmware to JUNOS softwarewith enhanced services firmware for supported platforms.

■

Starting with ScreenOS 6.0.0, we have removed information on configuring
Physical Interface Modules (PIMs) and Mini Physical Interface Modules (Mini-PIMs)
from the installation and configuration guides for SSG devices. This information
is now in a new guide, the PIM and Mini-PIM Installation and Configuration Guide.
Refer to that guide for information on configuring PIMs and Mini-PIMs.

■

We have added search capability to the online Help system for the WebUI andhave made some changes to the appearance of the online Help system.

Getting Help for ScreenOS 6.1.0 Software
For further assistance with Juniper Networks products, visit
http://www.juniper.net/support/.
Juniper Networks occasionally provides maintenance releases (updates and upgrades)
for ScreenOS firmware. To have access to these releases, you must register yoursecurity device with Juniper Networks at the above address.

72■

Documentation Changes