User manual BARRACUDA NG FIREWALL 5.0 MIGRATION INSTRUCTIONS REVISION 1.3

[. . . ] Migration Instructions Barracuda NG Firewall 5. 0 2010-10-08 Revision 1. 3 Read this document before updating your system Please pay special attention to the appearing Software Restrictions and Hardware Restrictions Barracuda Networks Inc. Winchester Blvd Campbell, CA 95008 http://www. barracuda. com Copyright Notice Copyright 2004-2010, Barracuda Networks www. barracuda. com v4. x-090623-06-1119 All rights reserved. Information in this document is subject to change without notice. Trademarks Barracuda NG Firewall is a trademark of Barracuda Networks. All other brand and product names mentioned in this document are registered trademarks or trademarks of their respective holders. Content General . [. . . ] Barracuda NG Admin has to be restarted in order to reestablish the connections. This will be fixed with a future firmware update. 20 Migration Instructions - Known Issues HA Configuration Sync Only Possible Between 5. 0 and 4. 2. 12 or Higher Configuration synchronization between HA boxes, of which one was updated to Barracuda NG Firewall 5. 0, is only possible if the other box is running at least release version 4. 2. 12. If you intend to keep both versions in parallel for a longer period of time, Barracuda Networks recommends updating the primary box to 4. 2. 12 and the secondary box to 5. 0. 0. No VMWare Tools on Virtual Appliances VMWare tools can not be installed within the virtual machines of the virtual appliances. This issue will be fixed with the upcoming patch to Barracuda NG Firewall 5. 0. Active Recovery Technology (ART) ART is slated to be a replacement to the existing SDR technology that was available on some appliances. Please note that during USB thumdrive installation unlike SDR, ART does not write an installation log onto the USB thumb drive. nf-edge, nf-sintegra XS, F10, F100, or F101, clicking Control -> Box -> Save current Config for ART will generate an error message saying No ART available on this box. Actually, ART is available on flash based appliances, however, it is not possible to save the current configuration. On appliances with LCD display it is intentionally not possible to save and load a PAR file. This function was provided by third-party SDR technology before the 5. 0 release on some appliances. VMWare Network Drivers Setting VMWare emulates different network cards depending on VMWares Guest Operating System settings setting. If you select Other Linux (32-bit), the network drivers in NGF must be set to AMD PCnet32. If you select Other Linux (64-bit), the network drivers in NGF must be set to Intel Pro/1000 PCI and PCI-X. 21 Migration Instructions - Known Issues Hardware Restrictions Erroneous BIOS in Certain Hewlett-Packard Servers Certain servers by Hewlett-Packard are equipped with an erroneous BIOS. If the installation of Barracuda NG Firewall 5. 0 on an HP server fails, then use the following kernel parameter: intel_iommu=off CPUs Not Supporting TSC and MOV Not Supported Barracuda NG Firewall 5. 0 will only install on hardware based on i686 compatible CPUs supporting the TSC and MOV instructions. Any attempt to install or update on a system with older CPUs will exit with an error. Type rpm -q kernel --qf %{ARCH}\\n within the shell in order to find out which kernel is present. Irrelevant Error Message on Systems with Floppy Controller Installation on systems with an integrated floppy controller may take longer. Furthermore, on such systems the log entry I/O read error on fd0 will be logged. This error results from the device mapping detection and can safely be ignored. Crypto Accelerator Cards Not Supported Barracuda NG Firewall 5. 0 provides higher VPN throughput without accelerator cards. Therefore, crypto accelerator cards from Broadcom or Hifn are not supported anymore. S. M. A. R. T. This affects L2000 and C610 appliances. 22 Migration Instructions - Known Issues Arbitrary x86 Compatible Hardware Not Supported Updating of arbitrary x86 compatible hardware is not supported with this firmware and therefore prohibited by default. If you still want to update x86 compatible hardware, this can be overridden. Execute the command touch /opt/phion/run/forceupdate via SSH or remote execution before executing the firmware update. ART Not Supported on C610 Active Recovery Technology (ART) is not available on the C610 Control Center Appliance. No LED Support on C610 and nf-780 The C610 and nf-780 appliances do not have LED support to visualize the appliance status. Further Known Issues Advice about further known issues is available at http://www. barracuda. com/kb?id=50160000000IIQ1 . If you are using standard hardware and / or updating from phion netfence, please pay also attention to Migrating from phion netfence to Barracuda NG Firewall 5. 0, page 38. 23 Migration Instructions - Known Issues Bugfixes Included with Barracuda NG Firewall 5. 0 Barracuda NG Admin Table 1­8 Barracuda NG Admin Module Barracuda NG Admin Version 5. 0 5. 0 5. 0 5. 0 Description In very rare occasions, generated system report files were corrupt. Occasionally, the system report access cache did not work as intended. [. . . ] The inverted CIDR notation can be calculated very easily: "Inverted" = 32 - "CIDR". Table 2­14 Comparison CIDR - inverted CIDR notation Quad 255. 255. 255. 255 255. 255. 255. 254 255. 255. 255. 252 255. 255. 255. 248 255. 255. 255. 240 255. 255. 255. 224 255. 255. 255. 192 255. 255. 255. 128 255. 255. 255. 0 255. 255. 254. 0 255. 255. 252. 0 255. 255. 248. 0 255. 255. 240. 0 255. 255. 224. 0 255. 255. 192. 0 255. 255. 128. 0 255. 255. 0. 0 255. 254. 0. 0 255. 252. 0. 0 255. 248. 0. 0 255. 240. 0. 0 255. 224. 0. 0 255. 192. 0. 0 255. 128. 0. 0 255. 0. 0. 0 254. 0. 0. 0 252. 0. 0. 0 248. 0. 0. 0 240. 0. 0. 0 224. 0. 0. 0 192. 0. 0. 0 128. 0. 0. 0 0. 0. 0. 0 CIDR 32 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 Inverted CIDR 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 41 Migration Instructions - Migrating from phion netfence to Barracuda NG Firewall 5. 0 Known Issues for Updating from phion netfence Software Restrictions for Updating from phion netfence phion netfence 3. x Not Supported By Control Center 5. 0 Barracuda NG Control Center 5. 0 does not provide support for managing phion netfence 3. 2, phion netfence 3. 4 or phion netfence 3. 6 boxes. All boxes must be updated to at least phion netfence 4. 0 or Barracuda NG Firewall 4. 2 prior to updating the respective CC or MC to Barracuda NG Firewall 5. 0. Successive Migration of Boxes Running a Lower Release Version than 4. 2 Updating to Barracuda NG Firewall 5. 0 is possible from phion netfence 4. 2 as well as from Barracuda NG Firewall 4. 2, with the exception of nf-cash / nf-140 appliances that need to be updated to 4. 2. 13 prior being updated to 5. 0. In case you are running phion netfence release versions 3. x or 4. 0, you must execute update and migration in successive steps beginning with the oldest matching minor release to release version 4. 2 and then, finally, to Barracuda NG Firewall 5. 0. SDR Not Available Anymore Installing Barracuda NG Firewall 5. 0 on a Secudos appliance will replace the SDR mechanism with Barracuda NG Firewall Active Recovery Technology (ART) Therefore, on Secudos appliances, it is not possible to go back to netfence 4. 2 once Barracuda NG Firewall 5. 0 has been installed due to the removal of SDR. Updating of nf-140 If a nf-140 appliance is updated to Barracuda NG Firewall 5. 0 from an older release version than 4. 2. 13, then the hardware detection mechanism may fail to recognize the DSL interfaces. nf-140 appliances must be updated to release version 4. 2. 13 before being updated to Barracuda NG Firewall 5. 0. management reporter Not Available management reporter is not yet available with Barracuda NG Firewall 5. 0. Therefore, do not update a management reporter box to Barracuda NG Firewall 5. 0. [. . . ]