Release Notes 2.1.5

What's New

New in this release:

FIPS

Tempered Networks now offers FIPS 140-2, based on the HIPswitch 500 and Conductor 500 platforms. With FIPS, private keys are stored on the FIPS-certified HSM (hardware security module). The HSM performs all cryptographic operations. For this added key security, performance may be noticeably slower in terms of data plane throughput and firmware update processing. Redundant HA FIPS is not supported at this time.

Improved time management

NTP sync is now configurable from the Conductor. Various improvements have been made to ensure HIPswitch time is closely synchronized with the Conductor, eliminating time-drift.

Note: We recommend pointing your HIP-enabled servers and clients to the same NTP Time source to ensure proper synchronization.

HIPswitch 75w Series

We now offer the HIPswitch 75 Series with a built-in WiFi module. Software version 2.1.5 does not currently provide WiFi LED status on the outside of the unit, but the WiFi uplink functions correctly. This will be addressed in a future release.

HIPswitch 150e Series

We now offer the HIPswitch 150e base platform, suitable for ICS and SCADA environments and includes 4x Gig-E and 1x SFP port, 1x micro-USB console port, and can be powered by PoE or external single- or dual-power supply. The HIPswitch 150 can sustain 75 Mb/s, and burst up to 100 Mb/s. This new platform supports field-upgradeable expansion modules.

HIPswitch 150 Series cellular module

This release supports a cellular expansion module suitable for North American cell carriers, which accepts 3FF Micro SIM cards. ATT, Verizon, T-Mobile, Rogers, and Telus have been field-tested at the time of this release.

HIPswitch 250 Series single- and dual-modem automated recovery

We added an internal watchdog monitor for cell carrier uplink connections. If a HIPswitch cannot connect to Conductor via any means, then occasionally (approx. once per day) it will perform a full reset, which may re-establish the carrier connection in certain environments. This will only occur when the HIPswitch 250 has no means of reaching the Conductor or peer HIPswitches.

HIPrelay bandwidth reporting

It is now possible to view the bandwidth of relayed connections between HIP Services in Conductor! An extra tab will appear in Conductor at HIPservice > Reporting > HIPrelay Stats for each HIPrelay. These statistics provide visibility into your network utilization with full-color, layered bandwidth graphs. They are also useful for troubleshooting underlay network relayed connection issues.

Service-specific CPU and memory reporting

For 2.1.5 and above, your HIP Services will report resource utilization more granularly, and you will be able to see this diagnostic information in the HIPservice > Reporting > Graphs.

Headless install for Windows HIPclient and HIPserver

You can now perform non-interactive installations of the Windows 7 HIPclient or HIPserver using Microsoft’s System Center Configuration Manager (SCCM). Previous releases required manual acknowledgment by an administrator to complete the installation of an unsigned network tap (TAP) driver on Windows. We have patched the driver and obtained Microsoft certification, so this step is no longer necessary.

Tags public API

All basic tagging capabilities released in software version 2.1.4 are exposed in the public API. This includes the ability to index the tags, set or unset tags on taggable objects, such as devices, device groups, HIP Services, HIPservice groups, networks, and people. You can manage tags, retrieve various objects by tag, manage tag expirations, and perform other tag-based actions on several taggable objects at once. Advanced tag management, such as using tags in smart device group rules, or managing monitor event-actions that manipulate tags, will be added in a future release.

Custom CA alerts & public API

Though technically possible, it was difficult to use a non-Tempered CA at scale with your Conductor and HIP Services. Prior releases required you to manually copy/paste each CSR and cert from the Conductor GUI. Now you can automate the process using new public API calls. This enables a scriptable, scalable Conductor-centric workflow. Also, an admin alert is created in Conductor when custom CA certs are near expiration.

Upgrade Considerations

The 2.1.5 release includes all hotfixes from prior releases and addresses all known support cases at the time of release.

Extensive testing was conducted both in-house and with selected development partners, in lab and in production environments to ensure that performance is equivalent to 2.1.4. Additionally, 2.1.5 should be more stable than all prior releases.

Fixes

Known Issues