User manual BARRACUDA NG FIREWALL 5.0 MIGRATION INSTRUCTIONS REVISION 1.3

[. . . ] Migration Instructions Barracuda NG Firewall 5. 0 2010-10-08 Revision 1. 3 Read this document before updating your system Please pay special attention to the appearing Software Restrictions and Hardware Restrictions Barracuda Networks Inc. Winchester Blvd Campbell, CA 95008 http://www. barracuda. com Copyright Notice Copyright 2004-2010, Barracuda Networks www. barracuda. com v4. x-090623-06-1119 All rights reserved. Use of this product and this manual is subject to license. Information in this document is subject to change without notice. Trademarks Barracuda NG Firewall is a trademark of Barracuda Networks. [. . . ] In case of a failed migration, Barracuda Networks recommends to verify the described condition and, if it applies, to reconfigure the setting in question by changing the Subnet Type to Explicit, followed by manually entering the subnet settings and then storing this into the Repository before restarting the migration process. Changings in Hardware Support As of release version 5. 0, Barracuda NG Firewall only supports hardware and virtual appliances by Barracuda Networks and particular phion netfence hardware. Third-party "standard" hardware is, as of 5. 0. 0, not yet supported, but it is planned to add support in a later minor release. Temporary Configuration Migration on Ranges or Clusters Below 5. 0 When updating an MC/CC-managed box to 5. 0 while the range or cluster is still below 5. 0, the configuration data of the box will be temporarily migrated. Emergency override is not possible then during the migration process, as the 5. 0 configuration data cannot be handled on the box as long as the migration process for the whole cluster or range has not been finished. 1 GB Memory Stick Needed for USB Memory Stick Installation For USB memory stick based installation, a 1 GB memory stick is required. The ISO image does not fit on a 512 MB memory stick. 17 Migration Instructions - Known Issues No Support of Token Ring and FDDI Support for Token Ring and FDDI cards is not available. ReiserFS Not Supported Anymore As ReiserFS is not supported anymore, ReiserFS partitions will cause the update to fail, generating an appropriate error message. Downtime During Update The system will reboot and therefore have a downtime during the installation process. Data Preservation During the update process, only files within /phion0/ will be preserved. Configuration data and management centre data residing within /opt/phion/maintree/configroot is saved to /phion0/ and restored after the update process. HA Sync Not Possible below 4. 2. 11 Firewall sync in an HA cluster with one box running 4. 2 and the other box running Barracuda NG Firewall 5. 0 does not work if the 4. 2 box is running release version 4. 2. 10 or below. Firewall sync requires that the HA partners are running 4. 2. 11 or higher. 18 Migration Instructions - Known Issues Additional Reboot Necessary in Flash Drive Mode If Flash Drive mode is forced within the System settings, then the system must be rebooted subsequently to an upgrade to Barracuda NG Firewall 5. 0 or after installing the box using a PAR file. Alternative Driver Support for Certain Intel 100Mbps Cards The alternative driver for the Intel 100Mbps cards from Donald Becker ("Intel EtherExpressPro/100 (DB)" or "eepro100" is not supported by Barracuda NG Firewall 5. 0. Please replace this driver with the "Intel Pro/100" driver manually before updating or reinstalling Barracuda NG Firewall 5. 0. Limited Backward Compatibility of Control Center 5. 0 Please see Combining Barracuda NG Firewall 5. 0 and phion netfence, page 44, in order to learn about restrictions regarding to which release versions are manageable with Control Center 5. 0 and which are not. VPN Site-2-Site Rekeying may Overload Tunnel on Virtual Appliances Excessive rekeying for VPN site-2-site may lead to tunnel teardown in VMWare setups. Reduce the rekeying interval if this happens on your VMWare installation. No Stream Compression in Virtual Appliance HA Setups Stream compression may not be used in a VMWare HA setup, having both VPN boxes on the same VMWare host. 19 Migration Instructions - Known Issues SSH Client within Barracuda NG Admin May Set Wrong Terminal Size On initial connect, the SSH client within Barracuda NG Admin occasionally sets the terminal size to an incorrect value. Subsequently, full screen applications like vi or top may be displayed incorrectly. Authentication Client Offline Sync May Fail After Update Authentication client offline synchronization, formerly phibs offline synchronization, with an Active Directory may fail after updating the system to firmware 5. 0. 0. This occurs on slow network connections, resulting in a connect timeout to the specified servers. On the next try, the synchronization process can usually be completed successfully. PAR Setup of WiFi Box Requires Additional Step Setting up a WiFi box using a PAR file (recovery) requires a dummy change of the WiFi module and subsequently a network activation in order to get WiFi up and running. 64bit Barracuda NG Admin May Display Negative Time Values Barracuda NG Admin may display certain time values with negative values on 64bit platforms. This may occur within the firewall status, firewall history or VPN status UIs and usually happens if firewall or VPN sessions are older than 24 days. It does not affect Barracuda NG Firwall operation by any means. This visualization issue will be fixed with a future firmware update. Disconnecting in NG Admin Audit GUI Breaks All NG Admin Connections Pressing Disconnect within the Firewall Audit GUI causes all Barracuda NG Admin connections to disconnect. Barracuda NG Admin has to be restarted in order to reestablish the connections. This will be fixed with a future firmware update. 20 Migration Instructions - Known Issues HA Configuration Sync Only Possible Between 5. 0 and 4. 2. 12 or Higher Configuration synchronization between HA boxes, of which one was updated to Barracuda NG Firewall 5. 0, is only possible if the other box is running at least release version 4. 2. 12. If you intend to keep both versions in parallel for a longer period of time, Barracuda Networks recommends updating the primary box to 4. 2. 12 and the secondary box to 5. 0. 0. No VMWare Tools on Virtual Appliances VMWare tools can not be installed within the virtual machines of the virtual appliances. This issue will be fixed with the upcoming patch to Barracuda NG Firewall 5. 0. Active Recovery Technology (ART) ART is slated to be a replacement to the existing SDR technology that was available on some appliances. Please note that during USB thumdrive installation unlike SDR, ART does not write an installation log onto the USB thumb drive. nf-edge, nf-sintegra XS, F10, F100, or F101, clicking Control -> Box -> Save current Config for ART will generate an error message saying No ART available on this box. Actually, ART is available on flash based appliances, however, it is not possible to save the current configuration. On appliances with LCD display it is intentionally not possible to save and load a PAR file. [. . . ] For now, these boxes must be kept on release version 4. 2. 42 Migration Instructions - Migrating from phion netfence to Barracuda NG Firewall 5. 0 Legacy Traffic Shaping Removed No automatic migration of legacy Traffic Shaping settings will take place. Please reconfigure Traffic Shaping using the shaping methods introduced with netfence 4. 2. Netmask Policy On initial startup, ngadmin checks if the current profile (e. g. the registry) contains phion. a settings. If phion. a was running previously, a popup asks the user if CIDR or inverse CIDR (phion) netmask notation should be used. [. . . ]