Juniper Networks NETSCREEN 5XT, NETSCREEN 204, NETSCREEN 500, NETSCREEN 5200, NETSCREEN 208 User Manual
...
Juniper Networks
NetScreen Release Notes
Product: Juniper NetScreen-5XT, Juniper NetScreen-204, Juniper
NetScreen-208, Juniper NetScreen-500, Juniper NetScreen-5200,
Juniper NetScreen-5400
Version: ScreenOS 5.0.0r9-FIPS
Release Status: Private
Part Number: 093-1638-000, Rev. A
Date: 6-01-05
Contents
1. Version Summary on page 2
2. New Features and Enhancements on page 3
2.1 New Features and Enhancements in ScreenOS 5.0.0r9-FIPS on page 3
2.2 New Features and Enhancements from ScreenOS 5.0.0r8 on page 3
2.3 New Features and Enhancements from ScreenOS 5.0.0r6 on page 4
2.4 New Features and Enhancements from ScreenOS 5.0.0r1 on page 4
3. Changes to Default Behavior on page 5
4. Addressed Issues in ScreenOS 5.0.0 on page 5
4.1 Addressed Issues in ScreenOS 5.0.0r9-FIPS on page 5
4.2 Addressed Issues from ScreenOS 5.0.0r8 on page 13
4.3 Addressed Issues from ScreenOS 5.0.0r7 on page 21
4.4 Addressed Issues from ScreenOS 5.0.0r6 on page 21
4.5 Addressed Issues from ScreenOS 5.0.0r5 on page 23
4.6 Addressed Issues from ScreenOS 5.0.0r4 on page 23
4.7 Addressed Issues from Previous Releases on page 27
ScreenOS 5.0.0r9-FIPS P/N 093-1638-000, Rev. A Page 1 of 42
Juniper Networks NetScreen Release Notes
5. Known Issues on page 29
5.1 Limitations of Features in ScreenOS 5.0.0 on page 29
5.2 Compatibility Issues in ScreenOS 5.0.0 on page 30
5.2.1 Upgrade Paths from Previous Releases on page 31
5.3 Known Issues in ScreenOS 5.0.0 on page 32
5.3.1 Known Issues in ScreenOS 5.0.0r9-FIPS on page 32
5.3.2 Known Issues from ScreenOS 5.0.0r8 on page 33
5.3.3 Known Issues from ScreenOS 5.0.0r7 on page 34
5.3.4 Known Issues from ScreenOS 5.0.0r6 on page 34
5.3.5 Known Issues from ScreenOS 5.0.0r5 on page 34
5.3.6 Known Issues from ScreenOS 5.0.0r4 on page 34
5.3.7 Known Issues from ScreenOS 5.0.0r3 for the 5000-M2 on page 35
5.3.8 Known Issues from ScreenOS 5.0.0r3 on page 36
5.3.9 Known Issues from ScreenOS 5.0.0r2 on page 36
5.3.10 Known Issues from ScreenOS 5.0.0r1 on page 36
5.3.11 Known Issues from Previous Releases on page 40
6. Getting Help on page 41
1. Version Summary
Juniper Networks NetScreen ScreenOS 5.0.0r9-FIPS is the latest version of
ScreenOS firmware with FIPS mode for the Juniper NetScreen-5XT, Juniper
NetScreen-200 Series security appliances, the Juniper NetScreen-500, and the
Juniper NetScreen-5000 Series security systems.
The ScreenOS 5.0.0r9-FIPS release is interoperable with, and provides basic
support for, all versions of NetScreen Remote and ScreenOS 2.6.1 and later
versions. This version of ScreenOS is fully supported by Security Manager,
Juniper Networks-NetScreen's security management platform.
This version of ScreenOS also supports selection of either the Baseline or
Advanced version of the firmware. To access a specific Advanced feature, you need
to purchase the appropriate Advanced feature key.
ScreenOS 5.0.0r9-FIPS P/N 093-1638-000, Rev. A Page 2 of 42
Juniper Networks NetScreen Release Notes
Refer to the following table to understand what ScreenOS versions map to which
product.
Product Firmware
Juniper NetScreen-5XT ns5xt.5.0.0r9.0
Juniper NetScreen-200 Series ns200.5.0.0r9.0
Juniper NetScreen-500 ns500.5.0.0r9.0
Juniper NetScreen-5000 Series (with
5000-M)
ns5000.5.0.0r9.0
2. New Features and Enhancements
The following sections detail new features and enhancements in ScreenOS 5.0.0
releases. For a complete list and descriptions of new features and enhancements
in ScreenOS 5.0.0, refer to the Juniper Networks NetScreen ScreenOS Migration
Guide.
2.1 New Features and Enhancements in ScreenOS 5.0.0r9-FIPS
None.
2.2 New Features and Enhancements from ScreenOS 5.0.0r8
Destination NAT Enhancement – An enhancement has been added to the
destination NAT feature to allow ARP responses for addresses that are on the
same subnet as the device's interface. For further information on this feature
please see the Juniper Networks/NetScreen Knowledgebase.
Scan Engine Update for Juniper NetScreen-5GT – ScreenOS now embeds
Trend Micro’s new scan engine version 7.0 to provide better scanning coverage
and increase performance. All previous versions of pattern files will be compatible
with this new version.
As part of the Scan Engine Update, Juniper Networks implemented the ability to
increase scanning coverage using the following commands:
• set av http skipmime
• unset av http skipmime
Note: The feature may impact performance on the device for traffic that may
match embedded text in HTML packets.
ScreenOS 5.0.0r9-FIPS P/N 093-1638-000, Rev. A Page 3 of 42
Juniper Networks NetScreen Release Notes
According to Trend Micro, the categories of viruses bypassed include HTML and
Javascript. However, the subset of the bypassed viruses can be described as the
following:
Javascript/Jscript/HTML embedded in HTML code (having HTTP content
type of text/HTML) AND is accessed through a script-enabled browser from a
remote web server (via HTTP).
For example, anti-virus scanning would NOT be bypassed for the following
scenarios:
1. Javascript/HTML malware which is stand-alone in a *.js file
2. Javascript/HTML malware propagating via email attachments
So the viruses bypassed would be all Javascript and HTML based viruses, but
accessed or contained with the above characteristics in HTTP traffic only.
2.3 New Features and Enhancements from ScreenOS 5.0.0r6
New Hidden Command - In response to the NISCC VULN 236929, a new
hidden command is implemented in this release. The command is set/unset flow
check tcp-rst-sequence. By default, the command is not set. This command
alters the device’s response to potentially spoofed TCP RST packets.
2.4 New Features and Enhancements from ScreenOS 5.0.0r1
Juniper NetScreen-5GT - Dial Backup, Dual Untrust, OSPF, and BGP are now
available in the 10-user version. Previously these features were only available in
the Plus version.
Juniper NetScreen-5GT - The Extended version provides the same capabilities
as the Plus version with additional features: High Availability (NSRP Lite), the
DMZ security zone, and additional sessions and tunnel capacity. For information
on these features, refer to the Juniper Networks NetScreen ScreenOS Concepts &
Examples Reference Guide for ScreenOS 5.0.0.
Note: You must register your product at www.juniper.net/support so that certain
ScreenOS features, such as antivirus or deep inspection, can be activated on the
device. If you already have an account, enter your user ID and password; if you are a
new Juniper customer, create your account first. To register your product, you need
the model and serial number of the device. After registering your product, confirm that
your device has internet connectivity. Issue the CLI command exec license-key
update to make the device connect to the Juniper server to activate the feature.
ScreenOS 5.0.0r9-FIPS P/N 093-1638-000, Rev. A Page 4 of 42
Juniper Networks NetScreen Release Notes
3. Changes to Default Behavior
There are numerous changes in default behavior. For detailed information on
changes to default behavior in ScreenOS 5.0.0, refer to the Juniper Networks
NetScreen ScreenOS Migration Guide.
Specific changes in default behavior in ScreenOS 5.0.0r9-FIPS release:
• The unset vendor-def CLI command removes all files stored in flash
memory except the license file.
• Security Manager does not work with this release.
4. Addressed Issues in ScreenOS 5.0.0
The following sections detail addressed issues in each release of 5.0.0.
4.1 Addressed Issues in ScreenOS 5.0.0r9-FIPS
• 03875 – After attempting to update a new configuration to the device from
Security Manager to the primary Juniper NetScreen-5200 system in an
active-passive HA pair of Juniper NetScreen-5200 systems, the primary
system failed. The backup system failed a minute and a half later.
• 03637 – When the firewall acted as a TCP proxy server, and if the server
returned the syn-ack packet too late in response to a syn packet, the relevant
firewall flow resource could be released too early and caused the firewall to
fail.
• 03632 – When you have two VOIP phones connected to a trust and an
untrust zone on a Juniper NetScreen-5GT running in extended mode, and
you tried to place a call, the phone obtained its IP address from a DHCP
server.
• 03607 – When two 5000-24FE system running in an NSRP active-passive
transparent mode, where the e2/25 and e2/26 interfaces connected to a
switch, stopped passing traffic and displayed the following meaningless
message on the console:
get log system saved
• 03600 – If you issued the get tech command for a Juniper NetScreen-5400
in an NSRP active-passive configuration while the system was busy, the
system failed.
• 03569 – A Juniper NetScreen-5000 Series system could fail due to flow
memory corruption from out-of-order TCP packets.
• 03558 – A trace route or ping operation sometimes caused memory
corruption, causing the device to fail.
ScreenOS 5.0.0r9-FIPS P/N 093-1638-000, Rev. A Page 5 of 42
Juniper Networks NetScreen Release Notes
• 03537 – The device failed when it incorrectly sent the DHCPDISCOVER
packet out in the callback function.
• 03528 – The subscription key retrieval operation worked only intermittently
because the device did not close the SSL socket properly.
• 03522 – When Security Manager imported a Juniper NetScreen-5200 with a
configuration with large amounts of policies (5,000) and VPNs (2,000), the
device failed.
• 03495 – You could not retrieve mail from certain mail clients that send
POP3 authentication requests (such as Mozilla Mail Client) because the
device did not support POP3 authentication.
• 03478 – A few days after you first configured the Juniper NetScreen-5GT,
the device could receive traffic, but not transmit it.
• 03463 – When ScreenOS performed an SNMP traversal over the MIB for the
Juniper NetScreen-5200, the traversal halted because the device OID did not
increment properly.
• 03435 – The Simple Mail Transfer Protocol (SMTP) client timed out when
large attachments passed through a Juniper NetScreen-5GT anti-virus scan.
• 03433 – When two BGP peers established an adjacency and then lost the
adjacency state, and the NetScreen peer attempted to reestablish the state,
the NetScreen peer could be in the wrong state. This prevented it from
reestablishing the adjacency.
• 03415 – You could not re-add a peer to a BGP peer group once you unset it.
• 03413 – A firewall device could fail when multiple users attempted
unauthorized SSH sessions.
• 03404 – The device generated incorrect traffic log titles when it sent a traffic
log based on a multicell policy. The traffic log title displayed the same source
IP and destination IP addresses.
• 03397 – The device failed because VPN traffic did not handle interrupts
properly.
• 03394 – You could not manage the untrust interface through a route-based
VPN.
• 03379 – After successfully configuring the Juniper NetScreen-5GT in
Extended mode, the WebUI incorrectly indicated that the device was in
Trust-Untrust mode.
• 03369 – When the primary device in an HA pair performed a cold start
synchronization, with a large number of VPN tunnels, the backup device in
the HA pair sometimes dropped some SPI synchronization packets.
• 03367 – When you clicked the Cancel button on the WebUI admin page for
Security Manager, you could no longer locate the page.
ScreenOS 5.0.0r9-FIPS P/N 093-1638-000, Rev. A Page 6 of 42
Juniper Networks NetScreen Release Notes
• 03358 – A very long URL entry when you attempt to perform URL filtering
sometimes caused the device to fail.
• 03356 – The Phase 2 rekey sometimes failed after the Phase 1 expired when
you used Kbytes as the criteria to trigger a Phase 2 rekey operation.
• 03355 – Track IP packets were sent out at the wrong interval, increasing
failed counts (decreasing success rates) even though pings worked correctly.
• 03353 – When you configured a policy using the multiple service feature
including more than 49 services, the Move checkbox of the policy
disappeared from the WebUI and the WebUI displayed some field strings
incorrectly.
• 03351 – When the Juniper NetScreen-5XP successfully upgraded to
ScreenOS 5.0.X, the device incorrectly displayed the following message:
The NetScreen device was unable to complete the upgrade of the
file system.
The NetScreen device was unable to complete the upgrade of the
loader.
• 03346 – The Juniper NetScreen-5200 sometimes failed when you set up IKE
gateways in a Vsys on the Juniper NetScreen-5200.
• 03340 – Security Manager did not send the correct Action code when
generating a traffic log.
• 03338 – The component blocking feature that forces a packet to be dropped
did not work properly.
• 03311 – When the VIP server detection was set to the Manual setting, the
VIP server status detection still displayed the same status when the server
detection parameter was set to Automatic.
• 03308 – When you attempted to change a username in the WebUI, the
system added a new user instead of changing the name of the existing user.
• 03295 – When you issued a get interface command or similar commands,
ScreenOS truncated interface names that had too many characters.
• 03294 – When you issued the command get log traffic | inc on a Juniper
NetScreen-5200, the system failed.
• 03281 – When you performed an incremental SPF (Shortest Path First)
operation for an OSPF virtual routing instance, the device failed.
• 03278 – When updating a dynamic VPN tunnel’s peer gateway IP, a new
route lookup was not performed for the updated peer gateway IP. If the
updated peer gateway IP was not reachable via the old route used for the
previous peer gateway IP entry, the VPN would fail.
• 03273 – After you saved the value in the policy counter in the WebUI, the
value was different from the actual policy count.
ScreenOS 5.0.0r9-FIPS P/N 093-1638-000, Rev. A Page 7 of 42
Juniper Networks NetScreen Release Notes
• 03269 – The Juniper NetScreen-5GT incorrectly autonegotiated to 10MBps
half duplex after it had initially set itself to 10MBps full duplex.
• 03267 – The anti-virus feature had a problem handling the HTTP packets
because a web server inserted too many unnecessary white spaces in the
HTTP header.
• 03263 – When managing the device from the V1-untrust or V1-trust
interface using Manage IP, multiple sessions were created for each packet.
• 03261 – When you have two VPNs active between two devices, with outgoing
interfaces, after the VPN Monitor deactivated the tunnel after nine seconds,
and caused a failover to the secondary VPN, the device did not update the
session information.
• 03250 – A memory corruption caused the device to fail.
• 03243 – In an instance where the client on the Untrust side of the device
connected to a MIP that connected the server to the trust side, when an ASP
began the server, it used a zero-sized window, slowing down performance,
with the server sending back one character at a time.
• 03239 – When you performed an FTP transfer or email download that went
beyond the maximum bandwidth allocated in the traffic shaping feature,
VOIP calls experienced a lot of intermittent voice transmissions.
• 03235 – When you forcefully closed several PKA/RSA SSH sessions without
properly logging out first, the system randomly failed several times.
• 03232 – Under some conditions, an HA (High Availability) pair with a 5000M2 module installed failed. This occurred when the primary device had
4,000 sessions on it and the backup device had 100,000 sessions.
• 03205 – When running two Juniper NetScreen-5200-24FE systems in an HA
active-passive environment, the secondary path would fail and both devices
would assume the primary role after you unplugged the two HA links.
• 03203 – The device sometimes failed when it traversed the session table.
• 03178 – The device sometimes failed with high CPU and the full session
table due to session memory corruption.
• 03177 – Intermittent system failures occurred during an SNMP walk.
• 03152 – When running XAuth in the WebUI environment, the XAuth page
displays the CHAP fragment reassembly method selected by default.
• 03142 – When you sent 64 bytes of packets through a route-based VPN
between two Juniper NetScreen-5200 Series systems with an IXIA packet
analyzer device, the Security Association failed and the packets did not pass
through the IXIA device.
• 03136 – Gratuitous ARP packets sent out to broadcast the presence of a
device were blocked from being sent.
ScreenOS 5.0.0r9-FIPS P/N 093-1638-000, Rev. A Page 8 of 42
Juniper Networks NetScreen Release Notes
• 03132 – When using Juniper NetScreen-Remote to connect to a Juniper
NetScreen-500 dial-up VPN using the WebUI, the IKE Gateway
Configuration displays as user instead of user-group.
• 03128 – Mistakes occurred with (MIP) Mapped IP translation when a remote
shell used a secondary session initiated from the server for redirecting
standard error output from the console.
• 03095 – If the Juniper NetScreen-5XT autonegotiated its speed and duplex
settings with a Cisco 3550, the devices operated properly, but the connection
would fail if you manually set 100MBps - Full and 100MBps - Half for both
devices.
• 03092 – When the device was in transparent mode, it sometimes was unable
to download the latest anti-virus signatures.
• 03081 – An anti-virus parsing error slowed performance for HTTP sessions.
• 03078 – With a very large configuration, when you attempt to save a very
large configuration, the device sometimes generated false HA up-down
messages incorrectly indicating alternatively that the device disconnected
and connected.
• 03071 – If the first VIP (Virtual IP) in the VIP list did not have a service
defined for it, if you added a service to the second to fourth VIP in the list,
the VIP Summary Page displayed no data.
• 03068 – When you modified the IKE Phase 1 gateway name using the
WebUI, the primary device in an HA pair could not synchronize properly
with the backup device so that the backup device received the IKE gateway
name.
• 03058 – After you successfully updated a device with the latest configuration
in Security Manager, and then ran a Delta Configuration Summary
operation, the summary still displayed commands indicating that the update
did not successfully transfer all settings to the device.
• 03054 – The device did not update its ARP table because too many packets
queued up for the same ARP entry.
• 03042 – The serial interface on the device disappeared after you downgraded
from ScreenOS 5.0.0rx to a previous version with the Unlimited Number of
Users Version 2 key installed.
• 03025 – In certain situations, when a user authenticated using WebAUTH
with SecureID, and the user in the Auth table timed out, subsequent
attempts to authenticate failed.
• 03010 – In certain situations when you ping a Juniper NetScreen-5200-24FE
interface, an error condition occurred which sent out fragmented packets.
• 02988 – The ALG did not work for a custom-defined rsh (remote shell)
service.
ScreenOS 5.0.0r9-FIPS P/N 093-1638-000, Rev. A Page 9 of 42
Juniper Networks NetScreen Release Notes
• 02986 – SSHv2 with RADIUS authentication failed to authenticate external
users properly.
• 02985/02996 – The Juniper NetScreen-5000 Series systems sometimes failed
from memory corruption due to kernel locking.
• 02975 – While performing a virus scan with the anti-virus engine, the antivirus update failed, and no traffic could pass through a Juniper Networks
security appliance because the policies blocked it, and the device failed
repeatedly.
• 02972 – When you tried to transfer large files using SCP, the connection
closed before the transfer completed.
• 02952 – A code loop in a SIP disconnect state occurred and resulted in a core
the device failing when disconnecting a SIP call over a Cisco VOIP (Voice
Over IP) network.
• 02941 – When you configured a device with a DIP (Dynamic IP) and traffic
shaping, the first traffic the device sent failed to reach its destination.
• 02933 – While attempting to age out specific sessions, the device sometimes
went into an infinite loop causing the watchdog timer to cause the device to
fail.
• 02921 – A Juniper NetScreen-5400 stopped accepting all traffic after you
reset the device and then unset a policy with multiple services.
• 02918 – A Juniper NetScreen-5000 Series system sometimes could not
support HTTPS when the system occurred in an NSRP active-passive
environment in Transparent mode when you used HTTPS to manage both
the primary and backup devices.
• 02915 – An invalid pointer reference between FTP control channel and data
caused the device to fail.
• 02913 – Although a session on the device has a timeout of one second, when
the session exceeded the timeout, the device did terminate the session.
• 02911 – In some cases, sessions on the Juniper NetScreen-5000 Series
systems never aged out even if there was no response to them.
• 02908 – When you lost a Web and SSH connection to the primary device in
an active-passive HA configuration, you could not connect to the primary
device using an SSH or WebUI session, although you could connect to the
backup device.
• 02906 – You were unable to ping from one device to another over a VPN
between two devices that were each in transparent mode running ScreenOS
5.0.0rX.
• 02893 – When high amounts of traffic transferred across the Fast Ethernet
port on the Juniper NetScreen-500, the data could become corrupted.
ScreenOS 5.0.0r9-FIPS P/N 093-1638-000, Rev. A Page 10 of 42
Juniper Networks NetScreen Release Notes
• 02867 – If the DHCP relay server is set with an IP address, the device
incorrectly attempted to resolve the IP address with the host name even
though there was no hostname.
• 02861 – IP swapping issues occurred on the Juniper NetScreen-5000 Series
systems sometimes because of invalid cache.
• 02845 – In an NSRP active-passive configuration, improper MAC table
entries prevented the backup device from being managed.In some instances,
you could not manage a backup device in an NSRP active-passive
configuration.
• 02810 – A policy with the negate option did not free memory on the device
properly, creating a memory leak, degrading performance on the device.
• 02798 – The Juniper NetScreen-5000 Series systems sometimes had a
redundant buffer when receiving out-of-order fragmented VPN packets.
• 02787/03020 – A memory leak caused by a failed DNS query on a Juniper
NetScreen-5200 in an HA pair caused the primary system to fail.
• 02774 – Multiple trace routes occurred after you created a BGP neighbor to a
device in an HA pair, disabled HA synchronization, and then attempted to
redistribute routes from the primary device to the backup device.
• 02768 – When the primary device attempted to synchronize with the backup
device and sent it a new DIP session, the backup device could still have the
existing DIP session and could not perform the synchronization.
• 02762 – If you attempted to display 100 logs per page in the WebUI Traffic
Log, the WebUI displayed no logs.
• 02725 – In an NSRP device pair, the primary device generated a log that
indicated that multiple failovers occurred, but the backup device only
generated one log, indicating only one failover.
• 02710 – The Unknown Protocol SCREEN option did not work on the Juniper
NetScreen-5000 Series systems.
• 02656 – The WebUI home page did not display the status for Layer 2
interfaces.
• 02620 – Issuing the debug command for the WebSense server, caused the
device to fail.
• 02604 – When a device exported routes from a Vsys to a root virtual router,
the exported routes were not tagged with the correct Vsys ID.
• 02602 – Attempts to establish Telnet, WebUI, and SSH, sessions to the
interface, where management was enabled, failed, when a route from the
correct interface was not provided or the route pointed to a different
gateway.
ScreenOS 5.0.0r9-FIPS P/N 093-1638-000, Rev. A Page 11 of 42
Juniper Networks NetScreen Release Notes
• 02580 – When you created a new custom service, and then configured a VPN
using IKE, the Proxy ID setting in the VPN Autokey IKE configuration
incorrectly defaults to the new custom service, and not the ANY service.
• 02555 – The system incorrectly created sessions for embedded ICMP
packets.
• 02530 – A TCP stack error caused the BGP neighbor state to change to the
Idle state before the BGP holddown time value (default of 180 seconds)
expired. The BGP neighbor state, a setting determined by whether the
current BGP routing instance, can detect its neighbor to be active, and is not
supposed to render the neighbor Idle until no neighbor response occurs after
the holddown time elapses.
• 02519 – In an instance where an active-passive HA pair of Juniper
NetScreen-208, the SA (Security Association) went out of sync, the backup
device became corrupted and the device failed because memory on both
devices became corrupted.
• 02498 – The status link LED incorrectly indicated that the Fast Ethernet
port on both the Juniper NetScreen-500 and Juniper NetScreen-200 was
running at 10 Mbps while the physical link was correctly running at 100
Mbps.
• 02486 – In some instances, after enabling a WebSense server, when you
accessed the Microsoft Outlook Calendar utility, you would lose connectivity
to Outlook Email.
• 02482 – Slow http/https through vpn. Bug in H323 implementation can
possibly cause session leak R. HTTP cant pass if unset flow tcp seq + set flow
tcp syn combo is used.
• 02385 – When you selected multiple source address groups in an intra-zone
policy where the source was Trust and the destination was Trust, then the
groups were not displayed properly in the Policy list.
• 02152 – In instances where you created an intra-zone policy with the source
zone was Trust and the destination zone was untrust and that used multiple
addresses, the Policy list displayed the same entity for both the source and
destination in the policy.
• 02101 – Messages logged with a VIP (Virtual IP) incorrectly indicated the
VIP connection connected and disconnected repeatedly, indicating the
presence of a false positive even though the VIP connection sent
acknowledgment responses to the query. The messages displayed
continuously were:
VIP cannot be contacted.
VIP is now alive.
ScreenOS 5.0.0r9-FIPS P/N 093-1638-000, Rev. A Page 12 of 42
Juniper Networks NetScreen Release Notes
• 01998 – You could not save the set console aux disable command into the
device configuration.
• 01739 – Ping operations would not work if fast aging out of MAC addresses
did not occur when a PC migrated from one Juniper NetScreen-5GT port to
another in the same zone.
• 01635 – The system failed when an H323 recomputed a UDP checksum; the
UDP packet lengths sometimes were too consistent with the IP lengths.
• 01584 – If a virtual routing instance acted as the ABR (area border router),
then the routing instance did not advertise inter-area summary routes. An
inter-area summary route is one value that encompasses a range of route
prefixes contained in multiple routing areas.
• 01523 – An OSPF virtual routing instance sometimes unexpectedly dropped
routes.
4.2 Addressed Issues from ScreenOS 5.0.0r8
• 40292 – A potential cross-site scripting attack existed in the anti-virus scan
engine when processing compressed files.
• 39458 – You could not configure 16 concurrent anti-virus messages, the
expected maximum number of messages allowed when running the antivirus Scan Manager utility in the WebUI.
• 39087 – In certain circumstances, the first attempt to access a TCP
application through a Juniper NetScreen-5000 system with authentication
failed when the ARP entry for the application was not present.
• 38193 – A Juniper NetScreen-5GT could not access common public web sites
when an administrator performed an anti-virus scan for HTTP on the device.
The attempted connections will expire after they exceed the time out
threshold for connection attempts.
• 37933, 37945 – If a number of different attacks entered the Juniper
NetScreen-5000 Series system over a period of time, the system sometimes
began to drop packets.
• 36708 – You could not view the traffic logs for a Vsys if you entered the Vsys
as a root admin user.
• 36670 – You could create more VLANs on a Juniper Networks security
appliance than the number of VLANs the device officially supported.
However, doing this sometimes caused unexpected results. Refer to the
specifications sheet for your NetScreen product to learn how many VLANs it
supports.
• 36494 – Upon startup, Juniper Networks security appliances using PPPoE
sometimes generated a warning message informing that the interface
gateway command was invalid. This is a result of the gateway changing
ScreenOS 5.0.0r9-FIPS P/N 093-1638-000, Rev. A Page 13 of 42
Loading...