-XQLSHU1HWZRUNV
1HW6FUHHQ5HOHDVH1RWHV
3URGXFW1HW6FUHHQ;71HW6FUHHQ*71HW6FUHHQ1HW6FUHHQ
1HW6FUHHQ1HW6FUHHQ1HW6FUHHQ1HW6FUHHQ
1HW6FUHHQ
9HUVLRQ6FUHHQ26U
5HOHDVH6WDWXV3XEOLF5HOHDVH
3DUW1XPEHU
'DWH

&RQWHQWV
1. Version Summary on page 2
2. New Features and Enhancements on page 2
3. Changes to Default Behavior on page 2
4. Addressed Issues on page 2
5. Known Issues on page 3
5.1 Limitations of Features in ScreenOS 5.1.0r2 on page 4
5.2 Compatibility Issues in ScreenOS 5.1.0r2 on page 6
5.3 Known Issues in ScreenOS 5.1.0 on page 7
6. Getting Help on page 8ScreenOS 5.1.0r2 Rev. A

Page 1 of 8

Juniper Networks

NetScreen Release Notes

 9HUVLRQ6XPPDU\ScreenOS 5.1.0 is the latest release version of ScreenOS firmware for theNetScreen-5XT, NetScreen-5GT, NetScreen-25, NetScreen-50, NetScreen-204 andNetScreen-208 security appliances, and the NetScreen-500 and NetScreen-5200and NetScreen-5400 security systems.
The ScreenOS 5.1.0r2 release is interoperable with, and provides basic support for
all versions of NetScreen Remote and ScreenOS 2.6.1 and later versions.
This version of ScreenOS is not supported by Security Manager, Juniper
Networks-NetScreen’s security management platform.

 1HZ)HDWXUHVDQG(QKDQFHPHQWV
For a list and descriptions of new features and enhancements in this release, referto the NetScreen ScreenOS Migration Guide.
Note: You must register your product at www.juniper.net/support/ so that certain
ScreenOS features, such as antivirus or deep inspection, can be activated on thedevice. If you already have an account, enter your user ID and password; if you are anew NetScreen customer, create your account first. To register your product, youneed the model and serial number of the device. After registering your product,confirm that your device has internet connectivity. Issue the CLI command exec
license-key update to make the device connect to the NetScreen server to activate
the feature.

 &KDQJHVWR'HIDXOW%HKDYLRUThere were numerous changes in default behavior between ScreenOS 5.1.0r1 andthe previous release, ScreenOS 5.0.0. For detailed information on those changes,
refer to the NetScreen ScreenOS Migration Guide. There are no changes in default
behavior between ScreenOS 5.1.0r1 and ScreenOS 5.1.0r2.

 $GGUHVVHG,VVXHVThis section describes issues that were addressed in the current release.
• 44099 (NetScreen 5000 series) – When there were high volumes of calls on
the NetScreen device, some media sessions failed when the call setup rate
was equal to or greater than 50 calls-per-second (CPS).
• 43847 – When upgrading from ScreenOS 5.0 to 5.1, if the bandwidth was setto zero, traffic shaping options were missing.

ScreenOS 5.1.0r2 Rev.A

Page 2 of 8

Juniper Networks

NetScreen Release Notes• 43776 – When you upgraded from ScreenOS 5.0 to ScreenOS 5.1, previously
configured VIPs disappeared.
• 43344 – In ScreenOS 5.1.0r1, the interface-based IP tracking options werehidden commands on the NetScreen-5XT and NetScreen-5GT. These
commands are not hidden in this release.
• 43260 (NetScreen-5GT) – When the NetScreen device was in Extended port
mode, the WebUI erroneously displayed the port mode as Trust/Untrust anddid not allow you to change it.
• 43097 – When the NetScreen device was in transparent mode, it created
duplicate multicast sessions.
• 43008 – Before you put a NetScreen device into a cluster, you could not add/
modify/remove NSRP track-IP objects on the Track IP page of the WebUI.
• 42992 – The NetScreen device crashed when the new RTSP session rate
went over 100 RTSP sessions and there was additional traffic going throughthe device.
• 42801 – When you used the redirect URL filtering feature with aSurfControl server, sending a URL that was longer than 512 bytes
sometimes caused unexpected results on the SurfControl server.

 .QRZQ,VVXHVThis section describes known issues with the current release.
• Section 5.1 “Limitations of Features in ScreenOS 5.1.0r2” identifies featuresthat are not fully functional at the present time, and will be unsupported forthis release.
• Section 5.2 “Compatibility Issues in ScreenOS 5.1.0r2 on page 6 describes
known compatibility issues with other products, including but not limited tospecific NetScreen appliances, other versions of ScreenOS, Internetbrowsers, NetScreen management software and other vendor devices.
Whenever possible, information is provided for ways to avoid the issue,
minimize its impact, or in some manner work around it.
• Section 5.3 “Known Issues in ScreenOS 5.1.0 on page 7 describes deviations
from intended product behavior as identified by NetScreen Test Technologies
through their verification procedures. Again, whenever possible, information
is provided to assist the customer in avoiding or otherwise working aroundthe issue.

ScreenOS 5.1.0r2 Rev.A

Page 3 of 8

Juniper Networks

NetScreen Release Notes

 /LPLWDWLRQVRI)HDWXUHVLQ6FUHHQ26UThis section describes the limitations in various features in ScreenOS. They apply
to all platforms, unless otherwise noted.

 /LPLWDWLRQVLQ6FUHHQ26
The following limitations are present in ScreenOS 5.1.0r2.
•

H.323 Incoming NAT Call – ScreenOS 5.1.0r2 does not support
Gatekeeper routed calls; therefore, when there are H.323 endpoints
in the Trust and Untrust zones, and the Gatekeeper is in the Untrustzone with incoming DIP enabled on the untrust interface, calls
between endpoints in the Trust zone fail.

•(NetScreen-500) Saving Firmware to Flash – You cannot saveScreenOS 5.1.0 firmware to flash memory using the boot loader. Use
the WebUI or CLI to save ScreenOS 5.1.0 firmware to flash memory.

•(NetScreen-5000 Series) Transparent Mode – Moving sessions(both sessions and VPNs) from one interface to another in the same
L2 zone is not supported on these platforms.

•(NetScreen-5000 Series) – The MGT-2 board does not support
ScreenOS 5.1.0. You must use the MGT board.

•(NetScreen-200 Series) Deep Inspection – Installing the Deep
Inspection (DI) license key on the NetScreen-200 in advanced mode
decreases the maximum number of sessions to 64,000 sessions. To
restore the number of sessions supported to 128,000 sessions, remove
the DI license key and reboot the NetScreen device.

•Antivirus (AV) – Trend Micro discontinued the VirusWall scanner,which is used with the external AV feature. Although the external AV
feature might work in ScreenOS 5.1.0, Juniper Networks does notsupport it, except for security-related issues.

•Large File Transfers – The maximum size file inspected by theintegrated AV feature defaults to 10MB. If AV and Deep Inspection(DI) are enabled, this is reduced to 6 MB. If AV, DI, and URL filtering
are all enabled, this is reduced to 4MB.

•VoIP – Juniper Networks tested VoIP with the following IP phone
vendors:• H.323 IP Phones: Avaya 4612/4606/4624; Digital 6408D• Analog Phones: Polycom: Phones were connected to an OKI H.323
gateway to convert the analog signal into H.323.
• SIP IP Phones: Cisco IP Phone 7960 and 7940, image version 6.3

ScreenOS 5.1.0r2 Rev.A

Page 4 of 8

Juniper Networks

NetScreen Release Notes /LPLWDWLRQVIURP3UHYLRXV5HOHDVHV
The following limitations from previous releases are also present in thisrelease.
•SSH Version 1 Interoperability – The embedded SSH server inScreenOS 5.1.0 has issues with the client from SSH Communications
Security when operating in SSH version 1 mode.
W/A: Use the SSH Communications client in version 2 mode, or use a
different SSH version 1 client, such as OpenSSH.

•SSHv2 Interoperability – The only tested and certified SSHv2
clients are OpenSSH and Secure CRT.

•(NetScreen-5XT and NetScreen-5GT) Primary & BackupInterfaces – The primary and backup interfaces bound to theUntrust security zone cannot both use DHCP for address assignment
at the same time. You can use DHCP for one interface and PPPoE for
the other, or you can use PPPoE for both interfaces.

•(NetScreen-500 and NetScreen-5000 Series) Vsys for GroupIKE ID – Group IKE ID users cannot be used in a vsys if that vsys
uses a shared untrust interface.
W/A: Use a private Untrust interface (tagged VLAN subinterface ordedicated physical interface) for the vsys.

•ScreenOS 5.1.0r2 Rev.A(NetScreen-5000 Series) Aggressive Aging – The Aggressive
Aging feature is not supported on the NetScreen-5000 Series devices.

Page 5 of 8

Juniper Networks

NetScreen Release Notes

 &RPSDWLELOLW\,VVXHVLQ6FUHHQ26U
Below are the known compatibility issues at the time of this release. Wheneverpossible, a work-around (starting with “W/A:”) has been provided for yourconvenience.
• General Compatibility Issues– Freeswan - The Freeswan VPN client is incompatible with ScreenOS
5.1.0r2 in certain configurations due to IKE features that Freeswan does
not fully support. The result is that Phase 2 negotiations and Phase 2 SA
will not complete if the following commands are enabled:
set ike initiator-set-commit
set ike responder-set-commit
set ike initial-contact
W/A: Unset these commands to ensure compatible configuration on theNetScreen device.
• Compatible Web Browsers - The WebUI for ScreenOS 5.1.0r2 was tested
with and supports Microsoft Internet Explorer (IE) browser versions 5.5 andabove, and Netscape Navigator 6.X for Microsoft Windows platforms, andMicrosoft Internet Explorer version 5.1 for MacOS 10.x. Other versions ofthese and other browsers, were reported to display erroneous behavior.

 8SJUDGH3DWKVIURP3UHYLRXV5HOHDVHV
If you are upgrading a NetScreen device from a release that is earlier than
ScreenOS 5.0.0, you must upgrade it to ScreenOS 5.0.0 before upgrading toScreenOS 5.1.0. For detailed information on how to upgrade any NetScreendevice, refer to the NetScreen ScreenOS Migration Guide. The migration
guide provides step-by-step upgrade procedures and important information
about upgrading NetScreen devices.

ScreenOS 5.1.0r2 Rev.APage 6 of 8

Juniper Networks

NetScreen Release Notes

 .QRZQ,VVXHVLQ6FUHHQ26
The following are known deficiencies in features at the time of this release.
Whenever possible, a work-around is suggested following the description of theproblem. Workaround information starts with “W/A:” If there is no subsection fora particular ScreenOS release, no new known issues were identified for that
release.

 .QRZQ,VVXHVLQ6FUHHQ26U
• 03756 (NetScreen-5GT) – The scan engine treats a zero-byte file within aZIP file as a file in ZIP format instead of a file of any other format.
W/A: Increase the decompression layer setting. The range is 1 to 4 layers ofdecompression.

 .QRZQ,VVXHVIURP6FUHHQ26U• 43113 – When the NetScreen device is in transparent mode, internal servers
cannot initiate sessions to dialup VPN clients.
• 43054 – When you use the integrated URL filtering feature, the port numberrange (1024 -32767) allowed by the WebUI is incorrect. The CLI allows 1024
to 65535, which is correct.

ScreenOS 5.1.0r2 Rev.APage 7 of 8

Juniper Networks

NetScreen Release Notes

 *HWWLQJ+HOS
For further assistance with Juniper Networks products, visit
www.juniper.net/support
Juniper Networks occasionally provides maintenance releases (updates andupgrades) for ScreenOS firmware. To have access to these releases, you mustregister your NetScreen device with Juniper Networks at the above address.
Copyright © 2004 Juniper Networks, Inc. All rights reserved.
Juniper Networks, the Juniper Networks logo, NetScreen, NetScreen
Technologies, GigaScreen, and the NetScreen logo are registered trademarks ofJuniper Networks, Inc. NetScreen-5GT, NetScreen-5XP, NetScreen-5XT,NetScreen-25, NetScreen-50, NetScreen-100, NetScreen-204, NetScreen-208,
NetScreen-500, NetScreen-5200, NetScreen-5400, NetScreen-Global PRO,NetScreen-Global PRO Express, NetScreen-Remote Security Client, NetScreenRemote VPN Client, NetScreen-IDP 10, NetScreen-IDP 100, NetScreen-IDP 500,
GigaScreen ASIC, GigaScreen-II ASIC, and NetScreen ScreenOS are trademarksof Juniper Networks, Inc. All other trademarks and registered trademarks are theproperty of their respective companies.
Information in this document is subject to change without notice.
No part of this document may be reproduced or transmitted in any form or by anymeans, electronic or mechanical, for any purpose, without receiving written
permission from:
Juniper Networks, Inc.
1194 N. Mathilda Ave.
Sunnyvale, CA 94089-1206
U.S.A.
ATTN: General Counsel
www.juniper.net

ScreenOS 5.1.0r2 Rev.APage 8 of 8