InstaGate Release Notes - SiteFilter/Usability Update (3/16/2009)
SITEFILTER/USABILITY UPDATE RELEASE NOTESVersion Number: 3.1.20090223***Important Note***If you saved passwords in Internet Explorer or other browsers, they will not work with the new sessions-based authentication. You will be prompted to enter your password in the new form when you log into the new User Interface. If you have forgotten your password this can be reset from the LCD on the front panel of your unit, or through the serial console. You can also reset the password before updating from the System > Administrator Settings page.
Related Articles:Web Security - Admin Override
Web Security - Ignored Domains
Web Security - Authetication Cache
Base System Software - InstaGate - All Models- Update process has been changed so that a check for new software is performed before the installation occurs. If new software is found, it will be downloaded before the install process begins. You won't see the changes take effect until the next update performed.
- The FTP backup/restore process now works with FTP servers based on linux-ftpd.
- The System Information report correctly displays the NAT Table now.
- DHCP Leases report now works when viewing the system information report for network.
- Updated the serial console to prevent a problem with DHCP configuration and network settings that caused system instability.
- The progress bar that displayed during system restarts now works properly.
- The progress bar displayed during software installs has not worked properly since the last general release. This has been fixed but you won't see the changes take effect until the next update.
- When the hostname is changed, some browsers (Internet Explorer) would show a message related to the certificate change. Now after a hostname change, a full administrative interface refresh is performed.
- Localization support has been added to the InstaGate 404, 604, and 806. The link for all products appears under the System menu.
- Only English and Japanese options are now shown due to the localizations for other languages being out of date. Systems using another language will still show that language, but will have outdated localization.
- Remote devices using DHCP for their WAN configuration will now be updated correctly in the VPN Manager configuration.
- The VPN manager backup and restore now works properly.
- Fixed an issue where the webmail configuration allowed unnecessary debugging methods which triggered security alerts.
- Updated the quarantine view to prevent problems with certain preset keywords.
- Problems with the eSoft Reputation Filter and RBL list updates were fixed.
- Fixed an issue with the "whitelist from notification" feature that would result in a case sensitive whitelist entry.
- In previous releases, local domains were exempt from white/blacklist processing. This restriction has been lifted for whitelist processing but is still in effect for blacklist processing.
- In previous releases, if you had multiple email recipients and one of those recipients was white or blacklisted, the action would apply to all recipients. This has been changed so that only the defined email address is white/blacklisted. Any additional addresses that are not otherwise defined are left to be handled as appropriate.
- IP addresses specified via the Global SpamFilter Whitelist are now exempt from the Invalid Headers address verification check.
- Whitelist functionality has been updated to properly account for Aliases.
- On the white and blacklist forms, local addresses are shown separately on the form as a warning.
- Removed a quarantine restriction to allow larger quarantines to display correctly.
- Non-immediate quarantine notifications now work under all configurations.
- Wildcards and new categories defined under Custom Sites did not take affect until the web proxy server was fully restarted. This has been fixed.
- After the last general release, specifying a HA WAN address could cause some Internet connectivity problems. The firewall rules on the backup HA unit have been adjusted to solve this problem.
You will notice many new features related to the administrative user interface and Web Security ThreatPak. Each of these features is discussed briefly below.
Sessions Based Authentication
The previous HTTP-based authentication has been replaced with a new session-based authentication method. When the administrator or users log into the management interface, you will see a separate login screen instead of the previous browser login prompt.
***Important Note***
If you saved passwords in Internet Explorer or other browsers, they will not work with the new sessions-based authentication. You will be prompted to enter your password in the new form when you log into the new User Interface. If you have forgotten your password this can be reset from the LCD on the front panel of your unit, or through the serial console. You can also reset the password before updating from the System > Administrator Settings page.
Web Proxy Admin Override
Selected Admin users can now modify the behavior of blocked pages for users. The following actions can be performed:
- Temporarily override the page for a specified time for this user.
- Add the page to the Web Proxy Whitelist - Applies to all users.
- Change the category - Applies to all users.
When enabled, a new Override link will appear on the block page. Any user on the Administrative Override list can log in using their login name and password and override web proxy block.
Ignored Domains
Some update applications do not use the client's proxy configuration settings properly (not proxy aware). As a result, access for these applications will be blocked by the proxy. These non-proxy aware applications may also keep trying endlessly and degrade web proxy performance.
In order to work around these issues, the web proxy now has an area where you can specify domains that have password restrictions removed. This is located under Web Security > Proxy Settings > Advanced. The web proxy policies still control access to these sites. The following domains are added by default:
microsoft.com
windowsupdate.com
mcafee.com
mcafeeasap.com
adobe.com
IP Authentication Cache
An authentication cache based on IP address is now enabled so that the authentication "re-checks" occur only every 30 seconds. On previous versions, credentials were re-checked every time an authorized user accesses content through the web proxy server. On large installations using Active Directory authentication, this can cause performance issues.
This new setting is located under Web Security > Proxy Settings > Advanced. If you change this value to 0, it will default to the old behavior.
Google Safe Search
Google Safe-Search support has been expanded for other country domains that Google supports.
ThreatMap
This release adds enhanced ThreatMap features and improved DIA information delivery processes.
DIA Settings
A DIA menu option has been added to opt into eSoft's Distributed Intelligence Architecture (DIA). These settings can be found under System > DIA. This option was previously under the ThreatMap.
NTP Synchronization
NTP for time management has been added for the InstaGate platform. To change to NTP use the Local Options page under the System menu.
Trusted Remote Support Addresses
Firewall rules have been added so that only eSoft Support IP addresses are able to connect to the SSH server if remote support is enabled.
