/
8.3.1 Release Notes

8.3.1 Release Notes

    Subscribe

    Important Announcements and Notes

    Read this section before you continue with the Release Notes below.

    Outdated technical features are subject to removal in order to keep the CloudGen Firewall up to date and performing properly. See the following two paragraphs for the features that will be removed in this release and the features that are subject to removal in upcoming releases.

    Certain features will be removed completely because they have become technically obsolete; other features have become outdated and will be replaced by improved technology.

    Features No Longer Supported as of the 8.3.0/8.3.1 Release

    • Generic Forwarder
      As of 8.3.0/8.3.1, networks that were entered in General Firewall Configuration -> Operational -> Generically Forwarded Networks are no longer supported and will be removed. Networks that are configured in this list will no longer be forwarded by the firewall after updating to release 8.3.0 or higher. You must configure a forwarding firewall service with corresponding rules to have this functionality.

    • Protocol 254/FW compression
      Firewall-to-Firewall compression has been discontinued and is no longer configurable. Traffic that was previously configured to use FW-2-FW compression will now be transported uncompressed.

    Features that Will Become Obsolete in an Upcoming Release

    • FWAudit

    • WAN Optimization

    • CloudGen Firewall Web UI

    Precautionary Security Measures for Control Centers

    If you have a Control Center deployed with the CC wizard and there is no ECDSA CC SSH key configured at CC Identity, Barracuda Networks recommends the following to avoid possible security risks:

    1. Manually create a new ECDSA "CC SSH key"

    2. Create a legacy CC SSH key with more than 512 bits

    Important Note for Users Wanting to Upgrade from Firmware Release 8.2.2

    As of February 6, 2023, you can now upgrade from firmware release 8.2.2 to firmware release 8.3.1. This upgrade can be installed both on CloudGen Firewalls and on Control Centers. However, as this is a special upgrade, there are two different methods of how you must perform it depending on the type of your appliance.

    For more information on how to upgrade from firmware release 8.2.2 to 8.3.1, see 8.3.1 Migration Notes.

    Use the Appropriate Firewall Admin Release

    Generally, Barracuda Networks recommends using the latest version of Firewall Admin for a new firmware release.

    As of the public availability of this firmware 8.3.1, Barracuda Networks recommends using at least Firewall Admin version 8.3.1-64. You can download this version here: https://dlportal.barracudanetworks.com/#/packages/5466/FirewallAdmin_8.3.1-64.exe.

    In case of upcoming hotfixes that solve known issues for Barracuda Firewall Admin, you can find the respective notes for the updated version(s) in this info box:

    Release Notes

    Firmware version 8.3.1 is a minor release.

    Before installing the new firmware version:

    Do not manually reboot your system at any time during the update unless otherwise instructed by Barracuda Networks Technical Support. Upgrading can take up to 60 minutes.

    IMPORTANT Note for Hotfix-1083

    SAML/ADFS Authentication also relies on the parameter Session Cookie Lifetime and can be configured at Box > Infrastructure Service > Authentication Service > SAML/ADFS Authentication, in section SAML Configuration. Switch to Advanced Mode in the left menu area, and click CONFIGURATION MODE to get access to this parameter.

    If you have SAML/ADFS Authentication enabled and the value for the parameter Session Cookie Lifetime is not 0, you must set the value to 0 after installing hotfix-1083.

    Changelog

    To keep our customers informed, the "Known Issues" list and the release of hotfixes resolving these known issues are now updated regularly. If there are intermediate updates to this release, the corresponding notes will be found in this info box.

    The following devices have reached EoL status:

    Device Type

    Model

    EoL Date

    Device Type

    Model

    EoL Date

    CloudGen Firewall

    F800 Rev. B

    2022-03-01

    CloudGen Firewall

    F900 Rev. A

    2021-11-31

    Control Center

    C400

    2022-02-28

    Control Center

    C610

    2022-02-28

    Modem

    M10 (3G/UMTS)

    2019-03-31

    Modem

    M11 (3G UMTS)

    2021-09-30

    What's New in Version 8.3.1

    CGF Policy Profiles

    On Barracuda CloudGen Firewall version 8.3.1, a new feature has been implemented that allows central management of SD-WAN policies as well as policies for handling different network scenarios and applications. Policy profiles are predefined rules that can be applied to access rules on Control Center-managed or stand-alone firewall units. The Barracuda CloudGen Firewall allows administrators to manage, create, and customize general policies on global, range, cluster, or box level that can then be applied to access rules instead of configuring firewall objects. You can customize default profiles by adding or modifying policies or creating new profiles with explicit policies. This new feature is specifically designed to simplify the handling of policies, especially on a global scale. For more information, see Policy Profiles.

    The Barracuda CloudGen Firewall provides the following policies:

    SD-WAN Policies

    SD-WAN provides multipath VPN tunnels across all providers with redundant, reliable, and fail-safe network connections. The Barracuda CloudGen Firewall provides a predefined default configuration of SD-WAN policies that allows you to use the advantages of SD-WAN immediately, without even having to set up your own configuration. For more information, see How to Create SD-WAN Policies.

    Application Policies

    Application policies allow administrators to block, allow, or customize traffic for detected applications on a global and local level. Create explicit profiles and policies on the Control Center and assign them to access rules on managed firewalls. For more information, see How to Create Application Policies.

    URL Filtering Policies

    Barracuda Networks provides a large database for URL filtering. The default action of a policy can be either to block all and define exceptions that are allowed or to allow all and define exceptions that are blocked. You can customize a URL filtering policy profile to match individual requirements, or you can create explicit policies. For more information, see How to Create URL Filtering Policies.

    Malware Protection Policies

    Malware protection offers protection against advanced malware, zero-day exploits, and targeted attacks not detected by the Intrusion Prevention System. Scanning is done according to the virus scanner configuration and, if an Advanced Threat Protection (ATP) license is present, also by the ATP engine. For more information, see How to Create Malware Protection Policies.

    SSL Inspection Policies

    SSL Inspection decrypts inbound and outbound SSL and TLS connections so the Barracuda CloudGen Firewall appliance can allow features, such as Malware Protection and the Intrusion Prevention System (IPS), to scan traffic that would otherwise not be visible to the firewall service. For more information, see How to Create TLS Inspection Policies.

    IPS Scanning Policies

    The Intrusion Prevention System (IPS) monitors local and forwarding traffic for malicious activities and provides various countermeasures to avert possible network attacks. Create explicit IPS policies to match individual network requirements. For more information, see How to Create IPS Policies.

    It is recommended to read the Known Issues section at the bottom of this 8.3.1 Release Notes article ( Known Issues related to CGF Policy Profiles ) before using CGF Policy Profiles.

    Barracuda Firewall Admin

    Barracuda Firewall Admin has undergone many changes, including those related to the new implementations listed below. The most salient improvements are as follows:

    New Network Activation

    Activating the network is now supported by two new dialog windows that include user-interface items displayed either statically or dynamically, depending on the context in which the window is displayed:


    The Soft option will be displayed only in certain required contexts.
    For more information, see How to Activate Network Changes.

    Automated Session Reconnect

    In the Control Center, the Connect button for reconnecting to a lost session has been removed. Reconnecting is now done permanently in the background. Firewall Admin checks the availability and immediately reconnects to an appliance when it becomes available after a previously lost session.

    Automated HA Auto Pairing

    The HA Auto-Pairing feature has been improved and now supports automated pairing of two Control Centers as well as the automated pairing of managed firewalls.

    For more information, see HA Auto-Pairing and How to Enable HA Auto-Pairing for Two Managed Firewalls.

    Barracuda Firewall Admin

    If multiple tabs are open in Barracuda Firewall Admin and the main window will be closed by clicking the 'X' symbol in the upper right corner of the window, a dialog will be displayed giving the user the choice to cancel the closing of all tabs or to keep Firewall Admin's window open. The option of displaying the dialog window can be turned off via a checkbox.

    C2S TINA VPN Improvements

    Unlike before, when network routes could only be entered as an IP address, they can now be entered as a domain in the group policies. These domains will be resolved by the CloudGen Firewall when a client connection to the firewall is established using Barracuda Network Access Client. In addition, a description can now be added to the domain names. This feature also is available when creating licenses for VPN users or when creating network routes for a template.

    On the NAC client site, these added domains will be introduced to Windows machines as routes using their related IP addresses. In order to log the DNS calls to resolve the introduced routes, some new logs have been added to the NAC client.

      We value your feedback.
      If you have questions, suggestions, or feedback on our documentation, contact the Campus Product Documentation team.
      For general product inquiries or technical support, please contact the global Barracuda Support team.