Fix: Fixes an issue where a forwarding policy could not retrieve the Service Name Indication (SNI) from a TLS Client Hello message causing the Gateway to close the connection with a TCP RST. This is caused by a change made in Chrome in April 2024 to shift to Post-Quantum Cryptography. With this change, the Client Hello is larger than 1415 bytes, which can result in an inability to retrieve the SNI, which is used by the policy to match or filter by domain. The fix ensures the forwarding policy can support Client Hello sizes greater than 1415 bytes.
Fix: Fixes an issue related to new Talos Rulesets where a Ruleset change could cause issues with applying the new Rulesets to the Gateway. The Gateway will become stuck in Policy Ruleset Status "Updating..." state. This issue was caught prior to new Talos Rulesets being published. The issue has is resolved with this update such that new Talos Rulesets can be successfully applied.
Fix: Fixes an issue where the datapath could become momentarily stuck, causing issues processing traffic, including heathchecks. When this occurs, the Gateway will bounce between healthy and unhealthy, which is evident in a series of System Log messages. The stuckness usually does not last long enough for the Controller to mark the instance for replacement.
Fix: Fixes an issue related to a UDP connection pool leak caused by specific UDP session behavior that could eventually result in a datapath restart. When the datapath restart occurs, the instance will be unhealthy for the duration of the restart. If that unhealthy period is long enough, the Controller will mark the instance for replacement.
Fix: Fixes an issue where a forwarding policy could not retrieve the Service Name Indication (SNI) from a TLS Client Hello message causing the Gateway to close the connection with a TCP RST. This is caused by a change made in Chrome in April 2024 to shift to Post-Quantum Cryptography. With this change, the Client Hello is larger than 1415 bytes, which can result in an inability to retrieve the SNI, which is used by the policy to match or filter by domain. The fix ensures the forwarding policy can support Client Hello sizes greater than 1415 bytes.
Enhancement: Integrates the FIPs Teleport agent into the Gateway to accommodate both FIPS (FedRAMP) and non-FIPS (commercial) environments. Teleport is disabled by default. It can only be enabled by the customer when working in conjunction with Cisco Support for advanced troubleshooting.
Fix: Fixes an issue where traffic processing on an Ingress Gateway could cause high CPU resulting in an unnecessary auto-scale. The high CPU is a result of moving from a policy that initially processes a connection using an unencrypted HTTP proxy and then moving to an encrypted TCP proxy due to an HTTP redirection.
Fix: Fixes an issue where an Egress Gateway Forward Proxy policy could get stuck in attempting to match traffic to the proper Policy Rule
Fix: Fixes an issue where some long-lived active connections would not be properly reset (TCP RST) during Gateway replacement, policy change or timeout expiry
Fix: Fixes a Gateway crash that is caused by detection of malware in an Ingress Gateway reverse proxy policy
Fix: Fixes the recording of Stats related to Active Connections and Connection Rate where UDP sessions were not being properly counted
Fix: Fixes an issue where a Gateway could unnecessarily consume CPU in a proxy scenario where the backend connection is unresponsive causing delays in processing traffic
Enhancement: Provides an enhanced Gateway image that supports the BoringCrypto required for use for Gateways deployed in a FedRamp environment. This is a continued effort towards Multicloud Defense being FedRamp compliant.
Enhancement: Adds support for a custom banner to be displayed when an SSH session to the Gateway is established through Teleport
Fix: Fixes an issue where a TLS session that contains Kyber cipher suites could cause increased CPU usage resulting in the inability to process traffic
Fix: Fixes an issue where the connection drain time was not being honored when a Gateway instance was replaced
Fix: Fixes a stability issue where the Gateway datapath could self-heal when proxied sessions are actively terminated during policy change or Gateway instance replacement
Fix: Fixes an issue where the generation of a Diagnostic Bundle could fail
Fix: Fixes an issue where a proxy policy could not retrieve the SNI from a TLS Client Hello message causing the Gateway to close the connection with a TCP RST. This is caused by a change made in Chrome in April 2024 to shift to Post-Quantum Cryptography. With this change, the Client Hello is larger than 1415 bytes, which can result in an inability to retrieve the Server Name Indication (SNI), which is used by the proxy to determine what certificate to issue. The fix ensures the proxy policy can support Client Hello sizes greater than 1415 bytes.
Fix: Fixes an issue where a change to DNS for a domain used in an FQDN-based Address Object would be received by the Gateway datapath agent, but not applied to the datapath workers. This would result in the DNS change not being applied to the dynamic nature of the Address Object, impacting proper traffic processing.
Fix: Fixes an issue where the Gateway-side cipher suites used in a Gateway SSH session were potentially flagged as weaker cipher suites. The fix accommodates only the most secure GCM-based cipher suites.
Fix: Fixes an issue where the connection drain time was not being honored when a Gateway instance was replaced
Fix: Fixes a stability issue where the Gateway datapath could self-heal when proxied sessions are actively terminated during policy change or Gateway instance replacement
Fix: Fixes an issue where a proxy policy could not retrieve the SNI from a TLS Client Hello message causing the Gateway to close the connection with a TCP RST. This is caused by a change made in Chrome in April 2024 to shift to Post-Quantum Cryptography. With this change, the Client Hello is larger than 1415 bytes, which can result in an inability to retrieve the Server Name Indication (SNI), which is used by the proxy to determine what certificate to issue. The fix ensures the proxy policy can support Client Hello sizes greater than 1415 bytes.
Enhancement: Continued enhancements to the Gateway to accommodate FedRAMP CIS Level-2 hardening
Fix: Fixes and issue where the Gateway will self-heal if an empty FQDN/URL Filtering Profile is assigned to the Policy Rule Set Rule
Fix: Fixes a deny Rule Action issue related to the use of domains as a 6-tuple match. If the first Rule match is a 6-tuple match (includes an assigned FQDN Match Profile) and the Policy Action is set to Deny, the Deny action will be based on the 5-tuple match and will not include the domain for match consideration. This fix ensures that all 6-tuples are considered when evaluating the Rule and its action. If the traffic does not match the Rule based on the 6-tuple match, then it will refine its match to a subsequent Rule and take action based on the matched Rule's configuration.
Fix: Fixes an issue where an Azure Ingress Gateway will get stuck in Health Checking Pending state after a policy update is applied. This issue also includes new Gateway deployments
Fix: Fixes an allow Rule match issue related to the use of domains as a 6-tuple match. If the first Rule match is a 6-tuple match (includes an assigned FQDN Match Profile), the Policy Action is set to Allow and there are no subsequent Rules that are consistent with the 5-tuple match of the first Rule, then all domains will be allowed and domains will be denied. This fix ensures that only the domains that are matched in the Rule will be allowed and all other domains will be denied.
Fix: Fixes an issue where a Egress Policy Rule Set that uses an decryption-based Forward Proxy (TLS, HTTPS, WebsocketS) is initially matching on 5-tuple and retrieving the domain from the SNI, but not performing a match refinement based on the 6th tuple resulting in a TLS error. The fix ensures that 6-tuple match refinement occurs such that the traffic can be successfully processed by the proper decryption Rule.
Fix: Fixes an issue where sessions with TLS negotiation errors where not recording the SNI as a Traffic Summary -> Event
Fix: Fixes an issue where multiple SNI events were being recorded for each Forward Proxy full decrypted session
Fix: Fixes an issue where the Address Group size could be exceeded, causing all IPs/CIDRs in excess of the size to not be included in the Address Group. The Address Group size has been increased to 20k IPs/CIDRs.
Fix: Adds a System Log message if the GeoIP limitations of the Gateway are exceeded
Fix: Fixes an issue where the wrong action would be taken for URL Filtering Category matching if a timeout occurs when attempting to retrieve the URL Filtering Category if the URL is not found in the cache
Fix: Ensures that an user with administrator access to configure a URL Filtering Profile cannot use the custom URL response to inject Javascript. The fix enforces HTML encoding in the custom URL response.
Enhancement: Adds support for inspecting content within a GRE tunnel that passes through the Gateway. The Gateway will decapsulate the traffic, perform inspection on the encapsulated traffic to apply proper policy and protection, then re-encapsulate that traffic back into the GRE tunnel.
Enhancement: Adds support for active connection resets during Gateway upgrade and scale-in scenarios. When these scenarios occur and the Gateway is processing long running connections that are not closed by the client or server, the Gateway will take action by sending a TCP RST to actively close the connection when reaping the old instance.
Enhancement: Support ability to specify a custom banner when logging into a Gateway instance through Teleport (SSH access). This is a requirement for Gateways deployed into FedRamp environments where any method of SSH access requires a customer-defined banner to be displayed.
Fix: Fixes an issue where specifying an Validate Certificate action other than "Default" in a Decryption Profile will cause the Gateway to become unhealthy
Fix: Fixes an issue for user-generate diagnostic bundles where the Gateway would fail to generate the diagnostic bundle and send to the Controller
Fix: Fixes an issue related to the use of GeoIP. Countries with many providers have a very large number of advertised prefixes. When those country codes are used in a GeoIP Address Group, the Address Group will contain a large number of CIDR blocks. The GeoIP Address Group was restricted to 64k CIDRs where exceeding this limit would result in a partial set of CIDRs applied to the policy. This fix relaxes the limit to ensure the full set of CIDRs will be applied to the policy. It is recommended to use an 8-core instance type due to the additional memory requirements imposed by GeoIP.
Fix: Fixes an issue where a proxy policy could could issue the wrong certificate when a Chrome browser is connecting to the Gateway using TLS 1.3. This is caused by a change made in Chrome in April 2024 to shift to Post-Quantum Cryptography. With this change, the Client Hello is larger than 1415 bytes, which can result in an inability to retrieve the Server Name Indication (SNI), which is used by the proxy to determine what certificate to issue. The fix ensures the proxy can support Client Hello sizes greater than 1415 bytes.
Fix: Fixes an issue where the Gateway was producing the correct statistics for display in the Investigate -> Network Analytics -> Stats page
Fix: Fixes an issue related to blue/green policy change. When the policy change occurs and the new datapath becomes active, the Gateway begins draining current sessions off the old datapath. If the datapath cannot properly drain the sessions, it treats the datapath as unhealthy and will employ a datapath restart. This will terminate both old and new datapaths, which could cause disruption to old and new sessions. The fix ensures that the session draining completes properly and eliminates the situation where the datapath is seen as unhealthy.
Fix: Fixes an issue where a VPN tunnel state transition was not generating a System Log message to provide troubleshooting and debugging information on the tunnel setup and negotiation
Fix: Fixes a slow memory leak for an Ingress Gateway that eventually results in a datapath self heal. The memory leak is related to traffic that contains files that are gzip compressed.
Fix: Fixes an issue where a Policy Rule that uses DNS-based FQDN cache could become corrupted causing the Gateway to not properly process traffic
Fix: Fixes an issue where an Ingress Gateway could drop a connection when back-to-back POST commands contain a payload greater than 160k