Release Notes 2.1.7

• If you have a HS that must remain on 2.1.x but work through a multi-homed 2.2.x relay.

• HS-100 intermittently failing to execute diagnostic commands, or appearing to upgrade but not installing the upgrade.
• Have intermittent issues with HS-150 cell modems
• Need to use the HTTP GET monitor and point it at arbitrary IP addresses
• Need HS-500 to not have ports 3/4, 5/6 go into hardware bypass when the unit is powered off

UserAuth sometimes does not work with 2.1.6 HIPswitches.

Workaround: None

Android HIPclient 2.1.6 is not able to pass traffic with another HIPclient with User Authentication feature enabled.

Workaround: Upgrade Android HIPclient to 2.2.1 or later.

A 2.1.6 Conductor with map1 HS is not blocked from upgrading to 2.2.

Workaround: None

CLONE (2.1.7) - Health data is sent when it is disabled in the Conductor.

Workaround: None

The Route Notice check does bit check the currently configured routes.

Workaround: The UI warns that you need an Overlay Gateway Address even though one is already configured.

Using the mvebu image as an example, it lists the 250 variants before the 150 variants.

The x86 image is fine.

Workaround: The list of platforms supported on a build image should list them in numerical order

The Conductor net/net utility incorrectly allows the setting of two (2) default routes.

Workaround: Set only one (1) default route and then apply static routes via the Setup page, under Conductor UI General Settings,.

HIPclient chooses an incorrect interface and cannot establish a connection with devices behind a HIPswitch running on the Google Cloud Platform (GCP). It has to do with having multiple active interfaces.

Workaround: In the HIPclient configuration, select your desired network interface instead of allowing the HIPclient to automatically choose an interface.

Removing the Conductor HA does not remove the standby Conductor's address from the HIPswitch Conductor search list on HIPswitches running versions previous to 2.0.

Workaround: De-configuring Conductor HA does not remove the Standby Conductor's address from the HIPswitch Conductor search list on HIPswitch versions older than v2.0. Customer should upgrade to 2.1x.

If you perform a factory reset on a Conductor that's in HA-mode, the database gets into a bad state and Postgres won't start. Note that a second factory reset fixes the issue.

Workaround: Factory resetting a Conductor that's in an HA-pair doesn't work correctly the first time. To fix this, a second factory reset is required.

When attempting firmware upgrades get failure messages.

Workaround: The first attempt to upgrade fails, reboot the HS and upgrade again. (this clears out old /tmp files)

When route injection is enabled, a HIPswitch protected subnet must contain only one HIPswitch. Additionally, any custom routes added to the route table are deleted when route injection is enabled.

Workaround: If you want to deploy multiple HIPswitches in the same protected subnet or keep your custom routes, disable route injection.

101g: Ping peer HIPswitches pings wrong Underlay IP.

Workaround: On Mac and Linux HIPapp, if your computer has multiple active NICs and you select a specific NIC in HIPapp configuration, it instead lets the operating system chose the NIC for outbound traffic.

If your computer has multiple active NICs and you select a specific NIC in your HIPclient configuration, the operating system will choose the NIC for outbound traffic.

Workaround: None

In rare cases, the Conductor HA pair will stop syncing.

Workaround: If this happens, promote the HA-secondary to a primary, then re-pair them.

The IP address field on associated with a HIPswitch may be blank on the HIPservices tab.

Workaround: You can locate the IP address information under the Reporting tab.

Toggling policy on and off too quickly on a HIPswitch hosted in Google Cloud can result in the Route Table becoming out of sync when using route injection.

Workaround: After toggling policy, wait 10 seconds before toggling it again.

When reconfiguring your Underlay network from one physical port to another in the Conductor, the changes may not be applied successfully and the configuration will revert back to the original settings.

Workaround: Make the configuration changes in diagnostic mode.

You can add a voucher code more then once from the Licensing tab. This does not create additional licenses, but is visually confusing.

Workaround: None

The Licensing tab may display invalid entries.

Workaround: Remove the invalid items manually.

When creating or editing a smart device group, rules can have the same ordinal values. This can cause unintended issues in the processing results.

Workaround: When creating rules, verify each rule has a unique ordinal value.

A fully qualified Domain name cannot be used for local or peer replication addresses on an HA Conductor pair.

Workaround: FQDN for Local or Peer Replication address on an HA Conductor pair can be used ONLY IF the reverse lookup yields the same FQDN

Device NAT functionality currently does not work with layer two (2) traffic.

Workaround: None

In some cases, allow incoming pings (ICMP) and SYN Flood Protection on the Firewall page may be disabled and won't toggle.

Workaround: Refresh your browser to resolve the issue.

After configuring the Conductor for the first time, you may receive a Lost Connection to the original server message if you select Return to settings too quickly.

Workaround. Wait at least 20 seconds before selecting Return to settings.

PCI Reporting shows the UUID reference instead of the name when generating a PCI report from Settings > Advanced > PCI Reporting > Downloads > User Activities Report.

Workaround: To view names, you can download object references from the same page where you generated the PCI report.