Release Notes ScreenOS 6.0.0r5 Rev 02

Juniper Networks ScreenOS Release Notes
Products: Integrated Security Gateway (ISG) 1000, ISG 1000-IDP, ISG 2000, ISG 2000-IDP, Secure Services Gateway (SSG) 5, SSG 20, SSG 140, SSG 300M-series, SSG 500/500M-series, and NetScreen-5000 series (NS 5000 MGT2/SPM2). Version: ScreenOS 6.0.0r5 Revision: Rev 02 Part Number: 530-024608-01 Date: April, 2008
Contents Juniper Networks ScreenOS Release Notes ....................................................................... 1 Version Summary ............................................................................................................... 5 New Features and Enhancements ....................................................................................... 6 New Features and Enhancements Introduced in 6.0.0r5................................................. 6 ISG-IDP Session Pass Under Heavy Throughput....................................................... 6 New Features and Enhancements Introduced in 6.0.0r2................................................. 8 New Features .............................................................................................................. 8 Performance Enhancements........................................................................................ 9 CPU Protection Tools ............................................................................................... 10 New Features and Enhancements Introduced in 6.0.0r1............................................... 12 Hardware Features .................................................................................................... 12 Virtual Private Network (VPN) ................................................................................ 14 Firewall ..................................................................................................................... 14 Universal Threat Management.................................................................................. 15 IDP and GPRS .......................................................................................................... 16 Virtual Systems......................................................................................................... 17 Network Address Translation ................................................................................... 17 NetScreen Redundancy Protocol .............................................................................. 17 Layer 2 Transparent Mode........................................................................................ 18 UAC .......................................................................................................................... 18 Feature Extensions .................................................................................................... 18 Changes to Default Behavior ............................................................................................ 21 Changes to Default Behavior Introduced in 6.0.0r3 ..................................................... 21 USB Boot Sequence.................................................................................................. 21 Changes to Default Behavior Introduced in 6.0.0r2 ..................................................... 21 Max Dialing Interval Default.................................................................................... 21 CPU Protection and Utilization Profiling ................................................................. 21
ScreenOS Release Notes
TCP-SYN-Check Packet Flow ................................................................................. 21 Infranet Auth Object Cleanup................................................................................... 21 Infranet Auth Cold Start NSRP Synchronization ..................................................... 22 Infranet Controller and Management IP ................................................................... 22 Removing Denied Sessions on Auth Table Change ................................................. 22 Changes to Default Behavior Introduced in 6.0.0r1 ..................................................... 22 TCP-SYN-Check Default ......................................................................................... 22 RADIUS Attributes................................................................................................... 22 IP Option Packets...................................................................................................... 23 Coredump to USB..................................................................................................... 23 Addressed Issues............................................................................................................... 24 Addressed Issues in ScreenOS 6.0.0r5 ......................................................................... 24 Administration .......................................................................................................... 24 Antivirus ................................................................................................................... 24 CLI ............................................................................................................................ 24 DHCP........................................................................................................................ 25 DNS........................................................................................................................... 25 GPRS......................................................................................................................... 25 HA & NSRP.............................................................................................................. 25 IDP ............................................................................................................................ 26 Management.............................................................................................................. 26 NAT .......................................................................................................................... 26 Other ......................................................................................................................... 27 Performance .............................................................................................................. 28 Routing...................................................................................................................... 28 Security ..................................................................................................................... 28 VoIP/H323 ................................................................................................................ 29 VPN........................................................................................................................... 29 WebUI....................................................................................................................... 29 Addressed Issues from ScreenOS 6.0.0r4..................................................................... 29 Administration .......................................................................................................... 30 Antivirus ................................................................................................................... 30 CLI ............................................................................................................................ 30 GRPS......................................................................................................................... 30 HA and NSRP ........................................................................................................... 30 IDP ............................................................................................................................ 30 Management.............................................................................................................. 31 Other ......................................................................................................................... 31 Routing...................................................................................................................... 32 Security ..................................................................................................................... 33 VoIP/H323 ................................................................................................................ 33 VPN........................................................................................................................... 33 WebUI....................................................................................................................... 34 Addressed Issues from ScreenOS 6.0.0r3..................................................................... 34 Antivirus ................................................................................................................... 34 HA and NSRP ........................................................................................................... 34
Management.............................................................................................................. 34 Other ......................................................................................................................... 35 Routing...................................................................................................................... 35 WebUI....................................................................................................................... 35 Addressed Issues from ScreenOS 6.0.0r2..................................................................... 35 Antivirus ................................................................................................................... 35 HA and NSRP ........................................................................................................... 36 IDP ............................................................................................................................ 36 Other ......................................................................................................................... 36 Routing...................................................................................................................... 36 WebUI....................................................................................................................... 36 Known Issues .................................................................................................................... 37 Known Issues in ScreenOS 6.0.0r5............................................................................... 37 Administration .......................................................................................................... 37 Antivirus ................................................................................................................... 38 CLI ............................................................................................................................ 38 GPRS......................................................................................................................... 38 HA & NSRP.............................................................................................................. 38 IDP ............................................................................................................................ 39 Management.............................................................................................................. 39 NAT .......................................................................................................................... 40 Other ......................................................................................................................... 40 Performance .............................................................................................................. 42 Routing...................................................................................................................... 42 VoIP .......................................................................................................................... 42 VPN........................................................................................................................... 42 WebUI....................................................................................................................... 43 Known Issues from ScreenOS 6.0.0r4.......................................................................... 43 IDP ............................................................................................................................ 43 Management.............................................................................................................. 43 Other ......................................................................................................................... 44 Known Issues from ScreenOS 6.0.0r3.......................................................................... 44 HA and NSRP ........................................................................................................... 44 Known Issues from ScreenOS 6.0.0r2.......................................................................... 44 Antivirus ................................................................................................................... 44 HA and NSRP ........................................................................................................... 44 IDP ............................................................................................................................ 45 Management.............................................................................................................. 46 Other ......................................................................................................................... 46 Performance .............................................................................................................. 48 VPN........................................................................................................................... 49 WebUI....................................................................................................................... 49 Known Issues from ScreenOS 6.0.0r1.......................................................................... 49 Antivirus ................................................................................................................... 49 HA and NSRP ........................................................................................................... 50 IDP ............................................................................................................................ 50
Management.............................................................................................................. 50 Other ......................................................................................................................... 51 Performance .............................................................................................................. 52 Routing...................................................................................................................... 52 VLAN ....................................................................................................................... 52 VPN........................................................................................................................... 52 WebUI....................................................................................................................... 52 Limitations and Compatibility .......................................................................................... 53 Limitations of Features in ScreenOS 6.0.0r1................................................................ 53 Compatibility Issues in ScreenOS 6.0 .......................................................................... 55 Documentation Changes ................................................................................................... 57 Changes in SSG Hardware Documentation.................................................................. 57 Documentation Changes Introduced in 6.0.0r2 ............................................................ 57 Documentation Changes Introduced in 6.0.0r1 ............................................................ 57 Getting Help for ScreenOS 6.0 Software.......................................................................... 58
Version Summary
ScreenOS 6.0 firmware can be installed on the following products: Secure Services Gateway (SSG) 5, SSG 20, SSG 140, SSG 320/350M, SSG 520/520M, SSG 550/550M, Integrated Services Gateway (ISG) 1000, ISG 1000-IDP, ISG 2000, ISG 2000-IDP, and NetScreen-5000 series with MGT2/SPM2. This release incorporates the fixes from ScreenOS maintenance releases up to 5.4r4 and 5.3r8, plus the addressed issues listed in this document. Note: If you are using an SSG 500-series device and an SSG 500Mseries device in a NetScreen Redundancy Protocol (NSRP) environment, both devices must be running ScreenOS 5.4r2 or later. Note: NSRP clusters require the use of the same hardware products within a cluster. Do not mix different product models in NSRP deployments. Note: You can use NetScreen-Security Manager (NSM) 2007.1 with the Forward Support Update software to manage devices running ScreenOS 6.0. To do this, install a schema upgrade on the management server and user interface. The upgrade is available at http://www.juniper.net/customers/support/. Refer to the NSM Forward Support for ScreenOS 6.0.0 Release Notes for installation instructions and the features and platforms supported with this schema upgrade.
New Features and Enhancements

The sections below describe new features and enhancements available in ScreenOS 6.0.0 releases. Note: You must register your product at http://support.juniper.net so that licensed features, such as antivirus, deep inspection, and virtual systems, can be activated on the device. To register your product, you need the model and serial number of the device. At the support page: If you already have an account, enter your user ID and password. If you are a new Juniper Networks customer, first create an account, then enter your ID and password.
After registering your product, confirm that the device has Internet connectivity. Use the exec license-key update all command to make the device connect to the Juniper Networks server to activate the feature.
New Features and Enhancements Introduced in 6.0.0r5

The section below describes the new feature introduced in the ScreenOS 6.0.0r5 release. ISG-IDP Session Pass Under Heavy Throughput An option to allow sessions to pass through without inspection under heavy throughput conditions has been introduced in this release. This feature bypasses traffic inspection for some sessions when the Intrusion Detection and Prevention (IDP) Security Module (SM) is unable to stay in lockstep with incoming traffic while continuing to inspect other packets. You might use this feature when you are sensitive to packet drops and want to enable an on/off switch to have packets inspected at the firewall level instead of through the security module. By default, this feature is off; that is, as in previous releases, all traffic is inspected by IDP and under heavy throughput, some packets may be dropped. To enable this feature, use the following command syntax: exec sm sm_id ksh "scio const set sc_adapt_enable 1" You need to run this command on each IDP SM. The valid sm_id values are 1, 2, 3. To disable this feature, use the following command syntax: exec sm sm_id ksh "scio const set sc_adapt_enable 0"
When enabled, throughput conditions are taken into account and bypassing packet inspection is done using a set of criteria. Traffic conditions will result in IDP operating in the following modes: Normal inspectionAll traffic is inspected by IDP. Basic cut-through modeAll new sessions will be marked as cut-through and will be allowed to pass uninspected. The first packet of the session received by the Security Module triggers the cut-through marking. It is possible for subsequent packets to still be sent to the Security Module before the Management module takes cut-through into effect. All these subsequent packets are sent out without inspection. Progressive cut-through modeAll sessions for which packets are being observed by the IDP security module will be bypassed.
Log messages are issued for any IDP bypass state. The six log types for session bypass state changes are: Normal to basic cut-through Basic cut-through to normal Basic cut-through to progressive cut-through Progressive cut-through to basic cut-through Normal to progressive cut-through Progressive cut-through to normal
Here are details of the log messages: Category is NS_LOG_CATEGORY_ALARM. Logtype is NS_LOG_ALARM_OTHERS. Severity is NS_LOG_SEVERITY_WARNING. Service is cutthrough_transit. Its values and means are
o o o o o o SC_LOG_CUTTHROUGH_NORM_TO_LOW = 1 SC_LOG_CUTTHROUGH_LOW_TO_NORM = 2 SC_LOG_CUTTHROUGH_LOW_TO_HIGH = 3 SC_LOG_CUTTHROUGH_HIGH_TO_LOW = 4 SC_LOG_CUTTHROUGH_NORM_TO_HIGH = 5 SC_LOG_CUTTHROUGH_HIGH_TO_NORM = 6
Here is a sample log message for status changes: SM %d IDP (cpu %u) transits from %s. %u sessions was bypassed in the previous state! The log also includes log version, timestamp, device_domain_id, device_record_id, device_domain_ver2, and policy_id. You can use counter commands to get information about whether a CPU is in cut-through mode and the number of sessions that were set to cut-through mode. For example, exec sm 1 ksh "scio counter get kpp sc_kpp_loopback sc_kpp_norm2low sc_kpp_low2high sc_kpp_high2low sc_kpp_low2norm exec sm 1 ksh "scio counter get flow sc_flow_session_basic_cutthrough 0 sc_flow_session_progress_cutthrugh 0 sc_flow_cur_cutthrough_sessions 0

The sections below describe new features and enhancements introduced in the ScreenOS 6.0.0r2 release. New Features New features introduced in the ScreenOS 6.0.0r2 release are as follows:
PIM Support
The following PIMs are now supported on the SSG 300M-series devices: 6-port GE SFP uPIM, 8-port 10/100/1000 uPIM, 16-port 10/100/1000 uPIM, ADSL2+ PIM, G.SHDSL PIM, 2-port T1 PIM, 2-port E1, and 2-port serial PIM.
2M Session Support on NS 5400
The NetScreen 5400-MGT2 Secure Port Module 2 (SPM2) now supports up to two million (2M) sessions. Note: Since two SPMs are required to support this feature, the NS 5200 will continue to support only 1M sessions.
SSG 320M/350M Devices
There are now two new SSG platforms introduced in conjunction with the 6.0.0r2 ScreenOS release that will support ScreenOS and JUNOS.
Web User Interface for uPIM Statistics
The WebUI now supports uPIM statistics CLI commands that were available in 6.0.0r1. In earlier releases, the standard counters were not enabled for bgroups on the SSG 140, 520, and 550. This feature adds WebUI support for uPIM statistics. All SSG platforms support this WebUI feature.
IPv6 Support for ISG 1000
The ISG 1000 now supports IPv6. ISG-IDP, however, does not yet support IPv6.
Unified Access Control Clustering Enhancements
Auth table entries are now synced from the active device to the backup device and are retained after failover. Auth table cold-sync support was added to support seamless failover. This feature is supported on all platforms. Note that this feature requires Unified Access Control (UAC) 2.1.
Network Time Protocol Server Support
ScreenOS now includes Network Time Protocol (NTP) server support for intranet hosts using the NTP client service. This feature provides Simple Network Time Protocol version 4 (SNTPv4) support to hosts on the internal network requesting network time. NTP server support is available on all platforms and is enabled per-interface on interfaces with their own IP address. Interfaces without a specific IP address cannot use the NTP server feature. Also, NTP server is not supported on tunnel interfaces. The implementation currently supports only Unicast mode. CLI commands for NTP server are [set/unset] interface <if_name> ntp-server and get interface <if_name> ntp-server. The feature supports vsys and NSRP. NTP configuration will be synced if NTP server is enabled on a VSI. IPv6 is supported. Transparent mode is not. NTP server support is implemented according to RFC 2030. Performance Enhancements Performance enhancements introduced in the ScreenOS 6.0.0r2 release are as follows:
Improve Session Age-Out
This feature decreases the amount of communication between the ASIC and CPU by pushing more information to the session stored in hardware and decreasing the DMA time. This change improves session age-out performance on Juniper Networks hardware-accelerated platforms and should increase the sustained session ramp rate. The feature is supported on the ISG 1000, ISG 2000, ISG-IDP, and NetScreen-5000-MGT2/SPM2.
ScreenOS Release Notes 9
Improve Policy Installation Performance
This feature optimizes policy installation on Application-Specific Integrated Circuit (ASIC) platforms when changes are made to a single policy or when changes are made that affect the entire policy base. This change will decrease symptoms such as packet loss, high-CPU, and system hangs, which are often experienced when a policy, an address object, or a service object is modified while the device is under load. The feature is supported on all platforms.
Resource Manager ALGs Default Changed to Off
Resource manager Application Layer Gateways (ALGs) will be disabled by default on ASIC-based platforms. Affected ALGs include H.323, SIP, MGCP, Skinny, RPC, and SQL. Note that this feature will only take effect on a new installation (that is, no active configuration is currently in flash). During high CPU utilization situations, it has been noted that the sources of the high CPU utilization are resource manager ALGs, many of which are never in use on ASICbased platforms. The feature is supported on the ISG 1000, ISG 2000, ISG-IDP, and NetScreen-5000-MGT2/SPM2.
TCP 3-way-check in ASIC for NetScreen-5000
This feature moves the TCP 3-way-check to the Packet Process Unit (PPU) in the NetScreen-5000 for both single and multi-ASIC sessions. Performance is greatly enhanced when the TCP 3-way-check takes place in the PPU. The feature is implemented in this release on the NetScreen-5000-MGT2/SPM2 and was available on the ISG 2000 in an earlier release.
NSRP Performance Improvements
NSRP messages are now optimized on high-end platforms to improve performance. The performance improvements apply to the ISG 1000, ISG 2000, ISG-IDP, and NetScreen-5000-MGT2/SPM2. Note: When upgrading NSRP clusters, it is necessary to upgrade both devices as soon as possible. DO NOT run 6.0.0r1 and 6.0.0r2 simultaneously in the same cluster, because messages will get out of sync, which could result in a device crash. CPU Protection Tools CPU protection tool features introduced in the ScreenOS 6.0.0r2 release are as follows:
CPU Enforcement Distribution
This feature allows administration of the firewall during high CPU situations. In prior releases, attacks were enforced by the CPU, which contributes to very high utilization during the attack. This feature moves enforcement to the ASIC and bases dropped traffic on a customizable blacklist. CPU protection is implemented on the ISG 1000, ISG 2000, ISG-IDP, and NetScreen-5000-
10
MGT2/SPM2. Note that this feature is best used in conjunction with CPU utilization profiling. The following CLI command is used to create a CPU protection blacklist: set cpu-protection blacklist id<num> <src-ip/mask> <dst-ip/mask> [protocol <num> [src-port <num>] [dst-port <num>] ] [timeout <num>] CPU protection is independent of vsys; it is a per-device configuration. CPU protection is not synced between NSRP peers and is not supported in IPv6. The feature does support Transparent mode.
CPU Utilization Profiling
This feature allows for prioritization of management traffic over noncritical packets during high-CPU situations. In prior releases, when CPU utilization was very high, the device often became unmanageable. Prioritizing management traffic during high-CPU utilization is supported on the ISG 1000, ISG 2000, ISGIDP, and NetScreen-5000-MGT2/SPM2. Note that this feature is best used in conjunction with the CPU Protection feature also provided in the 6.0.0r2 release. Note that CPU profiling is independent of vsys, is not synced between NSRP peers, and is not supported in IPv6. CPU profiling does support Transparent mode. The table below indicates how the CPU profiling feature defines critical and noncritical traffic.
Critical 1 2 3 4 5 Critical traffic includes Management Traffic and Routing Protocol Traffic Broadcast Non-first packet First packet Other
Noncritical
NSRP Security Module Monitoring
NSRP configuration options in this release include weighted security module monitoring. Security module (sm) monitoring can be set in an NSRP cluster to ensure that security modules are active and to fail the device if a particular security module fails. If your device includes security modules and any module fails, you can set a weight for each module failure. This gives you the flexibility of deciding whether an entire device should fail if a particular security module on that device fails. To set a failure weight for a security module, run set nsrp monitor sm <x> weight <num> in the CLI. The default security module monitored weight is 255.
11
ISG-IDP Flow Enhancements
ISG-IDP device policy implementation has been changed to improve CPU and memory usage. The management module will no longer perform an infinite loop if communication with a security module fails. A timer is used to try to resend the policy for a predetermined period (60 seconds). If communication fails continuously for 60 seconds, the management module will treat this condition as a policy push failure and send the status back to NSM. ISG-IDP devices do not handle of out-of-memory errors more gracefully. Before compiling a policy, the amount of memory required to compile that policy is estimated. If it is determined that the free memory available is insufficient, the policy compilation will fail immediately, rather than failing to an irrecoverable state later in the process. Lastly, in the event of a policy-compile failure on at least one security module, the management module will send a compile cleanup message to all security modules. Upon receiving the compile cleanup message, if the current active policy has previously been unloaded, then IDP will restart on the security module. Otherwise, memory used by the new compiled policy, if any, will be freed up.

The sections below describe new features and enhancements introduced in the ScreenOS 6.0.0r1 release. Hardware Features Hardware features introduced in the ScreenOS 6.0.0r1 release are as follows:
16-port 10/100/1000 uPIM
The 16-port 10/100/1000 universal Physical Interface Module (uPIM) is supported on the SSG 140, SSG 500-series, and SSG 500M-series security devices and provides connectivity to copper-based gigabit Ethernet LANs. This PIM also supports up to eight bridge groups (bgroups), which let you group several Ethernet interfaces together. Connect to the module using CAT-5 cable. If you are using this module, see "PIM Power and Thermal Requirements" in the Limitations section.
8-port 10/100/1000 uPIM
The 8-port 10/100/1000 uPIM is supported on the SSG 140, SSG 500-series, and SSG 500M-series security devices and provides connectivity to copperbased gigabit Ethernet LANs. This PIM also supports up to four bgroups, which let you group several Ethernet interfaces together. Connect to the module using CAT-5 cable.
12
If you are using this module, see "PIM Power and Thermal Requirements" in the Limitations section.
6-port GE SFP uPIM
The 6-port small form factor pluggable (SFP) uPIM is supported on the SSG 140, SSG 500-series, and SSG 500M-series security devices and provides connectivity to fiber-based and copper-based gigabit Ethernet LANs. Non-Juniper SFPs are not currently supported by Juniper Networks Technical Assistance Center (JTAC). This PIM also supports up to three bgroups, which let you group several Ethernet interfaces together. Connect the module using the appropriate cable type depending on the specific media used: single-mode or multimode optical cable for SX and LX, and CAT-5 cable for the copper transceiver.
Synchronous Serial Mini-PIM for SSG 20
The synchronous serial Mini-Physical Interface Module (Mini-PIM) is supported on the SSG 20 security device and provides connectivity to serial network media types. Its dedicated network processor forwards traffic to the SSG 20 CPU, where traffic decisions are made based upon the security policy.
1-port GE SFP Mini-PIM for SSG 20
The single port SFP Mini-PIM is supported on the SSG 20 security device and provides connectivity to fiber-based and copper-based gigabit Ethernet LANs. Non-Juniper SFPs are not supported by JTAC at this time. Connect the module using the appropriate cable type depending on the specific media used: singlemode or multimode optical cable for SX, LX, FX, or BX, and CAT-5 cable for the copper transceiver.
E-3 Support
ScreenOS now supports E3 PIMs on the SSG 500-series platforms.

ADSL2+ PIM
The 1x ADSL2+ PIM (Annex A or Annex B) is now supported on the SSG 140, SSG 520/550, and SSG 520M/550M platforms. The two new discrete multitone (DMT) standards supported are: ITU 992.3 (also known as ADSL2): supports data rates up to 1.2 Mbps upstream and 12 Mbps downstream ITU 992.5 (also known as ADSL2+): supports data rates up to 1.2 Mbps upstream and 24 Mbps downstream
G.SHDSL PIM
The G.symmetric high-speed digital subscriber line (G.SHDSL) PIM supports multi-rate, high-speed, symmetrical DSL technology for data transfer between a single customer premises equipment (CPE) subscriber and a central office (CO).
13
The G.SHDSL PIM is now supported on the SSG 140, SSG 520/550, and SSG 520M/550M platforms. ScreenOS 6.0 supports the ITU G.991.2, Single-pair High-speed Digital Subscriber Line (SHDSL) Transceiver discrete multitone (DMT) standard. Virtual Private Network (VPN) VPN features introduced in the ScreenOS 6.0.0r1 release are as follows:
AutoConnect-Virtual Private Network (AC-VPN)
AutoConnect-virtual private network (AC-VPN) enables spokes in a hub-andspoke VPN network to dynamically create VPN tunnels directly between each other as needed. This not only addresses issues of latency between spokes but also reduces processing overhead on the hub and thus improves overall network performance. Because AC-VPN creates dynamic tunnels that time out when traffic stops flowing through them, network administrators are freed from the time-consuming task of maintaining a complex network of static VPN tunnels. All devices must be running ScreenOS 6.0 or later.
Screen on Tunnel Interface
You can now apply any configured screens to tunnel interfaces. Traffic exiting tunnels is examined before and after encryption. However, screens that currently have limited support on the ASIC-based platforms will continue to have the same limitations. Firewall Firewall features introduced in the ScreenOS 6.0.0r1 release are as follows:
WebUI Enhancements
The Web user interface (WebUI) is improved to optimize work flow, display diagnostic information, enhance the homepage, and categorize the menu options.
FTP Get/Put Service Enhancement
This feature redefines the FTP-Put and FTP-Get service definitions used in firewall policies. In earlier ScreenOS releases, FTP-Put and FTP-Get were configured together with different actions in a policy and service groups. In ScreenOS 6.0, the enhancements for FTP Get/Put are as follows: FTP / FTP-Get / FTP-Put should not be in a single service group. FTP/ FTP-Get /FTP-Put should not be defined for one single policy.
14
FTP-Get or FTP-Put is the same as FTP service in policies with deny action. Description in WebUI enhanced.
Automated Data Gathering
This feature is a basic looping script consisting of get commands that run as a background process, saving the output to a FIFO file in the flash. You may record a series of get commands to gather information in the background, but not all get commands are supported. Note: Depending on the information gathered, CPU usage is affected. Universal Threat Management Universal threat management features introduced in the ScreenOS 6.0.0r1 release are as follows:
AV Scanning for IM Services
ScreenOS supports antivirus (AV) scanning for instant messaging (IM) services such as AIM, ICQ, Yahoo! Messenger, and MSN Messenger. AV scanning is supported for text/group chat messages and for file transfer/file sharing. The following versions of the IM client and protocol are fully supported. Forward compatibility on later versions of the IM client and protocol are supported on a best-effort basis.
Instant Messaging Service AIM and ICQ Yahoo! Messenger Supported Protocol Versions OSCAR generic service version 4 Yahoo! Messenger Service Gateway Protocol (YMSG) version 8, 9, 10 Mobile Status Notification Protocol (MSNP) version 11, 12, 13 Supported IM Client Versions AIM 5.9.3861 to 5.9.6089 ICQ 5.04 to 5.1 Yahoo! Messenger 5.5.1228 (v8.0.0.506 is supported as best efforts) MSN Messenger 7.5
MSN Messenger (Windows XP)
All platforms require the high-memory option to run AV scanning. Supported platforms are the SSG 5, SSG 20, SSG 140, SSG 520/550, and SSG 520M/550M.
AV HTTP Trickling Enhancement
This feature enhancement is important for low-speed links. It allows you to configure time-based thresholds to send bits through the firewall to prevent browser timeouts when the device is receiving data or while the data is being scanned by the internal AV engine.
15
IDP and GPRS IDP and GPRS features introduced in the ScreenOS 6.0.0r1 release are as follows:
IDP Enhancements
IDP provides the following enhancements: IDP recommended actions: You can now allow recommended actions in IDP rules. If you specify recommended as the action in a rule, the recommended action will be applied in cases where you do not specify an action within a policy rule. If you specify an action within a policy rule, it will take precedence over the recommended action. VLAN groups for L2 vsys: VLAN groups for L2 vsys are now supported on the ISG 1000, ISG 1000-IDP, ISG 2000-IDP, and NetScreen-5400 devices. IDP inspection of GTP-encapsulated and GRE-encapsulated traffic: The ISG 1000 and ISG 2000 with IDP can now inspect traffic that is encapsulated in GPRS tunneling protocol (GTP) and generic routing encapsulation (GRE). IMSI information in NSM logs: NSM IDP logs now contain International Mobile Subscriber Identity (IMSI) data on IDP security devices. This information allows you to specifically identify the end user for threats and attacks that are detected during forensic evaluation using the provided subscriber-level identifiers. IDP Detector.so has been updated to IDP 4.0: The IDP 4.0 engine has been synced to ScreenOS 6.0. You will now have the same detection capabilities on ISG1000/ISG2000 with IDP as you do on the standalone IDP 4.0 devices. DSCP marking based on application marking: You can now change the DSCP marking of a packet based on IDP actions performed on the ISG 1000/2000 with IDP. This will allow upstream and downstream devices to prioritize traffic based on IDP rules. Troubleshooting IDP: You can use the get sm tech-support command to gather IDP configuration and statistics to troubleshoot IDP security modules.
Authentication Service Enhancements
ScreenOS authentication service provides the following enhancements: Added user IP address to authentication logs Support for TACACS+ authentication servers
16
Prioritized authentication between external server and local database Increased number of permitted administrator IP addresses Enhanced RADIUS features Framed-pool support (IP pool supplied by RADIUS server, not local device) Customizable interface description Called-Station-ID attributes for differentiated billing purposes
Virtual Systems Virtual systems features introduced in the ScreenOS 6.0.0r1 release are as follows:
Virtual System Enhancements
Virtual systems provide the following enhancements: Increased virtual system support on ISG 1000 and ISG 2000 devices: The ISG 1000 and ISG 2000 security devices now support additional virtual systems (vsys). The ISG 1000 now supports up to 50 vsys (increased from 10). The ISG 2000 now supports up to 250 vsys (increased from 50). To take advantage of these increases in vsys support, you must install a new license key. Virtual system names: Vsys names can contain up to 20 characters. Previously, vsys names could contain up to 10 characters.
Network Address Translation Network address features introduced in the ScreenOS 6.0.0r1 release are as follows:
DIP Pool Enhancement
The number of dynamic Internet Protocols (DIP) pools per vsys is increased to 1020 on all platforms. For low-end platforms, the maximum number of DIP pools is 1000; and for some high-end platforms supporting vsys, 51K for ISG 1000 and 64K for NetScreen 500, NetScreen-5000, NetScreen 5400, and ISG 2000. NetScreen Redundancy Protocol NSRP features introduced in the ScreenOS 6.0.0r1 release are as follows:
NSRP Dynamic Route Synchronization
ScreenOS 6.0 now supports dynamic route synchronization. You can sync Dynamic Routing Protocol (DRP) routes in an active-passive NSRP cluster. In the event of a failover, the new active device can use the backup routes while it establishes peering relationships.
17
Layer 2 Transparent Mode Layer 2 transparent mode features introduced in the ScreenOS 6.0.0r1 release are as follows:
VLAN Retagging
VLAN retagging provides a way to selectively screen VLAN traffic. You place a security device in parallel with your Layer 2 switch and configure the switch to direct to the security device only traffic from VLANs you want screened. Traffic to and from your other VLANs continues to pass directly through the switch, thus avoiding any impact to throughput that might be caused by passing all VLAN traffic through the security device. This is currently only supported on NetScreen5000 series devices. UAC UAC features introduced in the ScreenOS 6.0.0r1 release are as follows:
Infranet Authentication
The Infranet authentication includes the following enhancements: Visual display of auth table entries in the WebUI: This feature allows you to view the users with active auth table entries (displays the User, Source IP, and Roles). Additional actions field for infranet auth policies: This feature, available with UAC 2.1, permits the Infranet Controller to control additional policy actions (AV, DI, logging, Web filtering, and antispam) on a per-role basis. This allows you to make policy decisions such as activating AV for partners or untrusted machines, or turning on Web filtering for specific roles. Increased number of auth table entries
Devices SSG ISG NS-5000 series Auth Table Entries 10,000 50,000 50,000
Feature Extensions Feature extensions introduced in the ScreenOS 6.0.0r1 release are as follows:
Jumbo Frames
Jumbo frames are supported on the ISG 1000 and ISG 2000 devices without IDP. To enable jumbo frames, use the set envar CLI command and set max-frame-size to any value from 1515 through 9830 inclusive; for example,
18
set envar max-frame-size=7500. When you enable jumbo frames and restart the security device, only interfaces on the 4-port SFP IO card, plus the management Ethernet interface, become active. Use the get envar command to show the max-frame-size setting. Use the unset envar max-frame-size command to disable jumbo frames support and return the device to the normal maximum frame size (1514 bytes). Jumbo frames are also supported on the NS-5000 series running MGT2 and SPM2 cards. Limitation: DI and IDP are not supported in Jumbo Frames mode.
Bridge Groups for Ethernet Ports on SSG Devices
Bridge groups (bgroups) let you group several Ethernet interfaces together. Starting with ScreenOS 6.0, the SSG 140 security device is preconfigured with three bgroups to which you can add the built-in Ethernet ports. New uPIMs support bridge groups on all SSG devices. Limitation: SSG500/500M-series do not support bgroups on the built-in Ethernet ports.
DHCP Relay Flow
No DHCP Relay: By default, ScreenOS relays DHCP request packets from all zones except the V1-Untrust zone and V1-DMZ zone. Enable this feature to prevent relay of DHCP request packets from a specified zone.
Layer 2 Vsys
Layer 2 vsys is now supported on the ISG 1000, ISG 1000-IDP, ISG 2000, ISG 2000-IDP, and NetScreen-5000 series devices.
Management IP Address Limit Increased
The total number of IP addresses from which a security device can be managed is increased to 50 plus 1 times the number of virtual systems. By making the number of manager IPs a function of the number of vsys, memory is not wasted on low-end devices that require relatively few manager IPs, while high-end devices are not restricted to an artificially selected number.
PPU Enhancement
To increase throughput, TCP-SYN-Bit checking is now done in the Programmable Processing Unit (the ASIC) and supported on the NetScreen 5200 and NetScreen 5400.
DSCP Enhancement
Differentiated Services Code Point (DSCP) marking is now supported on the ISG 1000 and ISG 2000 with IDP and on the NetScreen 5200/5400.
Universal Serial Bus Support
Universal Serial Bus (USB) ports allow file transfers such as device configurations, user certificates, and update version images between an external
19
USB storage device and the internal flash storage. USB functionality is available on SSG devices. The following USB flash drives have been tested and found to work properly with SSG devices: Lexar JumpDrive Firefly 1GB Kingston Datatraveler 2GB PNY attach 256M SanDisk Cruzer Micro 512M
Some other USB flash drives have been found to not work properly with SSG devices.
Coredump and Logs to USB Port
ScreenOS supports full coredump file, logs, and full memory dump file transfers to the USB port on the SSG 5 and SSG 20 and USB ports/compact flash cards on the SSG 140, SSG 500-series, and SSG 500M-series security devices.
IPv6 Support
IPv6 is now supported on the following security devices: NS-5000 series using 5000-M2 management module SSG 5/SSG 20: IPv6 support is available on Ethernet interfaces. (IPv6 is not supported on wireless or WAN interfaces.)
20
Changes to Default Behavior

The sections below describe changes to default behavior introduced in ScreenOS 6.0.0 releases.
Changes to Default Behavior Introduced in 6.0.0r3

This section lists changes to default behavior in ScreenOS 6.0.0r3 from previous ScreenOS firmware releases. USB Boot Sequence When converting an SSG 300M-series device from ScreenOS to JUNOS, apply the set boot junos command. This command changes the boot sequence to boot from the USB instead of from the Primary CF card.

This section lists changes to default behavior in ScreenOS 6.0.0r2 from previous ScreenOS firmware releases. Max Dialing Interval Default The maximum dialing interval has changed from 60 to 600 seconds. This resolves an issue in previous releases regarding the dialing interval in that sometimes dialing failed but the device did not wait long enough and instead redialed almost immediately. CPU Protection and Utilization Profiling As a result of implementation of CPU protection and utilization profiling features in this release, the set firewall ppu command is now hidden and nonfunctioning. Systems that currently have the command set will lose the setting when upgrading to this release. TCP-SYN-Check Packet Flow In previous ScreenOS releases, all three handshake packets (SYN, SYN-ACK, and ACK) were sent to the CPU when you set TCP-SYN-Check. This was the case for single-ASIC, dual-ASIC, and multi-ASIC platforms. With the 6.0.0r2 release, only the first packet (SYN) will be sent to the CPU with the following two packets (SYN-ACK and ACK) processed by the PPU (ASIC) when you set TCP-SYN-Check. Infranet Auth Object Cleanup In releases prior to 6.0.0r2, infranet auth table entries were removed as soon as connectivity with the Infranet Controller was lost. In this release, infranet auth table entries remain for two minutes while the device attempts to reestablish a connection to the Infranet Controller.
21
When combined with Infranet Controller changes scheduled for release in UAC 2.1, the delay in removing auth table entries allows for better failover in Infranet Enforcer and Infranet Controller clusters. Infranet Auth Cold Start NSRP Synchronization In releases prior to 6.0.0r2, infranet auth table entries were synchronized between nodes in an NSRP cluster as long as both nodes were up and communicating with each other. Any infranet auth table changes that occurred while one node was down, however, would not be seen by the other node. In this release, the infranet auth table entries are synchronized between the two nodes of an NSRP cluster when they start communicating with each other. Infranet Controller and Management IP In releases prior to 6.0.0r2, it was not possible to use an interface with a management IP configured to communicate with the Infranet Controller. This was because the NACN message was sent from the non-management IP, and the Infranet Controller would attempt to ssh back to the Infranet Enforcer using the non-management IP, resulting in a failed connection. In this release, the management IP (if configured) is used to send NACN messages to the Infranet Controller. Removing Denied Sessions on Auth Table Change In releases prior to 6.0.0r2, upon removal of an infranet auth table entry, all associated sessions were terminated. However, other changes to the infranet auth table or infranet auth policies had no effect on existing sessions. In this release, when an infranet auth table entry changes, all of its associated sessions are reevaluated. Any that are no longer allowed are terminated.

This section lists changes to default behavior in ScreenOS 6.0.0r1 from previous ScreenOS firmware releases. TCP-SYN-Check Default The default for NS-5200/5400 devices is set flow tcp-syn-check, which includes both SYN-bit check and a three-way handshake. In ScreenOS 6.0.0r1, the default is set tcp-syn-bit-check. RADIUS Attributes In ScreenOS 6.0.0r1, both calling-station and called-station IDs are supported as default behavior.
22
IP Option Packets The IP option packets (record-route and timestamp) in ScreenOS 6.0.0r1 are not dropped. All four IP option packets (record-route, timestamp, security, and stream) behave consistently. Coredump to USB The maximum file size limitation for the coredump file is removed. The maximum USB size supported is 1GB.
23
Addressed Issues
This section describes addressed issues with the current release and includes the following sections: Addressed Issues in ScreenOS 6.0.0r5lists issues from earlier releases that are fixed in this release. Addressed Issues from ScreenOS 6.0.0r4lists issues from earlier releases that are fixed in this release. Addressed Issues from ScreenOS 6.0.0r3lists issues from earlier releases that are fixed in this release. Addressed Issues from ScreenOS 6.0.0r2lists issues from earlier releases that are fixed in this release.
Addressed Issues in ScreenOS 6.0.0r5

The following operational issues were resolved in this release. Administration 233016Dropped traffic from the Self MGT zone was not being logged for IPv6 packets. 234164[SSG 500] The clear counter all command did not clear the 64-bit hardware counters. 237639Admin authentication to the device WebUI via Radius fails if the username is 31 characters. 241401Device failed after deleting a VSYS.
Antivirus CLI 223190The set monitor cpu 100 CLI command does not show up in the config file. 229935The set pak-poll command appears and disappears frequently in the configuration file. 238949URL filtering gets disabled after a restart if the URL filtering profile contains a space. 237473Large iso files cannot be downloaded from certain Web sites when the AV keep-alive option is set. 237846POP3 connection to a POP3 server is reset after enabling AV.
24
DHCP DNS GPRS 238369A failure could occur in the GTP function when referencing deleted GTP tunnels, which in some circumstances were not deleted by the system. 241576After an ISRAU, only one GTP tunnel is deleted while the other stays active. 240535PPPoA learned DNS values overwrite the local DNS settings of the firewall, regardless of preference setting. 236408Device does not send DHCPREQUEST message via broadcast on T2 time when acting as DHCP client. 257662User cannot set a negative integer value for DHCP custom option 2.
HA & NSRP 220773After merging configurations via TFTP to the primary device, some of the configuration fails to synchronize to the backup device, resulting in partial configuration loss. 227549The backup device in an NSRP cluster failed after forcing failover and then doing failback, due to accessing a null pointer. 230940With NSRP session synchronization, it was possible for the backup device to see a single host with multiple DIP addresses from a fixed-port DIP pool. 236524The NSRP backup device in transparent mode incorrectly forwards SNMP requests sent to its manage-ip, and treats traffic as through-traffic instead of self-traffic, which causes the corresponding switch MAC address to flap. 238578Non-VSD sessions in an Active/Active NSRP configuration incorrectly synchronize between cluster members if the session's egress subinterface differs between cluster members. 251797In certain conditions, when a policy is deleted from the primary device, it does not sync to the backup device. 253075FTP traffic stopped when an NSRP failover occurred. 258684The tcp/udp/icmp sessions were not cleared on the backup device in transparent mode. Also, the set nsrp rto-mirror session ageout-ack command was not functioning correctly, resulting in sessions on the backup not being cleared.
25
259736When an AES algorithm or AH protocol is used, the backup firewall fails to read the correct SA sequence number from the primary firewall, causing a VPN issue after a device failover. 260760[SSG 5] NSRP failover not working properly when both NSRP interfaces and a secondary path are enabled.
IDP
229742[ISG 1000/2000] In transparent mode, integrated URL filtering does not work when IDP inspection with Security Module is also enabled. 232075[ISG 1000/2000] Time binding attacks are not reporting logs to the NSM server. 236437[ISG 1000/2000] In certain situations, the traffic passing through an inline mode IDP rule may experience excessive delay when other rules are configured for TAP mode IDP. 237769[ISG 1000/2000] There is high CPU utilization on a single SM (Security Module) due to uneven session distribution. 252958[ISG 1000/2000] Login attempts with FTP brute force signature were erroneously being logged as accepted.
Management NAT 250756In certain cases, NAT translation for ICMP/ICMPv6 causes the device to restart. 255034Under certain conditions, MIPs may be deleted, even though the same MIPs are still being referenced in a policy. 224382Task CPU spikes when the authentication result from the RADIUS server does not arrive on time. 232175The device failed when updating the configuration via TFTP. 239362The BGP Established Time was not shown correctly using SNMP walk. 252700Unsupported "Far End" OIDs were modified so that they return a "no such object" response to an SNMP query. 25278164-bit hardware counters for aggregate interface exceed the 32-bit limit, causing inaccurate results. 253762The NSM agent sends an incorrect MS-RPC UUID service value back to NSM, causing a configuration update issue. 258148SNMP reports incorrect ifspeed on serial interface.
26
Other
255984Policy-based NAT is unable to perform NAT to pass through ESP packets. 261134With set arp nat dst enabled, the device responds to an ARP request, even though the policy is disabled.
214857With a CF card inserted, under certain conditions, the "Flash" LED does not illuminate after a reboot. 225211The ISDN Basic Rate Interface (BRI) does not work correctly with certain ISDN vendors. 225870The device can restart in the presence of two PPP active lines (for example, DSL) when one of the lines is reset. 227315After adding 10/100/1000TX interfaces to an aggregate interface, the counter of the aggregate interface is wrong. 227438CTS traffic incorrectly detected as "HTTP:Overflow:Content-Overflow" and dropped. 228235Spam emails are not tagged properly when source uses DomainKey Signature. 229985In unframe mode, an SSG 140 sent an idle flag that conflicted with an M7i router. 231670In certain environments, if only URL filtering is enabled in the policy, the HTTP response might fail to be parsed. 234140Debug causes device failure because of malformed TCP packets. 234233Xauth server configuration is lost after restart if the auth-server name contains a space. 234715The device may fail under certain conditions when receiving MGCP traffic. 234773When a cable is not connected to an interface with track-ip configured, the device may restart periodically. 236565L2TP configured in a VSYS would not work after a restart. 236694In rare cases, the device may restart due to invalid interface reference. 241343When a user in the Radius system belongs to multiple groups, and the user is authenticated via the firewall to the Radius server, the firewall may restart. 251463Device failed when a packet with an invalid ALG port number address was being forwarded.
27
252624NSRP DIP debugging messages are being printed to the console even with no debugs enabled. 253020On occasion, a device failure occurs when the function to match sessions from IPv6 embedded packets tries to access an incorrect memory location. 253965Frame Relay clocking mode did not initialize properly. 256071TCP sessions established through a tunnel interface with GRE are not removed from the session table, even after application termination. 256589When a large number of VPN policy is configured, the device may fail to create VPN policy when the tunnel id is not specified. 258336The device restarts on its own when the Deep Inspection Signature Pack is updated. 262666When NTP is enabled, and set ntp server src-interface is used, NTP communication cannot be checked in policy when the traffic is sent out to an interface other than the one specified in the command.
Performance 233167[ISG, NetScreen-5000] High CPU utilization in flow occurs when L2TP traffic passes through the device. 254924In some cases, when a packet loops between two devices, the TTL is not decreased accordingly, which causes high CPU utilization.
Routing 225134When gateway tracking routes are configured, the device may restart while processing traffic that uses the gateway tracked route. 227948When OSPF is configured with Reduce flooding, a rare condition of network changes can cause an incorrect value of "LSAs with no DCoption" counter, resulting in continuous purging of OSPF LSAs. 228200An alternate route cannot be added to the routing table and be active after a tunnel failure. This issue will occur when using the set interface tunnel_name protocol rip demand-circuit command. 235160IPv6 routing suddenly fails due to an exception on one of the PPUs. 240158The device may fail when one IGMP router interface proxies more than one host interface.
Security 228860Device not passing traffic when Infranet Controller is unreachable or unavailable.
28
VoIP/H323 VPN 224953In certain situations, the device is unable to create a route-based VPN. 227486In transparent mode, h.323 communication failed due to inability to execute the MAC cache operation. 255168With the ALG enabled, the pre-marked DSCP values for H.323 traffic are not retained when passing through the device.
WebUI 234071Under some circumstances, the ADSL PPPoE interface service option cannot be changed via the WebUI. 235599It is possible to erroneously configure a VIP that is the same as Untrust for http (port 80). 239316When editing an aggregate interface (next to Traffic Bandwidth), "Memmbers" is used instead of "Members." 239748[NetScreen-5200-MTG2] Counting configured on a policy incorrectly shows a drastic drop in the bytes/sec counter in the WebUI. 241069Using the WebUI, the software version shows an _ssg suffix, such as 6.0.0r2_ssg. 250313When using the WebUI for MIP grouping in a policy, the MIP object can be deleted. 256041In a particular circumstance, the device may fail when an admin edits a VPN configuration using the WebUI. 259582When adding Antispam to an existing Antivirus Profile via the WebUI, FTP session disconnects occur and result in abnormal behavior of FTP commands (ls, dir). 264300Config Merge from the WebUI fails.
Addressed Issues from ScreenOS 6.0.0r4

The following operational issues were resolved in this release. Note: Due to an update in the ScreenOS problem tracking system, some issues listed here have two bug numbers. The six-digit numeric code shown first is for the new system; the os and cs numbers included in the listing for some issues are provided as a reference to older Known Issues. Eventually the older reference numbers will be phased out.
29
Administration 222603When a root system administrator is authenticated via RADIUS, it's not possible to set the admin password for a vsys. 226959[SSG 520M] The alarm LED always shows red when NSRP is configured on the device. There is no effect on the device's performance.
Antivirus CLI GRPS 229295When GTP inspection was used, GTP UpdPdpRequest packets failed the sanity check and were dropped if the TEID was zero. 235940Unsetting a custom syn-flood destination threshold did not go back to the default value. 239997Deleting an access list entry using the CLI does not check if there is an address and netmask match. 227667Tagged VLAN traffic may be dropped when AV is enabled.
HA and NSRP 224084When an administrator is authenticated via RADIUS in a clustered environment, some commands may not be synchronized via NSRP. 227050In an NSRP failover, the state of the XFP gigabit interface is DOWN, but the software shows it as UP. 227366FTP traffic is lost momentarily for approximately three seconds after an NSRP failover occurs. 231510When enabling an NSRP secondary path using the WebUI, it does not get saved to flash. 234080The NSRP configuration was out of sync because the command lines in the configuration were in a different order. 235560[NetScreen-5000-MG2-8G2/2XGE] Once the syn-flood threshold is reached, the syn-cookie is not turned off correctly. 237697An NSRP cluster is out of sync due to the udp-flood dest-ip setting.
IDP
224786The scio subs status command does not display CPU utilization.
30
Management 224163The SNMP packet 64-bit counter values are not reporting correctly. 225013The types filed in the traffic log, byte_recv and byte_sent, should be displayed as unsigned values in the log; however, when a value larger than 2147483647 occurred, it was printed as a negative value. 226808Under a high-traffic volume condition, the traffic log is not sent to NSM. 234363[ISG 1000/2000, NetScreen-5000] Large policy installs via NSM to ASIC platforms may cause OSPF adjacencies to drop. 234662A device failed when trying to update a policy configuration using NSM. 234722In NSM, the Active Sessions statistics showed IP addresses as being reversed. 235853Some NSM configurations may cause the device to fail, due to task mismatch. 237505The ASIC sector memory space has been increased to allow more policies to be configured. 238162When using src-interface for some services, the route lookup is done in the default virtual router (VR) instead of the src-interface VR. 238777When deleting 2,000 policies from an ISG 2000 using NSM, the update fails after about 130 policies are removed.
Other
207158WebTrends messages are not sent out properly through a VPN tunnel when the device is running under an NSRP Active/Active configuration. 216025A memory leak occurred on an SSG 500 device due to the PKI online CRL. 223729Because PPP always referenced the L2TP tunnel auth setting for query config, set l2tp <name_string> auth server <server_name> query-config was considered to be a valid command; however, the set l2tp default auth server <server_name> query-config command fails to work. 225017[SSG 5/20] The device may stop passing traffic due to a link-layer buffer problem. 227229[ISG 1000/2000, NetScreen-5000] The devices maintaining hardware sessions may drop packets for UDP based applications if the frequency of the traffic and the timeout are configured to be the same.
31
227364Traffic log information is changed when adding or removing more specific policies. 227670Under rare circumstances, the FTP connection fails when an FTP retransmission packet is received. 228727The connection between the device and the SurfControl server failed several times a day when a high rate of activity was present, causing content filtering to be disrupted. 231303Service timeout may become incorrect when predefined service is overloaded by custom service. 23203664-bit out bytes and out ucast counters are incorrect for the serial interface. 234463With certain protocols, such as Telnet and FTP, the first pass-through connection can stop responding when using the policy pass-through auth and external auth server. 234493The device fails to strip the Domain Name when authenticating 802.1x against the RADIUS server. 234503When using 802.1x authentication, the NAS-IP-ADDRESS field becomes 0.0.0.0 when the RADIUS server is on the remote side of a route-based VPN using an unnumbered tunnel interface IP. 235905When using MLPPP or T3, the serial interface encounters timing slips. 240098The traffic to a VIP address that is the same as the interface IP gets dropped 251580The device may fail due to an address mismatch between the ASIC and CPU. 260884[ISG 1000/2000] In versions 6.0.0r2 and 6.0.0r3, the devices erroneously reported double the maximum number of sessions that they were able to handle. Starting with version 6.0.0r4, the code has been fixed to reflect the correct session maximums.
Routing 214163An ASIC is overburdened with processing RIP packets when a large number of RIP tunnels are being built up during the failover. 225869[ISG 2000] A failure occurred because of an array error in a route table lookup. 226284Certain BGP prefix routes were lost when advertising. 229973Under some conditions, the device fails due to an inconsistency between the routing table and the IP classification table, resulting in an invalid route.
32
231865TCP traffic cannot pass when there are no ARP entries in the ARP table. The TCP traffic will succeed when ARP entries exist. 235835Static routes redistributed into RIP, update with the wrong next hop. 239971[ISG 1000, ISG 2000, NetScreen-5000] IPv6 traffic does not pass on ASIC platforms when in transparent mode. 240429In some cases, multiple multicast routes for the same group are added to the routing table, causing the multicast-route limit to be reached, and no more multicast routes can be added.
Security 233964A critical parsing vulnerability was reported in OpenSSL ASN.1.
VoIP/H323 VPN 218452The certificate fails to renew the CRL if the CA server's publication interval is less than 12 hours. 220344IKE phase 1 continued to use the old IP address after dynamic DNS for a NAT-T peer had changed the IP address. 221350[NetScreen-5000-MGT2] UDP fragmented packets are dropped in a site-to-site VPN tunnel. 222173The VPN Up/Down event log does not show the first time, but later it works well. 222721Under certain circumstances, such as when editing VPN policies, the proxy-id of dial-up VPNs could be incorrectly reset to a nonproper value. This caused the IKE key renewal to fail; then VPN clients, such as NetScreen-Remote, prompted indefinitely for new authentication. 222964The VPN failover and then the failback do not work when using the VPN Monitor src-interface and destination-ip with Dual Untrust mode. 224421The set ike p1-max-dialgrp-session command does not work properly because the concurrent p1 dialgrp sessions number is counted incorrectly. 222660H.323 VoIP calls may fail due to the H.245 gate failing to open. 223896A SIP auth request is dropped when MIP is configured on a SIP Proxy. 230195An unattended device failed, due to SIP ALG. 231134The system failed in the SIP ALG functions.
33
225131The device may restart when running L2TP debug. 226681A memory allocation error occurred when trying to establish a dial-up VPN using certificates. 230340A VPN with a VLAN tag configured in a vsys, after a VPN rekey, caused problems with VPN traffic from a remote peer that used an old key; the old key failed to match the correct hardware session.
WebUI 219552After logging into a device via SSL, a popup message occurred regarding browser security. 220274An incorrect NTP server IP address will appear in the configuration if NTP is set up in the WebUI with only one server. 227729System may fail when doing a save self log using the WebUI. 227963Black/White list entries cannot be displayed/edited using the WebUI. 232471The DSCP settings on a policy are lost when the policy is modified.

The following operational issues were resolved in this release: Antivirus 254153FTP data fails when AV is enabled on the policy.
HA and NSRP 221838The backup device in the NSRP active-passive pair resets unexpectedly.
Management 227488Issuing the get tech command via telnet or SSH causes task CPU to spin in a loop, creating high task CPU. 231728For SSG 140, the DNS information from PPPoE does not update to the DNS host setting of the firewall. 232654When upgrading from a previous version to ScreenOS version 6.0, existing policies can be imported incorrectly 233428In Transparent mode, the management feature on a v1-Untrust zone is not added to the configuration, so it becomes disabled after a device reset.
34
Other
234379In Transparent mode, cross VSYS management traffic is allowed, even though there is no policy to allow this traffic.
237811Traffic fails to pass when using the NAT interface, due to DIP allocation failure.
Routing 236497In some cases, the device was not clearing out redistributed routes from the RIP database, even though the sending routing protocol has been disabled.
WebUI 227928When creating a custom zone in Untrust-VR, the zone is created in the Trust-VR instead. 229923The device may inadvertently reset if you direct a browser to the management IP address via WebUI.

The following operational issues were resolved in this release. Note: Due to an update in the ScreenOS problem tracking system, some issues listed here have two bug numbers. The six-digit numeric code shown first is for the new system; the os and cs numbers included in the listing for some issues are provided as a reference to older Known Issues. Eventually the older reference numbers will be phased out. Antivirus 218326 [os66700]Yahoo! Messenger IM file transfer from the Internet does not get scanned when set av http skipmime is enabled. 224994 [os69848]When the device is under heavy HTTP traffic and memory is running low, an incorrect debug message is displayed: "Fail to allocate new data area for buf." 225910 [os70197]When HTTP AV is enabled and Yahoo! Messenger (YMSG) IM AV is disabled, file transfers over YMSG (that use the HTTP protocol) may occasionally cause the file transfer to fail on reaching the maximum configured limits. For example, a file transfer may fail if the file is larger than the configured max-content-size. 225920 [os70207]Under high stress conditions with AV, it is possible to see FTP traffic blocked.
35
HA and NSRP IDP Other 221408 [cs12430]Some MGCP protocol extension traffic was being dropped by the MGCP ALG. 224307 [os69468]There is no option to clear the newly introduced bgroup interface counters on the SSG140. 224500 [os69570]On the SSG 20 devices, operating mode configured for ADSL2 or ADSL2+ is always incorrectly seen as auto in the WebUI. 226119 [os70287]Global DIP pool limit is 1K on SSG devices. 229379After upgrading from ScreenOS 5.4 to 6.0.0r1, SQL traffic may fail to pass through the device. 224257 [os69438]Under heavy traffic conditions, if the IDP Profiler is enabled, the CLI may respond slowly. 224759 [os69720]If you see this event log, dma_transmit failed to 1, then youve reached the maximum capacity of your device. 224248 [os69429]Unset interface <name> ip manageable is not propagated from master to slave.
Routing 223879 [os69272]ISG 1000 with IDP may fail when passing SunRPC traffic through a security module.
WebUI 222724, 121948 [cs12755]In an NSRP environment, you cannot use the WebUI to assign priority when you create a second redundant interface. 225485 [os70000]If you delete a vsys using the CLI, the vsys is still displayed in the WebUI. Selecting this incorrectly displayed vsys on WebUI will cause the device to fail. 227317 [cs13945]On SSG20-wireless devices, it is not possible to use the WebUI to bind a wireless interface to an SSID. Attempting to do so will result in a Web error page.
36
Known Issues
This section describes known issues with the current release and includes the following sections: Known Issues in ScreenOS 6.0.0r5describes deviations from intended product behavior as identified by Juniper Networks Test Technologies through their verification procedures. Again, whenever possible, information is provided to assist the customer in avoiding or otherwise working around the issue. Known Issues from ScreenOS 6.0.0r4 describes deviations from intended product behavior discovered in 6.0.0r4 that may still exist in 6.0.0r5 as identified by Juniper Networks Test Technologies through their verification procedures. Again, whenever possible, information is provided to assist the customer in avoiding or otherwise working around the issue. Known Issues from ScreenOS 6.0.0r3describes deviations from intended product behavior discovered in 6.0.0r3 that may still exist in 6.0.0r4 as identified by Juniper Networks Test Technologies through their verification procedures. Again, whenever possible, information is provided to assist the customer in avoiding or otherwise working around the issue. Known Issues from ScreenOS 6.0.0r2describes deviations from intended product behavior discovered in 6.0.0r2 that may still exist in 6.0.0r3 as identified by Juniper Networks Test Technologies through their verification procedures. Again, whenever possible, information is provided to assist the customer in avoiding or otherwise working around the issue. Known Issues from ScreenOS 6.0.0r1describes deviations from intended product behavior discovered in 6.0.0r1 that may still exist in 6.0.0r2 as identified by Juniper Networks Test Technologies through their verification procedures. Again, whenever possible, information is provided to assist the customer in avoiding or otherwise working around the issue.
Known Issues in ScreenOS 6.0.0r5

The following are known deficiencies in features at the time of this release. Whenever possible, a workaround is suggested following the problem description, preceded by W/A. Administration 223139Task CPU becomes high when executing some CLI commands with a large configuration which triggers high overall CPU utilization and reaches the alarm threshold. 239747The syslog message incorrectly shows that the action is deny, but traffic is permitted.
37
256694Negate policy doesn't work properly when policy has overlapping addresses in src or dst address. 267372The SNMP trap (OID) of the interface status is not correct. 267997Incorrect ifIndex in link-up/link-down SNMP trap for redundant interface. 273937WebUI to an interface is accessible, although ip manageable of the interface is disabled. 275288Device restarts when MIP configured with incorrect mapping from IPv4 to IPv6.
Antivirus CLI GPRS 224423If a timeout is configured in one GTP object, this timeout is used for all GTP objects. 259128With GTP inspection enabled, CreatePdpRequest packets could be dropped because the firewall ran out of available GTP paths. 260243When disabling the rate limit in a GTP object configuration, the limit was not actually disabled. W/A: Increase the rate limit to the maximum value of 20,000 pps or restart the device. HA & NSRP 227657The syslog src-interface option is incorrectly being synchronized to the backup device in an NSRP cluster. 227658The device could fail after issuing the unset service any timeout never command. 241267The output for the get chassis CLI command was not included in the get tech command. 241551[SSG 140] The get led CLI command does not show any information. 271297The get perf session detail command did not display the correct values. 263166With AV enabled, FTP data may freeze or fail. 266736With Antivirus enabled, an email containing certain characters may cause the POP3 or SMTP session to freeze.
38
227665The nsrp vsd-group track-ip method CLI command is lost after a reset. 258989[NetScreen-5000] Traffic is not forwarded when the packets are received on an aggregate interface of the backup VSD in an NSRP Active/Active cluster due to the TCP SYN check failing incorrectly. W/A: Disable TCP SYN check.
IDP
262533Alarm LED on an SSG 140 was not displaying correctly when an NSRP failover event occurred. 263019ARP entry to a non NSRP management zone causes track IP failure after failover in transparent mode. 267734The primary ISG does not read the sequence number correctly from the ASIC for AES after failover. 268708Traffic fails to pass after failover of a NSRP pair with devices configured in transparent mode. 268809When no-session-backup is enabled on a policy, traffic through the serial interface stops passing traffic.
225502[ISG with IDP] The IDP drops legitimate HTTP traffic for very large HTTP downloads. 239575When both tcp-syn-check is set and IDP is enabled in the policy, the ACK packet of a 3-way handshake is dropped. 260215When profiling smaller networks, the profiler on an ISG-IDP is not detecting new events and is not updating old ones.
Management 232391With IPv6, unable to ping management interface of ISG, even when in the same subnet. 236724Even with disabled HTTPS WebUI administration (via port 443) and DNS Proxy (port 53) on Untrust interface, no VIP could be properly created using interface-ip in the same Untrust interface. 253800In the case of aggregate and redundant interfaces, the ifAdminStatus and ifOperStatus are reported incorrectly. 254755Unable to upgrade device via Service Copy (SCP) using PSCP (Putty SCP). 259602[SSG 320/350M] The get chassis command incorrectly displays the CPU temperature as I/O temperature.
39
259773[SSG 140] When doing an SNMP get to the device, an incorrect sysObjectId is returned. 260188The device is only able to send 400 to 500 logs per second to NSM. 261714NSRP failover event log is not sent to syslog server. 266159[SSG 140] SNMP MIB walk shows up as SSG-240, instead of SSG-140. 266873In the event log, when the number of telnet and ssh to a device are higher than its display limitation, the log entries of the telnet-cmd number and ssh-cmd number are incorrectly displayed. 269298Some invalid commands are removed from the CLI command tree.
NAT
252031Creating an IPv6-based MIP sometimes results in a "One IP in range [ ] is in use" error. 258279Under certain circumstances, when using duplicated DIP IDs among different virtual systems, the existing mapping entries may be removed from both virtual systems when the DIP pool is removed from one virtual system. 267994CPU utilization is high after Virtual IP (VIP) is configured.
Other
224782The transmit and receive counters on an HA interface between two NSRP peers shows a mismatch, due to an incorrect byte count. 226075[NetScreen-5200] Device sending two ESP packets with the same sequence number. 240625Memory utilization is high due to DI session leak when SYN protection is enabled. 241107When sending RST to tear down the connection, the reason is logged as Close - AGE OUT. 251259Some http clients generated extra CRLF after a POST request, which might cause an out of memory situation when using URL filtering. 252613When a second user attempts to authenticate via WebAuth while the first user is still active from the same IP address and the same authentication group, the device keeps sending authentication requests to the RADIUS server. 254140NFS mount fails due to rpcbind service erroneously being added to the RPC mapping table.
40
254935Serial PPP connection fails authentication when once configured as backup. 255301TCP socket leak causes lost SSH management and BGP peering, resulting in high task CPU utilization. 256010The device outputs a Webtrends log with improper format. 256783Device failed due to mishandling of null pointer. 260626Device unable to pass packets greater than 1,468 bytes across an 802.1q tagged subinterface. 262448The exec policy verify command was not working when empty address groups are used in the policies. 262450The WebAuth login page contained a script error after entering a user name. 264263Device failed due to Null pointer access in sunrpc. 265230The alarm LED on an SSG 140 incorrectly displays as amber, instead of red, when an attack was detected by the firewall. 265446SQL data session times out incorrectly; only half of the service timeout is used. 266244The IPv6 network advertisement solicitation flag was set incorrectly. 267370When generating a syslog message, the source port and destination port are incorrectly interpreted from the event log. 269121GRE keepalive is dropped when the recursion control bit is set. 273879Authentication entries in pending or fail state fail to be cleared. 235311Transmission of the multicast data stream might stop for a while when handling a PIM fragment packet. 239594The device may fail when AV is enabled and AIM traffic is passing through. 266875Interface MAC did not change correctly when the VSI interface was assigned to the mgt zone. 269668Deleting multiple virtual systems at one time may prevent traffic from passing through other virtual systems. 269922With IPv6, an incorrect ICMP message is generated when the policy is configured with action reject. 270342In vsys environment, ping traffic from other vsys to local interface failed.
41
274973When get vr trust protocol pim rp proxy is executed, an exception dump might be output.
Performance 234153High flow CPU utilization caused by packet looping between CPU and ASIC. 266111Slow performance with Web traffic when URL filtering and the SYN Proxy is enabled. 267324[ISG, NetScreen-5000] Packets are being sent out of order when using aggregate interfaces on ASIC platforms.
Routing VoIP 226994If both the IDP module and the SCCP ALG are used, IP phones are unable to register using SCCP. 256706The device was not doing routing and policy lookup for IP addresses with unknown contact bindings from the SIP server. 264625[ISG 1000/2000] SCCP ALG logging messages in the event log, after the ALG was disabled. 274300The "Can't allocate memory for SCCP call context" message appears in event logs due to the timing between session age-out and call completion. 259054The BGP neighbor goes to idle after the BGP connection is reset. 260197Old BGP routes, no longer advertised by the BGP peer, are not cleared from the routing table. 260646The device would not become the PIM designated router (DR) after increasing the DR-priority. 269341IGMP Join occurs 10 seconds after a unicast route has changed. 274788Multicast route through GRE tunnel fails after the GRE routers do a failover.
VPN 264713Tunnel ID and hardware SA in an existing session do not update properly after VPN change, which causes traffic to stop. 266098An IKE gateway could not be created when the device was in L2 mode.
42
WebUI 222872Access to the WebUI is very slow when opening the main home page. 265334From the WebUI, if an RIP summary route is set to metric 1, it does not get written to the config. W/A: Use CLI. 266100The "More than one physical interface in zone V1-Trust" WebUI error appears when binding multiple interfaces to a Layer 2 zone. 266871Custom RPC service is deleted from the policy when that policy is edited. 267496The WebUI reports that the gbw value is out of range when editing on a subinterface. 268659Adding redundant interface or redundant subinterface through the WebUI succeeds, but the WebUI incorrectly produces an error. 270630Unable to disable SSH2 management from WebUI. 272946Unable to create an IKE gateway on a device in transparent mode from the WebUI. 276288When configuring an NSRP cluster id over 63 using the WebUI, the wrong error message is displayed.
Known Issues from ScreenOS 6.0.0r4

The following are known deficiencies in features at the time of this release. Whenever possible, a workaround is suggested following the problem description, preceded by W/A. IDP 225502[ISG with IDP] The IDP drops legitimate HTTP traffic for very large HTTP downloads. 260215When profiling smaller networks, the profiler on ISG-IDP is not detecting new events and is not updating old ones.
Management 217312 [cs11602]Updating devices from NSM using supplemental CLIs may cause cluster members to show incorrect status. W/A: Run a check config sync status directive after the device is updated.
43
Other 231278The device failed when the SNMP zone ID and address object were mismatched.

The following are known deficiencies in features at the time of this release. Whenever possible, a workaround is suggested following the problem description, preceded by W/A. HA and NSRP 235941The NSRP configurations are out of sync, due to the different ordering of AV parameters between master and backup devices.

The following are known deficiencies in features at the time of this release. Whenever possible, a workaround is suggested following the problem description, preceded by W/A. Note: Due to an update in the ScreenOS problem tracking system, some issues listed here have two bug numbers. The six-digit numeric code shown first is for the new system; the os and cs numbers included in the listing for some issues are provided as a reference to older Known Issues. Eventually the older reference numbers will be phased out. Antivirus 226198 [os70325]Under some conditions, AV supplemental CLIs cannot be pushed to the device because NSM erroneously reports that the AV license is not installed. 227591 [os70991]When enabling AV and updating the AV database (either manually or automatically), CPU utilization may reach 90% after a short time. 233302Under unusual circumstances, when AV is enabled and there is heavy traffic through the device, an SSG 20 may fail and restart without warning or any other indication that there is a problem.
HA and NSRP 226337 [cs13767]In an NSRP environment, if a policy has passed infranet auth, when the session permitted by the policy is synced to the backup device, the timeout of sessions on the backup is set to 10 seconds and will quickly age out, terminating the connection.
44
227073 [os70785]Under certain circumstances, an NSRP cold sync may require half an hour to complete when processed under heavy traffic conditions. 227728 [cs14043]ScreenOS does not currently support redundant or aggregate interfaces in an active-active HA pair of ISG 2000 systems. Packets received on the backup device cannot pass through the cluster in an active-active ISG 2000 pair. W/A: Avoid using the redundant interface to forward traffic.
228679The command set syslog src-interface XXX is synced to the backup device in an NSRP cluster even when the src-interface is a local interface. 234401Under certain long-term heavy traffic circumstances, if VPN traffic is running through an ISG 2000-IDP in an active-passive NSRP cluster, the active device may reset.
IDP 226383 [os70393]When major and minor attacks are configured in the IDP rulebase, FTP attacks are not detected within a GTP tunnel. W/A: 1. Configure a rule in the IDP rulebase with GTP service selected and no attacks and action. Configure another rule with attacks selected (major and minor) and action. 2. Now, when FTP root attacks are triggered, they will be detected in either direction. 228623With FTP attacks configured in the IDP rulebase, the GTP tunnel goes into the Ignored state, meaning that FTP attacks are not detected within the GTP tunnel. W/A: 1. Configure a rule in the IDP rulebase with GTP service selected and no attacks and action. Configure another rule with attacks selected (FTP attacks category) and action. 2. Now, when FTP root attacks are triggered, they will be detected in either direction. 229680When running an ISG 1000 appliance in Transparent mode with IDP in Tap mode, packet sizes larger than 1500 bytes cannot be fragmented into the proper size. Some applications may fail under these circumstances. 229975An ISG 2000-IDP may intermittently stop advertising prefixes to eBGP peers after BGP peer refreshes from other devices. W/A: Run the unset enable and set enable commands inside the BGP protocol configuration. 232420An ISG 2000 device running ScreenOS 6.0.0r1 with IDP in Inline mode causes packets to be dropped for return traffic if NAT and a mirror
45
port are both configured. Note that this is not a recommended configuration. 232805In Transparent mode on an ISG 1000 with IDP enabled, if both Web filtering and IDP are enable in one policy, all Web browsing that uses the policy will hang.
Management 226201 [os70328]It is possible that during a configuration save, a Read of flash block 193 failed before write message will appear on the console. If this happens, try to save the configuration again. 234025On the SSG 140 platform, DNS settings cannot be accepted through a PPPoE connection.
Other
226044 [os70254]Under some circumstances, the warning message st_demux_bad_sess_id_from_SM_proc is not support in this build may display on the console. This message is for debug purposes and can be safely ignored. 226115 [os70283]Sometimes after a blacklist is unset, traffic may be blocked. W/A: Restart the device and try again.
226193 [os70320]Under some conditions, it may take up to 30 minutes to load 8191 tunnel interfaces on NetScreen-5000 series platforms during startup. 226217 [os70336]When the IP address of a remote peer changes, IKE phase 1 may fail to update correctly. W/A: Clear the IKE cookies, SA, or DNS cache to force VPN to use the correct IP address.
226377 [os70387]When creating a cpu-protection blacklist during heavy traffic, it may take up to six seconds to make the blacklist work. During this period, it is not possible to execute cpu-protection CLI commands. Under normal traffic circumstances, this process should take less than one second. 226582 [os70558]Under extreme circumstances, the device may crash if a blacklist is set or unset repeatedly during heavy traffic. 226595 [os70571]When a voice call is invoked from v1-trust to v1untrust under Transparent mode, it is possible that one session with timer at 0 will be stuck in the register and unremovable.
46
226637 [os70613]The ICMP signature with time-binding enabled is not triggered when the number of attacks found is equal to the count specified in the time-binding settings. For ICMP packets, there is no concept of a session. Therefore, on ISG platforms, the packets are distributed between the two CPUs on the security module. As a result, the number of attacks for ICMP packets is tracked separately on each CPU. Only if the number of attacks found is equal to the count specified in the time-binding settings will the signature be triggered. This is unavoidable on an ISG device because the memory is not shared between the processes. W/A: One solution is to set the count in the time-binding settings to be half the value of the number of attacks that need to be seen.
226651 [os70627]When traffic reaches 1Gbps (in each direction) through two uPIMs, traffic will be blocked in both directions after approximately one hour. 227592 [os70992]The environment variables nsrp-max-vsd and nsrpmax-cluster must be a power of 2 value from this release. Although the function still works, the current value may not be a power of 2 if it was set using an earlier release. W/A: Reset the environment variables after upgrading to this release.
227641 [os71009]Sometimes invalid session information will be read from the ASIC chip while executing get db s on the console and the packet will be dropped. This happens very infrequently. 227782 [os71064]Under some narrow circumstances when deploying NTP server on ISG 1000 appliances, a hardware session is refreshed by a packet but will still be aged out immediately. 228479When an SSG 550 is working between client and proxy servers in Transparent mode with DI enabled, the device interprets the traffic from client to server on port 80 as an "HTTP:Overflow:Content-Overflow" attack and drops it. 228675When configuring a track-ip object using ARP and binding it to a special VSD group, the track-ip object will be lost after reset. In other words, the CLI command set nsrp vsd x track-ip ip x.x.x.x method arp setting will be lost after a reset. The impact is limited to this track-ip object and does not affect any other function. 229234When setting a Web filtering profile name that includes a space, after reset the profile cannot be saved .230155The get fprofile command may cause a device crash when packet profiling is enabled. 231101After heavy HTTP/FTP/UDP mixed traffic, several sessions could not be aged out. The sessions will only be cleaned up following a
47
device reset. The issue is caused by a PCI problem that causes the device to read a bad session index from the hardware. 231513When configuring a policy with multi-cell service or a service group that includes predefined services in the multi-cell or service group, traffic that matches this policy may have an incorrect timeout value. 231754In Transparent mode, SIP traffic may cause a device crash. 233140Under some circumstances when the RADIUS auth server is configured, the device will fail to execute the set auth-server xxxx command after a restart. 233385Packets may get dropped with the message dip with port translate allocation fail if an interface-based DIP (NAT-Src from the egress interface IP address) is applied. 233516After a large number of configuration changes (policy and VR changes particularly), an ISG 2000 may stop receiving IPv6 packets. 233872After a restart followed by many hours of heavy traffic, an SSG 5 may stop forwarding all traffic. 234058If an IKE gateway peer address is configured to be IPv4 but the local address is an IPv6 address, the device will fail and need to be reset. 236113On the NetScreen-5000 platform, if TCP-SYN-Check is enabled, a cross-chip TCP connection cannot be established in Transparent mode. W/A: Disable TCP-SYN-Check. 238795 On SSG 300M-series devices, you cannot upgrade the bootloader v3.0.5 or upload firmware via the bootloader when the SSG 300M-series device is connected to the TFTP server via an HP 1800-24G switch. W/A: Connect the TFTP server directly to the SSG 300M-series device. Performance 234168When deleting a policy, there are many tasks that need to be accomplished. For example, sessions must be scanned for policy rematching and policies must be deleted from hardware. These operations are CPU intensive, so CPU usage is very high when many policies are simultaneously deleted.
48
VPN 230357When multiple users who belong to the same VPN group try to connect via dialup VPN simultaneously, some connections will fail because of concurrent IKE negotiation limits. An event log entry will be made. Here is an example log entry: Discarded peer's P1 request because there are currently <089> sessions--max is <075>. (2007-02-18 12:28:49)<000> 231887When running a policy-based VPN together with Web filtering configured on an SSG140, the device may crash under heavy traffic. 233217In some situations, for example when an IPsec tunnel is configured, NetScreen-5000 devices cannot fragment 1500 byte VPN packets to the proper size and will instead drop the traffic.
WebUI 230134After creating an aggregation interface on an ISG 1000, the WebUI shows all interfaces as one member of this aggregation interface. This is only a Web display issue. The device will function properly. 232569If quality of service (QoS) is configured on a Voice-over-IP (VoIP) policy via the WebUI, the setting cannot be saved.

The following are known deficiencies in features at the time of release of ScreenOS 6.0.0r1. Whenever possible, a workaround is suggested following the problem description, preceded by W/A. Note: Due to an update in the ScreenOS problem tracking system, some issues listed here have two bug numbers. The six-digit numeric code shown first is for the new system; the os and cs numbers included in the listing for some issues are provided as a reference to older Known Issues. Eventually the older reference numbers will be phased out. Antivirus 220962 [os67933]You may experience a lost or delayed file transfer request if a MSN IM session is idle for more than 20 minutes. 225186 [os69903]Running heavy IM traffic for over a day on SSG5/20 may cause memory issues. 225915 [os70202]When Yahoo! Messenger instant messaging antivirus is enabled and the action is set to pass if the file being examined is larger than the configured value, then the event notifying that max-content-size was exceeded is sent twice. The corresponding error counter is also
49
incremented by 2 instead of 1. The actual handling of the file transfer is correct and no packets are retransmitted. 225916 [os70203]MSN users may experience apparent delay during chatting if MSN network traffic load is low; for example, if there is no ongoing file transfer and not many users are chatting through the firewall.
HA and NSRP 220335 [cs12194]In some cases on the ISG 2000, FTP data transfers do not complete in an active-passive NSRP failover. 221391 [os68106]FTP sometimes fails to complete in an NSRP activepassive setup. The data transfer fails when failover and fallback happen frequently during the FTP transfer. 224082 [cs13209]A backup device does not handle ARP requests when the interface is in Inactive mode or when the interface is disconnected and then reconnected.
IDP 223283 [cs12951]The command exec policy verify is used when DI is enabled on your device. On the ISG 2000/1000 IDP, the DI command is available but is not supported. 225124 [os69887]On ISG 1000/2000 devices, memory issues occur and policy push fails if you continuously push IDP policies. W/A: Unload the policy on the IDP security module prior to pushing a new policy. Enter the command, # exec sm <sm#> ksh "scio policy unload s0" on all the security modules. Replace "sm#" with the number of the security module. For example, for security module 1, the command is #exec sm 1 ksh "scio policy unload s0" 225442 [os69994]On an ISG 1000 device, pushing all attacks using NSM might fail after upgrading to ScreenOS 6.0. W/A: Delete the policy.gz.v from the flash prior to upgrading to ScreenOS 6.0. To delete the policy prior to upgrading, enter the following command from the CLI: # del file flash:policy.gz.v After you upgrade, push the new policy to the device. Management 221467 [os68130]This is an NSM only issue. Import Configuration in NSM may fail if your device has a backslash (\) in the parameter string. The problem stems from a lack of escape sequence for commands, such
50
as set av mime-list where NSM considers backslash as a control character. Other 214251 [os64521]It is possible to create a subinterface for PPP and HDLC connections even though it is not supported in ScreenOS. ScreenOS supports subinterfaces for Frame Relay and Multi-Link Frame Relay only. 219115 [cs11922]If a very small fragmented packet is sent to the FPGA, it is possible that it will be delayed until a larger packet is received to trigger the FPGA hashing functionality. 222710 [os68704]SSG 520, SSG 550, SSG 520M, and SSG 550M devices have incorrect AUX port settings. The correct values are 9600, 8, N, and 1. Currently, the default values are 115200, 8, N, and 1. 222850 [os68781]On the SSG 5 device, if the debug modem all and unset console db commands are both enabled, the CPU utilization is too high to allow for modem dialout from the v.92 interface. 223155 [os68925]SSG 20 devices cannot resolve IPv6 domain names for the IKE gateway. W/A: Specify an IPv6 address instead of a domain name for the IKE gateway. 223684 [cs13083]When using the GTP feature in ScreenOS, the PDP Request filtering checks the Access Point Name (APN) in the Information Element (IE), which is sometimes not supplied. 223776 [cs13119]After the backup firewall is started and if the NSM server sends a FIN packet to it, the backup firewall, when sending resets, uses virtual MAC rather than physical MAC. This causes traffic disruption for short periods (~ 30 seconds) if this packet passes through a switch. 223996 [cs13176]In scenarios using the ARP method for track-ip, changing the track-ip interval may cause track-ip failure. 224099 [cs13226]Sometimes during flow processing, after the packet's ARP entry is determined and before the packet is sent, the ARP entry is freed, which causes the device to fail. 224249 [os69430]An SSG 20 device fails if you insert a write-protected USB device followed by a get file command. 222914 [cs12801]In some cases, when you update the certificate for one vsys using NSM, another unrelated vsys certificate may be removed.
51
Performance 222946 [os68825]After long durations of heavy attack traffic conditions, the device may display bad session id messages incorrectly. 223070 [cs12838]During heavy traffic, SSG devices show high CPU (99%) usage and a warning message is displayed on the console, "WARNING: insertion in tree failed when free a port. Possibly Node Pool exhausted!" 224845 [os69772]Memory issues may occur on the ISG 1000 with IDP running in Transparent mode with all attacks installed.
Routing 215642 [cs11355]ISG 1000 and ISG 2000 devices do not terminate a TCP session immediately when a client sends an RST packet with an incorrect sequence number and with set flow check tcp-rst-sequence and set flow tcp-rst-invalid-session commands enabled. 224606 [cs13366]eBGP neighbor is displayed as an iBGP peer in the get vr <vr_name> protocol bgp neighbor command.
VLAN VPN
223634 [cs13057]Cannot create subinterfaces in two different zones and VRs with the same IP address.
223339 [cs12969]Cannot FTP large files through a VPN to Cisco devices, because the ISG devices change sequence numbers randomly, causing issues with the VPN tunnel on the Cisco end.
WebUI 222872 [cs12797]In some situations, when accessing the firewall's WebUI interface, the WebUI homepage takes a long time to load. 222963 [cs12816]NetScreen-5200 systems with M2/8G2 modules drops NAT-T UDP packets due to bad UDP checksum.
52
Limitations and Compatibility

This section describes limitations of features and compatibility issues with the current release and includes the following sections: Limitations of Features in ScreenOS 6.0.0r1identifies features that are not fully functional at the present time and that will be unsupported for this release. Compatibility Issues in ScreenOS 6.0.0r1describes known compatibility issues with other products, including, but not limited to, specific Juniper Networks appliances, other versions of ScreenOS, Web browsers, Juniper Networks management software, and other vendor devices. Whenever possible, information is provided for ways to avoid the issue, minimize its impact, or in some manner work around it.
Limitations of Features in ScreenOS 6.0.0r1

This section describes the limitations of various features in ScreenOS. They apply to all platforms unless otherwise noted. IDP ICMPDue to a design limitation, large ICMP traffic volume may cause high CPU utilization. SSG 500-seriesBridge groups (bgroups) are supported on Ethernet switch PIMs (uPIMs), including 16-port GE, 8-port GE, and 6-port SFP. Bgroups are not supported on 1-port SFP, old enhanced PIMs (ePIMs), and on-board GE ports. Bgroup interfaces can be dynamically created and deleted. The maximum number of bgroup interfaces on each PIM is half the number of ports. SSG 140Bgroups are supported on both on-board Ethernet ports and Ethernet switch PIMs (uPIMs). Bgroup interfaces can be dynamically created and deleted. The maximum number of bgroup interfaces on each PIM is half the number of ports. For the on-board ports, three bgroup interfaces are precreated. Bgroup interfaces can be configured on the same PIM or the system board only. IPv6 ASIC support in NetScreen-5000 systemsBecause NetScreen-5000 systems now support IPv6, per-ASIC session support has been decreased from 1M to 512K. This is caused by the increase in the session size in the session table. This limitation should have minimal impact on most customers. Note that to achieve maximum session count on the NetScreen-5000 series firewalls, it would be best to design the network to utilize multiple ports on the SPMs. This type of network architecture would distribute the sessions to multiple ASICs. For example, if only two ports on an 8G2 SPM card are used, the max session count value will be 512K.
53
Screens on traffic exiting tunnelshas the following limitations: This feature is not compatible with the new Syn-bit check in PPU feature. Screens for traffic exiting tunnels are performed by the CPU instead of the PPU. This feature will only apply if the screen is activated on the physical interface where the tunnel is terminated if the screen is hardware accelerated.
AC-VPNDPD does not work on the spoke when set on AC VPN profile with global IKE heartbeat enabled. Jumbo frame support on the ISGsOnly the 4-port SFP modules on the ISGs support jumbo frames. All other I/O cards in the device are disabled automatically (including the ISG 1000 built-in I/O card), when max-frame-size is set in the jumbo range (1515~9830). Online HelpAfter upgrading to ScreenOS 6.0, you may have to either clear your cookies in your browser or apply the default Help Link Path button in the WebUI under Configuration>Admin>Management. Because of the cookies Juniper Networks sets when managing a device, you may receive the prior versions Help files when selecting the online Help from within the WebUI. AV scan-extension modeThe AV scan-extension mode does not work for Yahoo! Messenger (YMSG) IM because Yahoo! does not specify the filename in the URL. Device-specific values for AV scanningThe following table specifies de device-specific values for AV scanning:
AV Command/Device SSG 5/20 SSG 140 1 to 4 1 to 6 The Decompress Layer* CLI option (set <protocol> decompress-layer <number>) specifies the number of layers of nested compressed files the internal AV scanner can decompress before it executes the virus scan. 20-10000 KB 20-16000 KB The Maximum Content Size# CLI option (set av scan-mgr maxcontent-size <number> ) specifies the maximum size of content for a single message that the internal AV scanner scans for virus patterns. 256 512 Total number of messages scanned concurrently. * The default value on the device is dependent on the selected protocol. # The default value for all devices is 10,000KB. SSG 500 1 to 8
20-24000 KB
1024
54
PIM Power and Thermal RequirementsIf you install either 8-port or 16-port uPIMs in your SSG 140, SSG 500-series, or SSG 500M-series device, you must observe the power and thermal guidelines. Refer to the PIM and Mini-PIM Installation and Configuration Guide for the power and thermal guidelines for all supported platforms available at: http://www.juniper.net/techpubs/hardware/pim_guide/pim_guide.pdf Warning: Exceeding the power or heat capacity of your device may cause the device to overheat, resulting in equipment damage and network outage.
Compatibility Issues in ScreenOS 6.0

Below are the known compatibility issues at the time of this release. Whenever possible, a work-around has been provided for your convenience, preceded by W/A. Compatible Web browsersThe WebUI for ScreenOS 6.0 was tested with and supports Microsoft Internet Explorer (IE) browser versions 5.5 and above, and Netscape Navigator 6.X for Microsoft Windows platforms, and Microsoft Internet Explorer version 5.1 for MacOS X. Other versions of these and other browsers were reported to display erroneous behavior. Upgrade sequenceJuniper Networks recommends that you follow the upgrade instructions described in the ScreenOS Upgrade Guide located at http://www.juniper.net/techpubs/software/screenos/screenos6.0.0/upgrade _guide.pdf. If you upgrade directly from ScreenOS 5.0.0 or ScreenOS 5.1.0 to ScreenOS 6.0, you risk losing part of any existing configuration. For ISG 2000 devices, you must upgrade to an intermediate firmware and upgrade the boot loader before upgrading to the ScreenOS 6.0 firmware. Refer to Upgrade Paths to ScreenOS 6.0 in the ScreenOS Upgrade Guide for intermediate software and boot loader upgrade information. Use the following procedure to upgrade the SSG 500/SSG500M boot loader: 1. Download the boot loader image (v.1.0.3) from the Juniper Networks support site to the root directory of your TFTP server. 2. Log into http://www.juniper.net/customers/support/. 3. In the Download Software section, click ScreenOS Software. 4. Download the latest SSG 500/SSG 500M boot loader and save it to the root directory of your TFTP server. 5. If necessary, start the TFTP server.
ScreenOS Release Notes 55
6. Make an Ethernet connection from the device hosting the TFTP server to the MGT port on the SSG 500 and a serial connection from your workstation to the console port on the SSG 500. 7. Restart the SSG 500 by entering the reset command. When prompted to confirm the commandSystem reset, are you sure? y/[n] press the Y key. The following system output appears: NetScreen SSG500 BootROM V1.0.2 (Checksum: 8796E2F3) Copyright (c) 1997-2004 NetScreen Technologies, Inc. Total physical memory: 512MB Test - Pass Initialization................ Done 8. Press the X and A keys sequentially to update the boot loader. 9. Enter the filename for the boot loader software you want to load (for example, Boot2.1.0.3), the IP address of the SSG 500, and the IP address of your TFTP server. The following system output appears: File Name [boot2.1.0.2]: boot2.1.0.3 Self IP Address [10.150.65.152]: TFTP IP Address [10.150.65.151]: 10. Press the Enter key to load the file. The following system output appears: Save loader config (112 bytes)... Done Loading file "boot2.1.0.3"... / Loaded successfully! (size = 125,512 bytes) Ignore image authentication! ... ....................... Done. WebUI upgradeWhen upgrading from ScreenOS 5.2.0 to ScreenOS 6.0 using the WebUI, you must upgrade the device to ScreenOS 5.2r3 and then upgrade the device directly to ScreenOS 6.0. Refer to Upgrading to the New Firmware in the ScreenOS Upgrade Guide for instructions on performing the upgrade.
56
Documentation Changes
The sections below describe changes that pertain to the ScreenOS and supported hardware documentation.
Changes in SSG Hardware Documentation

In the version of the SSG 300M-series Hardware Installation and Configuration Guide that appears on some ScreenOS documentation CDs, the EMC Emissions specifications for the SSG 350 are incorrect. The correct EMC Emissions specifications for the SSG 350 are: FCC Part 15 Class A (USA) EN 55022 Class A (Europe, Australia, New Zealand) VCCI Class A (Japan)
Documentation Changes Introduced in 6.0.0r2

ScreenOS 6.0.0r2 includes minimal changes to the provided documentation. Online help files have been updated to reflect Web user interface (WebUI) modifications, and this release note document describes new features offered in 6.0.0r2. No other changes have been made to other volumes of ScreenOS documentation for release 6.0.0r2. All new features available in 6.0.0r2 will be fully documented in the next ScreenOS release.
Documentation Changes Introduced in 6.0.0r1

To upgrade existing firmware to ScreenOS 6.0, refer to the ScreenOS Upgrade Guide located at http://www.juniper.net/techpubs/software/screenos/screenos6.0.0/upgrade_guide .pdf. The SSG 500/500M-series devices require boot loader upgrade. For more information on the upgrade procedure, see Upgrade Sequence in the Compatibility Issues in ScreenOS 6.0 section. Starting with ScreenOS 6.0.0, we have removed information on configuring Physical Interface Modules (PIMs) and Mini Physical Interface Modules (MiniPIMs) from the installation and configuration guides for SSG devices. We have moved this information into a new guide, the PIM and Mini-PIM Installation and Configuration Guide. Refer to that guide for information on configuring PIMs and Mini-PIMs.
57
Getting Help for ScreenOS 6.0 Software

For further assistance with Juniper Networks products, visit http://www.juniper.net/support. Juniper Networks occasionally provides maintenance releases (updates and upgrades) for ScreenOS firmware. To have access to these releases, you must register your security device with Juniper Networks at the above address. Copyright 2007, Juniper Networks, Inc. All rights reserved. Juniper Networks and the Juniper Networks logo are registered trademarks of Juniper Networks, Inc. in the United States and other countries. All other trademarks, service marks, registered trademarks, or registered service marks in this document are the property of Juniper Networks or their respective owners. All specifications are subject to change without notice. Juniper Networks assumes no responsibility for any inaccuracies in this document or for any obligation to update information in this document. Juniper Networks reserves the right to change, modify, transfer, or otherwise revise this publication without notice.
58

Release Notes ScreenOS 6.0.0r5 Rev 02

Uploaded by

Copyright:

Available Formats

Release Notes ScreenOS 6.0.0r5 Rev 02

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Release Notes ScreenOS 6.0.0r5 Rev 02

Uploaded by

Copyright:

Available Formats

Juniper Networks ScreenOS Release Notes

ScreenOS Release Notes

ScreenOS Release Notes

ScreenOS Release Notes

ScreenOS Release Notes

ScreenOS Release Notes

New Features and Enhancements

New Features and Enhancements Introduced in 6.0.0r5

ScreenOS Release Notes

ScreenOS Release Notes

New Features and Enhancements Introduced in 6.0.0r2

ScreenOS Release Notes

SSG 320M/350M Devices

Improve Policy Installation Performance

ScreenOS Release Notes

NSRP Security Module Monitoring

ScreenOS Release Notes

ISG-IDP Flow Enhancements

New Features and Enhancements Introduced in 6.0.0r1

ScreenOS Release Notes

ScreenOS now supports E3 PIMs on the SSG 500-series platforms.

ScreenOS Release Notes

ScreenOS Release Notes

Automated Data Gathering

MSN Messenger (Windows XP)

ScreenOS Release Notes

Authentication Service Enhancements

ScreenOS Release Notes

ScreenOS Release Notes

ScreenOS Release Notes

ScreenOS Release Notes

ScreenOS Release Notes

Changes to Default Behavior

Changes to Default Behavior Introduced in 6.0.0r3

Changes to Default Behavior Introduced in 6.0.0r2

ScreenOS Release Notes

Changes to Default Behavior Introduced in 6.0.0r1

ScreenOS Release Notes

ScreenOS Release Notes

Addressed Issues in ScreenOS 6.0.0r5

ScreenOS Release Notes

ScreenOS Release Notes

ScreenOS Release Notes

ScreenOS Release Notes

ScreenOS Release Notes

Addressed Issues from ScreenOS 6.0.0r4

ScreenOS Release Notes

ScreenOS Release Notes

ScreenOS Release Notes

ScreenOS Release Notes

Security 233964A critical parsing vulnerability was reported in OpenSSL ASN.1.

ScreenOS Release Notes

Addressed Issues from ScreenOS 6.0.0r3

ScreenOS Release Notes

Addressed Issues from ScreenOS 6.0.0r2

ScreenOS Release Notes

ScreenOS Release Notes

Known Issues in ScreenOS 6.0.0r5

ScreenOS Release Notes

ScreenOS Release Notes