Print topic

Fireware XTM v11.4.2 Release Notes

Supported Devices XTM 2, 5, and 8 Series
XTM 1050
Fireware XTM OS Build 322805
WatchGuard System Manager Build 322120
Revision Date

21 July 2011

 

The Fireware XTM OS v11.4.2 build 322805 resolves an issue with Fireware XTM OS v11.4.2 build 322284 (released on July 18, 2011). This issue caused Mobile VPN with IPSec traffic to not pass through the XTM device. If you previously installed Fireware XTM OS v11.4.2 build 322284, we recommend that you update to the current v11.4.2 release build 322805.

Introduction

WatchGuard is excited to release Fireware XTM v11.4.2. Fireware XTM v11.4.2 demonstrates a continuing commitment to quality to WatchGuard customers, with a significant number of bug fixes and enhancements, including:

You can install Fireware XTM OS v11.4.2 software on any WatchGuard XTM device, including 2 Series, 5 Series, 8 Series, and the XTM 1050. Although WatchGuard System Manager/Policy Manager v11.4.2 has been designed to manage Fireware XTM v11.3 and Fireware XTM v11.4 devices seamlessly, it is not possible to install Fireware XTM OS v11.4.x on WatchGuard e-Series appliances.

For more information about the feature enhancements included in Fireware XTM v11.4.2, see What's New in Fireware XTM v11.4.2.

Before You Begin

Before you install Fireware XTM v11.4.2, make sure that you have:

The user interfaces (WSM and Web UI) are not localized for the Fireware XTM v11.4.2 release. The user interfaces are available in English only.

Note that you can install and use WatchGuard System Manager v11.4.2 and all WSM server components with devices running earlier versions of Fireware XTM v11. In this case, we recommend that you use the product documentation that matches your Fireware XTM OS version.

Documentation for this product is available on the WatchGuard web site at www.watchguard.com/help/documentation.

Fireware XTM and WSM v11.4 Operating System Compatibility

WSM/
Fireware XTM Component		 Microsoft Windows XP SP2
(32-bit)		 Microsoft Windows Vista
(32-bit)		 Microsoft Windows Vista
(64-bit)		 Microsoft Windows 7
(32-bit &
64-bit)

Microsoft Windows
Server
2003
(32-bit)

 Microsoft
Windows
Server
2008 & 2008 R2*		 Mac OS X
v10.5 & v10.6
WatchGuard System Manager Application

Fireware XTM Web UI
Supported Browsers:
IE 7 and 8, Firefox 3.x

WatchGuard Servers

Single Sign-On Agent Software

Single Sign-On Client Software

Terminal Services Agent Software

**

Mobile VPN with IPSec Client Software

 
Mobile VPN with SSL Client Software

***

* Microsoft Windows Server 2008 32-bit and 64-bit support; Windows Server 2008 R2 64-bit support.

* *Microsoft Windows Server 2003 SP2 required.

*** Mac OS X support for the SSL VPN client is for 32-bit mode only.

System Requirements

  If you have WatchGuard System Manager client software only installed If you install WatchGuard System Manager and WatchGuard Server software

Minimum CPU

Intel Pentium IV

1GHz

Intel Pentium IV

2GHz

Minimum Memory

1 GB

2 GB

Minimum Available Disk Space

250 MB

1 GB

Minimum Recommended Screen Resolution

1024x768

1024x768

Downloading Software

  1. Log in to the WatchGuard Portal and select the Articles & Software tab.
  2. From the Search section, clear the Articles check box and search for available Software Downloads. Select the XTM device for which you want to download software.

There are several software files available for download. See the descriptions below so you know what software packages you will need for your upgrade.

WatchGuard System Manager

All users can now download the WatchGuard System Manager software. With this software package you can install WSM and the WatchGuard Server Center software:

WSM11_4_2s.exe — Use this file to upgrade WatchGuard System Manager from v10.2.x or v11.x to WSM v11.4.2.  

Fireware XTM OS

Select the correct Fireware XTM OS image for your hardware. Download the .exe file if you will install the OS from a computer running a Microsoft Windows OS. Use the .zip file if you will install the OS from a computer that runs a non-Windows OS.

If you have…. Select from these Fireware XTM OS packages

XTM 1050

 
XTM_OS_1050_11_4_2.exe 
XTM_XTM1050_11_4_2.zip

XTM 8 Series

 
XTM_OS_XTM8_11_4_2.exe
XTM_XTM8_11_4_2.zip

XTM 5 Series

 
XTM_OS_XTM5_11_4_2.exe
XTM_XTM5_11_4_2.zip

XTM 2 Series

 
XTM_OS_XTM2_11_4_2.exe
XTM_XTM2_11_4_2.zip

Single Sign-On Software

There are no new Single Sign-On software components for this release. For information about how to install and set up Single Sign-On, see the product documentation.

Terminal Services Authentication Software

Mobile VPN with SSL Client for Windows and Mac

There are two files available for download if you use Mobile VPN with SSL:

Mobile VPN with IPSec client for Windows

You can download the new Shrew Soft VPN client for Windows from our web site. For more information about the Shrew Soft VPN client, see the help or visit the Shrew Soft, Inc. web site.

Upgrade from Fireware XTM v11.x to v11.4.2

Before you upgrade from Fireware XTM v11.x to Fireware XTM v11.4.2,download and save the Fireware XTM OS file that matches the WatchGuard device you want to upgrade. You can find all available software on the WatchGuard Portal, Articles & Software tab. You can use Policy Manager or the Web UI to complete the upgrade procedure. We strongly recommend that you back up your device configuration AND your WatchGuard Management Server configuration before you upgrade. It is not possible to downgrade without these two backup files.

Back up your WatchGuard Management Server Configuration

From the computer where you installed the Management Server:

  1. From WatchGuard Server Center, select File > Backup/Restore.
    The WatchGuard Server Center Backup/Restore Wizard starts.
  2. Click Next.
    The Select an action screen appears.
  3. Select Back up settings.
  4. Click Next.
    The Specify a backup file screen appears.
  5. Click Browse to select a location for the backup file. Make sure you save the configuration file to a location you can access later to restore the configuration.
  6. Click Next.
    The WatchGuard Server Center Backup/Restore Wizard is complete screen appears.
  7. Click Finish to exit the wizard.

Back Up your Log Server, Report Server, Quarantine Server

When you upgrade from WSM v11.3.x or earlier to v11.4.2, it is important to back up your v11.3.x Log and Report Server data in case you want to go back to WSM v11.3.2. You may also want to back up your Quarantine Server, if you use one. These steps are not necessary when you upgrade from Fireware XTM v11.4 or v11.4.1 to v11.4.2.

  1. From WatchGuard Server Center, note the directory path in which your Log and Report Server database is installed. Then, stop all servers.
  2. From Control Panel > Administrative Tools > Services, stop the PostgreSQL-8.2 Server.
  3. Back up or make a copy of the contents of the directory containing your Log Server and Report Server configuration.
    On Windows XP SP2 or Windows Server 2003, if you accepted the default installation, the Log and Report Server database will be in this location:
    %SYSTEMDRIVE%\Documents and Settings\WatchGuard
    On Windows Vista, Windows, 7, Windows Server 2008, or Windows Server 2008 R2, if you accepted the default installation, the Log Server and Report Server database will be in this location:
    %SYSTEMDRIVE%\ProgramData\WatchGuard
  4. Back up the Log Server and Report Server database directory, if they were changed from the default. You can find the database locations in WatchGuard Server Center on the Log Server and Report Server Database Maintenance tabs. By default, the database is located in the directory listed in Step 3 and this step is not necessary.
  5. Back up the Log Server directory where the database backup files are stored, if it was changed from the default. The Log Server Database Maintenance tab shows this directory path.
  6. Back up the Report Server directory where the XML files for the Available Reports are stored, if it was changed from the default. The Report Server Server Settings tab shows this directory path.

Upgrade to Fireware XTM v11.4.2 from Web UI

  1. Go to System > Backup Image or use the USB Backup feature to back up your current configuration file.
  2. On your management computer, launch the OS software file you downloaded from the WatchGuard Software Downloads Center.
    If you use the Windows-based installer, this installation extracts an upgrade file called xtm_[model].sysa-dl to the default location of C:\Program Files\Common files\WatchGuard\resources\FirewareXTM\11.4.1\[model].
  3. Connect to your XTM device with the Web UI and select System > Upgrade OS.
  4. Browse to the location of the xtm_[model].sysa-dl file from Step 2 and click Upgrade.

Upgrade to Fireware XTM v11.4.2 from WSM/Policy Manager v11.4.2

  1. Select File > Backup or use the USB Backup feature to back up your current configuration file.
  2. On your management computer, launch the OS executable file you downloaded from the WatchGuard Portal. This installation extracts an upgrade file called xtm_[model].sysa-dl to the default location of C:\Program Files\Common files\WatchGuard\resources\FirewareXTM\11.4.2\[model].
  3. Install and open WatchGuard System Manager v11.4.2. Connect to your XTM device and launch Policy Manager.
  4. From Policy Manager, select File > Upgrade. When prompted, browse to and select the xtm_[model].sysa-dl file from Step 2.

Upgrade WatchGuard Server Software

It is not necessary to uninstall your v11.0.x server or client software when you update from v11.0.1 or higher to WSM v11.4.2. You can install the v11.4.2 server and client software on top of your existing installation to upgrade your WatchGuard software components.

Upgrade FireCluster from Fireware XTM v11.x to v11.4.x

To upgrade your FireCluster from Fireware XTM v11.3.x, or from an earlier v11.4 release, you must perform a manual upgrade.

  1. From WatchGuard System Manager, select File > Connect to device and connect to the management IP address of the master device in your FireCluster.
  2. From WatchGuard System Manager, select File > Connect to device and connect to the management IP address of the backup master device in your FireCluster.
  3. From WatchGuard System Manager, select the backup master device on the Device Status tab and launch Firebox System Manager.
  4. From Firebox System Manager, select Tools > Cluster > Leave. Type your admin password.
    The device reboots into standby state. The master shows the device as inactive, but the standby device shows its status as standby.
  5. From WatchGuard System Manager, select the backup master device that you just removed from the cluster, and launch Policy Manager.
  6. From Policy Manager, select File > Upgrade. Use the management IP address of the backup master device currently in standby state.
    The device upgrades and reboots. When this is complete, the device remains in standby state.
  7. From WatchGuard System Manager, select the master device and launch Policy Manager.
  8. From Policy Manager, select File > Upgrade. Use the management IP address of the master device. When Policy Manager prompts you to select the devices you want to upgrade, select only the master device.
    The master device upgrades and reboots. Policy Manager shows you a message when the upgrade is complete.
  9. From Firebox System Manager, connected to the device currently in the standby state, select Tools > Cluster > Join
    The standby device reboots. The cluster builds again, running Fireware XTM v11.4.2.

Downgrade Instructions

Downgrade from WSM v11.4.x to WSM v11.x

If you want to revert from v11.4.2 to an earlier version of WSM, you must uninstall WSM v11.4.2. When you uninstall, choose Yes when the uninstaller asks if you want to delete server configuration and data files. After the server configuration and data files are deleted, you must restore the data and server configuration files you backed up before you upgraded to WSM v11.4.2.

Next, install the same version of WSM that you used before you upgraded to WSM v11.4.2. The installer should detect your existing server configuration and try to restart your servers from the Finish dialog box. If you use a WatchGuard Management Server, use WatchGuard Server Center to restore the backup Management Server configuration you created before you first upgraded to WSM v11.4.2. Verify that all WatchGuard servers are running.

Downgrade from Fireware XTM v11.4.x to Fireware XTM v11.3 or earlier

If you want to downgrade from Fireware XTM v11.4.2 to an earlier version of Fireware XTM, you either:

To start a WatchGuard XTM 5 Series, 8 Series, or XTM 1050 device in recovery mode:

  1. Power off the XTM device.
  2. Press the up arrow on the device front panel while you turn the power on.
  3. Keep the button depressed until "Recovery Mode starting" appears on the LCD display.

To start a WatchGuard XTM 2 Series device in recovery mode:

  1. Disconnect the power.
  2. Press and hold the Reset button on the back while you connect the power to the device.
  3. Keep the button depressed until the Attn light on the front turns solid orange.

Mobile VPN with IPSec

As of April 20, 2011, WatchGuard no longer distributes the WatchGuard Mobile VPN with IPSec client. WatchGuard Technical Support will continue to support any customers that currently have the client, and these customers can continue to install and use the client software. With Fireware XTM v11.4.1 and going forward, we have added support for a new IPSec VPN client from Shrew Soft, Inc. You can configure your XTM device to use the Shrew Soft VPN client much the same way you did for the WatchGuard Mobile VPN client and you'll find complete documentation for both clients in the product documentation.

You can download the Shrew Soft VPN Client for Windows v2.1.7 directly from the WatchGuard Portal, or from the Shrew Soft web site. Also available on the Shrew Soft web site are a user forum and list of known issues associated with the client. For your convenience, we include here several Shrew Soft bugs that could affect WatchGuard users:

Application Control

With the new Application Control security service (introduced with Fireware XTM v11.4), you can exercise fine-grained control over more than 1,800 applications, organized by category. Application Control uses a frequently-updated set of signatures to stay current with the latest applications and application versions. We recommend that you enable the automatic signature update feature or, to manually update the signatures on your XTM device, connect to your device with Firebox System Manager and select the Security Subscriptions tab. When you update signatures, both your IPS and Application Control signatures are updated.

When you configure Application Control, or when you look at Application Control reports, you might see application names you are not familiar with. To get information about any application that Application Control can identify, you can look up the application at http://www.watchguard.com/SecurityPortal/AppDB.aspx. We recommend that you review the online help and refer to the Getting Started with Application Control guide to learn more about the features of Application Control.

Manage applications through SSL

Many web-based applications are accessible through SSL (HTTPS), as well as HTTP. Organizations offer SSL connections to provide more security to users by encrypting communications. SSL encryption can also make applications more difficult to detect for Application Control. When you block applications, you may also need to specifically block the SSL login for that application to make sure that you block all access to that application.

For example, when you select to block the application Google Finance, this blocks users from using Google’s financial applications. It does not, however, block them from using Google Finance over SSL. To block that, you must also select the option for Google Authentication over SSL. It is important to understand that, once you block Google Authentication over SSL, all Google applications over SSL are blocked. For example, access to Google Docs and Gmail over SSL is also blocked.

Similar behavior may occur for some Microsoft and Yahoo applications when they are accessed over SSL. There are corresponding signatures for Authentication over SSL for Microsoft and Yahoo and many other applications in the Application Control application list. Companies may want to block SSL access to applications and then configure granular controls over the HTTP access that is allowed.

For a complete list of Known Issues related to Application Control, see the Known Issues/Security Subscriptions section below. Release notes for Application Control signature updates are available on the WatchGuard web site (login required).

IPS

Our implementation of IPS improved significantly in the Fireware XTM v11.4 release. We have implemented a new signature set with greater performance and efficiency. IPS is no longer restricted to only those ports and protocols used with proxies. It can now also be applied to packet filter policies. Signatures have been broken into 5 threat levels that are simpler to understand. You can find more information about each signature directly from the UI, and you can right click to simply add a signature to an exception list.

With Fireware XTM v11.4.x, you now create a global IPS action, which applies to traffic on all ports. You have the ability to enable or disable IPS at a per-policy level to meet your organizational needs. All policies for which IPS is enabled use the same IPS action. It is not possible to use more than one IPS action in your configuration at the same time.

This table is a useful summary of the differences between IPS in Fireware XTM v11.4.x and IPS in earlier Fireware XTM releases.

  IPS in Fireware XTM v11.4.x IPS in Earlier Fireware XTM Releases
IPS Configuration Configure IPS settings globally, enable and disable IPS per policy. The global IPS configuration applies to all policies that have IPS enabled.* Activate IPS with a wizard. Must configure IPS settings per-policy. Each policy that has IPS enabled can have a different IPS configuration.
IPS in Policies IPS is automatically enabled for all policies. IPS scans traffic on all ports IPS can be configured for only the DNS, FTP, SMTP, HTTP, POP3, and TCP/UDP proxy policies.
Threat Levels Five threat levels: Critical, High, Medium, Low, Information Numeric threat level from 1 to 100. 100 is the highest severity threat.
Signature Exceptions You can configure IPS to allow, block, or drop traffic that matches each signature exception. IPS allows traffic that matches the signature exceptions.
Where to See IPS Signature Information

In Firebox System Manager, on the Subscription Services tab, click Show to see information about each IPS signature.
In Fireware XTM Web UI, select Subscription Services > IPS, then select the Signatures tab to see information about each IPS signature.
Additional IPS signature information is published on the WatchGuard web site at http://www.watchguard.com/SecurityPortal/ThreatDB.aspx. Release notes for IPS signature updates are available on the WatchGuard web site (login required).

From this security portal, you can look up a signature ID. Click the signature ID to see links to additional information about the signatures, including CVE ID, Bugtraq ID, and other information, where applicable.

In Firebox System Manager, on the Subscription Services tab, click Show to see information about each IPS signature.

The CVE identifier (CVE-ID) is shown in the signature list in Firebox System Manager for signatures that have an associated CVE identifier.

Signature information is not available in the Fireware XTM Web UI in v11.3.x.

* For those customers that use HTTPS with DPI, it is important to note that IPS scanning occurs before decryption of the HTTPS stream so IPS is not an effective tool for blocking possible intrusion attempts that pass through your XTM device as part of an encrypted HTTPS stream.

When you upgrade to Fireware XTM v11.4 or v11.4.2, your IPS configuration is upgraded to match the v11.4 configuration options. During the upgrade:

Centralized Management

WSM v11.4 introduced a new workflow related to the use of templates. While the new workflow gives you an unprecedented level of control and flexibility over the Firebox and XTM devices you manage, it is important that you understand this new workflow before you upgrade.

With WSM v11.4 and higher, devices no longer subscribe to configuration templates. Instead, you can create and apply multiple templates to your devices. When you apply a template to a device, the template content is merged with the most recent configuration file stored for the device on the Management Server and saved as a configuration file revision. The device always checks for and downloads its latest configuration file when it contacts the Management Server.

You can create multiple templates and apply them to a device or a group of devices in a set order, one at a time. To apply a template to a group of devices, you simply create a folder of devices and drag and drop your template into that folder.

Another powerful template feature new to WSM v11.4 is template inheritance. With this feature you, can determine if you want the value of a configuration setting in the template to override the value of the same setting in the device configuration file when the template is applied. If two templates have no configuration settings in common, you can apply them in any order. If two templates contain common configuration settings, you must apply them carefully in the desired order to make sure that any updates do not inadvertently override the settings already applied to the device, or use the new inheritance settings to control which policies are updated on your devices.

It is important to understand that changes to a template are no longer automatically applied to managed devices. You must now manually select which devices to apply a template change to. This gives you increased control over configuration updates for your managed devices.

If you used Centralized Management with devices subscribed to templates in earlier versions of WSM, when you upgrade from WSM 11.x to v11.4.x, these templates are updated and the devices are no longer subscribed (though you can continue to update the devices using the same template, subject to the workflow changes identified above). Each device retains its template configuration. Existing templates are updated to use “T_” in their object names (to match the object names in the devices that used to subscribe to them). After you upgrade, you’ll see the template upgrade that occurs during upgrade in your revision history.

Resolved Issues

The Fireware XTM v11.4.2 release resolves a number of problems found in earlier Fireware XTM v11.x releases.

General

Networking

Proxies

FireCluster

Mobile VPN with SSL

Mobile VPN with IPSec

Mobile VPN with PPTP

Branch Office VPN

Authentication

Management

Certificates 

WatchGuard Log Server

Firebox System Manager (FSM)

Known Issues

These are known issues for Fireware XTM v11.4.2 and all management applications. Where available, we include a way to work around the issue.

General

WatchGuard System Manager

Workaround
Make sure that Windows XP compatibility mode is not enabled on the WSM v11.x executable file. To verify, locate the wsm.exe file in Windows Explorer. Right-click on the executable file, select Properties, and click the Compatibility tab.

Workaround
Connect to the Management Server from WSM. Select the managed device and select Update Device. Select the radio button Reset server configuration (IP address/ Hostname, shared secret).

Workaround
Exit the WatchGuard Server Center before you start the uninstall WSM. You can then uninstall WatchGuard System Manager successfully.

Web UI

WatchGuard Server Center

Command Line Interface (CLI)

Proxies

Workaround
You can use the H.323 protocol instead of SIP.

Workaround
1. Edit your HTTP proxy policy.
2. Click View/Edit proxy.
3. Select the Allow range requests through unmodified check box.
4. Save this change to your XTM device.

Workaround
Configure the PBX to send the Contact header with an IP address, not a domain name.

Security Subscriptions

Networking

Workaround
1. If your computer is directly connected to the XTM 2 Series device during the Web Setup Wizard, use a static IP address on your computer.
2. Use a switch or hub between your computer and the XTM 2 Series device when you run the Web Setup Wizard.

Multi-WAN

Authentication

Centralized Management

FireCluster

Workaround
Do not use any of the default IP addresses as the Primary or Backup cluster interface IP address.

Logging and Reporting

Workaround
Open Windows Task Manager and kill the process. From the WatchGuard System Manager installation dialog, click Retry. The installation should continue successfully. You may need to manually start the C:\WINDOWS\system32\wbem\wmiprvse.exe later.

Mobile VPN

Workaround
Increase the rekey byte count.

Workaround
To upgrade your Mobile VPN with SSL client from v11.2.1 to v11.3, use your web browser to connect to https://<IP address of a Firebox or XTM device>/sslvpn.html. You can then download and install the new client software. Or, you can download the client software from the Software Downloads page and email it your users to install on their computer.

Branch Office VPN

Workaround
If you use multi-WAN and have problems with your branch office VPN tunnels failing to negotiate with their remote peers, you must open your multi-WAN configuration and select Configure adjacent to your chosen multi-WAN configuration mode. Make sure that the appropriate interfaces are included in your multi-WAN configuration.

Workaround
Do not use Any for the Local or the Remote part of the tunnel route. Change the Local part of your tunnel route. Type the IP addresses of computers behind the Firebox that actually participate in the tunnel routing. Contact the administrator of the remote IPSec peer to determine what that device uses for the Remote part of its tunnel route (or the Remote part of its Phase 2 ID).

Updates to the Web Services API

If you use the Web Services API for logging and reporting, you must update the schema version to be able to use the new report types available with WSM v11.4 and supported by the Web Services API. Note that there are no additional changes to the schema for XTM v11.4.2; if you have already updated the schema for XTM v11.4, there is no additional work required.

The new reports in WSM v11.4 include:

To be compatible with Fireware XTM v11.4, Web Service clients must re-generate the stub code from the LogsService.wsdl file and update any references to the schema version in their user code. For example, in the code below, you must update "2010/04" to "2010/11".

Example WSM v11.3 Java code use

javax.xml.namespace.QName qName = new javax.xml.namespace.QName(
"http://www.watchguard.com/schema/xsd/LogsService/2010/04",
"AuthCredentials"
);

Updated for WSM v11.4 Java code use

javax.xml.namespace.QName qName = new javax.xml.namespace.QName(
"http://www.watchguard.com/schema/xsd/LogsService/2010/11",
"AuthCredentials"
);

Using the CLI

The Fireware XTM CLI (Command Line Interface) is fully supported for v11.x releases. For information on how to start and use the CLI, see the CLI Command Reference Guide, which has been updated for this release. You can download the CLI guide from the documentation web site at http://www.watchguard.com/help/documentation/xtm.asp.

Technical Assistance

For technical assistance, contact WatchGuard Technical Support by telephone or log in to the WatchGuard Portal on the Web at http://www.watchguard.com/support. When you contact Technical Support, you must supply your registered Product Serial Number or Partner ID.

 Phone Number
U.S. End Users877.232.3531
International End Users+1 206.613.0456
Authorized WatchGuard Resellers206.521.8375

Give us feedback  •   All product documentation  •   Knowledge Base

© 2011 WatchGuard Technologies, Inc. All rights reserved. WatchGuard, the WatchGuard logo, Firebox, Core, and Fireware are registered trademarks or trademarks of WatchGuard Technologies in the United States and/or other countries.