Category Archives: System Manager

Watchguard XTM 1050, XTM 2050, XTM 2 Series, XTM 3 Series, XTM 5 Series, XTM 8 Series – Fireware XTM OS 11.6 – CSP2 Build # 346090

Watchguard XTM 1050, XTM 2050, XTM 2 Series, XTM 3 Series, XTM 5 Series, XTM 8 Series – Fireware XTM OS 11.6 – CSP2 Build # 346090

11.6 – CSP2 Build # 346090 Resolves the following issues:

BUG66240: CLI command “restore factory-default all” fails to restore factory default

BUG67367: the state of the interface of XTM23 become unstable when transfering one big file by FTP

BUG67310: A/P XTM8 fails over WARNING: utm-11_6/src/343405/dev.c:1871 skb_gso_segment 0xce/0x1ca

Potential fix for Kernel Crashes related to “scheduling while atomic” when using BOVPN

BUG64611: BUG: scheduling while atomic: ntpd/2446/0x10000200 on 11.5.1 XTM5

BUG67819: XTM2 memory leak causing xfrm_dst_cache value to increase and causing appliance to lockup

Potential fix for Kernel crash matching the following bugs:

BUG65288: kernel crash and reboot

BUG65179: Interface traffic stopped EIP: 0060: e02acf7b EFLAGS: 00010246 CPU: 3

BUG66670: XTM1050 rebooted itself and writing crash log EIP: 0060:[<dff64f7b>] EFLAGS: 00010246 CPU: 1

BUG66809: A/P Cluster Master reboots kernel BUG at /builds/utm-11_5_3_csp/src/341451/ EIP: ec2b9f59

BUG66872: A/P Cluster Member reboots kernel BUG at/builds/utm-11_5_3/src/340457/ip_set.c:507 EIP e033af7b

You can request 11.6 – CSP2 Build # 346090 from Watchguard Support by logging a support case online, they should then be able to provide an ftp download link and appropriate credentials.

Please note that Watchguard CSP releases are cumulative so you should only need to apply the latest to ensure that you also have any previous fixes.

Watchguard XTM 1050, XTM 2050, XTM 2 Series, XTM 3 Series, XTM 5 Series, XTM 8 Series – Fireware XTM OS 11.6 – CSP1 Build # 345395

Watchguard XTM 1050, XTM 2050, XTM 2 Series, XTM 3 Series, XTM 5 Series, XTM 8 Series – Fireware XTM OS 11.6 – CSP1 Build # 345395

11.6 – CSP1 Build # 345395 Resolves the following issues:

BUG67424: Multi-WAN default route path lost on other external interfaces after PPPoE reconnect

BUG67731: Default Gateway route missing issues when using Multi-WAN with DHCP interfaces

BUG67520: Unable to ping static route network while multi wan’s pppoe I/F is disconnected

BUG66937: Kernel- unable to handle kernel NULL pointer dereference at 000002

BUG67399: XTM8 crash BUG: unable to handle kernel paging request at 780fed1e EIP c11f7cf6

BUG67312: XTM2050 crash BUG: unable to handle kernel paging request at cf9f9f5e EIP 4120667e

BUG67159: XTM5 A/P Cluster Kernel Crash  EIP: 0060:[<c11e02bb>]

BUG66135: XTM510 11.5.2  Kernel Crash EIP c11e035b

BUG65426: A/P FireCluster rebooted Pid: 1343, comm: bwdrv_wq/0 Tainted: P EIP c11e06cb

You can request 11.6 – CSP1 Build # 345395 from Watchguard Support by logging a support case online, they should then be able to provide an ftp download link and appropriate credentials.

Please note that Watchguard CSP releases are cumulative so you should only need to apply the latest to ensure that you also have any previous fixes.

Watchguard XTM 2 Series, XTM 3 Series, XTM 5 Series, XTM 8 Series – Fireware XTM OS 11.5.3 Build # 339420

Watchguard XTM 2 Series, XTM 3 Series, XTM 5 Series, XTM 8 Series – Fireware XTM OS 11.5.3 Build # 339420

Fireware XTM OS 11.5.3 Build # 339420 Resolves the following issues:

Minor enhancements

• Changes to the routes section of the Firebox System Manager Status Report to improve consistency in the way IPv4 and IPv6 routes are displayed.

• New IP address validity checking in Mobile VPN configurations to help prevent common errors with overlapping IP addresses.

General

• An instability issue found on some XTM 2 devices, where the device could pass traffic normally but could not be managed with WSM or Web UI, has been fixed. [64546]

• A Support Snapshot (a support.tgz file) can now be correctly saved to a USB drive. [64897]

Policy Manager

• You can now use an IP address with a leading zero (10.19.09.0 vs 10.19.9.0) without causing branch office VPN failures. [65189]

• Policy Manager now updates the Mobile VPN with IPSec policies when the configured Virtual IP Address Pool is changed. [65241]

Authentication

• The Event Log Monitor has been enhanced to more effectively retrieve group information in a clientless SSO environment. [65300]

• The SSO Client now responds appropriately when a client computer resumes from a hibernate or sleep state. [65561]

• In the SSO Setup Wizard, the Event Log Monitor check box is now clear by default. [65825]

• The SSO Agent can now correctly load configuration information when the network interface is unavailable. [65802]

Proxies

• HTTP proxy performance has been improved when downloading very large files. [65967]

• A chunking handling issue in the HTTP proxy has been resolved. [65505]

• The SMTP proxy now correctly detects a multi-line 550 response as a valid response. [64463]

• When you use TLS with the default optional allowed rules in the SMTP proxy, email messages can now be delivered successfully to mail servers that do not support TLS. [64650]

• A SIP ALG memory leak issue has been resolved. [65749]

• The SIP ALG now allows provisional ACKs. [65247]

• A problem that caused the SIP ALG to crash has been resolved. [60222]

Security Services

• Gateway AV now detects password-encrypted virus attachments as scan errors. [65047]

• Gateway AV signature update memory utilization has been optimized in this release. This prevents Gateway AV scanning failures caused by a lack of memory. [64940, 64511, 62222]

• The HTTP response no longer stalls when both Gateway AV and RED are enabled. [65877]

• The UTF8 encoded X-WatchGuard-AntiVirus header no longer breaks attachments with long file names. [64883]

• WebBlocker can now correctly fail over to a configured backup server. [65211]

Centralized Management

• Device configuration templates that contain a TCP-UDP proxy policy and a WebBlocker action now work correctly with WatchGuard devices running Fireware XTM v11.3.x. [65408]

Logging & Reporting

• The frequently seen log message: “failed to get routing rules” has been suppressed. [65463]

• A problem that caused log messages to take up to 15 minutes to fail over to a backup Log Server in some networks has been resolved. [62275]

• The Log Collector can now gracefully recover from errors related to a lack of shared memory. [65101]

• Report Manager no longer shows “500 Internal Server Error” when you try to get access to device reports on February 29th of a calendar leap year. [65735]

• Report Manager can now successfully generate PDF output for reports that contain a bar chart. [65099]

• Report Server no longer stops responding to requests while it generates ConnectWise reports data. [65725]

• The Application Usage and Blocked Applications reports no longer display the incorrect IP address value in the y-axis. [65302]

• You can now specify “https://” as part of the ConnectWise Server address without causing WatchGuard Server Center to fail. [64712]

Networking

• Configuration files that include a large number of 1-to-1 NAT entries no longer cause a traffic interruption when saved. [60037]

• A problem that caused a significant memory spike when you configured the DHCP server lease time to one second has been resolved. [65242]

• A problem that caused XTM device performance degradation to occur on devices configured with at least one VLAN interface and many secondary IP addresses has been resolved. [65591]

FireCluster

• A problem that could cause members in a cluster to lock up until rebooted has been resolved. This problem would only occur on a cluster for which proxies were configured. [61091]

• A crash that could occur when one or more connections spanned multiple failovers (at least two failovers in a row) has been corrected. [66008, 66177]

• A problem that could cause connections to time out prematurely has been corrected. In most cases, the symptom would be the disruption of a service (e.g. an FTP download would fail). The problem could affect connections assigned to the non-master of an Active/Active cluster or connections assigned to the new master of an Active/Passive cluster following a failover. [66110]

• Log messages about a FireCluster reboot have been improved to include the reason for the reboot. [65115]

• A problem that prevented a FireCluster failover from occurring because of an error in interpreting the health of the FireCluster Monitored Port has been resolved. [65441]

• An Application Control bug that caused both members of an active/passive FireCluster to reboot has been resolved. [65770]

Mobile VPN with SSL

• Policy Manager and Web UI now display a warning message if Mobile VPN with SSL is enabled and the external IP address of the XTM device is modified. [65806]

• A problem that caused the Mobile VPN with SSL client to crash when connecting from a computer using the Mac OSX 64-bit operating system has been resolved. [65776]

• The Mobile VPN with SSL client running on a computer using Windows 7 64-bit OS can now operate correctly with a third-party web server certificate. [65535]

Mobile VPN with IPSec

• The Mobile VPN with IPSec Shrew Soft client can now connect to an XTM device configured with a static IP address. [64920]

Branch Office VPN

• The latency of packets that traverse a branch office VPN tunnel has been improved. [65333]

• This release resolves a problem that caused an IKEd stacktrace issue in FireCluster. [63108, 65292]

CLI

• You can now use the CLI vlan-id command with the “external dhcp” option successfully. [65478]

• The CLI show sysinfo command now displays the correct CPU utilization values. [64521]

You can download Fireware XTM OS 11.5.3 Build # 339420 from the Watchguard website.

Please note that Watchguard XTM OS releases are cumulative so you should only need to apply the latest OS to ensure that you also have any previous fixes/features.