10.5.0 Release Notes

Read this section before you continue with the Release Notes below. Installation of Firmware 10.5.0 IMPORTANT Before updating to firmware 10.5.0, ensure that the box identity certificates and keys are updated to the length of 2048 bit! After updating to release 10.0.0 from 8.3.x or 9.0.0, some files from the installation are not cleaned up as expected. However, this doesn't have an impact on properly running firmware 10.5.0. Updating from firmware >= 9.0.1 doesn’t cause this issue and works as expected! Encryption, Weak Ciphers NOTE: As of firmware release 10.0, weak ciphers no longer support specific features for security reasons: NTP peering no longer works with SHA1. [BNNGF-97461] Syslog Streaming: Syslog streaming accross TCP TLS connections no longer accept RSA public key sizes of 1024 bits or less. [BNNGF-97492] TLS Protocol with SSLv3 is no longer supported by the newer OpenSSL versions and has been deprecated. [BNNGF-97493] If you are using syslog streaming, you must take the following measures: For every CGF-managed box, you must check the bit length used for syslog streaming. For every CGF-managed box that sends logs to the CC via Syslog Streaming, you must change the TLS protocol at least to version TLS 1.2 and change the configuration for a larger bit length at Syslog Config > Trusted Clients. For more information before migrating to 10.0.0, see . TLS inspection no longer supports hosts with SHA-1 signed certificates! (BNNGF-99949) The Explicit Transport Listening IP field in VPN GTI Settings now displays network addresses in CIDR instead of Phion notation. [BNNGF-99632] Multi-App Matching Note that after updating to firmware release 10.5.0, existing setups can show a different behavior due to multi-app matching. For more information, see: Access Rules and TLS Access rules with a user agent policy must have TLS added as additional protocol so that the policy matches properly. [BNNGF-97989] Naming of Shared IP v4/v6 Addresses The characters '.' and'-' are not allowed in names of SharedIP IPv4 and IPv6 addresses. [BNNGF-89810] SNMP NOTE: The SNMP value for active C2S connections is wrong. [BNNGF-94918] Removing the file vpnstatus.db will solve the issue. End-of-Life and End-of-Support Status For information on which devices and services have reached EoL or EoS, see: Barracuda NextGen and CloudGen Firewall Appliances - EoS / EoL Definitions End-of-Support for CloudGen Firewall Firmware Licensing Virtual images are now distributed with the VFC model preset by default because the VF model is deprecated!

Firmware version 10.5.0 is a major release. Before installing the new firmware version: Do not manually reboot your system at any time during the update unless otherwise instructed by Barracuda Networks Technical Support. Upgrading can take up to 60 minutes. To keep our customers informed, the history of this Release Notes article, the "Known Issues" list (at the end of this article), and the release of hotfixes resolving these known issues are now updated regularly. If there are intermediate updates to this release, the corresponding notes can be found in this info box. 10.03.2025 – Release of firmware 10.5.0 18.3.2025 – Release of Hotfix 1160 - IPS FPU state handling for CGF/SE 10.0.1 For more information, see HF-1160 - IPS FPU State Handling for CGF/SE 10.0.1. 24.3.2026 – Release of Hotfix 1159 - FEC handling leads to system crash. For more information, see FEC handling leads to system crash. 7.4.2026 – Release of update package including a fix for a reboot loop which occured in specific situations. 5.5.2026 - Release of Hotfix 1168 - Cumulative for CGF 10.5.0 For more information, see https://dlportal.barracudanetworks.com/#/packages/6497/cumulative-1168-10.5.0-277548623.tgz.

Use the Appropriate Firewall Admin Release Barracuda Networks recommends using the latest version of Firewall Admin for a new firmware release. As of the public availability of firmware 10.5.0, Barracuda Networks recommends using at least Firewall Admin version 10.5.0. You can download this version here: Barracuda Firewall Admin 10.5.0-213. Who Can Update to Firmware Release 10.5.0 Read the Migration Notes 10.5.0 before updating to firmware 10.5.0. For more information on the migration process, see the .

While new requirements can result in adding new features, existing features can become obsolete over time. To keep the CloudGen Firewall up to date and performing properly, certain features will be removed completely, and others may be replaced with improved technology. Features that Will Become Obsolete in an Upcoming Release (after 10.5) CGA Proxy The CGA Proxy will be phased out in an upcoming release. CudaLaunch & SSL-VPN CudaLaunch and SSL-VPN will be phased out in an upcoming release and will be replaced with SecureEdge Access. Features that Are No Longer Included in this Version 10.5 If you require one of the listed features, do not update to this firmware version! SF Licensing Old SF licensing is no longer supported and has been phased out. Cloud Deprecations The following features are no longer part of the 10.0 firmware release: AutoVPN Metered billing Azure Security Center Support ClamAV ClamAV has been removed in firmware 10.0. M30 Modem The M30 modem is no longer supported. OMS Agent, Azure Log Monitor Agent The OMS Agent and the Azure Log Monitor Agent has been replaced with Azure Log API. Branch Office Box VPN Compression The “BoB” Branch Office Box VPN Compression is no longer supported by release 10.0.

Firmware 10.5.0 is a major release. Hardware A new hardware appliance is now available under the label F2000 Rev. A. For more information, see . Authentication DC Client Rewrite The Domain Controller Client now connects to the Windows WMI interface directly to collect domain logon information, so a separate DC-Agent is no longer required. Security Group Tags The CloudGen Firewall now supports Security Group Tags to control the flow of information in an Cisco Trusted Network in conjunction with a Identity Service Engine running pxGrid 2.0. For more information, see . Besides the main configuration, the SGT feature will show up at different locations in the user interface: User Objects – CONFIGURATION > Config Tree > Signed Services > Firewall > Forwarding Rules > Firewall Objects > User and Groups, main view: New… window Edit/Create User Object > New…, right view Policy Patterns, button Add SGT… . Create New Policy – CONFIGURATION > Config Tree > Signed Services > Firewall > Policy Profiles > Applications, main view: Add Policy, window Create New Policy, section Criteria, menu list for Users: Access Rule – CONFIGURATION > Config Tree > Signed Services > Firewall > Forwarding Rules > Access rules: OAuth2 Authentication “Open Authorization” as an open standard for access delegation has been added as a new feature to the list of authentication schemes. For more information, see . Reporting Enhancements - Extended Firewall History As of this firmware release 10.5.0, the user is provided the option of writing the firewall’s history in extended form into a dedicated database. If this option is activated, a related button will be displayed in FIREWALL > History. For more information, see . SMTP-Authentication for Notifications Notifications now also supports SMTP via OAuth2 (Azure Entra). For more information, see Authentication Test You can now perform authentication test for newly configured authentication schemes. Basically, you must first configure the authentication scheme and can then test it with real user data to be entered in the test view. You can invoke the test page at CONTROL > Box, left menu column, Authentication Test. If a new scheme is available, it will indicated by the entry Do Authentication Test. In the dialog window presented next, enter you credentials in the related input fields and click Do Test. Firewall Enhancements Multi-App Matching For more information, see . Extended Firewall History The firewall history view at CONFIGURATION > FIREWALL > History now provides the option of writing the view’s entries into a history database. For more information, see . Barracuda Firewall Admin Single Sign On As of firmware release 10.5.0, Barracuda Firewall Admin now supports Single Sign On (SSO) into the firewall. This option is available after enabling it explicitly. For more information, see . Firewall Admin Settings The option for Always use Session Password (recommended) has been removed at Firewall settings, Client Settings > Authentication. Extended Firewall History The firewall history view at CONFIGURATION > FIREWALL > History now provides the option of writing the view’s entries into a history database. For more information, see . Auto-Lock for Service Tabs Double-clicking on a service tab in the configuration tree while keeping the CTRL-button pressed will open the related service label in the ribbon bar and immediately put the service node into locked mode. Switching from a CC User Interface Item directly to a Related Box Being logged in a Control Center in the view EVENTS and being presented a full list view of events from managed boxes, you can now switch directly from an event entry to the related box: The entry is based on the template “Log in to Box <yourbox>”. VPN-GTI Editor A new filter system has been implemented for the VPN GTI Editor. You can access and configure this filter by invoking the VPI GTI Editor on the required level (global, range, or cluster), and the bring the Services tab to the front. When clicking the down-arrow on the upper-right corner, you can invoke a help-page that describes the various options of how to feed the edit line to set up a correct filter. External Feeds The Control Center now provides an additional option for file updates: External Feeds. External Feeds provide the option of importing IP addresses and networks into Global Firewall Objects which can then be forwarded to managed firewalls to be considered in an access rule. For more information, see . Configuration Origins Creating a new configuration for a Control Center or a CloudGen Firewall is usually done interactively by an administrator in Barracuda Firewall Admin. However, configurations can also be created automated by the ConfTemplate framework or by another mastering instance like in SecureEdge. The Configuration Origins feature has been implemented to enable an administrator/user to distinguish between which source controls the parameter in question. There are three sources a parameter can be configured/modified/deleted: Manually by a user Through the ConfTemplates framework By a SecureEdge instance Indicator for Source of Control If a parameter is controlled by manual editing, a ‘pencil’ symbol left to the edit field will indicate this in the related configuration view. If such a parameter will be controlled by ConfTemplates, the user will see an ‘eye’ symbol instead indicating that the ConfTemplate controlled parameter is for a manual modification now in ‘read only’ mode. The same applies for a ConfTemplate managed parameter if a parameter is controlled by a SecureEdge instance. In short, the following list of priorities apples: SecureEdge (highest) ConfTemplate Manual (lowest) REST The REST framework has been improved at several places. Sharing Explicit Policy Profiles Shared Policies can now be created, updated, deleted, listed, and shared: https://<REST-API-IP>:8443/rest/cc/v1/config/ranges/<range>/clusters/<cluster>/boxes/b1/service-container/<service>/firewall/policies/<policyType>/config The policyType can be one of the following: fileContent malwareProtection urlFiltering userAgent ips tlsInsepction applications sdwan It then can be referenced on a global, range, or cluster level: https://<REST-API-IP>:8443/rest/cc/v1/config/ranges/<range>/clusters/<cluster>/boxes/b1/service-container/<service>/firewall/policies/<policyType>/mode Custom Applications REST API endpoints were added to create, update, delete, list and read custom applications according to these two application types: Node Locking Before these improvements, it was necessary to lock the whole box node for editing/modification a box' subnode. As of firmware 10.5.0, now the affected node can now be locked via its REST endpoint without preventing other administrators accessing another node on the same node level of the box. RCS Messages for ConfTemplates RCS commit messages can now be specified in the ConfTemplates REST API endpoints. Access Rules ConfUnits have been updated and now support access rules. Resetting a ConfTemplates Instance to its Originating ConfTemplate Sometimes it can happen that a user wants to reset a specific ConfTemplate instance to its originating ConfTemplate. His can now performed by using the following REST API command: curl --request POST \ --url <https://<REST-API-IP>>:8443/rest/cc/v1/ranges/<range>/clusters/<cluster>/boxes/<box>/ resetToConfTemplate \ --header 'Authorization: Basic cm9vdDphOjphYWM3NzQ0M2RmNzdmNDRkMjJmZmNhMWY1ZDJiODdjMA==' ConfTemplates Improvements ConfTemplates Accessibility via Tab The Configuration Templates window is now being displayed as part of a ‘Tab’ in the ribbon bar. This provides a higher degree of flexibility during configuration processes so that a user can switch from the ConfTemplates view to another view related to a another tab. Simplification of ConfTemplates Configuration In the Configuration Units view, the parameter Configuration Unit Condition has been removed. Existing ConfTemplates will not be affected, the parameter will be continued to be evaluated. However, as of firmware 10.5.0, it is no longer necessary to configure this parameter. The Template Binding parameter has been removed because its relevance has been replaced by the new Configuration Origins feature. Telemetry The list of telemetry has been updated with new parameters: For more information, see .

Box Installations, Installer Update An installer script no longer terminates unexpectedly before the end of the update procedure. [BNNGF-98039] Filesystem checks after updating now work as expected without user interaction. [BNNGF-100500] Authentication Parsing errors for SAML no longer occur. [BNNGF-94863] When some of many RADIUS servers become unavailable, requests to the remaining servers are now performed correctly. [BNNGF-95928] Mismatches of users in the authentication database no longer occur in specific situations. [BNNGF-96407] SAML no longer runs into errors in specific situations. [BNNGF-96557] The Message-Authenticator attribute in RADIUS authentication is now calculated correctly. [BNNGF-96737] Firewall authentication with SAML now works as expected. [BNNGF-97079] Parsing data for authentication purposes no longer fails in specific situations. [BNNGF-98408] An issue was fixed where users sporadically lost access to their ZTNA resources. [BNNGF-98480] 10.0.0 Control Centers now read SAML IDP metadata correctly. [BNNGF-98588] RADIUS authentication with Cisco ISE now works as expected. [BNNGF-99473] The system now correctly maintains HA configurations and licenses of an HA setup. [BNNGF-99841] The TS-client now works as expected if multiple terminal servers start up in parallel. [BNNGF-99922] Barracuda Firewall Admin The space character is now allowed to be used in Admin Password. [BNNGF-74733] The new parameter Terminate Session on Interface Change has been added to the rule editor in the section Dynamic Interface Handling. [BNNGF-81936] A new Authentication Test feature has been added to the CloudGen firewall. [BNNGF-94035] The Priority (fka Transport ID) has been reintroduced for rulesets and FW Live for the ruleset feature level 9.0 and above. [BNNGF-95872] The field Usage Count in Firewall > Forwarding Rules no longer displays negative values and stays empty if the counter is 0. [BNNGF-96693] To avoid long waiting times and occasional out-of-memory crashes, Firewall Admin does not load all history entries by default. [BNNGF-97037] The maximum size limit for compiled FW rulesets has been added to General Firewall Settings > Operational, section Ruleset Related Settings as the field Ruleset Size Limit Mode. [BNNGF-97496] Barracuda Firewall Admin no longer crashes when opening the URL Filter policy. [BNNGF-97779] Barracuda Firewall Admin no longer mistakenly sets the priority in GTI setups with more than one transport per class. [BNNGF-97888] The label Transport ID has been replaced by the new UI label Priority at several places in the UI. [BNNGF-97895] When creating a site-to-site TINA tunnel for config version 8.3 in Firewall Admin, the transport class for BULK is now set correctly. [BNNGF-97899] VPN site-to-site configurations no longer cause issues when they are transferred between different firmware versions via import/export/RCS. [BNNGF-97947] Potential inconsistencies in GTI TINA transports concerning either the newly introduced priority field (as of version 9.0) or the previously used transport ID will be automatically resolved. [BNNGF-97953] Cluster migration is denied if a node or a sub-node in that cluster has been added, modified, or removed without an activation. [BNNGF-97960] The handling of columns in the Live/History/Threat view and their visual organization has been improved. [BNNGF-97995] Barracuda Firewall Admin no longer crashes accidentally when clicking on a tab. [BNNGF-97996] Barracuda Firewall Admin now allows modifying user interface items only at places were it is officially allowed. [BNNGF-98031] Closing a tab with a right-button click now works as expected. [BNNGF-98041] Barracuda Firewall Admin no longer crashes upon startup when connecting to a firewall on box level. [BNNGF-98114] STARTTLS now works as expected when sending email test notifications. [BNNGF-98148] The option Allow Dynamic Mesh now works as expected in Barracuda Firewall Admin 9.0.5. [BNNGF-98185] Barracuda Firewall Admin no longer crashes when a user scrolls in CC logs. [BNNGF-98260] Barracuda Firewall Admin no longer crashes in specific situations. [BNNGF-98262] Barracuda Firewall Admin no longer freezes when a VPN profile is exported. [BNNGF-98283] GTI will now draw up to 100 services at once again. [BNNGF-98504] The usage counter for Network Objects now works as expected. [BNNGF-98530] Teams webhook URLs now also accept the ‘&’ and ‘=’ characters. [BNNGF-98717] Barracuda Firewall Admin no longer crashes in specific situations. [BNNGF-98846] A filter for finding relevant GTI tunnels has been added. [BNNGF-98936] An authentication scheme with the name ‘Other’ has been added for all CCs. [BNNGF-99025] The sorting for the column First Attempt at CONTROL > Remote Execution is now correct. [BNNGF-99103] Barracuda Firewall Admin now starts with no delay on the latest MS Windows OS versions without Internet access. [BNNGF-99131] The speed of opening the ConfTemplates tab has been increased, especially if there are many big templates and a lot of instances present. [BNNGF-99150] Barracuda Firewall Admin now provides the option to lock and open a node in the configuration tree. [BNNGF-99160] Barracuda Firewall Admin now indicates with a lock symbol if a config tab is locked. [BNNGF-99161] You can now connect to any box from a menu list in the CC eventing view. [BNNGF-99165] Duplicate entries for Transport Source/Listening no longer occur in the GTI editor if the configuration is unlocked. [BNNGF-99172] A new setting for limiting the number of network objects to be displayed in the UI at according places has been added the the Barracuda Firewall Admin Settings in the section FW Rule Editor. [BNNGF-99521] As of firmware 10.5, Barracuda Firewall Admin offers the option to login with a session password. [BNNGF-99523] The Explicit Transport Listening IP field in VPN GTI Settings now displays network addresses in CIDR instead of Phion notation. [BNNGF-99632] The description for the URL Category "Local Communities" now contains the correct text description. [BNNGF-100111] GTI no longer limits the number of services to be drawn. [BNNGF-100217] Firewall Admin now preserves the complete IKEv2 VPN tunnel configuration when managing boxes on older cluster or firmware versions, so site-to-site VPN tunnels keep working after configuration changes. [BNNGF-100765] Barracuda OS Removing a group policy only affects objects that are not referenced by other policies and afterwards displays a notification about objects that have not been deleted because they are still in use. [BNNGF-66288] The Instant Replacement feature is now displayed for CloudGen Firewalls as expected. [BNNGF-84799] The characters '.' and'-' are not allowed in names of SharedIP IPv4 and IPv6 addresses. [BNNGF-89810] The logging for NTP has been improved. [BNNGF-92032] The assignment of licenses to multiple boxes no longer causes issues. [BNNGF-92606] The logic for cleaning up licenses has been improved. [BNNGF-93063] The size of SNMP buffers has been increased and no longer causes issues. [BNNGF-93414] Activity log streaming is now more reliable and robust when the firewall is under high load. [BNNGF-94358] WCS 3.3 contains new categories. See the section New Features in Version 10.0.1 of the 10.0.1 Release Notes. [BNNGF-95628] After enabling header reordering, the list Reference in CONFIGURATION > Box > Configuration Tree > Network > Interfaces now displays correct values. [BNNGF-95824] SMTP passwords can now be longer than 56 characters. [BNNGF-95856] Reachable IPs now work as expected after sending changes in Firewall Admin. [BNNGF-95929] Logging has been improved to reduce confusion if no admins are configured. [BNNGF-96116] The network activation now works as expected after changing the MTU in the interface configuration. [BNNGF-96634] Connection failures no longer occur when rebooting a primary or secondary HA box with VMAC enabled. [BNNGF-96724] Unexpected errors no longer occur in the context of System Email Notifications. [BNNGF-96815] Statistics are stored in the correct folder as expected. [BNNGF-97061] Log files are stored in the correct folder as expected. [BNNGF-97308] TOTP bulk enrollment for multiple users now works as expected. [BNNGF-97441] A fix to the kernel has been implemented to prevent potential crashes. [BNNGF-97595] The upgrade process has been improved to perform a file system check before the upgraded box reboots. If an upgrade failure is detected, the box boots into the previous firmware, and the user must check manually. [BNNGF-97652] Box level SNMPd now works as expected. [BNNGF-97889] The ISO download now works as expected on unmanaged, updated boxes. [BNNGF-97961] STARTTLS now works as expected when sending email notifications. [BNNGF-98032] Updates from firmware 9.0.4 to 10.0.0 can now be performed using the system scheduler. [BNNGF-98174] System report generation via Firewall Admin works as expected. [BNNGF-98263] Syslog streaming using TLS now works as expected with respect to the box key size. [BNNGF-98382] The eventS logfile is sent to XDR. [BNNGF-98437] Watchdog CPU load limits have been recomputed based on the new hardware specifications. If the default values are not set and the feature is enabled, a logic now calculates the CPU load limits based on the hardware. [BNNGF-98497] The installation of a hotfix now works as expected, and the status is displayed correctly in the CC's firmware management tab. [BNNGF-98880] The watchdog is now active when it is enabled. [BNNGF-98881] The GRE tunnel configuration no longer creates unexpectedly a wild route. [BNNGF-99031] The configuration view for Multipath Routing now contains the Multipath Gateway field. [BNNGF-99094] Segmentation faults caused by cstatd no longer occur in specific situations. [BNNGF-99155] Boxes no longer create an unnamed logfile containing BGP related log messages. [BNNGF-99283] Trying to upgrade to 10.5.0 with an RSA box key <2048 bits will not be allowed. The box-key needs to be generated before the update can take place. [BNNGF-99346] Multicast Routing can be configured on a CC as expected. [BNNGF-99364] Azure Log Streaming CEF via CGF Log Daemon now works as expected. [BNNGF-99374] Sysstat and btop tools have been added to the firmware. [BNNGF-99466] The IKEv2 tunnel status is shown correctly again in SNMP. [BNNGF-99475] Virtual VIP IPv6 is no longer required even if IPv6 is enabled. [BNNGF-99517] Layer 3+4 Bond Hashing Policy description has been added to Barracuda Firewall Admin. [BNNGF-99564] Translated ports are also logged in the activity log. [BNNGF-99567] The traceroute package is again part of the firmware. [BNNGF-99649] IPMI login passwords may have a maximal length of 20 characters. [BNNGF-99935] Error messages that there are cloud configuration conflicts without being in a cloud no longer occur. [BNNGF-100429] Cloud AWS The CloudGen firewall now supports the more secure IMDSv2 for retrieving AWS instance metadata. [BNNGF-93721] AWS EC2 appliances can now update to firmware 10.0 as expected. [BNNGF-97988] Updating an AWS box from version 9.0.4 to 10.x now works as expected. [BNNGF-99006] Cloud Azure The security log table now comprises all relevant fields. [BNNGF-97857] Azure Log Streaming CEF via CGF Log Daemon now works as expected. [BNNGF-98002] Updating to 10.0.0 no longer breaks PAYG licenses. [BNNGF-98883] The authentication URL and associated parameters are now configurable for the Azur public clound. [BNNGF-100261] Control Center RCS now works again as expected. [BNNGF-91160] It is now possible to edit both local IPv4 and IPv6 networks for any tunnel in GTI. [BNNGF-95623] Changes in the GTI editor are no longer reverted unexpectedly. [BNNGF-96213] ConfTemplates can now use Global Firewall Objects only for the CGF. [BNNGF-96556] Firewalls no longer show up unexpectedly in CC events after having been removed from the list of boxes. [BNNGF-96578] The warning for duplicate hosts is now triggered as expected for Global Objects in Control Centers. [BNNGF-96695] On the Control Center, Firewall Objects no longer appear in the network settings after having been deleted. [BNNGF-96739] CC Admins with cluster-limited access now have access only to authorized Auth-Sync zones. [BNNGF-97301] Admin users can now access the firewall as expected. [BNNGF-97992] The firmware update tab in Barracuda Firewall Admin now displays boxes as expected. [BNNGF-98038] Adding a new SNMP service to a newly created box works as expected. [BNNGF-98083] If changes are made to a global reference remote network object and the object will be used by an HA cluster, the changes will now be updated on both instances of the HA pair as expected. [BNNGF-98201] Editing the global ruleset now works as expected on a 10.0.0 CC. [BNNGF-98251] TINA tunnels are no longer unexpectedly removed when invoking Send Changes in VPN. [BNNGF-98308] The RCS view no longer shows empty entries in specific situations. [BNNGF-98498] The firmware update tab in Barracuda Firewall Admin now displays boxes as expected. [BNNGF-98599] It's no longer necessary to specify NTP server when configuring DHCP subnets via a ConfUnit. It's no longer necessary to specify NTP server when configuring DHCP subnets via a ConfUnit. [BNNGF-98967] Service settings for AV of the related ConfUnit now write Explicit Listening IP correctly. [BNNGF-98991] The interface ConfUnit now supports the change of Port/Speed/Negotiation Setup via REST. [BNNGF-99268] Global DNS firewall objects now show IP addresses as expected. [BNNGF-99430] The RSC-SCP script now works as expected. [BNNGF-99498] Copy-Move-GTI VPN configurations no longer cause crashes in specific situations. [BNNGF-99792] Trustzone syncs now work as expected. [BNNGF-99811] DHCP The description for a raw vendor ID has been improved. [BNNGF-98587] The reverse map entry for DHCP-DDNS is now sent correctly. [BNNGF-98876] In Advanced config mode the field for vendor ID, ‘raw’ was removed and migrated to vendor ID, and Vendor ID conversion is set to raw. [BNNGF-99132] The DHCP tab now shows all active leases as expected. [BNNGF-99736] DNS The text for Forwarders Selection under Administrative Settings > Caching DNS Service > Forwarders Selection in Firewall Admin has been reworked. [BNNGF-95545] Measures have been taken to counteract the impact of CVE-2025-40778 and CVE-2025-40780. [BNNGF-99468] Firewall The passive HA unit does not flood the SSL log anymore when a too small box key is configured. [BNNGF-81600] App detection now works as expected if overlapping DNS URLs are configured. [BNNGF-95006] Global, range or cluster URL Filter Match Objects do not erroneously get dereferenced anymore when used as ABPS condition. [BNNGF-95076] Long running low bandwidth sessions (for example web radio streams) do not cause high memory use anymore. [BNNGF-96300] HTTP/1.1 sessions with Connection: close and without Content-Length or Transfer-Encoding are now handled correctly. [BNNGF-97182] Certain session types now work more reliably over non-ethernet networks. [BNNGF-97874] If the forwarding firewall is run in policy mode, policy profile rules in the local and special ruleset are now correctly processed. [BNNGF-98021] Resolving DNS objects now works as expected. [BNNGF-98033] The SD-WAN ID has been added to the IPFIX flow [BNNGF-98064] The menu option for Measure Provider Performance is no longer available. [BNNGF-98124] TLS Handshake processing now works more reliably. [BNNGF-98175] DNAT with fallback now works as expected. [BNNGF-98176] The Firewall Insights dynamic network object is now handled correctly. [BNNGF-98177] WCS test works as expected. [BNNGF-98250] DNAT with DNS objects no longer ends up in Block local loop states. [BNNGF-98344] Malware policy evaluation has been implemented for SMTP and POP3. [BNNGF-98457] Terminated sessions are now removed as expected. [BNNGF-98534] A new CLI command has been implemented for an easy-to-use URL categorization lookup. [BNNGF-98537] In specific cases, like for certificate chain configurations, the root certificate is removed when fwauthd presents the certificate to the clients [BNNGF-98589] The tap process no longer crashes in specific situations. [BNNGF-98594] The usage counter for policy profiles now works as expected. [BNNGF-98742] Custom network applications with multiple endpoints for the same domain now process all endpoints. [BNNGF-98884] Some irrelevant kernel log messages have been removed. [BNNGF-99000], [BNNGF-99034] The kernel no longer crashes in specific situations. [BNNGF-99035] IPS hits no longer cause the box to crash in specific situations. [BNNGF-99114] The feature level of firewall rulesets is no longer overwritten by external-netobj-tool. [BNNGF-99126] HTTP sessions with downloads no longer fail while the downloads are being SSL inspected. [BNNGF-99129] The activity log now contains source and destination port after port translation. [BNNGF-99226] The firewall engine now starts as expected on an F1000 appliance. [BNNGF-99313] SD-WAN ID does not show Fail anymore for VPN transport sessions. [BNNGF-99348] The Viverse app is now detected correctly as a business app. [BNNGF-99384] If in an SD-WAN policy rule the action Pin to Group X or Prefer Group X is selected, then breakout traffic will now be balanced between all providers in the group. [BNNGF-99395] Proxy connect now works for all private IPv4 source addresses, not just for the configured subnet. [BNNGF-99404] Allow-listing of hosts in Virus Scanner Settings > Content Scanning does not lead to broken HTTP archive downloads any more if archive content scanning is enabled. [BNNGF-99497] Custom network applications are now detected as expected. [BNNGF-99739] Ipoque has been updated to version 25.12.19. [BNNGF-99777] Fields for messages of type "Remove" in the firewall's Activity Log are now filled. [BNNGF-99933] IKE tunnels are establishing again correctly and the error Block Slot Creation Failed is no longer shown. [BNNGF-100427] Hardware A new hardware appliance is now available under the label F2000 Rev. A. For more information, see . HTTP Proxy The HTTP proxy no longer crashes on reconfigurations. [BNNGF-96627] The HTTP proxy now shows an appropriate amount of information in error pages in the Administrator mailto: link. [BNNGF-99397] REST REST API requests now report consistent information. [BNNGF-92049] ConfUnits have been updated and now support access rules. [BNNGF-94123] Filenames may now contain the ‘-’character. [BNNGF-95177] After adding ‘&’ and ‘_’ to the set of allowed characters for licenses, the box no longer returns the error code when invoking the node for <<https://<your_box>>>:8443/rest/control/v1/box/licenses. [BNNGF-96288] The rule list for the host firewall rules now show inbound rules as expected. [BNNGF-96458] The option for reachable IPs is now available in the REST API as an endpoint. [BNNGF-96666] The restd no longer crashes when the block/unblock configuration updates endpoint is triggered. [BNNGF-98377] When locking a config node, the configuration data will be reloaded as expected and will prevent any bypassing by other sessions. [BNNGF-98434] The MTU information is now returned for the the REST-API call /rest/cc/v1/config/ranges/{range}/clusters/{cluster}/boxes/{box}/network/vlans/{name}. [BNNGF-100086] VPN Report Creator now displays the top user as expected. [BNNGF-71774] Resolving DNS has been improved for IKEv1. [BNNGF-96089] IKEv2 tunnel are now marked according to their real state. [BNNGF-96585] TINA transports are now established as they are configured. [BNNGF-97001] Old VPN tunnels are cleaned up as expected after renaming or moving the VPN service. [BNNGF-97052] KTINA warnings about tunnels with a transport no longer are mistakenly displayed for IPsec tunnels. [BNNGF-97856] TINA transports configured as Fallback and On Demand now work as expected. [BNNGF-97923] The label Transport ID has been replaced by the new UI label Priority at several places in the UI. [BNNGF-97965], [BNNGF-97986] The VPN service no longer crashes due to an expired certificate. [BNNGF-97997] Restricting a Client-to-Site VPN Group Policy to use only SHA512 now works as expected. [BNNGF-98013] Migrating tunnels from release 8.3 to 9.0 now works as expected. [BNNGF-98046] Client-to-Site disconnects are no longer occurring due to fixed issues on VPN compression. [BNNGF-98101] The VPN service no longer causes memory leaks. [BNNGF-98120] VPN dynamic high performance mode now works as expected. [BNNGF-98153] VPN Throughput performance has been optimized. [BNNGF-98246] Configuring a provider in GTI now writes it to the correct site. [BNNGF-98256] VPN no longer crashes in specific situations after decompression. [BNNGF-98293] Kernel issues have been resolved and no longer cause malfunctioning VPN transports. [BNNGF-98607] Migrating from transports to priorities no longer causes issues. [BNNGF-98963] In GTI, the active site now initiates a TINA tunnel as expected. [BNNGF-99141] A box no longer crashes in specific situations when using VPN in hybrid mode. [BNNGF-99152] GTI no longer uses incorrect addresses for transport source. [BNNGF-99306] The Windows NAC-client X.509-user/pass authentication now works as expected with certificates from the Windows certificate store. [BNNGF-99534] Kernel leaks no longer occur in specific situations. [BNNGF-99609] IKEv1 no longer stops in specific situations and now works as expected. [BNNGF-100368] All 10.5-Related Ticket Overview As of firmware release 10.5.0, more than 2000 tickets have been resolved. For more information, see .

Authentication – Authenticating a CC Admin with the authentication scheme TACACS+ fails on firewalls which have a high latency due to their long distance between their location and the CC (i.e., boxes in China). [BNNGF-98445] Authentication – MFA in combination with RADIUS is not working for CC admins. [BNNGF-100489] Authentication – SAML Single-Sign-On doesn't work on remote-managemant connections between a Control Center and a box. [BNNGF-100594] Barracuda Firewall Admin – The change of a password for a CC-Admin which is using an external authentication scheme does not work on the CC. [BNNGF-98450] Barracuda Firewall Admin – GTI Tunnels are not displayed in Firewall Admin 10.5 for non root users. [BNNGF-101179] Box Update – Azure CC is no longer reachable after the update to 10.5.0. [BNNGF-101343] Barracuda OS – The SNMP value for active C2S connections is wrong. [BNNGF-94918] Removing the file vpnstatus.db will solve the issue. Barracuda OS – GUI soft-activate causes fibre ports to go down. [BNNGF-98179] Barracuda OS – Using non-ASCII characters in Description fields of the Translated HA IP configuration might cause errors during firmware upgrade. [BNNGF-98494] Barracuda OS – It is not possible to delete event notifications. [BNNGF-100049] Barracuda OS – It is not possible to use hyphens for shared network names. An EA HF is available. [BNNGF-101107] Barracuda OS – Disabling logging in firewall rule does not also disable it in syslog stream (data is still sent). [BNNGF-100350] Barracuda OS – The snmpd module is using memory at an increasing amount. [BNNGF-101301] Barracuda OS – A model change (e.g. from F380B to F400C) might cause interface issues due to the different interface naming scheme (p<n> vs. port<n>). This will require the firewall to be set up from scratch. [BNNGF-101807] Barracuda OS – Licenses valid until the beginning of 2030 or later show the expiry date "never". [BNNGF-101858] Barracuda OS – OID for PSU is no longer displayed in SNMP walk. [BNNGF-101988] Barracuda OS – A dirty release is detected if SCEP is enabled. [BNNGF-102163] Control Center (Licensing) – Global CC Admin is unable to assign Range Pool license. [BNNGF-99838] Control Center – The import of large archive.pgz fails. [BNNGF-99857] A workaround is to unpack the pgz with the zcat command and then import the par file. Control Center - The update status in the Control Center is not shown correctly anymore. [BNNGF-101632] Control Center – Read-only admins cause authentication failure warnings. [BNNGF-100874] Control Center – The administrator password still works after it has expired. [BNNGF-101710] CudaLaunch – iPad Pro devices with a MagicKeyboard cause issues. [BNNGF-95273], [BNNGS-4004] This is effectively not a known issue caused by our product, but rather by the iPadOS. We recommend to update your iPad OS to version 18.2 or higher! DNS – New DNS records are only added after a DNS service restart. [BNNGF-101808] Firewall – Inspecting traffic for QUIC/UDP 443 is currently not supported.    [BNNGF-74540] Workaround: Blocking UDP/443 makes clients fall back to TCP, and then that app can be inspected. Firewall – DNAT with DNS object as target causes ‘Block local loop’. [BNNGF-98387] Firewall – DNS object references in Generic Objects are not considered. [BNNGF-99712] Firewall – URLcat based exceptions from TLS inspections do not work in application ruleset mode anymore. [BNNGF-99850] Firewall – The firewall creates multiple sessions with the same source port. [BNNGF-100185] Firewall – Geo Block rules are causing firewall traffic to be terminated for the wrong countries. [BNNGF-101868] [BNNGF-101194] Firewall – On boxes that use the distributed firewall service, the fwurlcatd process fails to start which also has an impact on sessions going through SD-WAN policies. Workaround is to disable SD-WAN and use no, explicit, or dynamic SNAT. [BNNGF-101410] Firewall – DNS objects are currently causing high memory consumption. An EA version is available. [BNNGF-101575] Firewall – The overall throughput readout is not working properly if the Last24h filter is applied. [BNNGF-101630] Firewall – Block pages only show the related application rule, but not the policy rule. [BNNGF-101617] OS Distribution – mount.cifs is no longer available in version 10.0.x [BNNGF-100371] REST - Calling the REST-API endpoint for interfaces frequently can report inconsistent interface metrics in specific situations. [BNNGF-100213] REST – REST API shows inconsistent firewall status compared to phionctrl CLI. [BNNGF-100248] REST – REST API calls cause increase in RAM for DHCP service. [BNNGF-100535] SecureEdge Integration – HA standalone integrated in SE: the secondary box does not fetch the config when it is the active box. [BNNGF-100288] SSL-VPN and Cuda-Launch – Shared folders and files are no longer accessible via CudaLaunch if the name of the shared folder or file contains a blank space.    [BNNGS-3970] Workaround: You can make the folder accessible if you share it yourself and replace any blank character with %20. VPN – GTI editor displays either no priority ID or an incorrect one.. [BNNGF-98585] VPN – TINA UDP fail over ends up in "Ignore Fast Request (Decryption failed)" log messages. [BNNGF-99407] [BNNGF-100967] Note: An EA-hotfix is available for firmware 9.0.5. VPN – IKEv2 PSK on iOS – Internet traffic not working. [BNNGF-101312] VPN – Customized welcome messages and bitmaps for Client2Site VPN are not applied properly. [BNNGF-101827] VPN – Windows VPN IKEv2 clients no longer get the DNS server IP list for resolving hostnames. [BNNGF-101991]