-XQLSHU1HWZRUNV
1HW6FUHHQ5HOHDVH1RWHV
3URGXFW1HW6FUHHQ+DUGZDUH6HFXULW\&OLHQW1HW6FUHHQ;7
1HW6FUHHQ*71HW6FUHHQ1HW6FUHHQ1HW6FUHHQ
1HW6FUHHQ1HW6FUHHQ1HW6FUHHQ1HW6FUHHQ
9HUVLRQ6FUHHQ26U5HY%
5HOHDVH6WDWXV3XEOLF5HOHDVH
3DUW1XPEHU
'DWH

&RQWHQWV
1. Version Summary on page 2
2. New Features and Enhancements on page 2
3. Changes to Default Behavior on page 2
4. Addressed Issues on page 3
5. Known Issues on page 4
5.1 Limitations of Features in ScreenOS 5.1.0r3 on page 4
5.2 Compatibility Issues in ScreenOS 5.1.0r3 on page 6
5.3 Known Issues in ScreenOS 5.1.0 on page 7
6. Getting Help on page 9ScreenOS 5.1.0r3 Rev. B

Page 1 of 10

Juniper Networks

NetScreen Release Notes

 9HUVLRQ6XPPDU\ScreenOS 5.1.0 is the latest release version of ScreenOS firmware for theNetScreen-5XT, NetScreen-5GT, NetScreen-Hardware Security Client,NetScreen-25, NetScreen-50, NetScreen-204 and NetScreen-208 security
appliances, and the NetScreen-500 and NetScreen-5200 and NetScreen-5400
security systems.
The ScreenOS 5.1.0r3 release is interoperable with, and provides basic support for
all versions of NetScreen Remote and ScreenOS 2.6.1 and later versions.
This version of ScreenOS provides full support for Security Manager, Juniper
Networks-NetScreen’s security management platform.

 1HZ)HDWXUHVDQG(QKDQFHPHQWV
For a list and descriptions of new features and enhancements in this release, referto the NetScreen ScreenOS Migration Guide.
Note: You must register your product at www.juniper.net/support/ so that certain
ScreenOS features, such as antivirus or deep inspection, can be activated on thedevice. If you already have an account, enter your user ID and password; if you are a
new NetScreen customer, create your account first. To register your product, youneed the model and serial number of the device. After registering your product,confirm that your device has internet connectivity. Issue the CLI command exec
license-key update to make the device connect to the NetScreen server to activate
the feature.

 &KDQJHVWR'HIDXOW%HKDYLRUThere were numerous changes in default behavior between ScreenOS 5.1.0r1 andthe previous release, ScreenOS 5.0.0. For detailed information on those changes,
refer to the NetScreen ScreenOS Migration Guide. There are no changes in default
behavior between ScreenOS 5.1.0r1 and ScreenOS 5.1.0r3.

ScreenOS 5.1.0r3 Rev.B

Page 2 of 10

Juniper Networks

NetScreen Release Notes

 $GGUHVVHG,VVXHV
The following sections detail addressed issues in each release of ScreenOS 5.1.0.

 $GGUHVVHG,VVXHVLQ6FUHHQ26U
• 45341 – The SIP ALG parser used to report an error when there was no
CRLF in the last line of the message.
• 45042 – If you upgraded to ScreenOS 5.1.0r1, then downloaded a large filefrom the Internet, the client received the following message: Connection withserver has been reset.
• 43793 – The default service timeout value for H.323 was reduced to 30
minutes. You can configure the timeout by specifying the set service h.323
timeout <minutes> command.
• 03756 (NetScreen-5GT) – The scan engine treated a zero-byte file within aZIP file as a file in ZIP format instead of a file of any other format.

 $GGUHVVHG,VVXHVIURP6FUHHQ26U• 44099 (NetScreen 5000 series) – When there were high volumes of calls on
the NetScreen device, some media sessions failed when the call setup rate
was equal to or greater than 50 calls-per-second (CPS).
• 43847 – When upgrading from ScreenOS 5.0 to 5.1, if the bandwidth was set
to zero, traffic shaping options were missing.
• 43776 – When you upgraded from ScreenOS 5.0 to ScreenOS 5.1, previously
configured VIPs disappeared.
• 43344 – In ScreenOS 5.1.0r1, the interface-based IP tracking options were
hidden commands on the NetScreen-5XT and NetScreen-5GT. These
commands are not hidden in this release.
• 43260 (NetScreen-5GT) – When the NetScreen device was in Extended portmode, the WebUI erroneously displayed the port mode as Trust/Untrust anddid not allow you to change it.
• 43097 – When the NetScreen device was in transparent mode, it created
duplicate multicast sessions.
• 43008 – Before you put a NetScreen device into a cluster, you could not add/
modify/remove NSRP track-IP objects on the Track IP page of the WebUI.
• 42992 – The NetScreen device crashed when the new RTSP session rate
went over 100 RTSP sessions and there was additional traffic going throughthe device.

ScreenOS 5.1.0r3 Rev.B

Page 3 of 10

Juniper Networks

NetScreen Release Notes• 42801 – When you used the redirect URL filtering feature with aSurfControl server, sending a URL that was longer than 512 bytessometimes caused unexpected results on the SurfControl server.

 .QRZQ,VVXHVThis section describes known issues with the current release.
• Section 5.1 “Limitations of Features in ScreenOS 5.1.0r3” identifies featuresthat are not fully functional at the present time, and will be unsupported forthis release.
• Section 5.2 “Compatibility Issues in ScreenOS 5.1.0r3 on page 6 describes
known compatibility issues with other products, including but not limited tospecific NetScreen appliances, other versions of ScreenOS, Internetbrowsers, NetScreen management software and other vendor devices.
Whenever possible, information is provided for ways to avoid the issue,
minimize its impact, or in some manner work around it.
• Section 5.3 “Known Issues in ScreenOS 5.1.0 on page 7 describes deviations
from intended product behavior as identified by NetScreen Test Technologies
through their verification procedures. Again, whenever possible, information
is provided to assist the customer in avoiding or otherwise working aroundthe issue.

 /LPLWDWLRQVRI)HDWXUHVLQ6FUHHQ26UThis section describes the limitations in various features in ScreenOS. They apply
to all platforms, unless otherwise noted.

 /LPLWDWLRQVLQ6FUHHQ26
The following limitations are present in ScreenOS 5.1.0r3.

ScreenOS 5.1.0r3 Rev.B•TCP Reassembly for H.323 Traffic - You must use the set zone
zone reassembly-for-alg command to enable TCP reassembly forzones in which you expect to send and receive H.323 traffic. This
allows the NetScreen device to examine H.323 TPKT packets that arelarger than the maximum transmission unit (MTU), which isrequired for application layer gateway (ALG) filtering.

•H.323 Gatekeeper Routed Calling – In ScreenOS 5.1, Juniper
Networks has certified Gatekeeper routed calling and Gatekeeper toGatekeeper support for Avaya products. However, other vendors may
function properly, depending upon their adherence to standards.

Page 4 of 10

Juniper Networks

NetScreen Release Notes•(NetScreen-500) Saving Firmware to Flash – You cannot saveScreenOS 5.1.0 firmware to flash memory using the boot loader. Usethe WebUI or CLI to save ScreenOS 5.1.0 firmware to flash memory.

•(NetScreen-5000 Series) Transparent Mode – Moving sessions(both sessions and VPNs) from one interface to another in the same
L2 zone is not supported on these platforms.

•(NetScreen-5000 Series) – The MGT-2 board does not support
ScreenOS 5.1.0. You must use the MGT board.

•(NetScreen-200 Series) Deep Inspection – Installing the Deep
Inspection (DI) license key on the NetScreen-200 in advanced mode
decreases the maximum number of sessions to 64,000 sessions. To
restore the number of sessions supported to 128,000 sessions, remove
the DI license key and reboot the NetScreen device.

•Antivirus (AV) – Trend Micro discontinued the VirusWall scanner,which is used with the external AV feature. Although the external AV
feature might work in ScreenOS 5.1.0, Juniper Networks does notsupport it, except for security-related issues.

•Large File Transfers – The maximum size file inspected by theintegrated AV feature defaults to 10MB. If AV and Deep Inspection(DI) are enabled, this is reduced to 6 MB. If AV, DI, and URL filtering
are all enabled, this is reduced to 4MB.

•VoIP – Juniper Networks tested VoIP with the following IP phonevendors:• H.323 IP Phones: Avaya 4612/4606/4624/4602/4620 and Digital
6408D with Avaya S8300/G700 server; Microsoft Netmeeting; OKI
VoIP TA (H.323 Fast Start Gateway)• SIP IP Phones: Cisco IP Phone 7960 and 7940 (Version 6.3) with
Cisco SIP Proxy Server (Version 2.1/2.2); Cisco 2600 SIP Gateway /LPLWDWLRQVIURP3UHYLRXV5HOHDVHV
The following limitations from previous releases are also present in thisrelease.
•SSH Version 1 Interoperability – The embedded SSH server inScreenOS 5.1.0 has issues with the client from SSH Communications
Security when operating in SSH version 1 mode.
W/A: Use the SSH Communications client in version 2 mode, or use adifferent SSH version 1 client, such as OpenSSH.

•ScreenOS 5.1.0r3 Rev.B

SSHv2 Interoperability – The only tested and certified SSHv2
clients are OpenSSH and Secure CRT.

Page 5 of 10

Juniper Networks

NetScreen Release Notes•(NetScreen-5XT and NetScreen-5GT) Primary & Backup
Interfaces – The primary and backup interfaces bound to theUntrust security zone cannot both use DHCP for address assignment
at the same time. You can use DHCP for one interface and PPPoE for
the other, or you can use PPPoE for both interfaces.

•(NetScreen-500 and NetScreen-5000 Series) Vsys for GroupIKE ID – Group IKE ID users cannot be used in a vsys if that vsys
uses a shared untrust interface.
W/A: Use a private Untrust interface (tagged VLAN subinterface ordedicated physical interface) for the vsys.

•(NetScreen-5000 Series) Aggressive Aging – The Aggressive
Aging feature is not supported on the NetScreen-5000 Series devices.

 &RPSDWLELOLW\,VVXHVLQ6FUHHQ26U
Below are the known compatibility issues at the time of this release. Wheneverpossible, a work-around (starting with “W/A:”) has been provided for yourconvenience.
• General Compatibility Issues– Freeswan - The Freeswan VPN client is incompatible with ScreenOS
5.1.0r3 in certain configurations due to IKE features that Freeswan does
not fully support. The result is that Phase 2 negotiations and Phase 2 SA
will not complete if the following commands are enabled:
set ike initiator-set-commit
set ike responder-set-commit
set ike initial-contact
W/A: Unset these commands to ensure compatible configuration on theNetScreen device.
• Compatible Web Browsers - The WebUI for ScreenOS 5.1.0r3 was tested
with and supports Microsoft Internet Explorer (IE) browser versions 5.5 andabove, and Netscape Navigator 6.X for Microsoft Windows platforms, andMicrosoft Internet Explorer version 5.1 for MacOS 10.x. Other versions ofthese and other browsers, were reported to display erroneous behavior.

ScreenOS 5.1.0r3 Rev.B

Page 6 of 10

Juniper Networks

NetScreen Release Notes 8SJUDGH3DWKVIURP3UHYLRXV5HOHDVHV
If you are upgrading a NetScreen device from a release that is earlier thanScreenOS 5.0.0, you must upgrade it to ScreenOS 5.0.0 before upgrading toScreenOS 5.1.0. For detailed information on how to upgrade any NetScreen
device, refer to the NetScreen ScreenOS Migration Guide. The migration
guide provides step-by-step upgrade procedures and important information
about upgrading NetScreen devices.

 .QRZQ,VVXHVLQ6FUHHQ26
The following are known deficiencies in features at the time of this release.
Whenever possible, a work-around is suggested following the description of theproblem. Workaround information starts with “W/A:” If there is no subsection for
a particular ScreenOS release, no new known issues were identified for that
release.

 .QRZQ,VVXHVLQ6FUHHQ26U• 44873 (NetScreen-5XT) – Using the set dbuf size command to increase thedebug buffer size results in a memory allocation failure. Even if thiscommand is successful, a failure occurs when you download the Deep
Inspection attack database.
W/A: Do not use the set dbuf size command to increase the debug buffersize. If you did, use the unset dbuf size command to restore the default
buffer size.
• 44586 – In NetScreen devices that support virtual systems (vsys), if thesecondary banner is set at the root level, updating a vsys through NetScreenSecurity Manager (NSM) fails. NSM displays an error message indicatingthat the secondary banner is set at the vsys level, even if this option is notavailable.
W/A: Unset the secondary banner at the root level.

 .QRZQ,VVXHVIURP6FUHHQ26U
There are no known issues from this release.

ScreenOS 5.1.0r3 Rev.BPage 7 of 10

Juniper Networks

NetScreen Release Notes .QRZQ,VVXHVIURP6FUHHQ26U• 43113 – When the NetScreen device is in transparent mode, internal servers
cannot initiate sessions to dialup VPN clients.
• 43054 – When you use the integrated URL filtering feature, the port number
range (1024 -32767) allowed by the WebUI is incorrect. The CLI allows 1024to 65535, which is correct.

ScreenOS 5.1.0r3 Rev.B

Page 8 of 10

Juniper Networks

NetScreen Release Notes

 *HWWLQJ+HOS
For further assistance with Juniper Networks products, visit
www.juniper.net/support
Juniper Networks occasionally provides maintenance releases (updates andupgrades) for ScreenOS firmware. To have access to these releases, you mustregister your NetScreen device with Juniper Networks at the above address.
Copyright © 2005 Juniper Networks, Inc. All rights reserved.
Juniper Networks, the Juniper Networks logo, NetScreen, NetScreen
Technologies, GigaScreen, and the NetScreen logo are registered trademarks ofJuniper Networks, Inc. NetScreen-5GT, NetScreen-5XP, NetScreen-5XT,NetScreen-25, NetScreen-50, NetScreen-100, NetScreen-204, NetScreen-208,
NetScreen-500, NetScreen-5200, NetScreen-5400, NetScreen-ISG 2000,
NetScreen-Global PRO, NetScreen-Global PRO Express, NetScreen-Remote
Security Client, NetScreen-Remote VPN Client, NetScreen-IDP 10, NetScreenIDP 100, NetScreen-IDP 500, GigaScreen ASIC, GigaScreen-II ASIC, andNetScreen ScreenOS are trademarks of Juniper Networks, Inc. All othertrademarks and registered trademarks are the property of their respectivecompanies.
Information in this document is subject to change without notice.
No part of this document may be reproduced or transmitted in any form or by anymeans, electronic or mechanical, for any purpose, without receiving written
permission from:
Juniper Networks, Inc.
1194 N. Mathilda Ave.
Sunnyvale, CA 94089-1213
U.S.A.
ATTN: General Counsel
www.juniper.net

ScreenOS 5.1.0r3 Rev.B

Page 9 of 10

Juniper Networks

ScreenOS 5.1.0r3 Rev.B

NetScreen Release Notes

Page 10 of 10