Release Notes > What’s New > New in Version 31.0.3.0
New in Version 31.0.3.0
Integrated AppWall Enhancements
Policy Based Distribution
The new Policy Based Distribution mechanism lets you easily apply the same security policies throughout a network.
With Policy Based Distribution, you can export a tunnel policy file from an integrated AppWall module and import the policy file into the same or a different AppWall module, or a standalone AppWall server. When importing the policy file, you must select an existing tunnel to override.
NFR ID: prod00251482
Admin User Authentication via TACACS and RADIUS
TACACS and RADIUS support for admin user is added for integrated AppWall.
Internal Web Crawler Removed
Because of its very limited use, the internal Web crawler was removed from AppWall. You can no longer define crawling jobs for the purpose of Auto Policy Generation.
FastView and AppWall
FastView and AppWall can now be activated on the same virtual service.
Dual-box SSL Inspection
Alteon outbound SSL Inspection can be supported using a single Alteon device (or a pair of devices for High Availability). However, there are cases when a sandwich configuration (dual-box) is required, the most apparent example being when strict separation between internal and external networks is required (2-leg firewall VAS). In such cases, the network administrator may prefer to connect each firewall leg to different SSL decryptor instances.
A dual-box configuration can also be used to scale-up the SSL capacity of such an SSL Inspection solution.
Alteon can now support such a dual-box solution for outbound SSL Inspection (such a configuration was always supported for inbound SSL Inspection).
A new SSL Inspection Deployment mode lets you define whether the Alteon device functions as a single outbound SSL Inspection device, or as either as internal or external devices in a dual-box solution.
The dual-box solution configuration includes the following:
*Internal device configuration should include the front-end SSL parameters, including a CA certificate and Private Key, bypass/inspect rules, as well as the service (VAS) chaining configuration. The SSL Inspection wizard is updated to support deployment of an internal device.
*External device configuration should include the back-end SSL parameters, a filter that intercepts decrypted HTTP traffic and performs back-end encryption, and filters that forward all other traffic as is (the original HTTP, other protocols).
The dual-box solution can be deployed using either two separate physical devices or two vADCs.
SNI on a Back-end SSL Connection
Alteon performing as an SSL client (back-end SSL encryption) can now include SNI in the Client SSL Hello it sends to the server. A new parameter, Include SNI, has been added as a back-end SSL parameter in the SSL policy.
When the Include SNI option is enabled in an SSL policy, the following applies:
*If front-end SSL is enabled in the same SSL policy, the SNI data received on the client-side SSL connection is copied to the Client SSL Hello message sent by Alteon to the server.
*If front-end is not enabled in the same SSL policy, the value of the Host header in the HTTP request is inserted as an SNI in the Client SSL Hello message sent by Alteon to the server.
Notes:
*The Include SNI option should not be enabled on HTTPS virtual services with HTTP multiplexing enabled or in Basic SLB virtual services with TCP Multiplexing enabled, if multiple domains are delivered over that same service.
*When performing outbound SSL Inspection, the Include SNI parameter on the back-end SSL policy is ignored and SNI is always included in the Client SSL Hello.
AppShape++ support has been added to allow SNI overwrite for back-end SSL encryption:
*The command SSL::sni <value> lets you set the SNI value
*The event SERVERSSL_CLIENTHELLO_SEND is triggered just before the Client SSL Hello message is sent to server, letting you set the SNI value.
NFR ID: prod00252350
TCP Multiplexing
TCP connection management (multiplexing) increases throughput and server capacity by minimizing the number of TCP connection establishments between Alteon and back-end servers. The TCP overhead is reduced by allowing multiple clients to reuse existing server connections.
TCP multiplexing is now also supported for non-HTTP services.
When TCP connection management is enabled for non-HTTP/S TCP services, one of the following behaviors can be achieved:
*TCP connection pooling ─ When a server is selected for a new client connection, Alteon reuses an idle connection from the server connection pool. If no idle connection is available, a new back-end connection is opened.
*TCP request multiplexing ─ When a server is selected for a new client TCP request, Alteon reuses an idle connection from the server connection pool. If no idle connection is available, a new back-end connection is opened. This is required for applications that have long-lived client connections and there is a need to load balance per transaction. To achieve this behavior, an AppShape++ script is required on this service – the script must identify a TCP transaction and signal its completion (and release of the back-end connection back to the idle connection pool) using the new TCP::detach command.
To enable this capability:
1. Enable the Connection Management parameter on the virtual service
2. Define the timeout, in minutes, after which an idle back-end connection is closed.
3. If request multiplexing is required, attach the AppShape++ script that signals the TCP transaction completion.
NFR ID: prod00251587
Graceful Server Shutdown
Administrative (Config) Shutdown
In earlier versions, graceful shutdown of a real server could be performed only using operator commands. Because operator commands were not saved in the configuration, when a reboot or failover to the backup device occurs, the shutdown status is lost and a new server is selected for new traffic.
This version now lets you perform server shutdown using configuration commands, letting you preserve the shutdown status even after reboot or failover. The following options have been added:
*Connection Shutdown – Traffic that belongs to connections that are still active on the server continues being forwarded to the server, but Alteon does not accept new connections (shut connection).
*Sessions Shutdown – Traffic that belongs to connections that are still active on the server continues being forwarded to the server, and Alteon accepts new connections that belong to active persistent sessions on that server (cookie, SSLID, Client IP) (shut psession).
Notes:
*This is not relevant for persistent sessions recorded using AppShape++ scripting.
*When the last real server is moved to shut psession/connection, the virtual server also moves to the down state (DE25609).
This feature was added for both an entire real server and real servers in a group.
NFR ID: prod00246660
Operational (Oper) Shutdown
A new operator command was added to allow for operational graceful shutdown of a real server within a group (oper/slb/group X/shut):
*Connection Shutdown – Traffic that belongs to connections that are still active on the server continues being forwarded to the server, but Alteon does not accept new connections (shut connection).
*Sessions Shutdown – Traffic that belongs to connections that are still active on the server continues being forwarded to the server, and Alteon accepts new connections that belong to active persistent sessions on that server (cookie, SSLID, Client IP) (shut psession).
*Note: This is not relevant for persistent sessions recorded using AppShape++ scripting.
Note: The command to operationally disable a server within a group (oper/slb/group X/dis <real server ID>) immediately terminates all connections when the Delayed Bind parameter is set to Force Proxy, but behaves like Connection Shutdown when the Delayed Bind parameter is set to Enable or Disable.
NFR ID: prod00247631
Server Health Check Failure Reason
The message (syslog/SNMP trap) sent when a real server goes down following health check failure now includes the failure reason.
The server health check failure reason can also be viewed via CLI and WBM.
• CLI: info/slb/virt
*WBM: Monitoring > Application Delivery > Virtual Servers > Virtual Service > Traffic.
*Note: Currently this capability is available only for real servers attached to virtual services.
NFR ID: prod00245945
Alteon VA/NFV/Cloud
VMware
*Starting with this version, VMware ESXi version 6.5 is officially supported.
Back-end SSL Reuse
SSL reuse on back-end connections to servers is now supported. Enabling this can improve server performance.
Back-end SSL reuse can be configured via CLI only using the new cfg/slb/ssl/adv/bereuse menu.