FireBrick

FireBrick - Firewalls, Bonding ADSL, Routers, Traffic Shaping...

FireBrick FB6000
FireBrick FB6000

FireBrick FB6000 series Software

As a matter of policy, FireBrick software upgrades are free to download for all FireBrick customers.

SOFTWARE UPGRADES ARE BEST PERFORMED USING THE WEB CONTROL PAGES ON THE FIREBRICK ITSELF

If you are loading new software from this web page, please read the instructions first.

Factory, Beta or Alpha?

There are three categories of software releases available - Factory, Beta and Alpha.

These categories reflect the amount of testing done - releases normally start life as an alpha, then after initial alpha testing are converted to a beta. As a beta they are subjected to further testing, both by ourselves and by customers in the field. If, after beta testing, a release is stable, we will promote it to a factory release. If during testing we find a problem, we may choose to withdraw that release, or promote a later release.

Factory releases have been tested extensively, both by us and by test users, and have been stable for some time as a beta release. We recommend upgrading all FireBricks to the latest factory release when convenient. FB2500 and FB2700 models will automatically upgrade to the latest factory release, unless you change the default "sw-update" setting in the config.

Beta releases have been through alpha testing to eliminate obvious bugs, and are generally stable. They are available to all users, should you wish to try a new feature or bug-fix before it is available as a factory release, and are willing to take the risk. FireBrick dealer technical support may also ask you to try a new beta to fix a problem. However, when running a beta, we suggest you keep an eye on our software downloads page, in case the beta you are using is withdrawn, or a subsequent beta release with relevant bug fixes is made available. When a beta release has had sufficient testing, it is normally promoted to factory release, or withdrawn if any serious problems are found. Your FireBrick's upgrade page will normally offer the latest beta release, or you can manually download it from our website and upload it onto your FireBrick.

Alpha releases are only for use by designated alpha testers, who are members of staff or customers closely involved in developing and debugging new features. Alpha releases may have had little or no testing, so there is a significant risk of bugs. If you would like to get involved in alpha testing, please contact your dealer. To load an alpha release, your FireBrick must first have alpha upgrades enabled by us. Your FireBrick's upgrade page will then offer the latest alpha release, or you can manually download it from our website and upload it onto your FireBrick.

Note that if any upgrade causes repeated crashes, your FireBrick automatically reverts to older code.

Upgrade Instructions

Upgrade using the FireBrick control pages

The FireBrick has a built-in software download and installation system which can be accessed from the web control pages. This provides a simple one-click download and install feature. Simply go to your FireBrick's Status page, and if there is an upgrade available it will display an upgrade link under the current software version. Click the upgrade link and it will show details of the latest release - once you have read the release notes and wish to proceed, simply click the Upgrade button and it will download that release, install it, and reboot (this causes a brief outage of a few seconds).

Manually downloading and installing an upgrade

To install new software manually you need to load the main product image file. You may also wish to update the bootloader; this is normally unnecessary unless indicated by the release notes. The XSD file corresponding to the software may also be downloaded; this does not need to be installed on the FireBrick, but is useful as a definitive reference for the XML configuration.

Log in to your FireBrick administration pages, select Upload, browse to the main or bootloader image, and click Send new code. The software will be saved to flash, which will take a few seconds, and will become operational the next time the FireBrick is rebooted. You can force an immediate reboot by ticking the checkbox before clicking Send New Code.

Breakpoint Releases

When upgrading manually, do not skip over breakpoint software releases (labelled [Breakpoint] under release version number), as these update your config for changes in format or syntax. If you have saved configs, always re-save a copy after upgrading to a breakpoint issue. If you have tools to update configs, check documentation to confirm they are up to date. We recommend using the upgrade button on the FireBrick web control pages as this will ensure you do not miss any steps. Automatic upgrades to the latest factory release are done by default on FB2500 and FB2700 models. More


FireBrick Model: FB6000 | FB2500 | FB2700 | SoHo/Plus | FB105

Model Variant: FB6202   Change to: (default is FB6202)

Software Versions: Recent versions only | Factory releases | Factory and Beta | Factory, Beta & Alpha

2013-04-23
Current factory release
1.24.004 (Crispa)
Config:XSD Doc
Manual:PDF HTML

Release notes from Factory release 1.23.001 to Factory release 1.24.004

Config

  • Fix problems with factory default config

DHCP

  • DHCP address allocation for new devices changed to be more reliable

L2TP

  • Changed default lockout timeout on relayed tunnels to 3 minutes
  • Use graph setting on local termination L2TP/PPPoE using match

Logging

  • Minor changes to default settings for system log messages

OS

  • Some thread priorities adjusted.

Routing

  • Changed logic for next hop checks where gateway is on multiple subnets, where at least one of which does not answer ARPs causing route to be suppressed

Web control pages

  • Changed web status pages to not show unused menus even in debug level user
2013-04-20
Older factory release
1.24.001 (Crispa)
[Withdrawn]
Config:XSD Doc
Manual:PDF HTML
This release has been withdrawn.

Release notes from Factory release 1.23.001 to Factory release 1.24.001

L2TP

  • Changed default lockout timeout on relayed tunnels to 3 minutes
  • Use graph setting on local termination L2TP/PPPoE using match

Logging

  • Minor changes to default settings for system log messages

Routing

  • Changed logic for next hop checks where gateway is on multiple subnets, where at least one of which does not answer ARPs causing route to be suppressed

Web control pages

  • Changed web status pages to not show unused menus even in debug level user
2013-04-19
Older factory release
1.23.001 (Bunthorne)
[Breakpoint]
Config:XSD Doc
Manual:PDF HTML

Release notes from Factory release 1.22.001 to Factory release 1.23.001

CQM

  • Off line detect on graphs with no timing (e.g. FB105 tunnels) was wrong, causing yellow traffic light
  • Added CQM logging of when graphs start and stop responding
  • Fixed use of = on numeric arguments for CQM graph URLs
  • CQM graphs corrected to show damping data
  • Refinded when keys show on graphs
  • Added additional stats to CQM XML
  • Fixed aggregate L2TP CQM graphs not showing damping, work around for older code is to add ?fud to URL
  • Percent loss not scaling properly, so wrong when under 100 pings/LCPs

Factory reset config

  • Changed factory reset to be consistent with separate LAN ports

L2TP

  • Tidy the logic for CQM on slow LCP echo to show actual sent count.
  • Changed default localpref for L2TP/RADIUS Framed-IP-Address to 0 instead of MAX. Being a /32 it is normally best route anyway, but this change allows a Framed-IP-Route /32 to set a metric where required.
  • Increase to calling and called circuit ID in negotiation of L2TP to 64 characters consistent with platform RADIUS.
  • Changed PPP negotiation to close if repeated unexpected PPP negotiation after PPP completed
  • Some additional route looping protection

Ping

  • Logging for ping graphs (e.g. DNS lookups, etc) now to CQM logging target

PPPoE

  • Fixed crash if pppod configured with no name field

RADIUS

  • RADIUS server config changed to single object type <server...> in services/radius with a type saying if authentication or accounting, etc.
  • Changed port to auth-port in services radius, and added separate control-port for dynamic RADIUS
  • Additional matching for (platform) RADIUS service (source and target IP of RADIUS request)
  • Added support to handle NAS-IP-Address in RADIUS response for L2TP to specify the local end IPv4 negotiated on IPCP - does not add routing or loopback for this
  • Platform RADIUS allows configurable secret based on matching rules
  • Platform RADIUS has option to require authenticator in request
  • Platform RADIUS supports RADIUS-Status-Server message
  • Platform RADIUS now logs the requesting IP and target IP

Routing

  • Network statement was not using profile, fixed
  • Added gateway feasibility testing to static routes in the same way as BGP routes,

Subnet

  • Subnet test can report one second false positive every 3 minutes, fixed
  • Config load causes a subpressed subnet (test failed) to have false positive for one second
  • Subnets with a test would start assumed active, now changed to start assumed inactive

UI

  • Added warning on home page when a reboot is necessary to activate new features

Web config

  • Improved layout in config editor for radius service

Web control pages

  • Added option to set Access-Control-Allow-Origin response to allow cross site javascript access to FireBrick. USE WITH CARE as could compromise your brick by remote hosted javascript re-using a login session.
  • Some menu items only shown if debug level user or if menu has some contents, specifically aimed at Status menu items for unused features

XML Config

  • Typo in help text
2013-02-25
Older factory release
1.22.001 (Araucaria)
Config:XSD Doc
Manual:PDF HTML

Release notes from Factory release 1.21.001 to Factory release 1.22.001

CQM

  • Removed standard deviation from CQM graphs
  • Added reject count on ping grpahs (ICMP error response) - new CQM xml definition
  • Changed fail on graph (dripping blood / red), and reject, to be percentage based

L2TP

  • Changed platform radius matching code for L2TP to handle longer challenges than 16 (now 64)

OS

  • Fixed problem with allocation of multiple flash blocks when saving images or large configs or data. Please ensure you have a copy of the config before a manual upgrade. Save config several times on FireBrick to minimise risk of issues.

Ping

  • Slow setting on ping now defaults to auto, i.e. when no proper replies for 2 minutes, but can be set true or false

Web control pages

  • No longer shows Wholesaler on status page (unless enabled for alpha builds)
2013-02-22
Older factory release
1.21.001 (Zoe)
[Breakpoint]
Config:XSD Doc
Manual:PDF HTML

Release notes from Factory release 1.20.001 to Factory release 1.21.001

BGP

  • Reversed a previous change which affected network statements. Default localpref set to max as before. Could cause issues if BGP announcing and accepting own as on external transit.

Factory reset config

  • Added PPPoE client in factory reset config on LAN as well as WAN

Firewall

  • Tweak for firewall logic where target interface is a 6 to 4 tunnel to resolve final interface

L2TP

  • Extra option in L2TP relay controls allowing picking one of the relay IPs at random first
  • Slightly better debug for RADIUS count issue, use of volatile on state ocntrol, and adjust polling task

NTP

  • NTP server field name now changed name and set to default which is ntp.firebrick.ltd.uk. Please configure any preferred ntp servers

O/S

  • Change to improve shutdown / reboot sequencing and timing

PPP

  • Fix minor discrepancy in NAK and REJ logic on PPP

PPPoE

  • Was incorrectly adding far end IP as a DNS server
  • Added some level of backoff on PADI, longer if never seen PADS

s/w upgrade

  • Longer backoff on s/w upgrade checks where no DNS available

SNMP

  • Added iso.3.6.1.2.1.1.2.0 sysObjectID

Subnet

  • When changing a subnet, a new MAC is allocated - it now picks from subnets in same port/vlan first

Web config

  • Adjusted some of the help text on config edit
  • Traffic lights for profiles in config edit (on profile list and lists which reference profiles)
  • Added "(b/s)" on description for rates in config

Web control pages

  • Username on web footer
  • Added port/VLAN to subnet list

XML Config

  • Changed services/platform-radius service to be services/radius as plans to expand config for other types of RADIUS
  • Moved RADIUS authentication and accounting lists from l2tp to services/radius
  • Changed error messages on config load to provide more context - shows XML around the error point
  • Corrected syntax check on XML duration with spurious letters
  • Added new restrict-mac field to interface definition - NOTE: USING THIS MAY CHANGE MAC OF SUBNETS IN USE
2012-12-06
Older factory release
1.20.001 (Yalena)
Config:XSD Doc
Manual:PDF HTML

Release notes from Factory release 1.19.001 to Factory release 1.20.001

  • Changed [not] to [inverted] in Profile logging text.

BGP

  • Note that the localpref default is 0 for network statements on this factory release.
  • Adjust next hop logic in presence of VRRP to avoid incorrect use of VRRP address in some route passing
  • Fix debug log of accepted prefixes on BGP, was showing garbage extra bits

CLI

  • Fix double line spacing on some command line output
  • Added a "show run" and "import config" in telnet/command line allowing dump and upload of raw XML.

CQM

  • Configurable latency Y axis
  • Ping only graphs (i.e. no throughput) now have standard deviation on ping timings
  • Minor change to default colours
  • Corrected showing of "off line" on graphs
  • Minor tweak on graphs
  • Setting Y axis latency in ms on graphs as part of URL

DNS

  • Malformed DNS packets could cause crash, fix

Factory reset

  • Default timeserver set to ntp.firebrick.ltd.uk rather than pool.ntp.org

L2TP

  • Additional control over timeouts on L2TP
  • Changed default timeouts on outgoing L2TP client sessions - faster recovery and retry
  • Possible lockup and watchdog in cases of unresponsive RADIUS servers
  • Added quota (tx) to L2TP (as RAIDUS filter code Q)
  • Added quota (tx, or tx+rx) and terminate action to allow radius accounting on exceeding quota or session timeout
  • Added Filter-Id and Session-Timeout to all RADIUS updates, was just Start record, as some data can change dynamically
  • L2TP should now accept RADIUS CoA sooner - was not accepted until PPP negotiation had finished

Monitoring

  • Changes in power supply inputs are now logged.

Ping

  • Allow configuration of larger ping packets

PPP

  • Improvements to checking and timing in PPP processes
  • Slight change in PPP sequence numbering
  • Minor tweaks, including new accept-dns in dongle config
  • Improved debug / logging for PPP connections
  • Support PAP as client login on PPP
  • Adjusted retry timeouts on PAP/CHAP requests
  • Corrected PPP client PAP continuing to IPCP

PPPoE

  • Tweak to handle multiple service responses in PADO

Profile

  • Improved logging after non state change profile
  • Date/time profile tests when not clock set assume initial state
  • Date/time profile tests now have comment field in config

Web config

  • Moved css-url to http services config, will need editing as not automatically moved

Web control pages

  • New layout for ping and traceroute allowing XML export
  • traceroute and ping no reporting a "firewalled" response if seen, rather than just unreachable
  • Web interface showing system name on title if trusted IP

XML Config

  • Fix factory reset config

XML config

  • Changed XSD duration to an FB type that uses saner syntax [[HH:]MM:]SS
2012-10-10
Older factory release
1.19.001 (Wilhelmina)
Config:XSD Doc
Manual:PDF HTML

Release notes from Factory release 1.18.001 to Factory release 1.19.001

  • Factory release needed for chipset variant at factory

L2TP

  • Incorrect fragmentaion of locally generated IPv6 packets sent via L2TP, fixed

OSPF

  • Started work on OSPF

RADIUS

  • RADIUS auth request sending NUl CUI as per RFC4372

Web control pages

  • autocomplete off on entry for OTP data
  • Moved Log to separate main menu entry

XML Config

  • Final XSD validation tidy
2012-09-15
Older factory release
1.18.001 (Vanessa)
Config:XSD Doc
Manual:PDF HTML

Release notes from Factory release 1.17.001 to Factory release 1.18.001

  • Draft documentation included in releases

BGP

  • New filter option to check for community present in a route
  • Showing BGP route details shows additional community tags as well
  • Fix for BGP config where local IP is DHCP, meaning BGP did not start up unless a local-id was set
  • Fix BGP import/export filtering which only considered first match rule
  • Allow use of pad on BGP peer if add-own-as set, even on ibgp
  • new use-vrrp-as-self (default true) means the next hop used in BGP will use an appropriate VRRP address if possible
  • Ignored received announcments treated correctly as a withdrawal
  • Corrected BGP ingress filtering to allow detagging the standard community tags
  • Made BGP next hop logic consider routes to dead end and to network as non feasible (previously they were feasible but could not route)
  • Fixed config to only allow one list of import and one list of export rules under bgp peer, as only first in list was checked anyway

CQM

  • Fix for long term shapers which only worked if sharing of shaper was set
  • Graphs show min and max rate limit per hour now
  • More corrections on long term shaper logic
  • Long term shapers were not actually applying the shaper limit, it seems, even if worked out correctly
  • Changed min line on graph to be dotted

DHCP

  • Fix for possible lock up causing watchdogs in some cases
  • Internal change to try and resolve issue where DHCP has been seen to cause a lock up and watchdog on some systems

DNS

  • DNS resolver no longer caching SOA as it was not expanding the MNAME/RNAME fields correctly
  • DNS server now ignores expired DHCP allocations

Ethernet

  • Added layer 2 interface mapping function (map port/VLAN to port/VLAN directly no session track or firewall)
  • Fix for linked ports including port 0

IP

  • Added ARP/ND link state test to work at subnet level
  • Made Wake on LAN a separate diagnostic and linked to DHCP
  • Internal change to avoid possibility of recursive tunnelling overrunning buffer space

IPv6

  • Fix for ND responses for FE80::/10 LL addresses matching our MAC prefix (we answered all requests even if specific MAC not in use)
  • Adjusted routing for FE80::/10 so all interfaces are equal metric to locate LL endpoints

L2TP

  • Change relayed L2TP session stats to be consistent with non relayed by counting only IP and not LCP, etc.
  • L2TP status showing an accounting session ID even when not using RADIUS accounting, useful for pcap
  • Adjusted length of called number field and improved PAP L2TP relay details
  • Better status report for back to back sessions
  • Correct NSN RADIUS parameters in platform RADIUS

OS

  • Improved watchdog error reporting
  • Further improvement to watchdog panic diagnostic
  • Avoid 0000fff8 ECC panic when upgrading from older s/w

PPP

  • Adjusted LCP restart logic to restart LCP if far end persists in restarting
  • Allow far end to refuse magic number negotiation

PPPoE

  • Linked status page from PPPoE to L2TP

SNMP

  • Added some IfXEntry SNMP values

VRRP

  • Changed default startup delay to 60 seconds as usually more sensible and should not cause any harm

Web config

  • Tweak class for cqm images in css

Web control pages

  • Set larger input box size on web diagnostic tools
2012-06-02
Older factory release
1.17.001 (Uriana)
Config:XSD Doc

Release notes from Factory release 1.16.001 to Factory release 1.17.001

  • This release includes additional memory checking - any problems, contact support
  • Updated documentation

BGP

  • LNS allowing full table
  • Corrected AS list in show routes to handle multiple sequences (was showing with no separator)

CLI

  • Fix obscure race condition which may cause panic when logging to command line (console).

Config

  • Removed redundant fast-reboot options

CQM

  • Corrected URL processing for CQM where using x=value/x=value type syntax
  • Change to ping scan and cqm polling functions to be more aligned to real time seconds, ready for when we do NTP fully

DHCP

  • Corrected tool tips on Kill/Unlock

L2TP

  • RFC4818 Delegated-IPv6-Prefix support added - see RADIUS documentation for how this is used.
  • Complex bug with IPv6 routed via IPv6 gateway that is routed via an L2TP over IPv4 and generating an ICMP error causing a crash - fixed

Logging

  • Removed unused log types for SNMP trap (will move to profiles) and SMS (may be added later)

NTP

  • Added option to set ntp poll rate, will be removed/changed when we do NTP fully.

OS

  • More details in thread statistics report
  • Scrub RAM after ECC errors.

Profiles

  • Clarified wording for and, or, and not, tests in profiles
  • Clarified meaning of timeout and recover as times not number of tests

RADIUS

  • Reinstated platform RADIUS accounting handling and relay (missing since 1.13.111)

Web control pages

  • New CSS - especially on config edit pages
2012-05-12
Older factory release
1.16.001 (Titania)
Config:XSD Doc

Release notes from Factory release 1.13.001 to Factory release 1.16.001

  • Change to persistent data storage logic and timing

BGP

  • Correct BGP route tie break where one route has MED set and one does not. No MED set is now treated as MED 0 correctly
  • Minor adjustment in graceful restart logic (not yet advertised)
  • Fixed long delay rebooting when BGP active
  • Colours on BGP status on web page

Config

  • Fixed factory default config for dns host name my.firebrick.co.uk - this means a new factory release of code.
  • Corrected parsing of an IP using final :: in place of :0 (i.e. seemed to have too many colons)
  • Not generating initial or trailing :: on IPv6 addresses where only one block replaced

DNS

  • DNS resolver negative caching handling and tweaks to handle VoIP DNS lookups where CNAME used
  • Corrected negative caching timings

Flash

  • Image priority tagging removed. Flash contents display shows penalty but no longer priority.
  • Change to flash block allocation strategy to spread block usage.

L2TP

  • Changed IPv6 padding to be more generic padding of any packet that looks too short and under 73 bytes so works with IPv6 over LCP on BT 20CN lines
  • Changed DHCPv6 served timing for L2TP
  • Added RADIUS option to avoid LCP restart on mismatched MRU
  • Corrected sending MTU in RADIUS auth (could be sent twice in some cases)
  • Allowing up to 64 byte CHAP challenge size in proxy auth

Logging

  • Better wording for missed log entries

Ping

  • Not trying to print reverse DNS on ping command while waiting DNS response

Ports

  • Avoid spurious port down messages at startup.

PPPoE

  • Config change losing external PPPoE IPv6 address from routing
  • Fixed IPv6 prefix delegation timeout issue
  • Issue with IPv6 DNS servers not working on a second PPPoE client connection if same as previous

Profiles

  • Fixed bug - a ping profile with no routing to send the ping was causing buffer loss
  • Possible problem in ping profiles could result in a watchdog failure

RADIUS

  • Corrected RADIUS tagging on NSN parameters in platform radius.
  • Work on RADIUS accounting to get better stats in case of pre-empted session
  • RADIUS accounting refernce could change some time after reboot depending on clock setting, fixed
  • Fix buffer leakage if RADIUS servers time out

Time

  • Added very simple sanity check to SNTP clock setting, and logging to right place
  • Logging IP from which clock was set

VoIP

  • Ignoring silly almost empty SIP packets from gigaset (some NAT thing)
  • Adjust for restart of LCP on PPP happening when non 1500 MTU proxied negotiation

VRRP

  • Fix issue if two separate VRRP configs used with same VRID one for IPv4 and one for IPv6

Web and CLI control

  • Added hard reboot option

Web control pages

  • Session list copes better if you stop the browser while displaying
  • Typo in web config for dns-host/block
  • Format of manual image upload UI page changed in line with auto update.
  • Avoid unnecessary invocation of bootloader when system reboot is requested

Web status pages

  • Fix session table display lockup
2012-04-27
Older factory release
1.15.001 (Sophia)
[Withdrawn]
Config:XSD Doc
This release has been withdrawn.

Release notes from Factory release 1.13.001 to Factory release 1.15.001

  • Change to persistent data storage logic and timing

BGP

  • Correct BGP route tie break where one route has MED set and one does not. No MED set is now treated as MED 0 correctly
  • Minor adjustment in graceful restart logic (not yet advertised)
  • Fixed long delay rebooting when BGP active

Config

  • Fixed factory default config for dns host name my.firebrick.co.uk - this means a new factory release of code.
  • Corrected parsing of an IP using final :: in place of :0 (i.e. seemed to have too many colons)
  • Not generating initial or trailing :: on IPv6 addresses where only one block replaced

Flash

  • Image priority tagging removed. Flash contents display shows penalty but no longer priority.
  • Change to flash block allocation strategy to spread block usage.

L2TP

  • Changed IPv6 padding to be more generic padding of any packet that looks too short and under 73 bytes so works with IPv6 over LCP on BT 20CN lines
  • Changed DHCPv6 served timing for L2TP

Ports

  • Avoid spurious port down messages at startup.

PPPoE

  • Config change losing external PPPoE IPv6 address from routing
  • Fixed IPv6 prefix delegation timeout issue

Profiles

  • Fixed bug - a ping profile with no routing to send the ping was causing buffer loss
  • Possible problem in ping profiles could result in a watchdog failure

RADIUS

  • Corrected RADIUS tagging on NSN parameters in platform radius.
  • Work on RADIUS accounting to get better stats in case of pre-empted session

VoIP

  • Ignoring silly almost empty SIP packets from gigaset (some NAT thing)
  • Adjust for restart of LCP on PPP happening when non 1500 MTU proxied negotiation

VRRP

  • Fix issue if two separate VRRP configs used with same VRID one for IPv4 and one for IPv6

Web control pages

  • Session list copes better if you stop the browser while displaying
  • Typo in web config for dns-host/block
  • Format of manual image upload UI page changed in line with auto update.

Web status pages

  • Fix session table display lockup
2012-04-21
Older factory release
1.14.001 (Rhea)
[Withdrawn]
Config:XSD Doc
This release has been withdrawn.

Release notes from Factory release 1.13.001 to Factory release 1.14.001

  • Change to persistent data storage logic and timing

BGP

  • Correct BGP route tie break where one route has MED set and one does not. No MED set is now treated as MED 0 correctly

L2TP

  • Changed IPv6 padding to be more generic padding of any packet that looks too short and under 73 bytes so works with IPv6 over LCP on BT 20CN lines

PPPoE

  • Config change losing external PPPoE IPv6 address from routing
  • Fixed IPv6 prefix delegation timeout issue

Profiles

  • Fixed bug - a ping profile with no routing to send the ping was causing buffer loss
  • Possible problem in ping profiles could result in a watchdog failure

RADIUS

  • Corrected RADIUS tagging on NSN parameters in platform radius.
  • Work on RADIUS accounting to get better stats in case of pre-empted session

VoIP

  • Ignoring silly almost empty SIP packets from gigaset (some NAT thing)
  • Adjust for restart of LCP on PPP happening when non 1500 MTU proxied negotiation

Web control pages

  • Session list copes better if you stop the browser while displaying
  • Typo in web config for dns-host/block

Web status pages

  • Fix session table display lockup
2012-03-13
Older factory release
1.13.001 (Pandora)
[Breakpoint]
Config:XSD Doc

Release notes from Factory release 1.12.002 to Factory release 1.13.001

  • Increased memory buffer to allow larger code to be uploaded - breakpoint release needed to ensure existing units can load later code

CQM

  • Added additional checkings on CQM shaper sharing to allow for erroneous negative traffic counts

Web control pages

  • Changed graphics for rule lists in firewall - more flowchart like
  • Fixed incorrect showing of "New" when a list of objects is full
2012-03-07
Older factory release
1.12.002 (Ophelia)
[Breakpoint]
Config:XSD Doc

Release notes from Factory release 1.11.004 to Factory release 1.12.002

Config

  • New option on subnet controls if DNS is accepted when acting as DHCP client (default true, obviously)
  • Change of attribute name in dns local records
  • Corrected cqm share-interface on web config to only list ethernet interfaces

CQM

  • Adjusted handling for mismatched speed shared shapers when all reaching limits to balance dropped packets in ratio to share of speed
  • Added Y scale fixing on CQM graphs (Y option)

DHCP

  • Added interface name on DHCP server logging

DNS

  • Local DNS not working for EDNS0 queries including internal lookups, fixed

Factory default

  • Factory default no longer does RA for 2001:DB8:: subnet. Quickstart guide being changed to match

IP

  • Changed broadcast restriction on subnet to only effect externally sourced packets

IPv6

  • Fix default arp timeout on RA client and PD subnets
  • Adjusted IPv6 neighbour announce to set O flag on link local addresses

L2TP

  • Changed source filtering controls of L2TP to allow traffic even if the L2TP route is lower metric (split bonded lines)
  • Changed L2TP to not announce connected routes until IPCP/IPV6CP completes, and added to debug log
  • Added ip-over-lcp to local auth options for inbound L2TP
  • Slightly faster PPP negotiation on L2TP
  • Corrected error code for "Received PPPoE Active-Discovery Terminate from client"
  • pcap of L2TP sessions from start was impacting the negotiation - fixed
  • Changed LNS DHCPv6 code to handle more than one requested PD and serving in order from RADIUS/config

Ping

  • Allow payload size to be specified in ping config and when setting up a ping graph dynamically
  • Allow routing table to be specified in UI graph ping setup
  • Prevent dynamic ping start/stop affecting a configured ping

PPP

  • PPP LCP restart on unexpected IPCP, IPV6CP, CHAP or PAP

PPPoE

  • ip-over-lcp on PPPoE now defaults to "auto" which means it is set if it receives IP over LCP
  • Fixed BRAS L2TP/PPPoE mode to correctly cope with ip-over-lcp setting
  • Added MAC address to PPPoE logging
  • Fixed debug logging of PPP negotiation in PPPoE BRAS mode
  • Faster PPP negotiation PPPoE
  • Better error reporting on PADT messages
  • Cleaner PPPoE shutdown in BRAS mode on reboot (not accepting PADI after shutdown starts)
  • Fixed bug in L2TP/PPPoE/BRAS mode when session ID exceeded 255
  • Added first stages of PPPoE prefix delegation for IPv6 for testing (not yet doing IA or DNS, just PD)
  • Changed pd-interface on PPPoE to default to "auto" meaning interfaces without existing RA serving prefixes
  • Fixed PPPoE/DHCPv6 to handle more than one prefix delegation correctly
  • Handling local IPv6 by DHCPv6 on PPPoE
  • Handling IPv6 DNS by DHCPv6 on PPPoE
  • IPv6 DNS by DHCPv6 on PPPoE now addig /128 route consistent with IPv4 DNS
  • PPPoE/DHCPv6 PD times requested now more sensible, not infinite
  • Further PPPoE timing improvements
  • Corrected lifetime on router announcement from prefix delegation - was sending infinite
  • Better handling where no IA returned in DHCPv6 but PD is returned
  • Corrected log and log debug operation for PPPoE
  • Additional security checking on DHCPv6 client used in PPPoE
  • PPPoE not working if no IPv6, doh, fixed

Web control pages

  • Changed http access controls so that trusted IPs are allowed even when not on local subnet
  • Added payload size to ping command
  • Corrected copyright date now we are in 2012
  • Added Wake-on-LAN option to Ping and link from DHCP web pages
  • Much more description and instructions on OTP/OATH settings page
  • Added kill and refresh to PPPoE status page
  • Changed to allow an interface to be defined with no subnets (now that PD could be the source of a subnet)
  • Improve error message on null image file upload
  • Improve layout of Graph PNG page
  • Improved help text on dhcp server settings
  • Login page shows your IP
  • Diagnostics access check default to using your IP that is accessing the web pages
2012-03-07
Older factory release
1.12.001 (Narcissa)
[Withdrawn]
Config:XSD Doc
This release has been withdrawn.

Release notes from Factory release 1.11.004 to Factory release 1.12.001

Config

  • New option on subnet controls if DNS is accepted when acting as DHCP client (default true, obviously)
  • Change of attribute name in dns local records
  • Corrected cqm share-interface on web config to only list ethernet interfaces

CQM

  • Adjusted handling for mismatched speed shared shapers when all reaching limits to balance dropped packets in ratio to share of speed
  • Added Y scale fixing on CQM graphs (Y option)

DHCP

  • Added interface name on DHCP server logging

DNS

  • Local DNS not working for EDNS0 queries including internal lookups, fixed

Factory default

  • Factory default no longer does RA for 2001:DB8:: subnet. Quickstart guide being changed to match

IP

  • Changed broadcast restriction on subnet to only effect externally sourced packets

IPv6

  • Fix default arp timeout on RA client and PD subnets
  • Adjusted IPv6 neighbour announce to set O flag on link local addresses

L2TP

  • Changed source filtering controls of L2TP to allow traffic even if the L2TP route is lower metric (split bonded lines)
  • Changed L2TP to not announce connected routes until IPCP/IPV6CP completes, and added to debug log
  • Added ip-over-lcp to local auth options for inbound L2TP
  • Slightly faster PPP negotiation on L2TP
  • Corrected error code for "Received PPPoE Active-Discovery Terminate from client"
  • pcap of L2TP sessions from start was impacting the negotiation - fixed
  • Changed LNS DHCPv6 code to handle more than one requested PD and serving in order from RADIUS/config

Ping

  • Allow payload size to be specified in ping config and when setting up a ping graph dynamically
  • Allow routing table to be specified in UI graph ping setup
  • Prevent dynamic ping start/stop affecting a configured ping

PPP

  • PPP LCP restart on unexpected IPCP, IPV6CP, CHAP or PAP

PPPoE

  • ip-over-lcp on PPPoE now defaults to "auto" which means it is set if it receives IP over LCP
  • Fixed BRAS L2TP/PPPoE mode to correctly cope with ip-over-lcp setting
  • Added MAC address to PPPoE logging
  • Fixed debug logging of PPP negotiation in PPPoE BRAS mode
  • Faster PPP negotiation PPPoE
  • Better error reporting on PADT messages
  • Cleaner PPPoE shutdown in BRAS mode on reboot (not accepting PADI after shutdown starts)
  • Fixed bug in L2TP/PPPoE/BRAS mode when session ID exceeded 255
  • Added first stages of PPPoE prefix delegation for IPv6 for testing (not yet doing IA or DNS, just PD)
  • Changed pd-interface on PPPoE to default to "auto" meaning interfaces without existing RA serving prefixes
  • Fixed PPPoE/DHCPv6 to handle more than one prefix delegation correctly
  • Handling local IPv6 by DHCPv6 on PPPoE
  • Handling IPv6 DNS by DHCPv6 on PPPoE
  • IPv6 DNS by DHCPv6 on PPPoE now addig /128 route consistent with IPv4 DNS
  • PPPoE/DHCPv6 PD times requested now more sensible, not infinite
  • Further PPPoE timing improvements
  • Corrected lifetime on router announcement from prefix delegation - was sending infinite
  • Better handling where no IA returned in DHCPv6 but PD is returned
  • Corrected log and log debug operation for PPPoE
  • Additional security checking on DHCPv6 client used in PPPoE

Web control pages

  • Changed http access controls so that trusted IPs are allowed even when not on local subnet
  • Added payload size to ping command
  • Corrected copyright date now we are in 2012
  • Added Wake-on-LAN option to Ping and link from DHCP web pages
  • Much more description and instructions on OTP/OATH settings page
  • Added kill and refresh to PPPoE status page
  • Changed to allow an interface to be defined with no subnets (now that PD could be the source of a subnet)
  • Improve error message on null image file upload
  • Improve layout of Graph PNG page
  • Improved help text on dhcp server settings
  • Login page shows your IP
  • Diagnostics access check default to using your IP that is accessing the web pages
2012-02-27
Older factory release
1.11.004 (Melissa)
Config:XSD Doc

Release notes from Factory release 1.10.001 to Factory release 1.11.004

BGP

  • Adjusted RR logic on BGP to avoid incorrect messing with next hop decision
  • Changed BGP to silently ignore routes where we are already the next hop
  • BGP change to still process withdraw in same packet as silently ignored routes (typically if using route reflectors)
  • Added peer level export-med to set MED on exported routes (unless explicitly set in export filter) as this is commonly the only export filter
  • Made local routes (apart from dead-end) take priority over equivilant BGP originated routes
  • Changed ttl-security option to be 1 to 127, and use -ve as meaning force TTL sending and no checking
  • Added import-localpref at peer level as a common global setting on EBGP links
  • Obscure race condition on BGP shutdown could cause a crash

CLI

  • Fix telnet timout on users setting timeout 0 to not logout.
  • Implement several readline-style line-editing sequences
  • Add two more control sequences - Ctrl-T and Alt-T
  • Added "show power status" command - same action as "show fan status"

Config

  • IMPORTANT - make sure all interface definitions state the port to use before upgrading
  • Documented that a login timeout of 0 means no timeout but not in ip-group users
  • Mandatory port on interface. Missing port on interface picks first port else creates a fatal error

Console

  • Serial login did not work if user has an allow list for IP access

DHCP

  • Added new lock and unlock feature on DHCP allocations
  • Added ability to manually set the name of DHCP allocations

DNS

  • Added new feature under services/dns to allow local DNS responses including based on DHCP

Factory default

  • Changed factory reset to have my.firebrick.co.uk as local DNS for the firebrick itself

Factory Reset

  • Changed so factory reset is DHCP client on WAN and DHCP server on LAN

General

  • Various additional debugging code added

IPv6

  • Adjust handling of RA client to cope when more than one RA has same SLLA (e.g. VRRP) from different hosts

L2TP

  • Added more debug logging on L2TP tunnels, especially relating to relaying

Logging

  • Changed power failure event to log a simple message rather than panic
  • Improved formatting of replay from previous run flash log on boot up

PPPoE

  • PPPoE server (BRAS mode) was broken, fixed
  • Added return of Relay-Session-Id received in PADO to PADR sent
  • Adjusted PPPoE logging so as not to fill logs with requests that are not for us

SNMP

  • Fix BGP and L2TP SNMP stats where values 128 to 255 and 32768 to 65535 reported as negative

Web control pages

  • Fix issue with some links on Chrome viewing BGP peers
  • Typos fixed in config
  • Incorrect HTML typo fixed in some tables
  • Tidy layout of platform radius controls
  • Tidy help on rule log settings
  • Correct various typos
  • Changed filenames for XML save to be more sensible
  • Clearer warning of active sessions on reboot and s/w upgrade pages
  • Fixed case where showing tables of information not right if a list of routes also shown
  • "Up to date" may have been erroneously displayed on Software Upgrade page - fixed.
  • First config save from factory reset was not working, fixed
  • Some more colours on tables
  • Fix links for ND entries that upset some browsers
  • Additional logic for getting L2TP session data using circuit ID in URl

Web pages

  • Hovering on a link now underlines it

Web status pages

  • Added new System submenu
  • Web status pages can now be seen by users with access level >= USER
  • Button to clear thread tick counts added to thread statistics page (for users with ADMIN access)
2012-01-24
Older factory release
1.10.001 (Katya)
Config:XSD Doc

Release notes from Factory release 1.08.001 to Factory release 1.10.001

BGP

  • Vendor specific SNMP for BGP status

CQM

  • Correct for rare race condition leading to multiple graphs of same name

DHCP

  • Clear DHCP command now allows range/prefix to clear multiple entries
  • Option to kill a DHCP allocation from web interface (DHCP status) now
  • Change handling of BOOTP to operate as a REQUEST not DISCOVER so causing allocation of lease

Flash

  • Avoid flash fragmentation by deleting old images if necessary before saving new image.

L2TP

  • Internal change to RADIUS handling to reduce risk of watchdog under heavy load
  • Updated RADIUS to abort authentication request if session closed to reduce load if slow auth replies
  • Better "clear l2tp all", depending on speed of RADIUS accounting
  • Vendor specific SNMP for L2TP status
  • Added min-retry as a minimum session time before retrying an outgoing L2TP connection (default 10 seconds)
  • New platform RADIUS logic

Shaping

  • Fix incorrect handling of (legacy) tx-interval on shaper

SNMP

  • SNMP now has extra logical interfaces which are all named shapers in order, including relevant stats for a shaper.
2012-01-18
Older factory release
1.09.001 (Jacynth)
[Withdrawn]
Config:XSD Doc
This release has been withdrawn.

Release notes from Factory release 1.08.001 to Factory release 1.09.001

BGP

  • Vendor specific SNMP for BGP status

DHCP

  • Clear DHCP command now allows range/prefix to clear multiple entries
  • Option to kill a DHCP allocation from web interface (DHCP status) now
  • Change handling of BOOTP to operate as a REQUEST not DISCOVER so causing allocation of lease

L2TP

  • Internal change to RADIUS handling to reduce risk of watchdog under heavy load
  • Updated RADIUS to abort authentication request if session closed to reduce load if slow auth replies
  • Better "clear l2tp all", depending on speed of RADIUS accounting
  • Vendor specific SNMP for L2TP status

SNMP

  • SNMP now has extra logical interfaces which are all named shapers in order, including relevant stats for a shaper.
2012-01-09
Older factory release
1.08.001 (Isadora)
[Breakpoint]
Config:XSD Doc

Release notes from Factory release 1.07.001 to Factory release 1.08.001

  • Auto upgrade software not done if new software already in flash, stops a crash causing a loop.
  • Better error message on ip group name syntax check
  • Added link to upload new config on factory reset screen
  • Added link to upload new config on soft factory recovery screen

CLI

  • Changed show [bgp] route command to list where each route is directed.
  • Allow abort by pressing a key on the show routes command.
  • Tidied show dhcp command

CQM

  • CQM graphs now in alphabetic order
  • Shaper sharing system
  • Hourly rate line on CQM graphs

DHCP

  • Internal change to handling of DHCP server when searching for a suitable IP

FB105-config

  • Convertor making more sensible names for things like "24-7"

Firewall

  • Improved traceroute through mapped IPs

L2TP

  • Increased negotiation sessions to 4096
  • Made payload-table consistent - now defaults to 0 not (in some cases) "same as table"
  • Faster session clearing when using clear all
  • IP over LCP sending as RADIUS controlled flag (filter C)
  • Not picking L2TP endpoint as our IP if cross table tunnel - picks any IP from a subnet on same table
  • Added return of Proxy-State in platform RADIUS response
  • Added Tunnel-Medium-Type (IPv4/6) in platform RADIUS response
  • Added optional Juniper Context-Name response in platform RADIUS response (for BT 20CN session steering)
  • Added username hash based Tunnel-Preference in platform RADIUS response
  • Recognise BT specific "Subscriber provisioning failed" error and send clear cause 15 on RADIUS
  • More options for ordering the response on platform RADIUS
  • Faster LCP conf req on l2tp connect with no LCP
  • Additional debug added in L2TP/RADIUS code

PPP

  • IP over LCP rx handling added. I.e. LCP with code 4X or 6X assumed to be IP.

Profiles

  • initial state of profile with set="..." now uses that setting not initial="..." value

RADIUS

  • Fix platform radius proxy state return issue affecting relayed platform radius

Web control pages

  • Added reboot link to web pages, in "status" section for ADMIN level or higher
  • Added VRRP masters count to pre-shutdown message for reboot and s/w updates
  • Added new form for pcap dumping to file from browser (/pcap/)

XML

  • XML checking recognises that an empty list is not valid on a mandatory attribute
  • XML checking no longer reports issues with schemaLocation - they are now ignored
2011-11-15
Older factory release
1.07.001 (Hermia)
Config:XSD Doc

Release notes from Factory release 1.06.004 to Factory release 1.07.001

  • Does not auto update and reboot if in factory reset recovery state

CLI

  • New show routes command not BGP specific
  • Show dhcp command layout fix

DHCP

  • DHCP client sets /32 routes for DNS servers provided

L2TP

  • Pressing a key on telnet command "clear l2tp all" stops clearing lines.
  • Increased L2TP neg slots to 1024
  • Support for RADIUS Framed-IP-Netmask mapped to L2TP PPP IPCP NETMASK (144)
  • L2TP client mode asks for DNS on PPP
  • Config change was unnecessarily restarting some L2TP sessions
  • L2TP failed tunnel timout reduced from 5 minutes to 1 minute
  • L2TP error response on duplicate tunnel ID to try and manage restart case better
  • Better logging of unexpected L2TP SCCRQ
  • Issue with L2TP clients when no hostname and no local system name configured

Web control pages

  • Using web interface diagnostics/routing could cause a crash
  • Showing associated routes on subnets, dongles, PPPoE, etc.
2011-11-03
Older factory release
1.06.004 (Gemini)
Config:XSD Doc

Release notes from Factory release 1.05.001 to Factory release 1.06.004

  • Added memory usage to one second stats
  • Possible obscure issue with DHCP server code fixed - probably only when default dhcp server user (i.e. ip not set)
  • Added new show status command on telnet, and reformatted web status page
  • Ethernet port status shown on FB6000 now

CQM

  • Bug if graphs trying to scale to just under 4Gb/s, showed scaled at bottom end in error. Fixed.
  • Not including old (off screen) rate changes in max scale on graphs

DHCP

  • Additional options in DHCP client
  • Changed DHCP server to serve bricks IP as DNS server allowing it to relay, unless explicit servers set in config

Ethernet

  • Changed autoneg setting on ethernet ports to default to false if manually setting speed or duplex and not 1G

L2TP

  • Changed L2TP logging so relay sessions have same logging as incoming session at the time
  • L2TP config change was clearing tunnels if not using a hostname setting
  • Changed logic for logging L2TP to try and ensure relayed sessions log correctly
  • L2TP relay was dropping first packets exchanged
  • Periodic RADIUS accounting was incorrectly showing timestamp less any current dropped packets which could cause a slight discrepancy
  • Change of field name (username) not preserving old field (user-name) in l2tp-relay, fixed

Logging

  • Log email sending retry logic changed
  • Added much more debug for log-debug for logging email sending

Ping

  • Ping graphs can now use a host name

PPPoE

  • Default if no route= set to also set /32s to DNS servers as well as default route

RADIUS

  • L2TP RADIUS for PAP was using cleartext password as message auth (16 byte), changed to random.

Syslog

  • Added additional information to emailed logs

VRRP

  • Deleting an interface which VRRP master caused a crash

Web control pages

  • Improved lists of objects with sub objects present in config editor
  • General change to css, layout and menus, and new options for menu/banner controls
  • Extra information on DHCP client status page (subnets)
  • Change to allow you to stay logged in when clock first sets
  • Home page shows if system name is not set is this really should always be set, but is not actually a mandatory field
2011-11-02
Older factory release
1.06.001 (Gemini)
[Withdrawn]
Config:XSD Doc
This release has been withdrawn.

Release notes from Factory release 1.05.001 to Factory release 1.06.001

  • Added memory usage to one second stats
  • Possible obscure issue with DHCP server code fixed - probably only when default dhcp server user (i.e. ip not set)
  • Added new show status command on telnet, and reformatted web status page
  • Ethernet port status shown on FB6000 now

CQM

  • Bug if graphs trying to scale to just under 4Gb/s, showed scaled at bottom end in error. Fixed.
  • Not including old (off screen) rate changes in max scale on graphs

DHCP

  • Additional options in DHCP client
  • Changed DHCP server to serve bricks IP as DNS server allowing it to relay, unless explicit servers set in config

Ethernet

  • Changed autoneg setting on ethernet ports to default to false if manually setting speed or duplex and not 1G

L2TP

  • Changed L2TP logging so relay sessions have same logging as incoming session at the time
  • L2TP config change was clearing tunnels if not using a hostname setting
  • Changed logic for logging L2TP to try and ensure relayed sessions log correctly
  • L2TP relay was dropping first packets exchanged
  • Periodic RADIUS accounting was incorrectly showing timestamp less any current dropped packets which could cause a slight discrepancy

Logging

  • Log email sending retry logic changed
  • Added much more debug for log-debug for logging email sending

Ping

  • Ping graphs can now use a host name

PPPoE

  • Default if no route= set to also set /32s to DNS servers as well as default route

RADIUS

  • L2TP RADIUS for PAP was using cleartext password as message auth (16 byte), changed to random.

Syslog

  • Added additional information to emailed logs

VRRP

  • Deleting an interface which VRRP master caused a crash

Web control pages

  • Improved lists of objects with sub objects present in config editor
  • General change to css, layout and menus, and new options for menu/banner controls
  • Extra information on DHCP client status page (subnets)
  • Change to allow you to stay logged in when clock first sets
  • Home page shows if system name is not set is this really should always be set, but is not actually a mandatory field
2011-09-22
Older factory release
1.05.001 (Filippa)
Config:XSD Doc

Release notes from Factory release 1.03.001 to Factory release 1.05.001

ARP

  • Internal adjustment to queued packets waiting on ARP

BGP

  • Stopped announce of FE80::/10 when subnet has bgp="true"
  • No longer logging full BGP packet when discarded due to !allow-own-as or allow-only-their-as
  • Added additional per peer counters for ignored and filtered incoming updates

CLI

  • The show flash log command is now available to admin users
  • Added new command line to clear data pages in flash

Diagnostics

  • Tidy up the traceroute command to allow more than one attempt per hop, and some bug fixes
  • Access list check (command and web UI)

Documentation

  • Started work on addition information on config documenation

Factory default

  • Made factory default have local-only set true on http access

FB105-config

  • Various corrections to config convertor for latest releases
  • Improved fb105 config conversion for VLAN handling

Logging

  • Possible fix to issue causing occasional unexplained crashes
  • Bug where viewing logs on web pages could cause crash, fixed
  • Removed hex dump debug log of DHCPv6 - as cluttred interface debug logs and better done using pcap

PPPoE

  • Additional logging of PPPoE PAP/CHAP response message even if failed

Services

  • Added new access check for local-only on services. IMPORTANT - defaults to true for telnet, dns, timed, so you will need to set to false if you want remote access to these

SNMP

  • snmp was not access locked to routing table, fixed

Web control pages

  • Removed WebSite link as caused confusion, and made footer have link to FB website
  • Added configurable links on home page and fb105 conversion
  • Added optional CSS URL allowing customisation of control pages
  • Added ping/traceroute on web interface
  • Ping and traceroute now separate diagnostics
  • Show route now on web diagnostics menu
  • Web config edit has more information shown now, and change to some spacing.
  • Missing titles on lists of blackhole and nowhere routes
2011-09-09
Older factory release
1.03.001 (Dimity)
Config:XSD Doc

Release notes from Factory release 1.01.002 to Factory release 1.03.001

  • TCP floods (e.g. http) could cause crash, fixed

Config

  • Changed default config - using LAN and WAN as interface and port group names and added more comments

L2TP

  • Changed to not debug log PAP passwords at all, but showing length of data sent (so length of password)

Logging

  • Documentation updated, and console log off/on commands now TROFF and TRON
  • log-starts logs start and stop of stats logging
  • Occasional crash in logging when lots of information is logged.

Profiles

  • Changed wording on logs for inverted profiles

Routing

  • Possible issue with watchdog failure being addressed

Web control pages

  • Heading on web logs saying which log report shown
  • Subnets listed in order
  • Icons redrawn
  • Changed page title to list name before serial
  • Manual s/w upgrade looks nicer now
  • Graph names as text on graphs list to allow searching in browser
  • Corrected icons for rule-set
  • Tweak factory reset menu
  • Additional per second stats for http access counts
  • Adjust timing on status check to try and ensure we see new s/w first time
2011-09-04
Older factory release
1.01.002 (Bryony)
Config:XSD Doc

Release notes from Factory release 1.00.001 to Factory release 1.01.002

Config

  • Increase internal storage for config by 33%
  • Password now mandatory on user field, and error if blank and not using OTP
  • Added extra notes on localpref to explain highest value wins
  • Minor change to wording on web config
  • Added <blackhole.../> and <nowhere.../> as explicit routing objects rather than using <route.../> with no gateway.
  • as-path only on network object as was not in fact functional on route object
  • IPv6 addresses use lower case when output as a config view.

DHCPv6

  • Rebind handling corrected (was being ignored)

Documentation

  • Corrected description of interface object

FB105-config

  • Timezone fixes on config convertor

L2TP

  • Fixed DHCPv6 issue on L2TP which was only working on session numbers below 4096
  • Incorrect logging of LCP Init Rx, Last Rx, and Last Tx, fixed
  • Improved logging where incorrect length proxy challenge or response received on L2TP connect
  • Added extra checking on L2TP packets where hidden fields could encode invalid length
  • Made error for bad hidden field length non fatal - investigating how this is happening
  • Hidden fields stopped working on L2TP tunnels after two config changes after tunnel was established, fixed
  • Some internal rework of L2TP code, and answering ICMPV6 router solicitations over L2TP
  • Adjusted IPv6 RA for L2TP - now send periodically if IPv6 router solicitation previously received
  • Logging of CHAP accept/reject showed wrong length (correct length was being sent)

Logging

  • Adjusted email log sending to use CR+LF on all contents lines as per RFC2821, rather than just LF as is convention on linux system
  • Fix for rare case causing crash after emailing a log.
  • Email has boot date/time in text at top now
  • Emailed logs were re-sent on every config change, fixed
  • Changed syslog to use UDP non encrypted RFC5424 logging with microsecond precision. Affects all log lines as module name added
  • Added option to specify source IP for syslog messages

pcap

  • Added more useful error messages for malformed pcap requests
  • Can now use pcap to log l2tp session from the start based on calling line id, see documentation for details
  • PCAP giving better error messages

Ping

  • Ping setting on interface was not always starting the pings, and not stopped when config removed. Fixed

Profiles

  • Changed logic so "or" profile with no other settings and none of the "or" profiles match will fail not pass.
  • Corrected timeout/recovery logic
  • Added initial-state option on profiles
  • Profiles tracking ppp did not spot if a PPP went off because it was itself turned off by profile config
  • Changed logging for profiles so "still active" and "still inactive" logs are log-debug now

Routing

  • Correctly sending ICMP errors for dead end routes
  • Routing loop detection improvements
  • Minor change to internal routing/ARP cache functions to test a specific bug report.

TCP

  • TCP test port (4242) removed
  • Increased number of active TCP sessions

VRRP

  • VRRP use-vmac default changed to true

Web control pages

  • Changed headings on config edit boxes
  • Changed the sequence when downloading new code
  • Automatically redirects to status page after a short delay when new s/w loaded
  • Less margins on web pages
  • Changed breadcrumbs in UI to use :: not : as spacing, consistent with website
  • Slight changes to layout of software upgrade pages
  • Made breadcrumbs larger and easier to read
2011-08-01
Older factory release
1.00.001 (Yves)
Config:XSD Doc

Release notes from Factory release 0.11.002 to Factory release 1.00.001

  • Launch release

Authentication

  • Users can now be restricted to a routing table.

Config

  • Subnet mtu states default based on interface.
  • Max portdef now 2, not 5.

Documentation

  • Alphabetic order for documentation of config.

L2TP

  • L2TP stack adjust
  • Possible bug with DHCPv6 on L2TP fixed

PPPoE

  • LCP negotiation now logged as log-debug
  • Did not do multiple PPP sessions on different ports if same session ID was being used, fixed

Profiles

  • Tidy wording on profile changes for new invert feature
  • Selecting fb105, ppp, route, and, or, vrrp, that have no entries now gives an error
  • Did not work checking vrrp state
  • Ping via explicit gateway now bypasses session tracking

VRRP

  • VRRP now has a default ID (42)
  • Now accepts DNS requests to VRRP address
  • DHCP now giving VRRP address as default DNS server not specified and not resolvers defined and VRRP is in use.
  • VRRP now has default VRID and the field is now optional

Web control pages

  • Changed "Subnet" icon to "Interface"
  • Timeout while editing config on web pages now fixed
  • Updated the link/message for s/w upgrades on status pages
  • Minor typos/changes on upgrade web page
  • Explains that routes with no gateway are blackhole routes.
  • Layout of share on rules tidied and comment field added.
  • route-override layout tidied.
  • List headings tidied.
  • Layout of DHCP server settings improved.
  • Platform RADIUS config tidied.
  • Subnet ttl now a hidden field.
  • Added some colour to lists of things in UI to make columns clearer.
  • Some help text improved.
  • Help link on config edit.
  • Tool tip on protocol says 1=ICMP, 6=TCP, 17=UDP
  • Add and Edit only on lists where order matters, else just Add at end.
  • Confirmed help link working in Web config edit
  • Profile link was not showing on status
  • Web config: Save and Cancel buttons.
  • Lots of tweaks, mosting UI web config improvements and IE9 support
  • Fix profile layout - was not showing all fields
  • Fix profile layout - was not showing all fields.
  • Static route tidy
  • Not showing bgp attribute by default as not usually relevant
  • Moved PPPoE settings under "Interface" and titled "PPPoE settings"
  • Move Ethernet and Port groups under "Interface"
  • Tidy up of config fields and web config edit
  • Typo in PPPoE status corrected
2011-07-19
Older factory release
0.11.002 (Xavier)
Config:XSD Doc

Release notes from Factory release 0.09.002 to Factory release 0.11.002

  • External logging was stopping after a change of profile state, fixed

VRRP

  • VRRP3 implementation for IPv6 and sub second timing
  • New VRRP3 (IPv4/IPv6) and some bug fixes
  • Some more bug fixes, new web UI in place now, and VRRP3 working.
2011-07-18
Older factory release
0.09.002 (Ulysses)
[Breakpoint]
Config:XSD Doc

Release notes from Factory release 0.08.049 to Factory release 0.09.002

  • test release, extra debug
  • Logs were restarting on config change
  • Odd error messages on reboot which could lead to issues upgrading - fixed

VRRP

  • VRRP logging using new logging system

Web control pages

  • UI updates - including a keep-alive to stay logged in while editing config
  • Change to CSS and layout of tables for comments
  • Major UI edit changes and re-styling
  • Various web UI changed, cache control improvements, not logging out while XML editing
  • Major improvements to web based config edit, and various minor enhancements
2011-07-08
Older factory release
0.08.049 (Sherlock)
[Breakpoint]
Config:XSD Doc

Release notes from Factory release 0.08.001 to Factory release 0.08.049

  • Test low level changes to ethernet PHY communications timeout management to handle possible race conditions
  • Fixed DHCP issue which stopped reuse of expired allocations
  • New logging system started - not finished yet
  • new logging systeme started - some more work needed
  • New logging started
  • New logging system now handling email, more work to do but should be a safe build to try
  • New logging doing email better now
  • Corrected picking up MX 0 for emailed logs
  • Logging changes, and slight adjustment to BGP origin
  • Test build - may not be totally safe
  • Test build
  • Improved session logging
  • Various improvements since last beta

L2TP

  • Error on hidden fields over 30 characters on L2TP messages, fixed
  • Corrected M bit on some sent L2TP AVPs for relayed L2TP
  • Source filtering control mon RADIUS for L2TP
2011-06-07
Older factory release
0.08.001 (Randolph)
[Breakpoint]
Config:XSD Doc

Release notes from Factory release 0.06.001 to Factory release 0.08.001

  • Factory release
  • Testing change to LCP echo timeout in case of major issues
  • Change for possible issue with fragments crashing session tracking code
  • More detailed controls of LCP echo rate and timeout per session. slow-poll deprecated
  • LCP rate and timeout per session in seconds, and change the timestamp on RADIUS stop to be last LCP response
  • Sending tunnel incoming name as Tunnel-Client-End in RADIUS access request and accounting to help track connections
  • Test build of NAT checksum changes
  • New CHAP-Password RADIUS response for tunnel relay password override
  • Corrected web/cli stats for outgoing sessions
  • Minor changes, and some experimental extra interface counters on SNMP.
  • Added SNMP (unwalkable) extra interface stats of IPv4 and IPv6 specific data. .410 and .610 for IPv4/Ipv6 of .10, and same for .11, .16 and .17
  • tidied up multiple request SNMP
  • Corrected LNS damping issue
  • Fix for remote-ip in matching rules on l2tp
  • Fix config bug, and wrap up recent l2tp match relay syntax changes
  • Test build, correcting some documentation
  • Minor changes to l2tp commands
  • Test build for Ben
  • Candidate factory release
  • Canditate factory release

L2TP

  • Extra L2TP NSN conditional setting for GGSN use
  • L2TP status on web interface
  • New local auth options for L2TP, untested
  • Local auth on L2TP tested, added extra debug
  • L2TP Proxy PAP handling
  • L2TP Proxy PAP handling (incoming and relayed)
  • L2TP congestion management (damping) bug fix
  • Shaper updates (mainly for L2TP usage)
  • Changed L2TP match to make relay clearer and local pref allow remote-ip
  • New PPPoE server / BRAS mode for L2TP, and various minor config tweaks
  • Fixes on L2TP command line and addition session and tunnel specific XML http requests for L2TP status
  • L2TP XML http tweak
  • Tidied the URL coding for L2TP http xml requests
  • Additional checks on L2TP status commands
2011-03-11
Older factory release
0.06.001 (Marmaduke)
Config:XSD Doc

Release notes from Factory release 0.02.001 to Factory release 0.06.001

  • Factory release
  • PPP DHCPv6 prefix delegation for initial testing (no DNS yet)
  • Faster reboot time
  • Sending DHCPv6 DNS responses as well
  • config load crashing if FB105 routes on dead tunnel
  • fb105 config causing config edit problem
  • DHCP server error recently introduced now fixed
  • Fixed DHCP client, and reqworked some ARP/ND code
  • Slight changes on IPv6 ND timeouts when no response, and also on IPv6 RA options for M and O bits
  • Corrected ARP issue introduced in previous version
  • Some significant internal changes, but main impact is subtle changes to subnets are now picked up correctly, and you can set gateway=' on a dhcp client to not pick up a gateway now
  • Minor tweaks on DHCP server side
  • Changed config main page layout, tweak to hopefully fix CQM average latency, additional debug added
  • New status reports on web admin pages, more to come
  • minor tidy of new status pages
  • Issue with handling of some reply packets fixed, e.g. DNS resolver function
  • Changes to IPv6 ND handling for FE80::/10 LL addresses, was affecting windows machines
  • Session tracking on web interface
  • Changed source to source-ip in profiles for pinging. Some prototype web config not finished let. Added profiles to FB6202.
  • Minor changes to screen layout and graphics
  • Added new experimental web config editor (for users set to level DEBUG) for testing/feedback
  • Web config initial release
  • IE6 fix for checkboxes
  • Candidate factory release. Also, IPv6CP timeout on PPP.
  • Factory release candidate - new web config
  • Web config not working on all variants, fixed
  • Tidy up of some web config and added profiles to subnets
  • Slight alteration for session tracking and firwalling to an interface where there is no route to host, should mean fewer lingering sessions. Also added special interfaces to web config.
  • Slight alteration for session tracking and firwalling to an interface where there is no route to host, should mean fewer lingering sessions. Also added special interfaces to web config
  • Factory release candidate
  • Test

Authentication

  • OATH/OTP login feature added
  • OATH/OTP update - lockout after failed attempts, etc

L2TP

  • Minor update to tunnel MTU on relayed L2TP
  • Checking fixed on DHCP via L2TP/PPP interface, caused fatal error before
  • Minor change to an L2TP parameter for GGSN use

VRRP

  • Change to handle unexpected VRRP packet via no ethernet interfaces

Web control pages

  • New web based status functions started, subnet list is only one so far
  • Various minor UI changes
2011-01-23
Older factory release
0.02.001 (Inigo)
Config:XSD Doc

No changes reported for this release note.