Astaro Up2Date Announcements tag:up2date.astaro.com,2010://4 2010-08-31T15:37:48Z Notifications, advisories, and prescriptive guidance for Astaro administrators. Movable Type 3.36 Status Update - Software error in old Astaro versions tag:up2date.astaro.com,2010://4.1578 2010-08-31T15:34:58Z 2010-08-31T15:37:48Z As previously communicated, on Friday August 27th we released a pattern which includes a fix for the y2k38 issue for all "old" versions (ie earlier than 7.507 and 8.001). This fix was applied successfully by the pattern script, but the... Richard Walford As previously communicated, on Friday August 27th we released a pattern which includes a fix for the y2k38 issue for all "old" versions (ie earlier than 7.507 and 8.001).

This fix was applied successfully by the pattern script, but the script had the unwanted side effect of removing a directory on the disk. This directory contains some temporary data used internally by the Astaro system and also, on version 7 systems, it contains a copy of some system libraries. These libraries were replaced by another pattern which was delivered approximately 2-3 hours later (depending on the version running).

Most customers and systems should not have experienced any issue. The system was correctly patched and the y2k38 problem has be circumvented.

However, the loss of temporary data meant that HA systems appeared to have lost the link between master and slave. In fact, they have not and the HA system is working normally, but WebAdmin does not show the correct status. This issue has, in almost most cases, been resolved either by rebooting the system or by an additional pattern which has been delivered on Monday and Tuesday (depending on the version). Although working correctly, we recommend that HA systems are rebooted at the next available maintenance window.

If a license was uploaded during the 2-3 hour period, then the new license was not recognised (because of a missing library) and the system reverted to a trial license. Uploading a new license once the library was replaced corrected this.

If the system was rebooted during the 2-3 hour period, the Astaro system fails to start. It was then necessary to log on through the console and manually recreate the missing directory and copy the missing libraries.

I and my team are clearly embarrassed to have to report such a situation and we sincerely hope that you have not been too inconvenienced by this issue. I understand that this is not an acceptable level of quality and that you should, and do, expect better from Astaro. We need to earn your trust and have therefore immediately made some changes to our software delivery process to eliminate these mistakes and ensure that in future we do meet your expectations as a partner.

Regards, Richard

]]> Software error in old Astaro versions, update required tag:up2date.astaro.com,2010://4.1576 2010-08-25T15:00:35Z 2010-08-25T16:51:48Z Dear Astaro Partners and Customers, We work constantly to ensure all our customers' networks are secure and connected no matter what version of the Astaro Security Gateway they are running. This is why we wanted to inform our partners and... Gert Hansen Dear Astaro Partners and Customers,

We work constantly to ensure all our customers' networks are secure and connected no matter what version of the Astaro Security Gateway they are running. This is why we wanted to inform our partners and customers of an upcoming software challenge we have identified that may affect installations using older versions of the Astaro Security Gateway.

Please read below:
 - What is the issue?
 - How can this issue be resolved?
 - What can I do if I have a problem on Sept. 4th?
 - Detailed "What should I do?" Workflow

In case you have any questions, don't hesitate to contact your usual Astaro representative.

Kind regards,
Your Astaro Team

]]>

What is the issue?

Astaro products use so called X.509 certificates (think of it as a kind of digital passport - see Wikipedia) internally for VPN, Astaro RED, Mail Encryption, WebGUI and a few more areas. Such certificates are only valid for a limited amount of time and we chose to set the expiration date far into the future (>27,4 years into the future) to be sure that our customers do not experience problems with expiring certificates.

Unfortunately, we now will stumble upon a common problem known as the "Year 2038 Problem" or the "Unix Millennium Bug" (Wikipedia). Starting September 4th, 2010 the expiration date of newly created CA-certificates will be beyond Jan 19th 2038, and therefore will be invalid.

Running installations are unlikely to experience any issues, as only a few very specific and rarely used administrator actions will trigger this issue. But installing new Astaro products with software versions 7.506 and older after Sept. 4th will not work, as the initial setup will fail. Please read the "Detailed Workflow" below for more information.

How can this issue be resolved?

Update to the latest version!

The issue has been fixed with the Up2Dates 7.507 and 8.001 which were released August 13th and all existing customers should update to this version before September 4th in order to be safe. Partners and Customers who still have Astaro Appliances in stock must reinstall them with version 7.507 or 8.001 prior setup or shipment.

All Astaro downloads and un-shipped units in the warehouse have been updated! New installation images can be found here http://download.astaro.com/.

What can I do if I a have a problem on Sept. 4th?

In order to ensure that all Astaro customers receive all the help they need, all Astaro customers are entitled to call the Astaro Support Hotline directly and we are on standby for you over the whole weekend (September 4th / 5th).

If you need help, please contact your nearest location: http://www.astaro.com/support/support-hotline

Detailed "What should I do?" Workflow

Below you find all possible conditions an Astaro installation can be in and a recommendation on what should be done: (The same procedures apply for AWG/AMG/ACC installations)

ASG is running at Version 7.507 or 8.001

These customers have no problems, and do not need to do anything.

ASG is running Version 7.506 or earlier, or 8.000

These customers will experience no issues during "normal" operation, however certain actions after September 4th will trigger the problem:

  1. Performing a factory reset will cause subsequent initial setup process to fail, which leads to no access to WebAdmin.
  2. Regenerating a Certificate Authority (like for the HTTP/S proxy, WebAdmin, or VPN/ Remote Access) will cause the problem. Certificates created using that new CA are invalid.
  3. Activating mail encryption or Astaro RED for the first time will cause the problem. Activating the feature will fail.

Solution: Up2Date or reinstall to 7.507 or 8.001 before September 4th.

Customers which re-install their ASG/ACC using an old ISO image

These customers will have an affected installation and be in the same situation as outlined above.
Solution: Reinstall the system with the latest ISO image (7.507+ or 8.001+) which can be found at http://download.astaro.com

Partners with appliances in stock with ASG Versions 7.506 or earlier, or 8.000

These boxes are affected. Installing them after September 4th will cause the initial setup process to fail, which leads to no access to WebAdmin.
Solution: Partner must update their ASG Appliances using a CD-Rom or Astaro Smart Installer before shipping to customer.

ACC is running at Version 2.200 or earlier

These customers will experience some issues.
Solution: Up2Date to 2.201, which will be released on or around August 27th.

Installations which are unable/unwilling to Up2Date to 7.507 or 8.001 or 2.201

We recommend upgrading to 7.507 or 8.001, but in case this is impossible we will provide a solution for these installations via our Pattern Up2date mechanism:

  1. The unit must be online and connected to the internet
  2. The customer needs to have a valid maintenance subscription
  3. Pattern download/installation interval setting must not be set to "Manual"
The system searches regularly for updates and installs them automatically. After the pattern has been applied, the issue will be fixed.

All installations using 7.506 or earlier and V8.000 will receive this fix. You can easily check if this fix has been applied to your installation by checking the "Pattern Version" on the ASG dashboard. If the pattern version is greater than or equal to 20,000 than the fix has been applied.

We plan to start distributing the pattern on or around August 26th.
Solution: Do nothing and check the pattern version beginning of September.

In case you have any questions, don't hesitate to contact your usual Astaro representative.

Best regards,
Your Astaro Team

]]> Astaro Command Center Up2Date 2.201 Released tag:up2date.astaro.com,2010://4.1575 2010-08-24T16:05:31Z 2010-08-25T14:29:43Z Today Astaro Command Center has been updated to 2.201. This up2date will address the UNIX time issue which was previously solved and distributed for ASG, and is the only fix in this release.... Angelo Comazzetto Today Astaro Command Center has been updated to 2.201. This up2date will address the UNIX time issue which was previously solved and distributed for ASG, and is the only fix in this release.

]]> For ACC 2.201, we have new ISO images and the Up2Date itself available for download from our FTP and mirriors. Of course, our Up2Date infrastructure will distribute the package to you. New VMware and Astaro Smart Installer images will be available in approximately the next 24 hours.

Official Details
Remarks:
-System will be rebooted

News:
-This Up2Date should be applied before end of August 2010

Fixes:
Fix [14883] Overflow in certificate creation will cause invalid certificates

Up2Date Package:
Size: 8,147,009 bytes
Md5: db37f0c76df9a4abdd5547c60dc3d675
FTP: ftp://ftp.astaro.de/pub/ACC/v2/up2date/

Software Appliance ISO Image:
Size: 611,086,336 bytes
Md5: 9fa4ee88a8b3e0fd585202e956a2246b
FTP : ftp://ftp.astaro.de/pub/ACC/v2/software_appliance/iso/

Hardware Appliance ISO Image:
Size: 615,235,584 bytes
Md5: a8db4aed5734b8fb874f219517f1b455
FTP : ftp://ftp.astaro.de/pub/ACC/v2/hardware_appliance/iso/

Feedback
- If you want to provide feedback or want to discuss any of the ACC V2.2 features you should post it on our User Bulletin Board. Please take care to add always(!) the version you refer to (e.g. "[2.200] World Map Labelling").
- If you have any feedback on our help, manual, or any documentation (Online Help) please send it to docu@astaro.com.
- There is also a demo server: http://demo.astaro.com
(All Up2Dates are GNUPG-signed!)

Regards,

The Astaro Product Management Team


]]> Up2Date 8.001 Released tag:up2date.astaro.com,2010://4.1569 2010-08-13T16:52:22Z 2010-08-13T16:42:14Z Our first Up2Date package for the new Astaro Security Gateway Version 8 is ready for distribution. Version 8 has enjoyed significant popularity in the past month, with thousands of new and existing customers experiencing V8's features and stability. You will... Angelo Comazzetto Our first Up2Date package for the new Astaro Security Gateway Version 8 is ready for distribution. Version 8 has enjoyed significant popularity in the past month, with thousands of new and existing customers experiencing V8's features and stability.

You will find 8.001 available for install via Up2Date on your installation. Mainly a bug fix release, this package will enhance the stability and operation of ASG V8, and addresses an issue with Unix time affecting certificates. Read on for the full details of this Up2Date.

]]> This release fixes some bugs with how Web Application Security handles connections for protection of Outlook Web Access servers, optimizing that communication. We have also adjusted the very popular Country Blocking to ensure traffic can flow to essential Astaro Internet resources (Eg. RED provisioning servers, global email scanning repositories etc.) so that your blocking choices won't interfere with ASG operations. In addition, some other bugs were addressed and some hardware glitches for our software users and their platforms of choice were solved.

On addressing the Unix Time issue:
ASG uses certificates for different purposes (such as for each user that is created) and CAs (certificate authorities) for signing the certificates mentioned before. When performing the initial setup, some CAs as well as the admin certificate are generated.
When passing a certain point in time the theoretical end-date for our certs and CAs is beyond 19 January 2038 which will cause trouble to the system as the end-date of a cert/CA must not be before the start-date.

*SUMMARY NOTICE*
Any and all systems which have this up2date applied before the end of August 2010 will be completely free from troubles or consequences as a result of this global Linux/Unix issue. If you apply it, you can avoid needing to educate yourself further.
For units which are not updated before then, we will issue a single fix for this bug via a specially crafted pattern Up2Date as well, which will be automatically patched/applied without updating the firmware version.

If you would like more education on this issue, you can read more about it here via Wikipedia's entry: Year 2038 problem.

Official Details
Download Information
Link: ftp://ftp.astaro.de/pub/ASG/v8/up2date/u2d-sys-8.001.tgz.gpg
Size: 81MB
MD5Sum: eaf81f4137425f04fd6a512f7e6285ec

Remarks:
*System will be rebooted.
*Configuration will be updated.
*HTTP Proxy cache will deleted.

News:
-This Up2Date should be applied before end of August 2010
-Added: HTML rewriting in Web Application Firewall.
-Fixed: Country based blocking can no longer block essential ASG functionality.
-Added exceptions for spam scanning servers, ACC, notification smarthost, NTP servers, and SNMP trap sinks.

Fixes:
[14688]: UNIX Epoch ends in 9999 days, so certificates cannot last longer
[14364] ASG does not use ESMTP for "Skip TLS negotiation hosts"
[14400] WAF disabled in predefined reverse proxy profiles
[14427] No successful boot with Perc H200
[14469] Country Blocking blocks essential services
[14519] GRUB fails to install properly on some HP servers
[14637]: Bridge interface gets unresponsive after change of IP addresses
[14735]: ASG 625a with versions 8 and 8.001 recognizing NIC order wrong
[14759]: Setting system time forward causes WebAdmin to get unresponsive for a while

For the ASG 8.0 Release Notes click here.

Astaro Up2Date technology makes it easy to upgrade your Astaro Security Gateway to the latest version.
There are two ways to apply an Up2Date package to the system:
1) Log on to WebAdmin, navigate to Management >> Up2Date >> Overview and use Update to latest version now to install the Firmware Up2Date. Click on the "Watch Up2Date Progress in new window" and an extra browser window will show the progress of the Up2Date installation. (The System administrator will receive a notification email once the Up2Date process has finished.)
2) Download the Up2Date package from our HTTP or FTP Server and install it under Management >> Up2Date >> Advanced:

Astaro AxG Up2Date Download Mirrors:
- Astaro US
- Astaro US2
- Astaro Germany
- Astaro Germany2

Feedback
- If you want to provide feedback or want to discuss any of the ASG V8 features you should post it on our User Bulletin Board. Please take care to add always(!) the version you refer to (e.g. "[8.001] WAN Link Balancing Question").
- If you have any feedback on our help, manual, or any documentation (Online Help) please send it to docu@astaro.com.
- There is also a demo server for public use: http://demo.astaro.com
(All Up2Dates are GNUPG-signed!)

Regards,

The Astaro Product Management Team

]]> Up2Date 7.507 Released tag:up2date.astaro.com,2010://4.1571 2010-08-13T16:10:43Z 2010-08-13T16:23:42Z We have released Up2Date 7.507 for ASG installations to address an issue around Unix Time which can affect the use of certificates, and thus your ASG installation. This up2date package should be applied before the end of August if possible.... Angelo Comazzetto We have released Up2Date 7.507 for ASG installations to address an issue around Unix Time which can affect the use of certificates, and thus your ASG installation. This up2date package should be applied before the end of August if possible. You can read more about this fix in the details below...

]]> ASG uses certificates for different purposes (such as for each user that is created) and CAs (certificate authorities) for signing the certificates mentioned before. When performing the initial setup, some CAs as well as the admin certificate are generated.
When passing a certain point in time the theoretical end-date for our certs and CAs is beyond 19 January 2038 which will cause trouble to the system as the end-date of a cert/CA must not be before the start-date.

*SUMMARY NOTICE*
Any and all systems which have this up2date applied before the end of August 2010 will be completely free from troubles or consequences as a result of this global Linux/Unix issue. If you apply it, you can avoid needing to educate yourself further.
For units which are not updated before then, we will issue a single fix for this bug via a specially crafted pattern Up2Date as well, which will be automatically patched/applied without updating the firmware version.

If you would like more education on this issue, you can read more about it here via Wikipedia's entry: Year 2038 problem.

Official Details
Remarks:
-Configuration will not be upgraded
-System will be rebooted

News:
-This Up2Date should be applied before end of August 2010

Fixes:
Fix [14657] Overflow in certificate creation will cause invalid certificates

Manual Package Download Information
Link: ftp://ftp.astaro.de/pub/ASG/v7/up2date/u2d-sys-7.507.tgz.gpg
Md5: 321e9f87525bc36dcfdd9531a6a1e5a0
Size: 8,147,144 bytes (Approx 8MB)

Astaro Up2Date technology makes it easy to upgrade your installed Astaro Security Gateway to the latest version.
There are two ways to apply an Up2Date package to the system:
1) Log on to WebAdmin, navigate to Management >> Up2Date >> Overview and use Update to latest version now to install the Firmware Up2Date. Click on the "Watch Up2Date Progress in new window" and an extra browser window will show the progress of the Up2Date installation. (The System administrator will receive a notification email once the Up2Date process has finished.)
2) Download the Up2Date package from our HTTP or FTP Server and install it under Management >> Up2Date >> Advanced:

Astaro AxG Up2Date Download Mirrors:
- Astaro US
- Astaro US2
- Astaro Germany
- Astaro Germany2

Feedback
- If you want to provide feedback or want to discuss any of the ASG V7 features you should post it on our User Bulletin Board. Please take care to add always(!) the version you refer to (e.g. "[7.507] Astaro Web Content Filter Profiles Question").
- If you have any feedback on our help, manual, or any documentation (Online Help) please send it to docu@astaro.com.
- There is also a demo server: http://demo.astaro.com
(All Up2Dates are GNUPG-signed!)

Regards,

The Astaro Product Management Team

]]> Astaro Command Center 2.2 Released tag:up2date.astaro.com,2010://4.1566 2010-07-16T15:20:40Z 2010-08-03T19:09:35Z We are excited today to inform you that Astaro Command Center 2.2 is available! After a half-year of development followed by a public Beta program, ACC 2.2 is ready for download via our FTP servers. Version 2.2 will be pushed... Angelo Comazzetto We are excited today to inform you that Astaro Command Center 2.2 is available! After a half-year of development followed by a public Beta program, ACC 2.2 is ready for download via our FTP servers. Version 2.2 will be pushed out via Up2Date to all our installations next week.

This release is focused around adding great new abilities like Global configuration of Packet Filter rules and Web Security settings and profiles. We have also other fantastic features to make your life easier when working with ASG. Regardless of if you have one, or hundreds of installations, you are sure to find something that saves you time with ACC!

Read on for all the details for this release...

]]> Astaro Command Center 2.2 Features
HTTP/S Proxy Configuration Support
-Build and deploy Web Security profiles and configuration from within ACC!
-Lets you centralize your Web Security settings and globally deploy and change policy across some or all connected ASG installations.
-Work with Filter Actions, URL Categories, Exceptions, and Proxy Auto-Configuration (PAC) files.

Packet Filter Configuration
-You can now make Network Security configuration settings in ACC for packet filter rules, and deploy them as needed to your selection of ASG devices.
-Build rules like you normally do in ASG
-Craft rule sets composed of your rules for deployment to ASG installations.
-Deploy to organizational units, select the position of the deployed rules (Eg. on top of existing rules in the ASG), and view/change/revoke rules with ease.

Auto Deployment of Definitions
-Continually updates selected ASG's with new/changed definitions
-Removes the need to manually select installations and deploy objects
-Keeps multiple installations constantly synced to the latest versions of definitions and other items

New Global Definition Types
-To further assist global deployment and true central management, two new definition types can be configured centrally.
-Time events can be defined and worked with via Definitions-->Time Events in the Gateway Manager
-IPSec policies can be defined and worked with via Configuration-->VPN-->IPSec policies in the Gateway Manager. You no longer need to choose only from pre-defined policies in ACC.

Object Merge Granularity Options
-Allows you to choose merge operations when deploying Global Objects which already exist locally on the ASG.
-Great for assisting migration from per-box configuration to ACC central configuration
-When a definition already exists, choose to overwrite it completely, skip it, or keep the name and just update the data with the Global Objects parameters.
-Many powerful uses for assisting the saving of your time across multiple ASG's!

Other Changes and Features
-Features accessible to the ACC can be restricted on an ASG (aka privilege restriction). You can configure this from Management-->Central Management in ASG 7.506/V8.000.
-Up2Date Cache restricts access to Up2Date servers, and is now ASG V8 compatible
-Expired licensing subscriptions will see their impact on monitoring levels decay over time and become less of a factor as a result.
-IPSec VPN Configuration can now re-use global network definitions and global/custom IPSec policies.

*More information about the various features of ACC 2.2 can be found in the ACC 2.2 release notes


Requirements
*ACC 2.200 requires at least ASG V7.506 or V8.000 for full compatibility.
**ASG features for allowing communication to two ACC servers and SSO real name pass-through are already implemented in ACC 2.2 and just awaiting ASG 7.507 and 8.002 releases.


Download Information
ACC 2.2 is available initially as an Up2date package from version 2.100 or Beta users at Version 2.180. ISO images are also available for full installations of ACC 2.2. Virtual Machine Images and an Up2Date push for existing installations will be released next week, along with new, detailed release notes for ACC 2.2

------------------------------
ACC Up2Date from 2.100 --> Version 2.2:
URL: ftp://ftp.astaro.de/pub/Astaro_Command_Center/v2/up2date/u2d-sys-2.200.tgz.gpg
Size: 259MB
md5sum: 91842af0d63f67e8d3e0b0d0f26ce185

------------------------------
ACC Software Appliance ISO 2.200
URL: ftp://ftp.astaro.de/pub/Astaro_Command_Center/v2/software_appliance/iso/acc-2.200-100715-3.iso
Size: 578MB
md5sum: 29d47dc87398c61725c0127cb1164455

------------------------------
ACC Up2Date from BETA 2.180 --> Version 2.2:
URL: ftp://ftp.astaro.de/pub/Astaro_Command_Center/v2/beta/u2d-sys-2.180-200.tgz.gpg
Size: 22MB
md5sum: 969963597aa2408028e19a411634f1b3


Astaro ACC Download Mirrors:
- Astaro US
- Astaro US2
- Astaro Germany
- Astaro Germany2


If you want to provide feedback or want to discuss any of the ACC V2.2 features you should post it on our User Bulletin Board. Please take care to always(!) add the version you refer to (e.g. "[2.2] HTTP Proxy Profile Push Question").
If you have feedback to our documentation (Online Help) please send it to docu@astaro.com.
There is also a demo server which will run ACC Version 2.2 shortly: http://accdemo.astaro.com


Regards,

- Your Astaro Product Management Team

]]> Up2Date 7.506 Released tag:up2date.astaro.com,2010://4.1565 2010-07-14T00:33:41Z 2010-07-14T01:06:09Z We are releasing ASG Up2Date 7.506. The primary purpose of this release is to prepare V7 installations for the launch of our new Wireless Security solution. As well, the ASG installations will receive some updated files for support of the... Angelo Comazzetto We are releasing ASG Up2Date 7.506. The primary purpose of this release is to prepare V7 installations for the launch of our new Wireless Security solution. As well, the ASG installations will receive some updated files for support of the next point-release of Astaro Command Center V2.2. We also take the opportunity to fix a few small bugs.

This will be pushed out via our Up2Date infrastructure, however if you would just like to manually download it you can do so here. Otherwise read on for the details.

]]> This version is focused around introducing the necessary options and menu items for our new Wireless Security solution. There is a new WebAdmin section called "Wireless Security" which contains an overview and controls. More details on the public wireless beta and the products themselves will be made available shortly. Changes and updates were made to the Astaro Command Center agent as well to prepare it for the upcoming GA release of ACC V2.2.

Official Details
Download Information
Link: ftp://ftp.astaro.de/pub/ASG/v7/up2date/u2d-sys-7.506.tgz.gpg
Size: 132.9MB (139,362,483 bytes)
Md5 : 614a8436398437c64cb7900c3b23601b

Remarks:
-Configuration will be upgraded
-System will be rebooted
*BETA Testers: Your connected access points will perform a firmware upgrade after 7.506 installs on the ASG. As with most firmware "flashing" operations, please do NOT power off your Access Point(s) while the LED's are blinking furiously during their patching process, or you might be left with a non-working unit!

News:
-Added Wireless Security support and WebAdmin area in preparation for upcoming public Beta phase (stay tuned!)
-Added support for upcoming ACC 2.2 release
-Added support for updated/renamed "Astaro IPsec Client"
-Improved Online help for ASG

Fixes:
Fix [12668]: FTP directory listing over HTTP Proxy may not work correctly
Fix [14025]: Site-to-Site SSL Server fails to add routes when bounced quickly

For the ASG 7.5 Release Notes click here.

Astaro Up2Date technology makes it easy to upgrade your installed Astaro Security Gateway to the latest version.
There are two ways to apply an Up2Date package to the system:
1) Log on to WebAdmin, navigate to Management >> Up2Date >> Overview and use Update to latest version now to install the Firmware Up2Date. Click on the "Watch Up2Date Progress in new window" and an extra browser window will show the progress of the Up2Date installation. (The System administrator will receive a notification email once the Up2Date process has finished.)
2) Download the Up2Date package from our HTTP or FTP Server and install it under Management >> Up2Date >> Advanced:

Astaro AxG Up2Date Download Mirrors:
- Astaro US
- Astaro US2
- Astaro Germany
- Astaro Germany2

Feedback
- If you want to provide feedback or want to discuss any of the ASG V7 features you should post it on our User Bulletin Board. Please take care to add always(!) the version you refer to (e.g. "[7.506] Astaro AP 30 Question").
- If you have any feedback on our help, manual, or any documentation (Online Help) please send it to docu@astaro.com.
- There is also a demo server: http://demo.astaro.com
(All Up2Dates are GNUPG-signed!)

Regards,

The Astaro Product Management Team

]]> Announcing release of Astaro Security Gateway Version 8 tag:up2date.astaro.com,2010://4.1562 2010-07-01T00:30:30Z 2010-06-30T23:52:48Z Today the next version of our flagship product is available; Astaro Security Gateway Version 8.000 has been released. Over 2 years in the making, we have collected feedback from you - our customers, partners, and distributors, and listened intently to... Angelo Comazzetto Today the next version of our flagship product is available; Astaro Security Gateway Version 8.000 has been released. Over 2 years in the making, we have collected feedback from you - our customers, partners, and distributors, and listened intently to the entire market and what it asked for in a security solution. Our open approach to feature requests set a new standard for visibility into our planning and allowed us to listen while we provided constant feedback and updates to you.

Today, we continue the success enjoyed by ASG Version 7. You will find a fresh WebAdmin GUI and improved auditing and compliance features. New features like VPN reporting, WebAdmin change tracking, new rights & roles abilities for multiple administrators, and the ability to print out the entire configuration for auditing or record keeping have been introduced. Support for IPv6 and a new 64-bit kernel have been implemented, along with many convenience features such as an easy way to search through all of WebAdmin and country blocking to prevent all communication with entire countries or regions.

Focusing on usable technology, our teams worked hard to make sure our product is easily configurable to solve real problems faced by businesses without the need for months of specialized training in how to use ASG features.

This post provides an overview of Version 8, how to get it, how to get using it, and the key dates and other information you need in order to begin using or selling this fantastic new release. Read on for full details and download information!

]]> As this is a major new version, you will likely have questions about various areas. I'd like to invite you to first review this post for the answers you seek. If you require additional help or information, your Astaro partner or sales contact will happily assist you. Remember you can always check our website or ask for help from our community at www.astaro.org.

About Astaro Security Gateway Version 8
This new version includes the following new features. Presented here is a general overview; for extended information and descriptions (and the full list of all changes in Version 8) please see the accompanying ASG Version 8 release notes(PDF link). You may also wish to look in the V8 WebAdmin for the new manual (Support-->Manual) and online help (click the "?" icon anywhere).


What's New? Highlights of Major New Things

  • Updated WebAdmin - New colors, fonts, and visuals make WebAdmin more easily readable with crisper overall presentation
  • IPv6 - Support has been added for the next iteration of IP addressing throughout ASG
  • New Kernel and Base System - Provides 64-bit support, massively increased hardware compatibility, and better performance
  • Country Blocking - Deny communications to/from any combination of countries and/or regions
  • Web Application Security - A new subscription has been added to our protection portfolio which protects your web servers from modern attacks, hackers, viruses and data theft
  • Flash-Based Reporting - Reporting data can be displayed via animated charts which add strong visual representations to how the data is presented
  • WebAdmin Rights & Roles - Let multiple administrators or auditors share duties by separating access permissions; for example giving someone the ability to work only with the Mail Quarantine
  • Configuration Change Tracking - Aid compliance and accountability efforts by identifying what was changed by an administrator on a forensic level
  • Printable Configuration - Save the contents of the entire system as an XML file to aid compliance efforts and record keeping
  • New Online Help - Improved layout coupled with new feature set updates this reference to be faster and more useful in retrieving information on demand
  • VPN Remote Access Reporting - Displays usage graphs for the various types of user connections, along with historical data for examining session information
  • WebAdmin Menu Search - Instantly filter the menu to show sections of WebAdmin based on a search query box; great for locating an option or feature quickly
  • Web Content Filter Override - Allow configured users and groups to bypass URL filtering block pages by providing credentials and entering a reason, all of which can be tracked using new override reports



Other Features and Changes
  • New installer for software appliances with improved navigation and troubleshooting options
  • Custom certificates support lets you remove browser warnings when accessing WebAdmin or the UserPortal
  • Windows Server 2008 R2 domain controller authentication support
  • Reverse DNS for creating reverse mappings in static DNS
  • Uninterrupted Intrusion Protection updates keep traffic flowing when new patterns are introduced
  • Rule numbering is preserved during search queries, making it easier to locate the resulting rules and where they sit in the configuration order
  • Exceptions improvements for HTTP/S and IPS now allow the use of granular "and/or" operators
  • Site-to-Site VPN's using PSK may now have different keys using PSK probing when configured as respond-only
  • Multiple syslog servers are supported which allows logging data to be sent to multiple locations simultaneously for preservation
  • Dozens of other usability improvements and minor feature additions!



"How Do I Get Version 8?"
ASG Version 8 gives you some options in how to begin using our latest version. Again, the release notes have detailed instructions for the available processes but summary information is below. Be aware that while existing licenses and their subscriptions are valid, if you have not already done so you need to login to MyAstaro and upgrade your license to our new on-demand format introduced back in February, as Version 8 will only accept this license style.

Depending on factors such as if you currently use ASG V7 and what your needs are you will have certain requirements which will be met via the following key dates:

June 30th - ASG V8 ISO Images Available
For ASG appliances or installations using ASG software on their own platforms, download the ASG V8 ISO image (see below), make a backup, install with USB CD-Rom or Astaro Smart Installer" and restore your configuration via the backup.
*NOTE* Beta testers of V8 are able to Up2Date to the GA V8.000 release without needing to re-install. Check the Up2Date section your existing Beta installation and install the GA Up2Date package to move to the GA release.

August 15th - ASG V7 Appliance Upgrade Option
Approximately in mid-August, we will publish an Up2Date for V7 which will add a button which automatically migrates your appliance and configuration from V7 to V8. As in the past, for quality assurance and hardware compatibility reasons, it will not possible to one-touch upgrade non-ASG appliances (software installations on custom hardware) using this method.

October 1st - Appliances ship pre-installed with V8
Until this time, new appliances will ship with Version 7 installed. Customers who purchase new appliances and wish to use ASG Version 8 can install the ISO image or have their partner assist them with this. Astaro Support can also answer questions on how to image your new appliance with Version 8.
*Note* In addition, throughout this period, Up2Dates for V8.00x will be released as planned/required.


Download Information
ASG Hardware Images
ASG Hardware Appliance ISO Image
(for use on official ASG appliances)
Link: ftp://ftp.astaro.de/pub/ASG/v8/hardware_appliance/iso/ssi-8.000-7.1.iso
Size: 348 MB (378179584 bytes)
Md5 : 84cdb87909167e0915b01eafca153c09
ASG Hardware Appliance ISO for Astaro Smart Installer
(for using V1 of the ASI product to install ASG on official appliances)
Link: ftp://ftp.astaro.de/pub/ASG/v8/hardware_appliance/smart_installer/v1/ssi-8.000-7.1-ASI.zip
Size: 348 MB (365,686,141) bytes
Md5 : ab6b709c2dd258fbe1a5748ab485636c

ASG Software Images
ASG Software ISO Image
(for use on your own hardware)
Link: ftp://ftp.astaro.de/pub/ASG/v8/software_appliance/iso/asg-8.000-7.1.iso
Size: 350 MB (368021504 bytes)
Md5 : 5bf91962005658df789b071036ed5501
ASG Software ISO Image for Astaro Smart Installer
(for using V1 of the ASI Product to install ASG on your own hardware)
Link: ftp://ftp.astaro.de/pub/ASG/v8/software_appliance/smart_installer/v1/asg-8.000-7.1-ASI.zip
Size: 339 MB (355587451 bytes)
Md5 : 49cd6d861ceea9c7c28fae86b7ad206c

ASG Virtual Images
ASG ESX Image
(for use with VMware ESX/i)
Link: ftp://ftp.astaro.de/pub/ASG/v8/virtual_appliance/asg-8.000-ESX-v3.zip
Size: 884 MB (927819047 bytes)
Md5 : db739b848493d34178992de49ba1e29d
ASG VMware Image
(for quick-use with VMware Player/Server/Workstation)
Link: ftp://ftp.astaro.de/pub/ASG/v8/virtual_appliance/asg-8.000-vmware.zip
Size: 859 MB (901489426 bytes)
Md5 : 91fbb2ffd084b03cbf5dcbd2c7835459

*Customers with the new "Version 2" of the Astaro Smart Installer, you will be able to use it with V8 images shortly, check the FTP site for when they are available.


Feedback
If you want to provide feedback or discuss any of the Version 8 features you should post it on our User Bulletin Board. For best responses, it helps to add the version to which you are referring in the the title of your post for example: "[8.000] - Question about IPv6".

If you have feedback to our documentation like the manual, online help or WebAdmin explanations please send it to docu@astaro.com.

There is also a demo server coming that allows you to try and see Version 8 anytime. You will find it at http://demo.astaro.com shortly.
All Up2Dates are GNUPG-signed!

Enjoy our new release.
Regards,
The entire Astaro team.

]]> IPS false-positive can block http download of windows executable tag:up2date.astaro.com,2010://4.1559 2010-06-03T15:18:27Z 2010-06-03T15:44:20Z It has come to our attention that a specific intrusion prevention pattern which is normally used to detect .NET exploits is falsely detecting some windows executable downloads to be malicious. You are only affected if you have the IPS system... Gert Hansen It has come to our attention that a specific intrusion prevention pattern which is normally used to detect .NET exploits is falsely detecting some windows executable downloads to be malicious.
You are only affected if you have the IPS system active, if you enabled the category "Attacks against Client Software" -> "Browser (Internet Explorer, Mozilla)" and set this category to "drop".
All other customers are not affected by this issue.

We have identified the pattern and are currently analyzing it. Once we are finished, we will run the fixed pattern set through our test procedures and expect to be releasing fixed ips patterns by tomorrow.

Read below how to work arround this issue ...

]]> I am affected, what can i do?
In order to bypass this rule, log in to WebAdmin and navigate to the "Advanced" tab of the Intrusion Prevention system. There you need to to add a new "rule modification" by clicking on the + sign.

ips_4.png

Than set the action "Alert" for rule "15306" like this:
ips_3.png

And save it, now it should look like this:
ips_2.png

That's it, now the download no longer gets blocked, yet all the .NET exploits will still be blocked.

Best regards
Gert Hansen

]]> Astaro Command Center 2.2 Public Beta Begins tag:up2date.astaro.com,2010://4.1558 2010-05-31T14:19:05Z 2010-05-31T14:59:05Z We would like to invite you to the Public Beta for our next point-release of the Astaro Command Center, Version 2.2. Our developers have been hard at work building and refining new features for our centralized management product, and there... Angelo Comazzetto We would like to invite you to the Public Beta for our next point-release of the Astaro Command Center, Version 2.2. Our developers have been hard at work building and refining new features for our centralized management product, and there are some very powerful new things to see and test.

Astaro Command Center 2.2 will remain a completely free product, and is available as a software appliance ISO which you download and install on the hardware of your choice or run inside a VMware virtual machine (or other virtual solution). From there, you quickly configure your Astaro Security Gateway(s) to communicate with ACC and you then get the ability to configure, get overview information, and generate reports for all connected devices, to name just a few things. This leaves you with a sort of "Throne-Room" for your ASG installations.

This version introduces some great new abilities like Global Packet Filter configuration, central configuration of Web Security profiles, and automatic deployment of Global Objects. Read on for all the details.

]]> IMPORTANT NOTE on Compatibility: In ACC 2.2, a new device agent is required to use the NEW features being introduced. This agent needs ASG V8 (currently in public Beta) V7.920 which is planned for June 1st. For V7 users, the new agent will be added in version 7.506 which should be released in mid to late June. ACC 2.2 is however fully backwards compatible with ASG V7.5+, only the NEW features require this updated agent. So for full use of the ACC 2.2 Beta and all it's features, you need either V8 Beta 7.920+ or V7.506+.

As with our past community-oriented Beta programs, all comments and discussions around the ACC 2.2 Beta are located can be found here in our Beta forum dedicated to ACC 2.2. There you will find further information on this release, along with details on the Beta contest.

Official Details
Download Information
Link: ftp://ftp.astaro.de/pub/ACC/v2/beta/acc-2.150-100531-3.iso
Size: 569M (596305920 bytes)
MD5: 8ecec0fc5d7680a41332e616f76eb0f2

Remarks
- Install Beta ISO and restore your ACC backup to it.
- You will be able to Up2Date from the Beta to the GA release of ACC 2.2

News
New Feature: Central Web Security Configuration (Including Filter Actions, URL Categories, Exceptions and Proxy Auto-Configuration)
New Feature: Central Packet-Filter Configuration
New Feature: Auto-Deployment of global definitions based on Organizational Unit
New Feature: Added new global definition types - (Time events & IPsec policies)
-Selectable merge granularity when capturing local definitions during deployment of global ones
-IPSec configuration can now re-use global network definitions and global/custom IPsec policies
-Expired license subscriptions will gradually loose impact on monitoring level
-Bug fixes and many other small improvements

But wait, there's more! During the Beta, additional features will be introduced. Added will be the ability to add a second ACC server connection, place some restrictions on the areas of ASG which ACC is allowed to interact with, and Single Sign On real name pass-through.

Enjoy testing this new release, there is a lot to see and use. Remember if you have any questions, or would like to know more about the Beta program for ACC 2.2, please visit our the ACC 2.2 Beta Forum.

Happy testing everyone,

Angelo Comazzetto
Product Manager

]]> Up2Date 7.505 Released tag:up2date.astaro.com,2010://4.1554 2010-05-20T08:12:31Z 2010-07-14T00:48:53Z Hello! Up2Date 7.505 has started to push to installations. This version is mainly to update some ASG code in preparation for the imminent GA release of the Astaro RED product. In addition, there are some fixes, stability changes, and we... Angelo Comazzetto Hello! Up2Date 7.505 has started to push to installations. This version is mainly to update some ASG code in preparation for the imminent GA release of the Astaro RED product. In addition, there are some fixes, stability changes, and we have also released a few new features. Added are support for multiple syslog servers, a read-only WebAdmin role, and XAUTH support in site-site IPSEC Tunnels.

As part of our extending the home user licensing to 50 IP addresses last winter, we now are introducing a small change to the customization ability of installations using ASG at home. Focused around the Web Security block page (and other customization areas), a "home-user only" notice will appear and customizations of these types of pages is now limited. This allows us to continue to offer such a large amount of total protection for free home use without any other limitations. Full details of V7.505 are below...

]]> Official Details
Download Information
Link: ftp://ftp.astaro.de/pub/ASG/v7/up2date/u2d-sys-7.505.tgz.gpg
Size: 142MB
MD5Sum: f75b4cc3ff92996c07f455c9f35fe0f1

Remarks:
-Configuration will be upgraded
-System will be rebooted
-Connected RED devices will perform firmware upgrade
RED USERS: Your device will perform a firmware upgrade (blinking LEDs) - do not power off the RED unit while upgrading, as this can cause firmware problems.

News:
-New Feature: Read-only WebAdmin user role
-New Feature: Support for multiple syslog servers
-New Feature: XAuth Support for Site-Site IPSEC Tunnels
-Restricted customization capabilities for Home-User Licensed Installations

Fixes:
[11239]: New Yahoo messenger not detected by IM/P2P security
[11496]: State of additional addresses remains at DOWN after the daily reconnect
[11621]: Packet filter is dropping own DNS replies
[11780]: IPsec Remote Access Errors
[11844]: Cannot use HTTPS scanning in a profile if HTTPS is not enabled for the global settings.
[11857]: Serial numbers showing up as "MISSING" in the WebAdmin dashboard
[12956]: Static routes missing in back end when activating High Availability
[13690]: Removed debug messages in kernel log on HA/Cluster with IPsec

For the new things in ASG 7.5 you can view the Release Notes here.

Astaro Up2Date technology makes it easy to upgrade your installed Astaro Security Gateway to the latest version.
There are two ways to apply an Up2Date package to the system:
1) Log on to WebAdmin, navigate to Management >> Up2Date >> Overview and use Update to latest version now to install the Firmware Up2Date. Click on the "Watch Up2Date Progress in new window" and an extra browser window will show the progress of the Up2Date installation. (The System administrator will receive a notification email once the Up2Date process has finished.)
2) Download the Up2Date package from our HTTP or FTP Server and install it under Management >> Up2Date >> Advanced:

Astaro AxG Up2Date Download Mirrors:
- Astaro US
- Astaro US2
- Astaro Germany
- Astaro Germany2

Feedback
- If you want to provide feedback or want to discuss any of the ASG V7 features you should post it on our User Bulletin Board. Please take care to add always(!) the version you refer to (e.g. "[7.505] Syslog Server Settings ").
- If you have any feedback on our help, manual, or any documentation (Online Help) please send it to docu@astaro.com.
- There is also a demo server: http://demo.astaro.com
(All Up2Dates are GNUPG-signed!)


Cheers,

Your Astaro Product Management Team

]]> Letter from the CEO tag:up2date.astaro.com,2010://4.1550 2010-05-07T16:01:48Z 2010-05-18T06:40:06Z Dear Astaro partners and customers, I profoundly apologize for the events of today. We issued two malfunctioning pattern updates for our flagship product Astaro Security Gateway which caused many of you significant troubles. I, and everyone at Astaro, understand that... Gert Hansen Dear Astaro partners and customers,

I profoundly apologize for the events of today.

We issued two malfunctioning pattern updates for our flagship product Astaro Security Gateway which caused many of you significant troubles. I, and everyone at Astaro, understand that our most important asset is the trust of our partners and customers and today was a bad day for us.

Please allow me to share the results of our preliminary investigation into what went wrong.

]]> What happened?

Today at 6:07 CEST our Up2Date servers began distributing Intrusion Prevention System (IPS) patterns (version 12404) which included two rules (numbers 15851 and 16576) that were incompatible with the version of the IPS engine used in ASG 7.5. The IPS stopped working following the update and, on systems with IPS enabled, all traffic was blocked due to the IPS fail-closed policy.

At 9:30 CEST our Up2Date servers began distributing IPS pattern version 12405 which corrected the error and we alerted all of our partners via email about the situation.

Systems with IPS activated could not download the new patterns because all network connectivity was blocked. As is usual, systems with IPS deactivated do not download new patterns either.

Immediately our support team began distributing instructions to our partners on how to resolve this problem. After further testing of this solution, we communicated the final instructions on how to resolve the situation to all of our partners via email at 11:44 CEST.

Then, incredibly, at 12:25 CEST our Up2Date servers began distributing Anti Virus (AV) pattern version 12407 which included a signature incompatible with the AV engine our systems are running. On systems with Dual AV Scanning enabled the Web proxy was not working and the Mail proxy was not forwarding email.

Our Up2Date servers began distributing the corrected patterns at 13:20 CEST and the issue corrected itself automatically once the systems loaded version 12410 of the patterns.

At 13:15 CEST we notified our partners via the Up2Date Blog about the incident.

How could this happen?

So, after we have had only one such issue in the last two years, how could we incur two within a few hours? Especially since, after the last incident, we have made such significant investments in our team, infrastructure, and processes to ensure we test every update on every platform before we release it?

In this case we manually and automatically tested the patterns, but not on all of the versions of the IPS and AV engines used in the field. Our automated testing framework is in migration right now in order to get it ready for V8, and we lost sight of maintaining full coverage during this period.

What did we learn?

1) We have relied on a testing framework that was in maintenance and not ready for production use. This is inexcusable and we will never do this again.
2) No error of any system in the field should prevent it from reaching our Up2Date servers so fixes can be deployed without manual intervention. We will fix this.
3) We need to define better escalation procedures and inform our partners and customers more quickly using multiple, redundant communication channels. We will implement this.

Once again, I offer my sincere apologies. I sincerely hope that you will accept them and allow us to prove ourselves as a trusted partner to your business going forward.

If you have other questions please do not hesitate to contact me by responding to this email.

Best regards,

Jan Hichert
Astaro CEO

]]> Faulty IPS pattern blocks all traffic - How to fix it! tag:up2date.astaro.com,2010://4.1548 2010-05-07T09:16:33Z 2010-05-18T06:38:26Z Dear partners and customers, As you might have noticed, our automated IPS pattern test routine has missed a faulty pattern which lead to the distribution of IPS pattern which blocked all communication through the Astaro Security Gateway. I personally apologize... Gert Hansen Dear partners and customers,

As you might have noticed, our automated IPS pattern test routine has missed a faulty pattern which lead to the distribution of IPS pattern which blocked all communication through the Astaro Security Gateway. I personally apologize for this fault.

We will analyze this issue to find the root cause of the problem and how it was able to bypass our test procedures and update them accordingly to prevent such incidents in the future.
In the meantime we have found and fixed the pattern and uploaded the fixed one to our up2date servers. But because of the blocked communication, the system will not recover itself automatically.
Please find attached a HowTo explaining how to get a system up and running again.
Again, please accept my apology for this incident.

Gert Hansen

Founder and VP Products

---

]]> We have tested that the new IPS patterns on the Up2Date server are fixed and working.

If your system is affected there are two ways to get the updated and fixed patterns:

1) WebAdmin (the preferred way)

- login to WebAdmin via https://YOUR_ASG_IP:4444
- go to left menu item "Network Security"
- go to sub menu item "Intrusion Prevention"
- disable the IPS system (if not already done)

ips.JPG

- go to the last tab "Advanced"
- click on the green "+" sign under "Modified rules"
- enter under "Rule ID": 15851 and check "Disable this rule"
- click "Save"
- click again on the green "+" sign under "Modified rules"
- enter under "Rule ID": 16576 and check "Disable this rule"
- click "Save"

ips_exceptions.JPG

- go back to the first tab and activate the IPS system again

This will fix the problem and install the new IPS pattern.

PLEASE NOTE: Depending on the speed and workload of your ASG it can take a minute!


2. Command line (only for experienced users)

ips_console.JPG

- login via SSH or local on console
- become "root"
- enter "echo 1 > /proc/net/nf_condition/ips"

That's all and will do the following:
* it will bypass completely the IPS system on lowest level (ASG is online then), independent if IPS is activated or deactivated on WebAdmin
* the new IPS pattern will be fetched and installed
* the next IPS pattern update we will provide later today will remove this bypass automatically and the ASG works like configured (with new pattern)


If your ASG uses ACC as an Up2Date cache: do the same above for these ASGs if there are affected. There is no todo on ACC.


If your ASG is not and was not affected, because IPS was turned off last 8 hours or not online and therefore didn't fetch the corrupt pattern then there is no action needed. The old, corrupt patterns are removed from the Up2Date server. It is safe the activate IPS now and set the ASG online again to fetch IPS pattern.

]]> ASG Version 8 Public Beta Continues tag:up2date.astaro.com,2010://4.1547 2010-05-06T15:18:27Z 2010-05-06T16:09:47Z In a little over 1 month since the Beta of our next major ASG Version has been available, hundreds of downloads have occurred and thousands of comments have been posted in the V8 Beta Forum. We have made some incremental... Angelo Comazzetto In a little over 1 month since the Beta of our next major ASG Version has been available, hundreds of downloads have occurred and thousands of comments have been posted in the V8 Beta Forum.

We have made some incremental Up2Dates to the Beta so far, and now today are releasing a larger Beta build which adds some hotly anticipated features like Location Based Blocking, Web Application Firewall Cookie Signing, and Custom WebAdmin/UserPortal Certificate support.

It is never to late to test the Beta! If you have been wanting to give it a try, you can do so easily. Read on for information on the new Up2Date, and information on how you can join the Beta if you are not already using ASG Version 8.

]]> Since the first Beta release of ASG V8 (dubbed 7.900) we have had 4 additional Up2Dates. Today we release 7.910 with the usual fixes and improvements from testing and beta feedback. In addition, some new features have been added for you to test out.
(For those new to our Beta process, see the original V8 Beta announcement and our V8 Introductory Post.)

If you are already using the ASG V8 Beta, you do not need to re-install. The new 7.910 Up2Date will be delivered to you normally and is installed via WebAdmin. As usual however, we have updated ISO's and manual Up2Date downloads for you, along with the release information.

ASG Beta 7.910 New Features
Cookie Signing
You can now enable a new feature in your Firewall Profiles for the Web Application Firewall called Cookie Signing. For each cookie set by the server this will add a signature stored in another cookie so that the WAF can check the signature on return from the client. This prevents tampering with the cookie on the client side.

Specify the WebAdmin/UserPortal SSL Certificate
In Management >> WebAdmin Settings >> HTTPS Certificate you can now select which certificate is used by WebAdmin and User Portal for SSL encryption. As well, if you have an existing CA that you would like to use to sign the certificate currently used by WebAdmin you can do so. This feature can allow for installations that have their own Certificates or CA to take advantage of a WebAdmin/UserPortal login which does not trigger a security warning in the browser when navigating to the login page(s). More information on this feature can be found in the forums.

New WebAdmin Role: "Reviewer"
In addition to the Admin and Auditor roles already in place, we are adding a new one to the Beta called "Reviewer". Reviewers are allowed to see all settings in WebAdmin (unlike the auditor which is limited to Logging and Reporting), but can't change anything.
You can give users this role via Management >> WebAdmin Settings >> Access Control. (This feature will also appear in ASG V7.505).

Location Based Blocking
Using a new section at ]Network Security >> Packet Filter >> Location Based Blocking
you have the possibility to block ALL traffic to and from IP addresses located in specific countries/regions.
Please note that this feature is a a rather blunt instrument without current support of exceptions. While usually quite accurate, it could produce the occasional false positive since tying IP addresses into a physical location is always a technical practice. However this feature is great for preventing traffic interactions with a certain region or country, perhaps for reasons of spam, constant attacks, probing, or simply to due company wishes.


ASG V8 Beta 7.910 Details
Remarks:
-Configuration will be upgraded
-System will be rebooted
-New features to test (see above)


Download Information
ASG ISO (for Software/Virtual appliance installation):
Link: ftp://ftp.astaro.de/pub/ASG/v8/beta/asg-7.910-10.1.iso
Size: 345M (362143744 bytes)
MD5sum: e21e04e64e1e961d24d1a6b003b09d6d

SSI ISO (for ASG Hardware appliance installation):
Link: ftp://ftp.astaro.de/pub/ASG/v8/beta/ssi-7.910-10.1.iso
Size: 355M (372389888 bytes)
MD5sum: dfa5eabbe8225d811613c7acc39a9860

Up2Date package (7.904 to 7.910):
Link:ftp://ftp.astaro.de/pub/ASG/v8/beta/u2d-sys-7.904-910.tgz.gpg
Size: 52M (54769352 bytes)
MD5sum: 4c32fc4a6e65a1cb38290ec5c45ac589


Fixes
[12326] Site to Site connection will not be established when SHA 512 is used as IPSec authentication algorithm
[12917] Email subjects with umlauts are not displayed correctly in the mail manager
[13221] Installer doesn't handle UTC option correctly
[13456] HTTP proxy doesn't support "single time events"
[13485] Site-to-site VPN Compression policy not working
[13507] CPU reports showing the same utilisation for both nodes
[13552] Log file download usability/consistency
[13561] Packet Filter Live Log formatting is broken
[13564] Logging --> View Log Files loads very slowly
[13569] Small display problem in info in object table with IE8
[13583] New Mail Security RBL too aggressive
[13602] IPSec "Add Remote Gateway" fails with "VPN ID may not be empty"
[13606] Web Application Firewall can not write audit log files (Permission denied)


Enjoy your testing, and if you have any questions or problems, don't forget to share them in the V8 Beta Forum. We have plans for cool prizes to reward some lucky testers!

Cheers,
Your Astaro Team

]]> ASG Version 8 Public Beta Begins tag:up2date.astaro.com,2010://4.1539 2010-03-31T19:00:58Z 2010-04-20T08:08:12Z Astaro would like to invite you to join us in testing our next major version of our Security Gateway product. Over the past 18 months our developers have been hard at work - Astaro Security Gateway Version 8 introduces a... Angelo Comazzetto Astaro would like to invite you to join us in testing our next major version of our Security Gateway product. Over the past 18 months our developers have been hard at work - Astaro Security Gateway Version 8 introduces a new Kernel, 64-Bit Support, IPv6, a refreshed WebAdmin, New Reports, and many other exciting things designed to solve problems and secure your network.

A Public Beta of ASG V8 is available immediately, allowing you to test our current progress of this release and refine/shape its development during the next months along its path to General Availability. At Astaro, our goal is to build products that people want to buy, and have features our customers actually use. We listen to the feedback of our community, and ASG V8 is designed with your requirements in mind. Throughout this process, you can contribute, read the comments of others, and keep up-to-date on the latest Beta happenings at our New V8 Public Beta Forum. There you will find full details and ongoing discussions and news about the ASG Version 8 Public Beta.

The V8 Beta program will have some different details compared to our past Betas; it isn't quite feature-complete yet. Rather than bake everything to an almost-done state and unleash it all on you to test at once, we are starting this Beta a bit early and will add a few more things to it during the next few months leading up to release.

Anyone can test out the V8 Beta, if you would like to know more about how get the Beta Version and contribute your findings, just read on!

]]> For the best Beta experience, a list of the new things, and other useful information, you should read this forum post in its entirety.

We'll start with a small disclaimer - ASG V8 is a BETA and not final, production-ready software. This is a work-in-progress; there will be bugs, broken areas of functionality, and parts where things just do not work as expected or planned. If you decide to use this someplace in production and it causes things to go horribly wrong, well...you were warned. By offering you the chance to test the product early you need to be aware that you will see stability and completeness issues. We use this opportunity to discover and quash bugs that we might not have otherwise discovered during our own testing. We also greatly appreciate your feedback and comments and will use them to further shape our product. The V8 Beta is also not yet complete, there are still features and areas of functionality we are working on which are not yet ready for you to test, we will make additions and add more to play with as the Beta progresses!
Being a Beta, be aware that much of the documentation and associated collateral's, online-help, language translations, and other written support information are not yet available.


ASG V8 Summary Feature Overview
Here is a summary list of new things currently in the V8 Beta. For all the details about this Beta release and a description of these new features, you should please visit the overview posting here.

[Major New Things]
* New Kernel
* New Hardware Compatibility - (take a look at our new HCL and Knowledge Base here.)
* New Installer
* IPv6 Support
* HTTP Reverse Proxy/Web Application Firewall
* Updated WebAdmin
* WebAdmin Change Tracking
* VPN Remote Access Reporting
* Web Content Filter Override

[Minor New Things]
* WebAdmin Menu Search
* WebAdmin Error Handling
* Flash-Based Reporting Charts
* Syslogging
* Reverse DNS
* IPSec VPN PSK Enhancements
* Intrusion Prevention Exceptions
* Intrusion Prevention Updates
* Updated Online Help


[Download Information]
The first public Beta release dubbed V7.900 is available for both ASG Appliances and your own hardware. If you were using a past release of the V8 alpha, you will notice your installation has the 7.900 available as an Up2Date. To use the V8 Beta ISO image, you need to download it, burn it to a CD, and install it, then restore a backup or build anew.

V8 Image for ASG Software on your own machine
ftp://ftp.astaro.de/pub/Astaro_Security_Gateway/v8/beta/asg-7.900-7.1.iso
ISO size: 303MB (317517824 bytes)
ISO md5sum: b621d6a8aaeeea919b1ce3daff8e50df

V8 Image for ASG Hardware appliances
ftp://ftp.astaro.de/pub/Astaro_Security_Gateway/v8/beta/ssi-7.900-7.1.iso
ISO size: 304MB (318775296 bytes)
ISO md5sum: 2625200d209d336a070dc73627eae0c0

To accommodate testing throughout the Beta period, we have made available full-featured testing licenses for the software ISO here and all ASG appliances here. They are also available via the V8 Beta Forums overview post. ASG Version 8 will only support the new licensing model from Astaro.

Cheers,

Myself and the entire Astaro team.

]]>