Note: This release is available through both online and offline firmware update mechanisms. Refer to the Installation Guide and User Manual for update methods and how to retrieve the package.
IMPORTANT:
Due to the nature of the SSL improvements in this release, users already using or planning on using the HTTPS scan functionality of the UTM should take the following into consideration:
- For environments where the HTTPS scanning function is enabled with the default UTM certificate already installed into every browser, after upgrading to this firmware version the UTM administrator will have to re-install the new certificate into every browser again to regain a transparent HTTPS browsing user experience. Otherwise, users will receive SSL certificate warnings from the browser when navigating to a HTTPS site.
- If the user has two or more different UTM models (e.g. one UTM50 and one UTM25), the two UTMs will use the different certificates after upgrading to this firmware version. If the administrator wants all the UTMs to use the same certificate for HTTPS scan, the admin must import the same certificate to all UTMs as a custom certificate. The operation can be performed on the Application Security -> HTTP/HTTPS -> Certificate Management page in the web GUI.
- Factory default will now create another random HTTPS scan certificate. Administrators should re-install this newly generated certificate into every browser after every factory default.
- Restoring configuration before v1.3.15-44 will NOT restore the old default HTTPS scan certificate. Restoring configuration in firmware v1.3.15-44 and after will restore the random HTTPS scan certificate used when the backup configuration package was created.
Resolved issues (since v1.3.15-42):
- Enhanced the strength of the HTTPS scanning service for all UTMs.
Known Issues:
- Not able to hear voice after a call is established from DMZ to LAN with server on the WAN and DMZ side.
- SNMP productid is still showing the UTM100 productid for the UTM150.
- SSL VPN client cannot be installed in some PCs with 3G adapters.
- In WAN loading balancing, if one of the WAN connections drop, all the lines get dropped and reconnected automatically.
- VLAN on VDSL is not supported. (UTM9S).
- Application control and firewall is now available for IPSEC traffic. With this new feature the IPSEC performance is up to 12% lower than the previous release
Caveats:
When installing SSLvpn, if there is a failure, a cache clean-up of the SSL-VPN adaptor is necessary. Use one of the following URLs to initiate the cleanup:
- For 32-bit PCs, select the following url:
https://<device IP>scgi-bin/users_portal/removeactivex?launch=true&is32bit=true - For 64-bit PCs, select the following url:
https://<device IP>/scgi-bin/users_portal/removeactivex?launch=true&is32bit=false
To Install
Firmware upgrade from update server:
================================
- Installed firmware versions older than 1.3.7:
If your firmware is older than 1.3.7 (<1.3.7) it cannot be updated directly to firmware newer than 1.3.7. Only firmware images older than 1.3.7 will be displayed when you query the update server (Application=>System Update=>Firmware). To upgrade to firmware newer than 1.3.7 you must first upgrade your system to 1.3.7. You can then perform the firmware update query again to display the newer firmware images (Application=>System Update=>Firmware). - Installed firmware versions 1.3.7 and above:
If your firmware is version 1.3.7 or above, when you query the update server all firmware versions will be displayed.
- Download the file, unzip it and follow the instructions provided in the user manual to upload the firmware.
This product includes software code developed by third parties, including software code subject to the GNU General Public License ("GPL") or GNU Lesser General Public License ("LGPL"). As applicable, the terms of the GPL and LGPL, and information on obtaining access to the GPL Code and LGPL Code used in this product, are available to you at NETGEAR's Open Source Code Web page