Nachgereicht: Resolved Issues in Fireware XTM 11.3.2

• This release resolves a problem that caused excessive CPU usage after multiple PPTP connection attempts. [56005]

• You can now add Single Sign-On exceptions by host range or subnet. [41194]
• The Single Sign-On agent no longer fails when you have Active Directory groups or users with non-ASCII characters in their names. [41883]
• A problem that caused the Single Sign-On client to get incorrect group membership information when used with the Microsoft Windows 7 OS has been resolved. [55738]
• This release includes improvements to the Single Sign-On client and agent software to improve the reliability of group membership retrieval. [44134]
• The Single Sign-on agent no longer sends login information to the Active Directory server twice. [45292]

• Mobile VPN with SSL client connections are no longer possible for a user who is not part of the SSLVPN-Users group when you use LDAP for the authentication server. [56462]

• This release resolves an issue the caused the real MAC address to be used when your Firebox or XTM device is configured for SSL VPN Bridge Mode. [55606]
• When you configure an active/active FireCluster, the FireCluster management IP addresses are now accessible through a branch office VPN tunnel. [39728]

• The Log Server no longer stops functioning if a Japanese font appears in the log messages sent from the Management Server. [56593]
• An email notification is now sent when the Log Server detects that a Firebox or XTM device has stopped sending log messages to the server. [55869]
• When you reinstall the Report Server, the Log Server database path no longer changes. [56292]
• If the Log Server is rebooted during the upgrade from Fireware v10.x to Fireware XTM v11.3.2, the database migration now resumes successfully. [56846]
• The WatchGuard Server Center Setup Wizard no longer fails when you install the Log Server without also installing the Management Server. [56509]
• A confirmation dialog now shows when you set up the Log Server or Report Server database path. [56516]

• The HTTPS proxy action is no longer blank when you create a new proxy action. [56627]
• You can now configure up to 200 Traffic Management objects in Policy Manager. [55796]
• Several improvements have been made to reduce the occurrence of configuration saves that fail with the error: "failed to read servers response: premature EOF". [40706]
• Certificate verification no longer fails for Role Based Access Control after a certificate is renewed. [56329]

• You can now release or renew a DHCP lease manually from the Web UI when the external interface is configured to use DHCP. [37478]
• You can now successfully generate a Mobile VPN with IPSec .ini profile when the group name contains a space. [56537]
• Policy Based Routing now works correctly when the external interface has a dynamic IP address. [56550]
• You can now disable Single Sign-On in the Web UI. [56661]
• You can now select a network subnet or host range when you configure Branch Office VPN tunnels. [44954]

• The default Body Content Types rule for Windows EXE/DLL files has been updated to match a larger class of Windows executable files. This change applies only to new configurations created in Policy Manager using version 11.3.2 or later. The existing configuration on your device does not change when you upgrade from a previous 11.x version. To correct the Body Content Types rule in your existing configuration, go to the Body Content Types category in your HTTP proxy action and edit the Windows EXE/DLL rule. (Note that in Policy Manager, you must be in Advanced View to edit the rule.) Use Pattern Match and for the pattern use: %0x4d5a%* [40799]
• The default WebBlocker Exception in Policy Manager to always allow WebBlocker categorizations to the WatchGuard web site has been updated to more closely match the WatchGuard domain. This change applies only to new configurations created in Policy Manager using version 11.3.2 or later. It does not apply to the Web UI. The existing configuration on your device does not change when you upgrade from a previous 11.x version. To correct the WebBlocker Exception in your existing configuration, edit your WebBlocker action and go to the Exceptions tab. Edit the WatchGuard exception. Change the “Match Type” to Regular Expression and use this expression: ^[0-9a-zA-Z_\-.]{1,256}\.watchguard\.com/ WatchGuard would like to thank Eric Snyder from Verus Corp in Fridley, MN for bringing this issue to our attention. [44585]
• The SMTP proxy configuration now includes an option to turn off the logging of denied SMTP Commands. [45119]
• A problem was resolved that caused HTTP traffic to fail when Gateway AV scanning of HTTP traffic is enabled on Firebox X Edge e-Series devices that run v11.3.2 build 291323. [57372]
• The Firebox System Manager Subscription Services tab now correctly displays IPS deny totals. [56096]
• This release resolves a stack trace in the FTP proxy caused by a malformed user command. [56248]
• When spamBlocker and Allow BDAT chunking are both enabled, the SMTP proxy log file now shows the spam score log message instead of a message that says: SMTP Message classification is unknown because an error occurred while classifying. [56394]

• SIP Forking (INVITE) with the same call-id now works correctly. [56000]
• MSRP file-transfer now works correctly. [55999]
• RTP packets are no longer sent from the wrong interface when multi-WAN is configured. [44587]
• The media timeout is now separate from the registration timeout. [55762]
• SIP registrations no longer fail when the server sends a NOTIFY. [56448]

• Branch Office VPN tunnels now rekey correctly when the remote side initiates the rekey and 1-to-1 NAT or Dynamic NAT is used within the tunnel. [56599]
• Traffic log messages now show the source interface of the incoming Branch Office VPN tunnel traffic. [45052]

• NAT loopback now works correctly with Server Load Balancing. [41090]
• When a Firebox or XTM device is configured in drop-in mode with no external interfaces configured, the default route now works correctly. [41802]
• This release resolves an issue that caused the DHCP Server on the Firebox or XTM device to hand out IP addresses slowly because of DNS host name lookup. [44571]
• You can now correctly add a secondary address to an external interface when the interface name contains a space. [56439]
• When you use MAC access control for wireless users and you bridge wireless to your trusted interface, you no longer need to add the MAC address to the trusted interface MAC Access Control list. [41678]
• When your Firebox or XTM device is configured in bridge mode, MAC access control is now applied correctly to DHCP bootp traffic. [56867]
• QoS now works correctly with FTP policies. [56266]
• When you change the wireless configuration on an XTM 2 device, the interfaces no longer go up and down spontaneously. [42300]
• This release resolves an issue that caused the certd process to use excessive memory. [56181]

Labels: Fireware 11, Fireware XTM, X Core, X Edge, X Peak, XTM 1050, XTM 2, XTM 5, XTM 8