Upgrades

Release notice for Ingate Firewall® 4.6.2 and Ingate SIParator® 4.6.2

The new version can be found here

Release notice for Ingate Firewall® 4.6.2 and Ingate SIParator® 4.6.2
Release name: 	Ingate Firewall® 4.6.2
		Ingate SIParator® 4.6.2
Release date: 	2007-12-19

New SIP Functionality

    * When the Ingate B2BUA is used it can now be configured to play music on hold. This is useful in e.g. transfer scenarios. [Tracking ID: 3509]
    * The Enhanced Security Module is now available. It groups several important SIP security features in one module. The module includes support for SIP signaling encryption using TLS, media encryption using SRTP as well as the intrusion detection and intrusion prevention IDS/IPS feature. From now on, TLS is also included in the SIP Trunking module. As a consequence of this, the TLS and SRTP features are removed as basic features from new Ingate units (purchased with the 4.6.2 SW load pre-installed). Units purchased with older versions will automatically get the Enhanced Security Module installed. [Tracking ID: 3566]

Performance Enhancements

    * The performance of configurations with many port forwarding relays and many routed and/or directly connected networks has been significantly improved. [Tracking ID: 3596]

Other New Functionality

    * Using the admin program, available from the console or via SSH, it is now possible to do a "Factory reset" command. Performing Factory reset will clear all logs and configuration and also return the unit to a state where it waits for the magic ping. [Tracking ID: 521]

Fixed SIP-related Problems

    * Handling of configurations where the SIP interoperability setting URI Encoding is set to "Keep username in URI" has been improved. As a consequence, the interoperability setting Delay URI decryption has been removed. [Tracking IDs: 3332, 3556 and 3606]
    * If a remotely NATed UA gets a new NAT binding in the remote NAT device, OPTIONS keepalive probes are now properly sent through the new NAT binding. [Tracking ID: 3396]
    * When not using URI encryption, URI header fields are now properly preserved in re-encoded URIs. [Tracking ID: 3480]
    * When using a SIParator with a NATed IP address, IP addresses are now correctly translated in all scenarios where SIP requests spiral. [Tracking ID: 3558]
    * Local ringback is now properly played in all situations. [Tracking ID: 3568]
    * When blocking disallowed SIP methods, the response will now be "405 Method Not Allowed" instead of "403 Forbidden". [Tracking ID: 3602]

Known Problems
Known VPN-related Problems

These problems are only relevant if IPsec is used.

    * Packets with a destination address that belongs to either end of a tunnel will appear to be encrypted in the log, even when they should not be encrypted. This is a problem with the log only. [Tracking ID: 46]
    * The local endpoint must be chosen so that it is the address closest to the next-hop router for that peer. This means that mobile clients must always connect via the same interface (typically the interface connected to the Internet). [Tracking ID: 508]

Known Failover-related Problems

This problem is only relevant if failover is used.

    * Upgrading a failover team is a complex operation. To upgrade it, you must break the team and upgrade each machine in turn. This will require a number of reboots and network outages. See the separate failover upgrade document which is available on the upgrade web. [Tracking ID: 499]

Other Known Problems

    * Using multiple default gateways does not work with PPPoE interfaces. [Tracking ID: 2980]
    * Autonegotiation of NIC duplex and speed does not work with Alcatel Speedtouch modems using some Ingate models that support configuration of NIC duplex and speed. Setting the duplex and speed manually to half/10 solves the problem. Affected models: Ingate Firewall 1450, 1880. Ingate SIParator 45, 88. [Tracking ID: 3006]