Release notes from Factory release 1.23.001 to Factory release 1.24.001

L2TP

• Changed default lockout timeout on relayed tunnels to 3 minutes
• Use graph setting on local termination L2TP/PPPoE using match

Logging

• Minor changes to default settings for system log messages

Routing

• Changed logic for next hop checks where gateway is on multiple subnets, where at least one of which does not answer ARPs causing route to be suppressed

Web control pages

• Changed web status pages to not show unused menus even in debug level user

Release notes from Factory release 1.19.001 to Factory release 1.20.001

• Changed [not] to [inverted] in Profile logging text.

BGP

• Note that the localpref default is 0 for network statements on this factory release.
• Adjust next hop logic in presence of VRRP to avoid incorrect use of VRRP address in some route passing
• Fix debug log of accepted prefixes on BGP, was showing garbage extra bits

CLI

• Fix double line spacing on some command line output
• Added a "show run" and "import config" in telnet/command line allowing dump and upload of raw XML.

CQM

• Configurable latency Y axis
• Ping only graphs (i.e. no throughput) now have standard deviation on ping timings
• Minor change to default colours
• Corrected showing of "off line" on graphs
• Minor tweak on graphs
• Setting Y axis latency in ms on graphs as part of URL

DNS

• Malformed DNS packets could cause crash, fix

Factory reset

• Change to "recovery" factory default to have separate LAN ports
• Default timeserver set to ntp.firebrick.ltd.uk rather than pool.ntp.org

L2TP

• Additional control over timeouts on L2TP
• Changed default timeouts on outgoing L2TP client sessions - faster recovery and retry
• Possible lockup and watchdog in cases of unresponsive RADIUS servers
• Added quota (tx) to L2TP (as RAIDUS filter code Q)
• Added quota (tx, or tx+rx) and terminate action to allow radius accounting on exceeding quota or session timeout
• Added Filter-Id and Session-Timeout to all RADIUS updates, was just Start record, as some data can change dynamically
• L2TP should now accept RADIUS CoA sooner - was not accepted until PPP negotiation had finished

Ping

• Allow configuration of larger ping packets

PPP

• Improvements to checking and timing in PPP processes
• Slight change in PPP sequence numbering
• Minor tweaks, including new accept-dns in dongle config
• Improved debug / logging for PPP connections
• Support PAP as client login on PPP
• Adjusted retry timeouts on PAP/CHAP requests
• Corrected PPP client PAP continuing to IPCP

PPPoE

• Tweak to handle multiple service responses in PADO

Profile

• Improved logging after non state change profile
• Date/time profile tests when not clock set assume initial state
• Date/time profile tests now have comment field in config

Web config

• Moved css-url to http services config, will need editing as not automatically moved

Web control pages

• New layout for ping and traceroute allowing XML export
• traceroute and ping no reporting a "firewalled" response if seen, rather than just unreachable
• Web interface showing system name on title if trusted IP

XML Config

• Fix factory reset config

XML config

• Changed XSD duration to an FB type that uses saner syntax [[HH:]MM:]SS

Release notes from Factory release 1.17.001 to Factory release 1.18.001

• Draft documentation included in releases

BGP

• New filter option to check for community present in a route
• Showing BGP route details shows additional community tags as well
• Fix for BGP config where local IP is DHCP, meaning BGP did not start up unless a local-id was set
• Fix BGP import/export filtering which only considered first match rule
• Allow use of pad on BGP peer if add-own-as set, even on ibgp
• new use-vrrp-as-self (default true) means the next hop used in BGP will use an appropriate VRRP address if possible
• Ignored received announcments treated correctly as a withdrawal
• Corrected BGP ingress filtering to allow detagging the standard community tags
• Made BGP next hop logic consider routes to dead end and to network as non feasible (previously they were feasible but could not route)
• Fixed config to only allow one list of import and one list of export rules under bgp peer, as only first in list was checked anyway

CQM

• Fix for long term shapers which only worked if sharing of shaper was set
• Graphs show min and max rate limit per hour now
• More corrections on long term shaper logic
• Long term shapers were not actually applying the shaper limit, it seems, even if worked out correctly
• Changed min line on graph to be dotted

DHCP

• Fix for possible lock up causing watchdogs in some cases
• Internal change to try and resolve issue where DHCP has been seen to cause a lock up and watchdog on some systems

DNS

• DNS resolver no longer caching SOA as it was not expanding the MNAME/RNAME fields correctly
• DNS server now ignores expired DHCP allocations

Ethernet

• Added layer 2 interface mapping function (map port/VLAN to port/VLAN directly no session track or firewall)

FB105-tunnel

• Updating the FB105 tunnel config did not always have immediate effect

Firewall

• Crash in some cases where traceroute via mapped address, fixed

IP

• Added ARP/ND link state test to work at subnet level
• Made Wake on LAN a separate diagnostic and linked to DHCP
• Internal change to avoid possibility of recursive tunnelling overrunning buffer space

IPv6

• Fix for ND responses for FE80::/10 LL addresses matching our MAC prefix (we answered all requests even if specific MAC not in use)
• Adjusted routing for FE80::/10 so all interfaces are equal metric to locate LL endpoints

L2TP

• Change relayed L2TP session stats to be consistent with non relayed by counting only IP and not LCP, etc.
• L2TP status showing an accounting session ID even when not using RADIUS accounting, useful for pcap
• Better status report for back to back sessions
• Correct NSN RADIUS parameters in platform RADIUS

OS

• Improved watchdog error reporting
• Further improvement to watchdog panic diagnostic

PPP

• Adjusted LCP restart logic to restart LCP if far end persists in restarting
• Allow far end to refuse magic number negotiation

PPPoE

• Linked status page from PPPoE to L2TP

SNMP

• Added some IfXEntry SNMP values

VoIP

• Added contact header in REGISTER response
• Possible fix on some issues with ring group logic

VRRP

• Changed default startup delay to 60 seconds as usually more sensible and should not cause any harm

Web config

• Tweak class for cqm images in css

Web control pages

• Set larger input box size on web diagnostic tools

Release notes from Factory release 1.16.001 to Factory release 1.17.001

• Updated documentation

BGP

• Corrected AS list in show routes to handle multiple sequences (was showing with no separator)

CLI

• Fix obscure race condition which may cause panic when logging to command line (console).

Config

• Removed redundant fast-reboot options

CQM

• Corrected URL processing for CQM where using x=value/x=value type syntax
• Change to ping scan and cqm polling functions to be more aligned to real time seconds, ready for when we do NTP fully

DHCP

• Corrected tool tips on Kill/Unlock

L2TP

• RFC4818 Delegated-IPv6-Prefix support added - see RADIUS documentation for how this is used.
• Complex bug with IPv6 routed via IPv6 gateway that is routed via an L2TP over IPv4 and generating an ICMP error causing a crash - fixed

Logging

• Removed unused log types for SNMP trap (will move to profiles) and SMS (may be added later)

NTP

• Added option to set ntp poll rate, will be removed/changed when we do NTP fully.

OS

• More details in thread statistics report

Profiles

• Clarified wording for and, or, and not, tests in profiles
• Clarified meaning of timeout and recover as times not number of tests

RADIUS

• Reinstated platform RADIUS accounting handling and relay (missing since 1.13.111)

VoIP

• Second call in a queue is not getting ringing to caller - fixed

Web control pages

• Added layout for config edit for l2tp incoming and outgoing
• New CSS - especially on config edit pages

Release notes from Factory release 1.15.001 to Factory release 1.16.001

BGP

• Colours on BGP status on web page

DNS

• DNS resolver negative caching handling and tweaks to handle VoIP DNS lookups where CNAME used
• Corrected negative caching timings

L2TP

• Added RADIUS option to avoid LCP restart on mismatched MRU
• Corrected sending MTU in RADIUS auth (could be sent twice in some cases)
• Allowing up to 64 byte CHAP challenge size in proxy auth

Logging

• Better wording for missed log entries

Ping

• Not trying to print reverse DNS on ping command while waiting DNS response

PPPoE

• Issue with IPv6 DNS servers not working on a second PPPoE client connection if same as previous

RADIUS

• RADIUS accounting refernce could change some time after reboot depending on clock setting, fixed
• Fix buffer leakage if RADIUS servers time out

Time

• Added very simple sanity check to SNTP clock setting, and logging to right place
• Logging IP from which clock was set

VoIP

• Possible issue with hunt groups messing up after call transfer fixed
• Reduced some of the debug
• SRV handling for VoIP

Web and CLI control

• Added hard reboot option

Web control pages

• Avoid unnecessary invocation of bootloader when system reboot is requested

Release notes from Factory release 1.14.001 to Factory release 1.15.001

BGP

• Route refresh capability announced and refresh request handled
• Minor adjustment in graceful restart logic (not yet advertised)
• Fixed long delay rebooting when BGP active

Config

• Fixed factory default config for dns host name my.firebrick.co.uk - this means a new factory release of code.
• Corrected parsing of an IP using final :: in place of :0 (i.e. seemed to have too many colons)
• Not generating initial or trailing :: on IPv6 addresses where only one block replaced

Firewall

• Routes to VRRP addresses now treated as to "self" not to "unknown" as previously
• Session table display indicates if incomplete as output was interrupted.

Flash

• Image priority tagging removed. Flash contents display shows penalty but no longer priority.
• Change to flash block allocation strategy to spread block usage.

L2TP

• Changed DHCPv6 served timing for L2TP

Ports

• Avoid spurious port down messages at startup.

VoIP

• Mute on a snom caused a call drop due to loss of media, changed to send reinvite same as if on hold
• Validation of allow lists in config save for VoIP
• Tweak to send record route back correctly on dialogue responses

VRRP

• Fix issue if two separate VRRP configs used with same VRID one for IPv4 and one for IPv6

Web control pages

• Format of manual image upload UI page changed in line with auto update.

Release notes from Factory release 1.13.001 to Factory release 1.14.001

• Change to persistent data storage logic and timing

BGP

• Correct BGP route tie break where one route has MED set and one does not. No MED set is now treated as MED 0 correctly

Firewall

• Possible case where session tracking code could crash fixed

L2TP

• Changed IPv6 padding to be more generic padding of any packet that looks too short and under 73 bytes so works with IPv6 over LCP on BT 20CN lines

PPPoE

• Config change losing external PPPoE IPv6 address from routing
• Fixed IPv6 prefix delegation timeout issue

Profiles

• Fixed bug - a ping profile with no routing to send the ping was causing buffer loss
• Possible problem in ping profiles could result in a watchdog failure

RADIUS

• Corrected RADIUS tagging on NSN parameters in platform radius.

VoIP

• Added experimental VoIP feature
• SIP registreations now persist over reboot
• RTP payload type mapping added
• Ends calls on reboot
• Added ring group support - ringing all phones at once
• Fixed crash if extn not defined on telephone users
• Fixed ring group calling
• Fix simultaneous answering of called (cross of 200 and CANCEL)
• Registrations could cause crashes if CSeq wrong, fixed
• Fixed some bugs (affecting grandstream and linksys phones)
• No auto s/w upgrade if calls in progress
• Adedd reboot when free logic
• Tested with IPv6 on gigaset, and some bug fixes.
• Added internal caller ID (extn number)
• Fixed but in sent Call-ID causing issues
• 141 prefix setting withheld now
• New config fields for carrier work added - not implemented yet
• Fixed registrations that use a host name, such as A&A SIP2SIM service
• Allow list checking on incoming call match to carriers
• Matching incoming carrier calls based on To address
• Incoming carrier auth challenge and checking
• Incoming CLI from carrier
• Supports call diversion on SIP handset
• Added call limits options
• Added call transfer functions (blind, and attended)
• Software upgrade from web pages now does reboot when free when manually uploading code
• Made logging of REGISTER messages separate to aid debugging
• Added control of source-ip for outbound registrations
• Sending of messages from same IP as was used as target of incoming registrations to keep some phones happer
• Added some NAT detection and handling at SIP level - not yet on media level
• Improved low level parsing of some syntax variants
• Software upgrade now doing reboot when free on picking new code available
• Improved final status when ringing multiple phones
• Outgoing number formatting for carrier
• Corrected some of the SIP escaping
• Initial ring group queue logic (simply doing ring all)
• Improved VoIP status on web pages
• Ring group logic including strict, cyclic, random, oldest, and all, cascade or sequence modes.
• Faster handling of group progression where phones are busy/DND
• Added BLF handling for snom phones
• Fixed "ringing" state on BLF
• Added more detail on subscription status
• Fixed BLF to work when using a different one of the FireBricks IPs for subscription
• Call pickup/steal added
• Added display name to ring groups
• Added BLF on steal prefix
• Bugfix in SIP subscriptions if invalid data sent
• Added display name on carrier
• Empty and invalid SIP messages could cause a crash, fixed
• Subscription / Registration expiry bug fix
• Fixed profile on ring groups, and also 404 if nobody to ring
• Call hold tone
• Call time on VoIP status
• Colour background on call list status
• Colour background on other data on VoIP status
• Crash in some call transfer cases fixed
• Obscure bug in some cases on complex ring groups would fall back to ringing all, fixed
• Ignoring silly almost empty SIP packets from gigaset (some NAT thing)
• Allow redirect of group calls if got as far as ringing even if redirect set false as this is a manual redirect
• Call transfer and redirect now calling using the carrier selected for the phone doing the transfer/redirect not the original caller
• SIP INFO processing for DTMF
• Incoming number handling for carriers
• ACK generation on delayed response to closed call
• Fix crash case - looks related to hunt groups calling numbers for which users are not yet registered
• Fix for call transfer problems
• Increased number of carriers as often back to back with telephone users
• Outgoing carrier picking for external calls from hunt group using calling carrier
• Pickup was not working for a ringing call
• Transfer to ringing hunt group not working
• Added reason on CANCEL and BYE in some cases
• Race condition on call transfer can cause call to get stuck, fixed
• Corrected handling of Replaces header in REFER where escaping some characters
• Corrected handling of 100 Trying response on outgoing registration so we can register against asterisk
• Updated to handle OPTIONS from a carrier (e.g. asterisk)
• Added tag= on From for calls out via carrier, oops
• Changed for registration reply that does not contain explicit Expires header (e.g. sipgate)
• Changed domain on From and Call-ID
• Added handling of a 407 proxy auth request as well as 401
• Tweak for seq advance on INVITEs after 401/407 (asterisk was unhappy with reuse)
• Added more detail as a CDR log entry
• More CDR log tweaks
• Media detect logic added
• Made call related logs more consistent, always starting with call ID
• Corrected start time ms on CDR log
• Media loss detection improved
• Incorrect call time on status page
• Additional debug for NAT

Web control pages

• Session list copes better if you stop the browser while displaying
• Typo in web config for dns-host/block

Release notes from Factory release 1.10.001 to Factory release 1.11.004

BGP

• Some extra debug for tracking next hop issues on bgp
• Fix to pass on IPv4 tunnel in BGP for Ipv6 tunnel routes as 2002::/16 prefix endpoint
• Adjusted RR logic on BGP to avoid incorrect messing with next hop decision
• Changed BGP to silently ignore routes where we are already the next hop
• BGP change to still process withdraw in same packet as silently ignored routes (typically if using route reflectors)
• Added peer level export-med to set MED on exported routes (unless explicitly set in export filter) as this is commonly the only export filter
• Made local routes (apart from dead-end) take priority over equivilant BGP originated routes
• Changed ttl-security option to be 1 to 127, and use -ve as meaning force TTL sending and no checking
• Added import-localpref at peer level as a common global setting on EBGP links
• Obscure race condition on BGP shutdown could cause a crash

CLI

• Fix telnet timout on users setting timeout 0 to not logout.
• Implement several readline-style line-editing sequences
• Add two more control sequences - Ctrl-T and Alt-T

Config

• Fix where config did not detect overlapping port groups unless actually used in an interface
• Documented that a login timeout of 0 means no timeout but not in ip-group users
• Mandatory port on interface. Missing port on interface picks first port else creates a fatal error

CQM

• Some cases graphs could be duplicated if using long names or odd characters, fixed

DHCP

• Added new lock and unlock feature on DHCP allocations
• Added ability to manually set the name of DHCP allocations

DNS

• Added new feature under services/dns to allow local DNS responses including based on DHCP

Factory default

• Changed factory reset to have my.firebrick.co.uk as local DNS for the firebrick itself

Factory Reset

• Changed so factory reset is DHCP client on WAN and DHCP server on LAN

FB105

• Changes to better handle packet reordering issues on bonded tunnels

FB105-tunnel

• Added tunnel set statistics clear button on status page
• Removed table from FB105 tunnel route sub object as not meaningful

Firewall

• Fixed firewall check code (web and command line) - was confused for more than the most basic checks
• Changed default for firewall where target unknown or nowhere to be "ignore" not "drop". This is important for pre-DHCP client connections from the brick

General

• Various additional debugging code added

IPv6

• Adjust handling of RA client to cope when more than one RA has same SLLA (e.g. VRRP) from different hosts

L2TP

• Added more debug logging on L2TP tunnels, especially relating to relaying
• Removed table from L2TP tunnel client route sub object as not meaningful

Logging

• Improved formatting of replay from previous run flash log on boot up

PPPoE

• PPPoE server (BRAS mode) was broken, fixed
• Added return of Relay-Session-Id received in PADO to PADR sent
• Adjusted PPPoE logging so as not to fill logs with requests that are not for us
• Removed table from PPP route sub object as not meaningful

SNMP

• Fix BGP and L2TP SNMP stats where values 128 to 255 and 32768 to 65535 reported as negative

Web control pages

• Fix issue with some links on Chrome viewing BGP peers
• Typos fixed in config
• Change to try and stop a factory reset config from claiming to have been changed whilst editing
• Incorrect HTML typo fixed in some tables
• Tidy layout of platform radius controls
• Tidy help on rule log settings
• Correct various typos
• Changed filenames for XML save to be more sensible
• Clearer warning of active sessions on reboot and s/w upgrade pages
• Fixed case where showing tables of information not right if a list of routes also shown
• Extra info shown on BGP status
• "Up to date" may have been erroneously displayed on Software Upgrade page - fixed.
• First config save from factory reset was not working, fixed
• New factory reset mode using port 1+3 to go back one config
• Some more colours on tables
• Fix links for ND entries that upset some browsers
• Additional logic for getting L2TP session data using circuit ID in URl

Web pages

• Hovering on a link now underlines it

Web status pages

• Added new System submenu
• Web status pages can now be seen by users with access level >= USER
• Button to clear thread tick counts added to thread statistics page (for users with ADMIN access)

Release notes from Factory release 1.09.001 to Factory release 1.10.001

CQM

• Correct for rare race condition leading to multiple graphs of same name

Flash

• Avoid flash fragmentation by deleting old images if necessary before saving new image.

L2TP

• Since 1.08.007 RADIUS timeouts could cause RADIUS servers to "clog up" and stop doing any RADIUS, fixed
• Added min-retry as a minimum session time before retrying an outgoing L2TP connection (default 10 seconds)
• New platform RADIUS logic

Shaping

• Fix incorrect handling of (legacy) tx-interval on shaper

Release notes from Factory release 1.08.001 to Factory release 1.09.001

BGP

• Vendor specific SNMP for BGP status

DHCP

• Clear DHCP command now allows range/prefix to clear multiple entries
• Option to kill a DHCP allocation from web interface (DHCP status) now
• Change handling of BOOTP to operate as a REQUEST not DISCOVER so causing allocation of lease

L2TP

• Better "clear l2tp all", depending on speed of RADIUS accounting
• Vendor specific SNMP for L2TP status

PPP

• Added IP over LCP sending option to PPPoE code

SNMP

• SNMP now has extra logical interfaces which are all named shapers in order, including relevant stats for a shaper.

Release notes from Factory release 1.06.001 to Factory release 1.07.001

• Does not auto update and reboot if in factory reset recovery state

CLI

• New show routes command not BGP specific
• Show dhcp command layout fix

DHCP

• DHCP client sets /32 routes for DNS servers provided

Factory default

• Made factory default have NAT set on the 10.0.0.X subnet

FB105-tunnel

• Shows associated routes on FB105 tunnel status
• Added graph on web view of fb105 tunnel status if a graph set

Firewall

• Some better checking for warning about blank firewall rules

L2TP

• Change of field name (username) not preserving old field (user-name) in l2tp-relay, fixed
• Pressing a key on telnet command "clear l2tp all" stops clearing lines.
• Support for RADIUS Framed-IP-Netmask mapped to L2TP PPP IPCP NETMASK (144)
• L2TP client mode asks for DNS on PPP
• Config change was unnecessarily restarting some L2TP sessions
• L2TP failed tunnel timout reduced from 5 minutes to 1 minute
• L2TP error response on duplicate tunnel ID to try and manage restart case better
• Better logging of unexpected L2TP SCCRQ
• Issue with L2TP clients when no hostname and no local system name configured

Web control pages

• Using web interface diagnostics/routing could cause a crash
• Showing associated routes on subnets, dongles, PPPoE, etc.

Release notes from Factory release 1.05.001 to Factory release 1.06.001

• Additional stats for sessions per second started
• Added memory usage to one second stats
• Allow multicast packets to be passed through switch
• Possible obscure issue with DHCP server code fixed - probably only when default dhcp server user (i.e. ip not set)
• Added new show status command on telnet, and reformatted web status page

CQM

• Bug if graphs trying to scale to just under 4Gb/s, showed scaled at bottom end in error. Fixed.
• Not including old (off screen) rate changes in max scale on graphs

DHCP

• Additional options in DHCP client
• Changed DHCP server to serve bricks IP as DNS server allowing it to relay, unless explicit servers set in config

Ethernet

• Changed autoneg setting on ethernet ports to default to false if manually setting speed or duplex and not 1G

FB105-tunnel

• FB105 tunnel status reporting half-up status correctly
• Changed logging to only log fatal errors (such as no source Ip or no route) once until next works
• Added additional recursion detection for FB105 tunnels
• Config of ports used in FB105 tunnels, and update to config convertor to match
• Reduced repetition of receive related warnings on identifyable tunnels

Firewall

• Internal adjustment to session tracking hashing functions
• Additional sanity check to pick up if someone tries adding a blank rule to a rule-set (typically by mistake)
• Rule set logic for checking tables when previously having table changes in another rule-set may not have been correct
• Diagnostic for firewalling not correctly handling non table 0 rule checks
• Checking for blank rules refined to allow rules just settting nat or tables

L2TP

• Changed L2TP logging so relay sessions have same logging as incoming session at the time
• L2TP config change was clearing tunnels if not using a hostname setting
• Changed logic for logging L2TP to try and ensure relayed sessions log correctly
• L2TP relay was dropping first packets exchanged
• Periodic RADIUS accounting was incorrectly showing timestamp less any current dropped packets which could cause a slight discrepancy
• Outgoing L2TP option ready for initial testing
• Final LCP TERM sent not logged correct field length in PPP dump, though sent correctly.

Logging

• Session track counter in log-stats
• Log email sending retry logic changed
• Added much more debug for log-debug for logging email sending

Ping

• Ping graphs can now use a host name

PPPoE

• Default if no route= set to also set /32s to DNS servers as well as default route

RADIUS

• L2TP RADIUS for PAP was using cleartext password as message auth (16 byte), changed to random.

Syslog

• Added additional information to emailed logs

VRRP

• Deleting an interface which VRRP master caused a crash

Web control pages

• Improved lists of objects with sub objects present in config editor
• General change to css, layout and menus, and new options for menu/banner controls
• Extra information on DHCP client status page (subnets)
• Change to allow you to stay logged in when clock first sets
• Added ethernet port status to web status page
• Home page shows if system name is not set is this really should always be set, but is not actually a mandatory field