Fireware XTM v11.3.2 Release Notes
Introduction
Fireware XTM v11.3.2 is the newest software release for the WatchGuard XTM and Firebox e-Series appliances. Fireware XTM v11.3.2 demonstrates a continuing commitment to quality to WatchGuard customers, with a significant number of bug fixes and enhancements, including:
- Ability to view and edit an alias from within the firewall policy using Policy Manager
- Several improvements for Single Sign-On functionality, including the ability to add exceptions by host range or subnet
- Report Server performance improvements
See the Resolved Issues section below for a complete list of resolved issues. For more information about the enhancements in the Fireware XTM v11.3.2 release, see What's New in Fireware XTM v11.3.2, available on our public documentation page.
If you have installed Fireware XTM v11.3.2 build 291323 on your Firebox X Edge e-Series, you must upgrade to the new Fireware XTM OS build 292057 to resolve a problem with AV scanning that occurred in the first posted Edge OS build. This new build resolves a problem that caused the HTTP proxy to stop passing traffic when Gateway AV is enabled.
Before You Begin
Before you install this release, make sure that you have:
- A Firebox X Core or Peak e-Series device running Fireware v10.2.x or higher, a Firebox X Edge e-Series device running v10.2.9 or higher, or a WatchGuard XTM 1050 or XTM 8, 5, or 2 Series device. If this is a new device, make sure you follow the instructions in the Quick Start Guide that ships with your device before you try to upgrade to v11.3.2.
- The required hardware and software components as shown in the Systems Requirements table below.
- An active LiveSecurity subscription.
- Feature key for your Firebox or XTM device – If you upgrade your Firebox e-Series from an earlier version of Fireware or Edge appliance software, you can use your existing feature key.
- Reputation Enabled Defense is included in the UTM Security Subscription bundles for XTM appliances. There is no new charge for existing XTM appliance customers with security subscription bundles, but, you must download an updated feature key to be able to use the Reputation Enabled Defense service. You can do this using the Synchronize Feature Key option available in FSM or the Get Feature Key option in the Web UI.
- Updated online documentation system for this product is available at www.watchguard.com/help/documentation
- See the Resolved Issues section below for a complete list of resolved issues.
Fireware XTM and WSM v11.3.2 Operating System Compatibility
System Requirements
Localization
The Fireware XTM management user interfaces (WSM application suite and Web UI) have been localized for the v11.3 release. Changes made to the user interface since the release of v11.3 remain in English. Supported languages are:
- Chinese (Simplified, PRC)
- French (France)
- Japanese
- Spanish (Latin American)
In addition to these languages, we have introduced localized Web UI support for Korean and Traditional Chinese with the v11.3.1 release. Only the Web UI itself has been localized. WSM, and all help files and user documentation, remain in English.
Note that most data input must still be made using standard ASCII characters. You can use non-ASCII characters in some areas of the UI, including:
- Proxy deny message
- Wireless hotspot title, terms and conditions, and message
- WatchGuard Server Center users, groups, and role names
Any data returned from the device operating system (e.g. log data) is displayed in English only. Additionally, all items in the Web UI System Status menu and any software components provided by third-party companies remain in English.
Fireware XTM Web UI
The Web UI will launch in the language you have set in your web browser by default. The name of the currently selected language is shown at the top of each page. To change to a different language, click the language name that appears. A drop-down list of languages appears and you can select the language you want to use.
WatchGuard System Manager
When you install WSM, you can choose what language packs you want to install. The language displayed in WSM will match the language you select in your Microsoft Windows environment. For example, if you use Windows XP and want to use WSM in Japanese, go to Control Panel > Regional and Language Options and select Japanese from the language list.
Reporting Web UI, CA Manager, Quarantine Web UI, and Wireless Hotspot
These web pages automatically display in whatever language preference you have set in your web browser.
Downloading Software
- Go to the LiveSecurity web site’s Software Downloads page at http://www.watchguard.com/archive/softwarecenter.asp
- Log in to the LiveSecurity web site. Then, select the product line you use and look for the Fireware XTM software download section.
There are several software files available for download. See the descriptions below so you know what software packages you will need for your upgrade.
WatchGuard System Manager
All users can now download the WatchGuard System Manager software. With this software package you can install WSM and the WatchGuard Server Center software:
WSM11_3_2s.exe — Use this file to upgrade WatchGuard System Manager from v10.2.x or v11.x to WSM v11.3.2.
Fireware XTM OS
Select the correct Fireware XTM OS image for your hardware.
Recovery Mode Software
To use the USB automatic restore feature, you must download and install a v11.x recovery mode software image for your XTM device. The file name is utm_[Firebox_model]_sysb-dl.zip and you can find recovery mode upgrade instructions later in these release notes. There is no new Recovery Mode software for e-Series devices.
Single Sign-on Software
There are two files available for download if you use Single Sign-on:
- WG-Authentication-Gateway.exe (SSO Agent software - required for Single Sign-on)
- WG-Authentication-Client.msi (SSO Client software - optional)
For information about how to install and set up Single Sign-on, see the product documentation.
Mobile VPN with SSL Client for Windows and Macintosh
There are two files available for download if you use Mobile VPN with SSL:
- WG-MVPN-SSL.exe (Client software for Windows)
- WG-MVPN-SSL.dmg (Client software for Macintosh)
Upgrade from Fireware XTM v11.x to v11.3.2
Before you upgrade from Fireware XTM v11.x to Fireware XTM v11.3.2, go to the WatchGuard Software Downloads Center. Download and save the file that matches the WatchGuard device you want to upgrade. You can use Policy Manager or the Web UI to complete the upgrade procedure. We strongly recommend that you back up your device configuration before you upgrade.
If you are currently running v11.0 or v11.0.1 on your Firebox X Edge e-Series, you must upgrade to v11.0.2 before you upgrade to v11.3.2 to avoid possible file system corruption. This issue does not apply to any other model.
From the Web UI:
- Go to System > Backup Image and back up your current configuration file.
- On your management computer, launch the OS executable file you downloaded from the WatchGuard Software Downloads Center. This installation extracts an upgrade file called utm_[Firebox_model].sysa-dl to the default location of C:\Program Files\Common files\WatchGuard\resources\FirewareXTM\11.3.2\[Firebox_model]
- Connect to your Firebox with the Web UI and select System > Upgrade OS.
- Browse to the location of the utm_[Firebox_model].sysa-dl file from Step 1 and click Upgrade.
From Policy Manager:
- From File > Backup, back up your current configuration file.
- On your management computer, launch the OS executable file you downloaded from the WatchGuard Software Downloads Center. This installation extracts an upgrade file called utm_[Firebox_model].sysa-dl to the default location of C:\Program Files\Common files\WatchGuard\resources\FirewareXTM\11.3.2\[Firebox_model]
- Open WatchGuard System Manager v11.3.2. Connect to your Firebox and launch Policy Manager.
- From Policy Manager, select File > Upgrade. When prompted, browse to and select the utm_[Firebox_model].sysa-dl file from Step 1.
Upgrade WatchGuard server software
It is not necessary to uninstall your v11.0.x server or client software when you update from v11.0.1 or higher to Fireware XTM v11.3.2. You can install the v11.3.2 server and client software on top of your existing installation to upgrade your WatchGuard software components.
Downgrade from Fireware XTM v11.3.x to v11.x
If you want to downgrade from Fireware XTM v11.3.x to an earlier version of Fireware XTM, you either:
- Restore a previously created full backup image to complete the downgrade; or
- Reset your Firebox or XTM device to its factory-default settings and then run the Quick Setup Wizard with the older version of Fireware XTM already installed on your management computer.
Upgrade the Recovery Mode Software Image
To use the USB automatic restore feature, you must upgrade the recovery mode software image on your XTM device to v11.3. This upgrade is only necessary if you use the USB automatic restore feature, which is available only for XTM devices. If, for any reason, you downgrade the OS version on your XTM device from v11.3.2 to an earlier version of Fireware XTM OS, there is no need to downgrade the Recovery Mode Software Image. The v11.3.2 Recovery Mode Software image works with earlier versions of Fireware XTM OS.
If you upgraded the recovery mode software image on your XTM device for Fireware XTM v11.3, you do not need to upgrade it again for v11.3.2.
To upgrade the recovery mode image:
From the Web UI:
- Copy the Recovery Mode upgrade file for your model of XTM device from the Software Downloads Center to your management computer.
- Extract the contents of the .zip file.
- Connect to your XTM device with the Web UI and select System > Upgrade OS.
- Browse to the location of the utm_[Firebox_model].sysb-dl file you extracted in Step 2 and click Upgrade.
From Policy Manager:
- Copy the Recovery Mode upgrade file for your model of XTM device from the Software Downloads Center to your management computer.
- Extract the contents of the .zip file.
- Open WatchGuard System Manager v11.3.2. Connect to your XTM device and launch Policy Manager.
- From Policy Manager, select File > Upgrade. When prompted, browse to and select the utm_[Firebox_model].sysb-dl file you extracted in Step 2.
Mobile VPN Client Software
With Fireware XTM v11.3.1, WatchGuard is releasing new Mobile VPN with SSL clients.
Mobile VPN with IPSec
There is no new Mobile VPN with IPSec client available for v11.3.1. You can continue to use the Mobile VPN with IPSec v11.2.3 client available on the Software Downloads page.
Mobile VPN with SSL client for Windows and Mac
The v11.3.1 Mobile VPN with SSL client is integrated into the Fireware XTM v11.3.1 OS. When an SSL client computer running an earlier version of the client software connects to a Firebox running v11.3.1, the user sees a prompt to upgrade the SSL client version to 5.5 for Windows and 5.3 for Mac. Select Yes to upgrade the Mobile VPN client version to v11.3.1.
There is a Known Issue for customers who upgrade from Fireware XTM v11.2.1 to v11.3.1. For v11.2.1 users, the upgrade process described above will fail. To upgrade the client software from v11.2.1 to v11.3.1, you have two options:
- Use your web browser to connect to https://<IP address of your Firebox or XTM device>/sslvpn.html. You can then download the new installer and install it manually.
- Download the client software from the Software Downloads page and email it to your users to install on their computers.
If you are running Fireware XTM, Mobile VPN with SSL continues to operate if the user chooses not to upgrade, however, the user does not receive the fixes available in the v11.3.1 Mobile VPN with SSL client. When you upgrade from Fireware or Edge OS to Fireware XTM, you must upgrade your Mobile VPN with SSL client.
Resolved Issues
The Fireware XTM v11.3.2 release resolves a number of problems found in earlier Fireware XTM v11.x releases.
General
- This release resolves a problem that caused excessive CPU usage after multiple PPTP connection attempts. [56005]
Authentication
- You can now add Single Sign-On exceptions by host range or subnet. [41194]
- The Single Sign-On agent no longer fails when you have Active Directory groups or users with non-ASCII characters in their names. [41883]
- A problem that caused the Single Sign-On client to get incorrect group membership information when used with the Microsoft Windows 7 OS has been resolved. [55738]
- This release includes improvements to the Single Sign-On client and agent software to improve the reliability of group membership retrieval. [44134]
- The Single Sign-on agent no longer sends login information to the Active Directory server twice. [45292]
Mobile VPN with SSL
- Mobile VPN with SSL client connections are no longer possible for a user who is not part of the SSLVPN-Users group when you use LDAP for the authentication server. [56462]
FireCluster
- This release resolves an issue the caused the real MAC address to be used when your Firebox or XTM device is configured for SSL VPN Bridge Mode. [55606]
- When you configure an active/active FireCluster, the FireCluster management IP addresses are now accessible through a branch office VPN tunnel. [39728]
Logging and Reporting
- The Log Server no longer stops functioning if a Japanese font appears in the log messages sent from the Management Server. [56593]
- An email notification is now sent when the Log Server detects that a Firebox or XTM device has stopped sending log messages to the server. [55869]
- When you reinstall the Report Server, the Log Server database path no longer changes. [56292]
- If the Log Server is rebooted during the upgrade from Fireware v10.x to Fireware XTM v11.3.2, the database migration now resumes successfully. [56846]
- The WatchGuard Server Center Setup Wizard no longer fails when you install the Log Server without also installing the Management Server. [56509]
- A confirmation dialog now shows when you set up the Log Server or Report Server database path. [56516]
WatchGuard System Manager
- The HTTPS proxy action is no longer blank when you create a new proxy action. [56627]
- You can now configure up to 200 Traffic Management objects in Policy Manager. [55796]
- Several improvements have been made to reduce the occurrence of configuration saves that fail with the error: "failed to read servers response: premature EOF". [40706]
- Certificate verification no longer fails for Role Based Access Control after a certificate is renewed. [56329]
Web UI
- You can now release or renew a DHCP lease manually from the Web UI when the external interface is configured to use DHCP. [37478]
- You can now successfully generate a Mobile VPN with IPSec .ini profile when the group name contains a space. [56537]
- Policy Based Routing now works correctly when the external interface has a dynamic IP address. [56550]
- You can now disable Single Sign-On in the Web UI. [56661]
- You can now select a network subnet or host range when you configure Branch Office VPN tunnels. [44954]
Proxies and Services
- The default Body Content Types rule for Windows EXE/DLL files has been updated to match a larger class of Windows executable files. This change applies only to new configurations created in Policy Manager using version 11.3.2 or later. The existing configuration on your device does not change when you upgrade from a previous 11.x version.
To correct the Body Content Types rule in your existing configuration, go to the Body Content Types category in your HTTP proxy action and edit the Windows EXE/DLL rule. (Note that in Policy Manager, you must be in Advanced View to edit the rule.) Use Pattern Match and for the pattern use: %0x4d5a%* [40799]
- The default WebBlocker Exception in Policy Manager to always allow WebBlocker categorizations to the WatchGuard web site has been updated to more closely match the WatchGuard domain. This change applies only to new configurations created in Policy Manager using version 11.3.2 or later. It does not apply to the Web UI. The existing configuration on your device does not change when you upgrade from a previous 11.x version.
To correct the WebBlocker Exception in your existing configuration, edit your WebBlocker action and go to the Exceptions tab. Edit the WatchGuard exception. Change the “Match Type” to Regular Expression and use this expression:
^[0-9a-zA-Z_\-.]{1,256}\.watchguard\.com/
WatchGuard would like to thank Eric Snyder from Verus Corp in Fridley, MN for bringing this issue to our attention. [44585]
- The SMTP proxy configuration now includes an option to turn off the logging of denied SMTP Commands. [45119]
- A problem was resolved that caused HTTP traffic to fail when Gateway AV scanning of HTTP traffic is enabled on Firebox X Edge e-Series devices that run v11.3.2 build 291323. [57372]
- The Firebox System Manager Subscription Services tab now correctly displays IPS deny totals. [56096]
- This release resolves a stack trace in the FTP proxy caused by a malformed user command. [56248]
- When spamBlocker and Allow BDAT chunking are both enabled, the SMTP proxy log file now shows the spam score log message instead of a message that says: SMTP Message classification is unknown because an error occurred while classifying. [56394]
SIP and H323
- SIP Forking (INVITE) with the same call-id now works correctly. [56000]
- MSRP file-transfer now works correctly. [55999]
- RTP packets are no longer sent from the wrong interface when multi-WAN is configured. [4458
- SIP registrations no longer fail when the server sends a NOTIFY. [56448]
Branch Office VPN
- Branch Office VPN tunnels now rekey correctly when the remote side initiates the rekey and 1-to-1 NAT or Dynamic NAT is used within the tunnel. [56599]
- Traffic log messages now show the source interface of the incoming Branch Office VPN tunnel traffic. [45052]
Networking
- NAT loopback now works correctly with Server Load Balancing. [41090]
- When a Firebox or XTM device is configured in drop-in mode with no external interfaces configured, the default route now works correctly. [41802]
- This release resolves an issue that caused the DHCP Server on the Firebox or XTM device to hand out IP addresses slowly because of DNS host name lookup. [44571]
- You can now correctly add a secondary address to an external interface when the interface name contains a space. [56439]
- When you use MAC access control for wireless users and you bridge wireless to your trusted interface, you no longer need to add the MAC address to the trusted interface MAC Access Control list. [41678]
- When your Firebox or XTM device is configured in bridge mode, MAC access control is now applied correctly to DHCP bootp traffic. [56867]
- QoS now works correctly with FTP policies. [56266]
- When you change the wireless configuration on an XTM 2 device, the interfaces no longer go up and down spontaneously. [42300]
- This release resolves an issue that caused the certd process to use excessive memory. [56181]
Known Issues
These are known issues for Fireware XTM v11.3.2 and all management applications. Where available, we include a way to work around the issue.
General
- To power off an XTM 5 Series device, you must press and hold the rear power switch for 4-5 seconds. [42459]
- On an XTM 5 Series device, the link light for network interface 0 remains lit when the device is powered off using the rear power switch. [42388]
- For XTM 5 Series devices, Interface 0 does not support Auto-MDIX and does not automatically sense cable polarity.
- An XTM 2 Series device can take up to 5 minutes to reboot.
- If your Firebox X Edge e-Series device is connected to a modem, it may not boot correctly if you try to set your Edge to its factory default settings. [30284]
- When you use the Policy Manager > File > Backup or Restore features, the process can take a long time but does complete successfully. [35450]
- Policy Manager opens the locally stored copy of your configuration, instead of the configuration from the device, when you use a status passphrase with a "-" character as the first character in the passphrase (for example: "-1234567"). [42616]
Workaround
Do not use the "-" character as the first character in your status or configuration passphrase.
Upgrade Issues
- After you upgrade a Firebox X Edge from v10.2.x, it is important to know that you must use the user name "admin" when you want read/write access to the Edge. In versions older than v11.0 of Edge appliance software, you could use a name other than "admin" in your administrative credentials, but this is no longer possible in Fireware XTM. You must log in to the Edge with the user name "admin" and the read/write passphrase you set during the upgrade.
- The disk space occupied by data in the Report Server database before you upgrade to v11.2.x is not freed until after the number of days specified in the Keep reports on the Report Server setting in your Report Server configuration. Because of this, the Report Server database consumes more disk space until this number of days pass.
- If you upgrade to Fireware XTM from an earlier version of Fireware and used a branch office VPN Phase 2 encryption setting of None, this setting is not correctly converted during the configuration upgrade. You must edit your Phase 2 encryption setting manually when the upgrade is complete to select an appropriate encryption setting.
- If you have special characters (, ;) in the policy names of your v10.x configuration, you must remove them from your policy names after you upgrade to Fireware XTM v11 so that reporting and monitoring operate correctly. [36577]
- In WSM v10.x, you could create a Traffic Management action that set both incoming and outgoing traffic bandwidth for an external interface. This action could operate on a policy that managed traffic to and from a trusted network. To reproduce this feature in Fireware XTM v11.x, you must create a Traffic Management action that sets the maximum upload speed on the external interface and the maximum download speed on the trusted interface.
- The Firebox X Edge Require user authentication and Trusted Hosts features do not exist in Fireware XTM, because of the increased granularity available when you configure policies for Edge users. During the Edge upgrade, the users are added to a local group called Local-Users. If you previously had Require user authentication enabled, you must use this group in your policies to enforce user authentication. The Trusted Hosts feature is no longer necessary.
- The DNS suffix and second DNS server entries are not converted when you upgrade from v10.2.x to v11.x on Firebox X Edge e-Series. [40774]
Workaround
Add the DNS suffix and second DNS entries again after you upgrade to v11.x.
WatchGuard System Manager
- There can be problems when you add, update, or delete a server installation from WatchGuard Server Center if WatchGuard System Manager is installed on a Windows 7 computer that has “XP Compatibility Mode” enabled. [56355]
Workaround
Make sure that Windows XP compatibility mode is not enabled on the WSM v11.x executable file. To verify, locate the wsm.exe file in Windows Explorer. Right-click on the executable file, select Properties, and click the Compatibility tab.
- Remote managed Firebox devices configured in Drop-in Mode may not be able to connect to a Management Server that is behind a gateway Firebox also configured in Drop-in Mode. [33056] If you restore a backup image to a managed client device managed by a Management Server, it is possible that the shared secret becomes out of sync.
Workaround
Connect to the Management Server from WSM. Select the managed device and select Update Device. Select the radio button Reset server configuration (IP address/ Hostname, shared secret).
- You cannot uninstall WatchGuard System Manager successfully when the WatchGuard Server Center is running on a computer using 64-bit Windows Vista. [39078]
Workaround
Exit the WatchGuard Server Center before you start the uninstall WSM. You can then uninstall WatchGuard System Manager successfully.
Web UI
- The Fireware XTM Web UI does not support the configuration of some features. These features include:
- FireCluster
- Full proxy configuration options
- The editing of static NAT rules
- Certificate export
- You cannot turn on or off notification of BOVPN events
- You cannot add or remove static ARP entries to the device ARP table
- You cannot get the encrypted Mobile VPN with IPSec end-user configuration profile, known as the .wgx file. The Web UI generates only a plain-text version of the end-user configuration profile, with file extension .ini.
- You cannot edit the name of a policy, use a custom address in a policy, or use Host Name (DNS lookup) to add an IP address to a policy.
- If you configure a policy in the Web UI with a status of Disabled, then open Policy Manager and make a change to the same policy, the action assigned to the policy when it denies packets is changed to Send TCP RST. [34118]
- If you use the Web UI to edit an existing proxy policy that has alarm settings enabled, the alarm settings may be disabled when you save your configuration. [38585]
- You cannot create read-only Mobile VPN with IPSec configuration files with the Web UI. [39176]
WatchGuard Server Center
- If you run the v11.3.2 Management Server Setup Wizard, but your gateway Firebox or XTM device is installed with pre-v11.3.2 software, the setup wizard can fail.
Workaround
You can either upgrade your gateway Firebox or XTM device to WSM v11.3.2, or do not add the gateway Firebox device information when you run the v11.3.2 Management Server Setup Wizard.
- If the WatchGuard Server Center is open when you uninstall WSM, you see multiple warning messages to close the application, instead of just a single warning. [36901]
Command Line Interface (CLI)
- The CLI does not support the configuration of some features:
- You cannot add or edit a proxy action.
- You cannot get the encrypted Mobile VPN with IPSec end-user configuration profile, known as the .wgx file. The CLI generates only a plain-text version of the end-user configuration profile, with file extension .ini.
- The CLI performs minimal input validation for many commands.
Logging and Reporting
- The scheduled group reports to .pdf format option does not work. [44679]
- You cannot use a v11.x Report Server with a v10.x Log Server. You must upgrade both servers for reporting to work correctly. You can, however, use v11.x Report Manager with a v10.x Report Server.
- LogViewer always generates PDFs in English, regardless of the language you view LogViewer in. Also, unicode characters that cannot be displayed in the default font may not appear correctly in the PDF. [41244]
Multi-WAN
- When you enable the Multi-WAN Immediate failback option for WAN failover, some traffic may fail over gradually. [42363]
- When you enable Multi-WAN in round-robin mode, you cannot use the HTTP Proxy Caching Server option. [57561]
Networking
- You cannot bridge a wireless access point to an interface configured as trusted or optional if that network interface is already part of a bridge. [39603]
- You cannot configure traffic management actions or use QoS marking on VLANs. [56971, 42093]
- You cannot bridge a wireless interface to a VLAN interface. [41977]
- The Web Setup Wizard can fail if your computer is directly connected to an XTM 2 Series device as a DHCP client when you start the Web Setup Wizard. This can occur because the computer cannot get an IP address quickly enough after the device reboots during the wizard. [42550]
Workaround
1. If your computer is directly connected to the XTM 2 Series device during the Web Setup Wizard, use a static IP address on your computer.
2. Use a switch or hub between your computer and the XTM 2 Series device when you run the Web Setup Wizard.
- When a secondary network is configured for an XTM 2 Series device configured in Drop-In Mode, it can sometimes take a few minutes for computers that connect to the secondary network to appear in the ARP list of the XTM 2 Series. [42731]
- After you enable the MAC access control list or add a new MAC address, you must reboot your Firebox before the change takes effect. [39987]
- You must make sure that any disabled network interfaces do not have the same IP address as any active network interface or routing problems can occur. [37807]
- If you enable the MAC/IP binding with the Only allow traffic sent from or to these MAC/IP addresses check box, but do not add any entries to the table, the MAC/IP binding feature does not become active. This is to help make sure administrators do not accidentally block themselves from their own Firebox. [36934]
- Any network interfaces that are part of a bridge configuration disconnect and re-connect automatically when you save a configuration from a computer on the bridge network that includes configuration changes to a network interface. [39474]
- When you change the IP address of a VLAN configured on an external interface from static to PPPoE and the Firebox cannot get a PPPoE address, Firebox System Manager and the Web UI may continue to show the previously used static IP address. [39374]
- When you configure your Firebox with a Mixed Routing Mode configuration, any bridged interfaces show their interface and default gateway IP address as 0.0.0.0 in the Web UI. [39389]
- When you configure your Firebox in Bridge Mode, the LCD display on your Firebox shows the IP address of the bridged interfaces as 0.0.0.0. [39324]
- When you configure your Firebox in Bridge Mode, the HTTP redirect feature is configurable from the user interface but does not work in this release. [38870]
- Static MAC/IP address binding does not work when your Firebox is configured in Bridge mode. [36900]
- When your Firebox is configured to use Bridge mode, the physical interface of the Firebox does not appear correctly in log messages. Instead, the interface is represented as "tbrX". [36783]
- When you change your configuration mode from Mixed Routing to Bridge or from Bridge to Mixed Routing, the CLI and Web UI may continue to show the previous configuration mode. [38896]
- The dynamic routing of RIPv1 does not work. [40880]
- When an IP address is added to the Temporary Blocked Site list by the administrator through the Firebox System Manager > Blocked Sites tab, the expiration time is constantly reset when traffic is received from the IP address. [42089]
Firebox X Edge e-Series Wireless
- When a Firebox X Edge e-Series is configured as both a wireless access point and as a Mobile VPN with SSL endpoint, the wireless connection does not work correctly if the SSL VPN address pool is configured on the same subnet as the wireless access point. [42429]
- When you set the external interface as a wireless client and configure static NAT to use the Eth0 interface as its source IP address, inbound static NAT does not operate correctly. [38239]
- The MAC Address Override feature is not available on a Firebox X Edge that has a wireless interfaced configured as an external interface. [38241]
FireCluster
- Each XTM device has a set of default IP addresses assigned to the device interfaces in the range 10.0.0.1 – 10.0.11.1. The highest default IP address depends on the number of interfaces. If you set the IP address of the Primary or Backup cluster interface to one of the default IP addresses, both devices restart, and the backup master becomes inactive. [57663]
Workaround
Do not use any of the default IP addresses as the Primary or Backup cluster interface IP address.
- If you change the IP address for the Primary or Backup cluster interface, when you save the configuration to the FireCluster, both clustered devices restart at the same time without warning. [57716]
- When you have an active/active FireCluster and use the WebBlocker Override feature, you may be prompted to enter your override password twice. [39263]
- Every network interface enabled in a FireCluster is automatically monitored by FireCluster. You must make sure that all enabled interfaces are physically connected to a network device.
- If you use HP ProCurve switches, you cannot configure your FireCluster in active/active mode because these switches do not support the addition of static ARP entries. [41396]
- FireCluster is not supported if you use either a Drop-in or Bridge network configuration mode on your WatchGuard devices. [37287]
- If you use the Mobile VPN with IPSec client from the same network as the external network address configured on your FireCluster, some traffic may not go through the VPN tunnel. [38672]
- Mobile VPN with PPTP users do not appear in Firebox System Manager when you are connected to a passive FireCluster member. PPTP is only connected to the active Firebox when using an active/passive FireCluster. [36467]
- FireCluster does not support dynamic routing. [39442]
Authentication
- For the Authentication Redirect feature to operate correctly, HTTP or HTTPS traffic cannot be allowed through an outgoing policy based on IP addresses or aliases that contain IP addresses. The Authentication Redirect feature operates only when policies for port 80 and 443 are configured for user or user group authentication. [37241]
Proxies
- The ability to use an HTTP caching proxy server is not available in conjunction with the TCP-UDP Proxy. [44260]
- Application Blocker can only block the initial login to Skype. It cannot block traffic for a Skype client that has previously logged in. If a user with a laptop logs in to Skype when the computer is not connected to your network, and then the user connects to your network while the Skype client is still active, Application Blocker cannot block the Skype traffic until the user exits and logs out of the Skype application.
- Application Blocker does not stop all BitTorrent connections. It does stop most connections, which causes BitTorrent throughput to be significantly reduced. [44288]
- You cannot make a SIP-based call from Polycom PVX softphone behind a Firebox to a Polycom PVX on the external network. [38567]
Workaround
You can use the H.323 protocol instead of SIP.
Security Subscriptions
- You cannot use a WebBlocker Server through a branch office VPN tunnel. [56319]
- To optimize performance of web browsing on the Firebox X Edge e-Series, Gateway AntiVirus does not scan the following content types when used with the HTTP proxy: text/*, image/*, audio/*, video/*, application/javascript, application/x-javascript, and application/x-shockwave-flash. The content types appear in the HTTP-Client proxy action configuration for the Edge, but Gateway AV does not scan for these content types. All other content types, including executable files, are scanned. Gateway AntiVirus also does not use code emulation capabilities of the AV engine on Firebox X Edge e-series appliances.
Mobile VPN with SSL
- Users who try to upgrade their Mobile VPN with SSL client from Fireware XTM v11.2.1 to a later version of Fireware XTM will fail. The failure does not damage the v11.2.1 client installation. [43970]
Workaround
To upgrade your Mobile VPN with SSL client from v11.2.1 to v11.3, use your web browser to connect to https://<IP address of a Firebox or XTM device>/sslvpn.html. You can then download and install the new client software. Or, you can download the client software from the Software Downloads page and email it your users to install on their computer.
- The Macintosh SSL VPN client may not be able to connect to a Firebox when the authentication algorithm is set to SHA 256. [35724]
- When the Macintosh SSL VPN client disconnects or is stopped manually, the client disables the AirPort wireless adapter on the Mac. [39914]
Mobile VPN with IPSec
- A continuous FTP session over a Mobile VPN with IPSec connection could get terminated if an IPSec rekey occurs during the FTP transfer. [32769]
Workaround
Increase the rekey byte count.
- When you use the Web UI or CLI to configure Mobile VPN with IPSec user profiles, user groups with extended authentication may show incorrectly as Firebox Local Authentication groups. [39695]
Branch Office VPN
- When you configure your Firebox or XTM device in multi-WAN mode, you must select which interfaces to include in your multi-WAN configuration. If there are any interfaces that you choose not to include in your multi-WAN configuration (i.e. you clear the check box for that interface), the system does not create a route for that network. This can cause a problem if you have a branch office VPN configured to include that same interface. In this case, the VPN tunnel can fail to negotiate with its remote peer. [57153]
Workaround
If you use multi-WAN and have problems with your branch office VPN tunnels failing to negotiate with their remote peers, you must open your multi-WAN configuration and select Configure adjacent to your chosen multi-WAN configuration mode. Make sure that the appropriate interfaces are included in your multi-WAN configuration.
- After ESP encapsulation, the IP header ID Field is not unique when IP fragmentation occurs. [56956]
- A branch office VPN tunnel does not pass traffic if an inbound static NAT policy that includes IP 50 and IP 51 protocols exists for the external IP address of the Firebox or XTM device. [41822]
- Managed branch office VPN tunnels cannot be established if the CRL distribution point (for example, the WatchGuard Management Server or a third-party CRL distribution site you use) is offline. [55946]
- The use of Any in a BOVPN tunnel route is changed in Fireware XTM. If a branch office VPN tunnel uses Any for the Local part of a tunnel route, Fireware XTM interprets this to mean network 0.0.0.0 and subnet mask 0.0.0.0 (in slash notation, 0.0.0.0/0). If the remote IPSec peer does not send 0.0.0.0/0 as its Phase 2 ID, Phase 2 negotiations fail. [40098]
Workaround
Do not use Any for the Local or the Remote part of the tunnel route. Change the Local part of your tunnel route. Type the IP addresses of computers behind the Firebox that actually participate in the tunnel routing. Contact the administrator of the remote IPSec peer to determine what that device uses for the Remote part of its tunnel route (or the Remote part of its Phase 2 ID).
- The VPN Keep-Alive feature is not available for the Firebox X Edge e-Series. [37769]
- If you have a large number of branch office VPN tunnels in your configuration, the tunnels may take a long time to appear in Policy Manager. [35919]
- When you set the Phase 2 SA expiration to zero by setting both the Life-time and Life-size values to 0, the Firebox changes the rekey life-time to 8 hours. [37209]
Using the CLI
The Fireware XTM CLI (Command Line Interface) is fully supported for v11.x releases. For information on how to start and use the CLI, see the CLI Command Reference Guide, which has been updated for this release. You can download the CLI guide from the documentation web site at http://www.watchguard.com/help/documentation/xtm.asp.Technical Assistance
For technical assistance, contact WatchGuard Technical Support by telephone or on the Web at http://www.watchguard.com/support. When you contact Technical Support, you must supply your registered Product Serial Number, LiveSecurity key or Partner ID.