Changed Features in Version 31.0.2.0
SSL Changes
OpenSSL Upgrade
OpenSSL on both the data and management paths was updated to OpenSSL 1.1.0f for:
Alteon platforms S, SL, and standard (no SSL card) modelsVA/NFV.SSL Performance Improvements
Significant performance improvements are achieved for software-based SSL offload (non-accelerated Alteon platforms, VA/NFV). Depending on the platform, the improvement adds:
ECC CPS – Between 70% and 200%RSA CPS – Between 10% and 70%Bulk encryption throughput – Between 11% and 35%In addition, SSL bulk encryption throughput for the 8420/8820 platforms was increased by 20% to 48 Gbps.
Trusted CA Group
Alteon now lets you import an entire group of Trusted CA certificates in a single PKCS#12 file. For example, this lets you easily import a full trust store from Mozilla or other source (relevant mostly for validating server certificates during outbound SSL).
The maximum number of Trusted CA certificates was increased to 300.
Connection Limit Exception
This feature lets you override the connection limit defined for a server, and to forward to that server new connections when the connection limit is reached, if the new connections belong to the persistent session active on that server. This is relevant for Persistency modes Client IP, cookie, and SSLID (it is not relevant when persistency is managed using an AppShape++ script).
You activate the override connection limit per server group using the new Maximum Connections Exception parameter (/cfg/slb/group <group ID>/maxconex enabled).
NFR ID: prod00251643
Filter Behavior Changes
Fallback Action on non-HTTP Filters
The Fallback action was previously not supported for Redirect filters that processed non-HTTP traffic in Proxy mode (Application Basic, SIP, or DNS). This capability is now available for all Proxy Redirect filters.
Note: The Fallback action is not supported for legacy Layer 7 filters.
Return to Source Hop
In earlier versions, Return to Last Hop (rtsrcmac) could only be enabled only under the following conditions:
The Reverse Session flag was enabledTraffic was processed in Proxy mode (Force Proxy)Client NAT (PIP) was configuredStarting with this version, these conditions are no longer required, and Return to Last Hop can be enabled without restriction.
Fallback Action Allow
The Fallback Action Allow filter routes traffic matching the filter to its destination when the filter group is down.
When the filter group is non-transparent (the destination IP address and/or port is changed) or the filter processes traffic in Proxy mode, special handling is required for the routed traffic to ensure the response is properly processed and forwarded to the client. Special handling is required to create a reverse session for each new connection irrespective of the Reverse Session flag value.
In this version, now a reverse session is created only when the Reverse Session flag is enabled. When the flag is disabled, to ensure proper processing of the response, the source port is automatically changed (DAM mechanism).
Virtual Service/Server Statistics
From the Alteon CLI, you can now easily print the information and statistics for all virtual services:
>> /info/slb/virt Enter virtual server id or [all]:
>> /stats/slb/virt Enter virtual server id or [all]: