10.5.1 Release Notes

IMPORTANT NOTE BEFORE UPDATING TO 10.5.1 HF-1171 prevents firmware release 10.5.1 from being installed! If you have installed hotfix HF-1171, you must first uninstall HF-1171 prior to updating to firmware 10.5.1 and perform the following steps: Log into SSH as admin on your firewall. Enter the following command into the shell: rpm -e phionnet_hotfix_1171. This will remove HF-1171. Apply the update for firmware 10.5.1. Read this section before you continue with the Release Notes below. Installation of Firmware 10.5.1 IMPORTANT Before updating to firmware 10.5.1, ensure that the box identity certificates and keys are updated to the length of 2048 bit! After updating to release 10.0.0 from 8.3.x or 9.0.0, some files from the installation are not cleaned up as expected. However, this doesn't have an impact on properly running firmware 10.5.1. Updating from firmware >= 9.0.1 doesn’t cause this issue and works as expected! Encryption, Weak Ciphers NOTE: As of firmware release 10.0, weak ciphers no longer support specific features for security reasons: NTP peering no longer works with SHA1. [BNNGF-97461] Syslog Streaming: Syslog streaming accross TCP TLS connections no longer accept RSA public key sizes of 1024 bits or less. [BNNGF-97492] TLS Protocol with SSLv3 is no longer supported by the newer OpenSSL versions and has been deprecated. [BNNGF-97493] If you are using syslog streaming, you must take the following measures: For every CGF-managed box, you must check the bit length used for syslog streaming. For every CGF-managed box that sends logs to the CC via Syslog Streaming, you must change the TLS protocol at least to version TLS 1.2 and change the configuration for a larger bit length at Syslog Config > Trusted Clients. For more information before migrating to 10.0.0, see . TLS inspection no longer supports hosts with SHA-1 signed certificates! (BNNGF-99949) The Explicit Transport Listening IP field in VPN GTI Settings now displays network addresses in CIDR instead of Phion notation. [BNNGF-99632] Multi-App Matching Note that after updating to firmware release 10.5.0, existing setups can show a different behavior due to multi-app matching. For more information, see:   Naming of Shared IP v4/v6 Addresses The character '.' is not allowed in names of SharedIP IPv4 and IPv6 addresses. [BNNGF-89810]   Access Rules and TLS Access rules with a user agent policy must have TLS added as additional protocol so that the policy matches properly. [BNNGF-97989] End-of-Life and End-of-Support Status For information on which devices and services have reached EoL or EoS, see: Barracuda NextGen and CloudGen Firewall Appliances - EoS / EoL Definitions End-of-Support for CloudGen Firewall Firmware Licensing Virtual images are now distributed with the VFC model preset by default because the VF model is deprecated! LVM Migration Failure on Non-Standard Partitions Platform upgrades from 9.0.6 to 10.5.1 (LVM migration) may fail destructively on boxes with a non-standard partition layout where /phion0 is the first partition and /boot or / (root) is a logical partition number. [BNNGF-102408] How to check if a box is affected: If /boot or / has a partition numbers affected, run the following command on the box: parted -s /dev/sda print

Before installing the new firmware version: Do not manually reboot your system at any time during the update unless otherwise instructed by Barracuda Networks Technical Support. Upgrading can take up to 60 minutes. To keep our customers informed, the history of this Release Notes article, the "Known Issues" list (at the end of this article), and the release of hotfixes resolving these known issues are now updated regularly. If there are intermediate updates to this release, the corresponding notes can be found in this info box. 12.08.2026 – Release of firmware 10.5.1

Use the Appropriate Firewall Admin Release Barracuda Networks recommends using the latest version of Firewall Admin for a new firmware release. As of the public availability of firmware 10.5.1, Barracuda Networks recommends using at least Firewall Admin version 10.5.1. You can download this version here: https://dlportal.barracudanetworks.com/#/packages/6623/FirewallAdmin_10.5.1-71.exe. Who Can Update to Firmware Release 10.5.1 Read the Migration Notes 10.5.1 before updating to firmware 10.5.1. For more information on the migration process, see the .

While new requirements can result in adding new features, existing features can become obsolete over time. To keep the CloudGen Firewall up to date and performing properly, certain features will be removed completely, and others may be replaced with improved technology. Features that Will Become Obsolete in an Upcoming Release (after 10.5) CGA Proxy The CGA Proxy will be phased out in an upcoming release. CudaLaunch & SSL-VPN CudaLaunch and SSL-VPN will be phased out in an upcoming release and will be replaced with SecureEdge Access. Features that Are No Longer Included in this Version 10.5 If you require one of the listed features, do not update to this firmware version! SF Licensing Old SF licensing is no longer supported and has been phased out. Cloud Deprecations The following features are no longer part of the 10.0 firmware release: AutoVPN Metered billing Azure Security Center Support ClamAV ClamAV has been removed in firmware 10.0. M30 Modem The M30 modem is no longer supported. OMS Agent, Azure Log Monitor Agent The OMS Agent and the Azure Log Monitor Agent has been replaced with Azure Log API. Branch Office Box VPN Compression The “BoB” Branch Office Box VPN Compression is no longer supported by release 10.0.

Authentication User Helper Scheme to fetch Group Information from another Authentication Scheme [BNNGF-100818] A user helper scheme to fetch group information for users reported through TSAgent from another authentication scheme has been implemented. Barracuda Firewall Admin IKEv2 tunnel config. [BNNGF-99696] It is now possible to add multiple IPs or entire networks for remote gateways in the IKEv2 tunnel config. For more information, see . Barracuda OS Monitoring Policy for HA Auto-Pairing [BNNGF-94482] Translated HA IP has been added to be used during the automatic HA pairing on standalone HA boxes with 'Usage Policy = both'. A ConfUnit and REST endpoint have been added for the Monitoring Setup. The REST endpoint may now be used for CC managed HA boxes that use the automatic HA pairing, because the Translated HA IP isn’t added there automatically. RCS option to "Retrieve Versions" into certificate stores [BNNGF-100126] The option Retrieve Version in the sense of reverting to an old version is only allowed if referenced certificates/keys are not deleted. CC ConfUnit ConfUnit CGF for DHCP advanced [BNNGF-75508] A ConfUnit for advanced DHCP has been created. REST Object API - More Details for SiteSpecificObj [BNNGF-94078] The firewall network object REST endpoints now return a siteSpecific flag, so you can identify site-specific (pool) objects directly from a single response instead of combining multiple API calls. SNMP Shared Service [BNNGF-82785] A ConfUnit has been created to link the SNMP service to a box. ConfUnit: Service Settings for VPN doesn't accept Listening IPs [BNNGF-98978] Service settings for VPN now accept Listening IPs in the related ConfUnit. Policy Profile ConfUnits on unmanaged boxes [BNNGF-100733] REST API endpoints for managing policy profiles on standalone boxes have been added. Control Center Remote Execution: Audit Trail and Scope-Based Access Control (BNNGF-99614) New permission level "Run Box REXEC": Allows executing remote scripts and viewing execution status/logs without the ability to create, modify, or delete scripts. This fills the gap between "Show Box REXEC" (read-only) and "Manage Box REXEC" (full access). Audit logging: Remote script executions now record which admin scheduled them. The admin name is shown in the "Scheduled By" column in Firewall Admin, included in the execution log file header, and logged via NLOG for audit purposes. Script scope visibility: Scripts can now be scoped to global, a specific range, or a specific range/cluster. Admins only see and can execute scripts within their administrative scope. The scope is selectable when creating or editing a script in Firewall Admin. Improved duplicate and overlap checking for Custom Application objects (BNNGF-99281) On firewalls running 10.5.0 or later, the duplicate/overlap check for Custom Application host entries has been fully disabled — the firewall itself handles these cases correctly at runtime. On earlier firewall versions the check remains but now reports all conflicts in a single message and distinguishes exact duplicates from wildcard overlaps. DNS Local Lookup for DNS Interception [BNNGF-101110] In Advanced Configuration mode in Firewall Admin, there is now an option to allow DNS interception to respond immediately with local DNS results instead of waiting for upstream DNS lookups, which improves resilience during internet outages. Firewall Enhancements Multi-App Matching For more information, see . VPN Improvement of HSTS Settings [BNNGF-95951] Improvements have been applied to the HSTS (HTTP Strict Transport Security) settings for the SSL VPN portal to meet current security best practices.

Anti Virus The CAS-dispatcher no longer causes high loads in specific situations. [BNNGF-100632] Authentication When TLS inspection encounters certificates with the OCSP staple extension, it no longer causes certificate validations to crash. [BNNGF-96575] Azure AD Client Authentication updates are now synced every 2-3 seconds regardless of their configured setting. [BNNGF-96584] TACACS+-CC Admin SSH login now works as expected an no longer fails on boxes with high latency. [BNNGF-98445] In specific cases, like for certificate chain configurations, the root certificate is removed when fwauthd presents the certificate to the clients. [BNNGF-98589] Mandatory and optional parameters in the Authentication ConfUnits are now consistent with the configuration definitions [BNNGF-98966] Authentication packets no longer become lost in specific situations. [BNNGF-99183] A user helper scheme to fetch group information for users reported through TSAgent from another authentication scheme has been implemented. [BNNGF-100818] The Terminal Server authentication agent now uses a single shared SSL context for all connections, so it no longer exhausts file descriptors — or floods the log with Too many open files errors — when many terminal servers connect, including during shutdown or reboot. [BNNGF-101082] NGF Local Authentication works again as expected. [BNNGF-101587] Barracuda Firewall Admin In Barracuda Firewall Admin, the size of the terminal window now correctly reflects the window dimensions on initial connect and reconnect. [BNNGF-76293] In Firewall Admin, filtering the firewall rule list by Source, Destination, or Service now works reliably, matching the text you enter against those columns. [BNNGF-94201] Configuration Workspaces are available again in Firewall Admin, letting you organize the configuration tree into focused workspaces — including creating, locking, switching, and activating them — for easier day-to-day operations. [BNNGF-94212] The list entries in Firewall Admin at FIREWALL > Shaping are now displayed correctly. [BNNGF-94330] The licenses for secondary HA partners now show up on the CC > Licensing > Single Licenses page as expected. [BNNGF-94422] If no encryption is selected for the parameter Encryption in the GTI configuration window for TINA tunnels, the value None is now displayed instead of Null. [BNNGF-94430] Importing comments from a CSV file in Firewall Admin are now processed correctly if references are contained in the file. [BNNGF-95156] In Firewall Admin, the configured number of addresses in a named network object is no longer reset to 1 when you use Send Changes again after editing. [BNNGF-96038] In Firewall Admin, firewall rule statistics whose name contains "server" are now shown under the correct statistics node instead of appearing under Assigned Services. Rule statistics now display consistently and correctly for both standalone and CC-managed units. [BNNGF-96212] If multiple hotfixes are displayed in the update window of Firewall Admin, only one hotfix can be selected for update at a time. [BNNGF-96438] It is now possible to filter, search, and sort the lists for Dynamic Rules and Redirect Availability at Firewall > Dynamic > Dynamic Rules. [BNNGF-97056] Firewall Admin now shows a confirmation dialog when entering a network address where host bits would be silently cleared (e.g. entering 10.0.0.5/24 is stored as 10.0.0.0/24). The dialog shows both the entered and the normalized address and lets the user accept or reject the change. For CSV network object imports, a summary of all normalized entries is shown before confirming the import. [BNNGF-97157] In Firewall Admin, you can once again use the Tab key to move between filter fields in the Object Viewer. [BNNGF-98005] A password-change attempt now results in an error message instructing users to change passwords directly in the external authentication system. [BNNGF-98450] Firewall Admin 10 now shows the expiry date for intermediate and root cert correctly in the Control Center. [BNNGF-99472] After creating Client-to-Site VPN external CA in Firewall Admin, it no longer disappears and now remains in the list. [BNNGF-99563] It is now possible to add multiple IPs or entire networks for remote gateways in the IKEv2 tunnel config. [BNNGF-99696] Firewall Admin now stays stable when switching between live and history view or displaying VPN graphs. [BNNGF-99837] The Emergency Override now works on network nodes where references/objects are used. [BNNGF-99971] The firewall's log calendar navigation now works as expected and timelines no longer jump when clicking the month navigation buttons. [BNNGF-100047] Empty RCS diffs may be possible and indicate that there was a dummy change which did not change anything effectively. [BNNGF-100270] Renaming firewall objects directly in the object list now works reliably again, even when the '(manual)' origin label is shown. [BNNGF-100328] Firewall Admin now stays stable when navigating the BGP, PIM, and VRF views under Control > Network. [BNNGF-100414] Firewall Admin now prevents invalid ChaCha20/Poly1305 combinations for IKEv2 tunnels, so only working encryption settings can be configured. [BNNGF-100481] Links to documentation in the Firewall Admin now go to the new Barracuda Campus URL and removed those no longer working. [BNNGF-100499] Firewall Admin no longer crashes when rules inside of a ruleset cascade are deleted or when switching between network objects and rule editing. [BNNGF-100586] The character limit for the BCMC rule propagation list has been increased from 64 to 256 characters. [BNNGF-100750] In the Firewall Admin ruleset editor, sections can again be renamed and deleted, and deleted sections now stay removed after sending changes. [BNNGF-100752] Firewall Admin now preserves the complete IKEv2 VPN tunnel configuration when managing boxes on older cluster or firmware versions, so site-to-site VPN tunnels keep working after configuration changes. [BNNGF-100765] The IKEv2 'Restart SA on close' option is available again in Barracuda Firewall Admin and can be configured for VPN tunnels on managed firewalls running earlier firmware versions. [BNNGF-100789] In Firewall Admin, the Activation button now appears immediately after removing the secondary box of an HA pair, without requiring an additional configuration change. [BNNGF-100882] In the Firewall Admin ruleset editor, firewall rules can again be moved from one section to another. [BNNGF-101069] Building the configuration tree in Firewall Admin is now faster on large Control Center deployments. [BNNGF-101077] Unlike before, when any Firewall Admin version could be used, measures have been taken to ensure that CGF administration is only possible with validated Firewall Admin versions. [BNNGF-101081] The tool-tip for VPN High Performance Settings has been updated to and to covers the two states No and Auto. [BNNGF-101104] Firewall Admin no longer crashes when you type in a ruleset that contains sections — such as a distributed firewall's local or special ruleset — without first locking the configuration node or opening a rule. [BNNGF-101178] Duplicate log entries in multi-log view no longer occur. [BNNGF-101465] Barracuda Firewall Admin no longer crashes in specific situations caused by Intel driver issues. [BNNGF-101543] Firewall Admin now correctly recognizes when a repository-linked configuration has overrides, including after an undo or discard. [BNNGF-101580] Firewall Admin no longer crashes when the filter is changed in the Firewall LIVE window. [BNNGF-101584] When adding a distributed Firewall to a box with Firewall Admin, the Special(cfirewall) set now is displayed as expected in the Assigned Services list. [BNNGF-101634] In Barracuda Firewall Admin, Send Changes now completes significantly faster for large firewall rulesets — in one measured case, about 6 seconds instead of 19. [BNNGF-101662] Barracuda Firewall Admin now shows the correct Perfect Forward Secrecy (PFS) state for IKEv1 IPSec Site‑to‑Site tunnels — tunnels with PFS disabled are displayed accurately instead of incorrectly appearing as PFS‑enabled with DH Group 1. [BNNGF-101690] Killing a non-running URLcatd Handler no longer causes all processes to be terminated. [BNNGF-101696] Removing entries from the ACL persistently in Firewall Admin for a personal license now works as expected. [BNNGF-101721] Renaming a global firewall object that is referenced by firewall rules — such as a URL Filter (URL category policy) object — no longer resets its reference count or breaks the rule's reference. The references are now updated to the new name, so the rules keep matching. [BNNGF-101852] Firewall Admin no longer crashes during high load conditions. [BNNGF-101857] Shutting down or restarting the firewall's packet-filtering engine no longer crashes Firewall Admin in specific situations. [BNNGF-101914] Barracuda OS distd2 sessions are now closed and boxes now receive config updates as expected. [BNNGF-94218] The link for Translated HA IP is now also established during automatic HA pairing process on standalone HA boxes for later monitoring purposes. [BNNGF-94482] The soft activation feature now also considers correctly VLANs created via the CLI. [BNNGF-94564] A soft network activation no longer deletes source-based throw routes, and consequently routing failures no longer occur. [BNNGF-95077] CC Events from the CC box layer for port 811 now show the proper source IP. [BNNGF-95151] When migrating an F600 Rev. D C10 to an F800 Rev. C CCC, the port in the Shared IP configuration are migrated correctly according to the new naming scheme. [BNNGF-95373] Sending events to the Apple Push Notification Service now works again correctly. [BNNGF-96167] A system time change during a configuration activation — for example, from an NTP synchronization — no longer interrupts the activation or terminates the active session, so the configuration is applied consistently. [BNNGF-96253] A network soft activation no longer causes traffic interruptions in combination with source-based routes. [BNNGF-96515] The dashboard now displays correct information for fan and power supplies. [BNNGF-98284] Failsafe activation no longer leaves wild routes in the table. [BNNGF-98387] You can now import certificates into the Certificate Store from a PEM file whose private key is in PKCS8 format; previously the key in the file had to be in PKCS1 format. [BNNGF-98484] Using non-ASCII UTF-8 characters in configuration no longer causes issues during firmware update. [BNNGF-98494] SNMP has been extended by a new OID which reports the serial of an appliance. [BNNGF-99074] As of firmware versions > 10.0.1, 10.5.0, the size of the /art partition will be preset to 6,144 MB for all fresh installed boxes. [BNNGF-99111] Segment faults no longer occur in specific situations. [BNNGF-99112] Crashes in the VPN statistics service (vpnstat3) no longer occurs in specific situations. [BNNGF-99113] Box IPs in the Additional Local IPs are now reflected correctly in a dynamic network object, and ConfUnits now set appropriate default values to ensure dynamic objects to work correctly. [BNNGF-99188] Update packages containing an update and one or more hotfixes are now longer displayed in the update tab after their installation. [BNNGF-99233] The dynamic routing service no longer crashes in specific situation and now stays functional. [BNNGF-99436] Updating appliances to firmware version 10.0 now works as expected if /boot is not the first partition. [BNNGF-99659] In a High Availability setup, the Lock Failover command in Firewall Admin now always applies to the correct appliance, even if the status display has not yet refreshed after a failover. [BNNGF-99703] The startup time has been reduced for cases where NTP servers were not reachable during startup. [BNNGF-99813] The dashboard now shows the correct network interfaces and their link state when multiple DHCP connections are configured on the same physical interface, including when one of them is disabled. [BNNGF-99966] The SNMP version setting was moved to the SNMP Settings group, and the configuration was updated to enable or disable Access Groups and SNMPv3 Users accordingly. [BNNGF-99972] Event Notifications can now be deleted reliably — removed entries stay deleted after activating the configuration ('Send Changes'). [BNNGF-100049] PPPoE connections now reconnect automatically after going down, without requiring a manual configuration change. [BNNGF-100149] Disabling logging in a firewall rule now also disables it in syslog streaming. [BNNGF-100350] Mounting CIFS shares now works as expected. [BNNGF-100371] The cooldown period for SSH login is now handled as expected. [BNNGF-100387] VLANs are now displayed as expected in the network configuration drop-down menus and can be selected via the GUI. [BNNGF-100408] Restoring backup daemon backups on managed boxes and secondary HA boxes is now supported via REST with Emergency Override. Warning: Restoring a backup on a CC managed box can lead to inconsistent configuration states; after the restore, a full config sync needs to be manually triggered for the box to ensure system consistency. [BNNGF-100473] Network activations now work as expected. [BNNGF-100477] Filesystem checks after updating now work as expected without user interaction. [BNNGF-100500] Using the management interface for direct Internet access no longer causes a consistency error and now works as expected. [BNNGF-100601] Automatic HA pairing on SecureEdge now works as expected. [BNNGF-100720] The DASHBOARD now accounts buffer/cache memory available for use and no longer displays misleading memory usage values. [BNNGF-100732] IKEv2 (Charon) statistics files are now generated and displayed in VPN statistics as expected. [BNNGF-100753] Firewalls using pool licenses now boot reliably after installing or upgrading to 10.5.0, instead of running out of memory during startup. [BNNGF-100772] Firewall rules with logging disabled no longer cause Detect entries in the firewall activity log. [BNNGF-100795] The HA pairing daemon no longer causes crashes in specific situations. [BNNGF-100873] Fixed an issue where Web log (webmsg) for HTTP traffic was not generated under some circumstances. [BNNGF-100971] Development hotfixes are now shown in the system report as expected. [BNNGF-100995] Firewall Insights now keeps reporting correctly after upgrading to firmware 10.5.0. [BNNGF-101102] You can once again use hyphens in the names of shared networks and IPs, including additional IPv4 and IPv6 addresses. [BNNGF-101107] The Firewall Insights subscription status now shows whether the license is in use. [BNNGF-101135] The SNMP service memory statistics now include the memory usage of the snmpd sub-process, providing accurate visibility into total SNMP service memory consumption. [BNNGF-101156] The snmpd module no longer consumes increasing amounts of memory. [BNNGF-101301] After updating the Control Center, the list of appliances in the Firmware Update tab is filled as expected. [BNNGF-101353] Cloud firewalls originally deployed on firmware 9.0.x or earlier now retain network connectivity after upgrading to 10.5.x. [BNNGF-101573] Calltraces introduced in a former firmware version will no longer spam the klogd.log on updated firewalls. [BNNGF-101590] The firewall now supports ED25519 SSH keys for its SSH identity (host) key, providing a modern elliptic-curve option that is not based on NIST curves. [BNNGF-101649] The configuration integrity check now detects when the same shared IP address is assigned to more than one interface. [BNNGF-101656] CC ConfUnit A ConfUnit for advanced DHCP has been created. [BNNGF-75508] When you configure a DHCP server subnet in a configuration template, a missing interface is now flagged during editing, so the problem is caught at configuration time instead of failing when the instance is deployed. [BNNGF-98975] Cloud AWS Firmware images no longer include unused example scripts that could be misidentified as malware by antivirus scanners. [BNNGF-100840] Control Center Applying changes on the CC Admins tab are now logged into RCS/history/changle-log for auditing. [BNNGF-46245] Box model migrations no longer enable or disable Automatic HA Pairing, DHCP, and WWAN. [BNNGF-82157] An IPS profile can now be linked from a Repository or newly created 9.0 distributed firewall as expected. [BNNGF-96448] For importing a pool license, a cluster and range column has been added to the Select Pool License dialog. [BNNGF-97048] The handling of large configlog.db files has been improved and nodes in the Control Center no longer become locked because of too large database files. [BNNGF-98143] The full history for RCS report entries is now displayed correctly. [BNNGF-98424] Service settings for VPN now accept Listening IPs in the related ConfUnit. [BNNGF-98978] Importing .tld files in the ConfTemplate Editor now works as expected. [BNNGF-99010] Configuration templates now only require activation when they are actually changed. [BNNGF-99101] On firewalls running 10.5.0 or later, the duplicate/overlap check for Custom Application host entries has been fully disabled — the firewall itself handles these cases correctly at runtime. On earlier firewall versions the check remains but now reports all conflicts in a single message and distinguishes exact duplicates from wildcard overlaps. [BNNGF-99281] When deploying boxes via Control Center configuration templates, the recursive DNS lookup setting is now applied. [BNNGF-99312] Remote execution has been made audit-proof. [BNNGF-99614] Global Admins are now able to assign Range pool licenses as expected [BNNGF-99838] Segmentation faults no longer occur in the context of the CCDB, and the CC no longer reboots itself. [BNNGF-100031] For the F400c/F600d, the parameter Filemax is now set to 65536 when creating a box on the Control Center at Config > Create new Box. [BNNGF-100332] The root partition is no longer filled up with RCS session files which could cause the CC to be rendered unusable. [BNNGF-100472] Certificates from the Control Center certificate store can now be assigned to the VPN service and are applied to the VPN configuration as expected. [BNNGF-100766] ConfTemplate managed SCs now contain all required parameter in the box.dbconf when it is regenerated. [BNNGF-100808] Inappropriate authentication warnings for read-only admins no longer occur, and only justified authorization issues trigger a warning. [BNNGF-100874] The configuration tree in Firewall Admin now loads quickly again on large Control Center deployments, matching the performance of earlier firmware versions. [BNNGF-100994] Adding or removing instances to configuration templates after updating from 9.0.5 to 10.0.x now works as expected. [BNNGF-101347] SC Templates aren’t listed anymore in the Firmware Update view as boxes. [BNNGF-101407] When importing a PAR file from a virtual box into Control Center, the default rules within the firewall ruleset are removed correctly. [BNNGF-101463] Customer admin accounts no longer can see Edge Computing nodes in clusters without appropriate permissions. [BNNGF-101599] The Control Center now displays all managed boxes as expected. [BNNGF-101610] The Parameter Origin feature no longer slows down VPN tunnel config writes. [BNNGF-101623] Duplicate SecureEdge integration nodes no longer shop up in specific production units. [BNNGF-101679] DHCP Stateless DHCPv6 now works as expected after an upgrade to firmware 9.x. [BNNGF-90412] REST API calls no longer causes high RAM usage in conjunction with the DHCP service. [BNNGF-100535] DHCP server configuration changes no longer cause multiple duplicate DHCP processes running simultaneously, and high memory usage and service timeouts no longer occur. [BNNGF-101087] DNS In Advanced Configuration mode in Firewall Admin, there is now an option to allow DNS interception to respond immediately with local DNS results instead of waiting for upstream DNS lookups, which improves resilience during internet outages. [BNNGF-101110] Firewall The firewall now frees the memory associated with DNS-based (hostname) network objects when those objects are deleted, preventing gradual memory growth over time. [BNNGF-100855] Adding a Geo Block rule for specific countries now works as expected. [BNNGF-101194] [BNNGF-101868] Firewalls now report a clean release state after updating to 10.5.1, because the log directory keeps its correct group ownership throughout the upgrade. [BNNGF-101405] [BNNGF-101555] Access rules using the Any service object now correctly match all TCP and UDP traffic when using the accelerated ruleset. [BNNGF-101480] Resolved a rare kernel crash and firewall reboot caused by a long-standing timing flaw in how the firewall engine delivers internal messages to helper services such as Application Control. [BNNGF-101552] Resolved a file-descriptor leak in the firewall's request handler that could, after repeated configuration reloads, cause the firewall process to crash or prevent the firewall ruleset from being installed. The handler now releases these resources on each reload, so they no longer accumulate. [BNNGF-101560] Exhaustive memory allocation during an HA takeover no longer occur. [BNNGF-101575] The firewall DASHBOARD shows the throughput or connection statistics for longer time ranges, and all time ranges now display the correct data. [BNNGF-101630] The "rule usage" counter for access rules is now accurate for rules that use an application ruleset. [BNNGF-101639] The column Usage for the Host Firewall rule is now populated correctly with appropriate data. [BNNGF-101676] License and configuration mismatches no longer cause warning messages in the klogd log file that tap3 is not listening. [BNNGF-101683] The firewall can now reserve selected TCP and UDP ports and port ranges from being used as source ports during source NAT, preventing conflicts with local services. [BNNGF-101996] Access rules that use dynamic hostname network objects now reliably permit connections to hosts whose DNS records rotate rapidly through many IP addresses (such as large API or CDN endpoints), even when the DNS server returns very short-lived answers. [BNNGF-102109] Stopping or reloading the Intrusion Prevention System (IPS) now completes cleanly, preventing a rare kernel crash that could occur while the IPS module was being unloaded. [BNNGF-102137] REST A ConfUnit has been created to link the SNMP service to a box. [BNNGF-82785] The REST Object API now includes a siteSpecific boolean field on network objects, simplifying object type identification. [BNNGF-94078] Changes on limitations in the REST-API for group name lengths no longer cause 400 errors. [BNNGF-101496] The CC REST API no longer causes OpenAPI 3.0 specification violations in the swagger_generator.json file. [BNNGF-101751] When forwarding REST API calls to a managed firewall, the Control Center now honors the Allow REST API forwarding setting and accepts only tokens that have this option enabled. [BNNGF-102070] VPN PPTP tunnels are now displayed as expected in the VPN > Client to Site tab. [BNNGF-91099] Improvements have been applied to the HSTS (HTTP Strict Transport Security) settings for the SSL VPN portal to meet current security best practices. [BNNGF-95951] Client-to-Site VPN passwords and credentials now accept UTF-8 special and accented characters, such as the § sign. [BNNGF-99004] The VPN service no longer crashes after an L2TP VPN client disconnect. C2S VPN connections now connect without a restart of the device. [BNNGF-99865] The compatibility issue to use SHA1 in parallel with AES128 has been fixed. [BNNGF-99936] SSLVPN sessions in the firewall's LIVE view are closed after the user has disconnected. [BNNGF-100284] IKEv1 no longer stops in specific situations and now works as expected. [BNNGF-100368] Memory leaks no longer occur in KTINA and in the Crypto-API. [BNNGF-100374] After multiple tunnels renew their keys at the same time, the IKEv2 VPN status no longer shows leftover or duplicate security associations (SAs) and only correct SAs are listed. [BNNGF-100739] After adding a 30-second timeout to the handshake phase, the SSLVPN service is now responsive when clients open a connection without completing the SSL handshake. [BNNGF-100877] IKEv2 tunnels are re-configured as expected. [BNNGF-100939] When IKEv2 tunnels with Universal Traffic Selectors are configured, TINA tunnels now work as expected when the option Main Routing Table is enabled. [BNNGF-101076] Support for configurable L2TP/IPSec encryption and hash algorithms has been added, thus replacing the hard-coded 3DES-SHA1 setting with user-selectable options. [BNNGF-101141] Kernel panics no longer occur in Site-to-Site VPN connections in conjunction with crypto context switching. [BNNGF-101302] IKEv2 client-to-site VPN connections from iOS devices using a pre-shared key now route all traffic through the tunnel as configured, so internet access works when the firewall pushes a full-tunnel default route (0.0.0.0/0). [BNNGF-101312] A kernel vulnerability (CVE-2026-31431) has been remedied, and a local user will no longer be allowed shell access to escalate to root privileges. [BNNGF-101338] SSL-VPN now works as expected after an update to 9.0.7. [BNNGF-101355] VPN tunnels in a High Availability setup now restore with correct high-performance mode settings after a fai-lover. [BNNGF-101432] On Client-to-Site (TINA) VPN, the firewall no longer repeatedly logs [Sync] Skip transport …: no valid tunnel or missing destination routes for each connected user. [BNNGF-101444] Resolved a rare firewall crash that could occur in TINA site-to-site VPN when VPN transports and uplinks were torn down at the same time. [BNNGF-101551] Deleted IPsec (IKEv2) site-to-site VPN tunnels are now properly removed from the box's internal tunnel table. [BNNGF-101578] Segmentation faults in the DynMesh handler no longer occur. [BNNGF-101616] IKEv2 tunnel configuration support has been added to GTI. [BNNGF-101658] The ipsecdyn.db no longer grows excessively due to orphaned entries related to IKEv2 S2S tunnels. [BNNGF-101677] Server mis-configurations no longer cause redirection of HTTP requests to HTTPS. [BNNGF-101685] The session handler no longer loops due to incorrect timestamp updates when configuration files are changed. [BNNGF-101733] VPN site-to-site tunnels now handle heavy traffic load reliably, avoiding a rare kernel crash. Dynamic bandwidth shaping is also retained after a tunnel is blanked and re-added. [BNNGF-101997] The SSL VPN service now stays stable under heavy concurrent load, resolving a rare threading flaw that could previously cause it to crash. [BNNGF-102139] All 10.5.1-Related Ticket Overview For more information, see .

Box-Update – Platform upgrades (LVM migration) may fail destructively on boxes with a non-standard partition layout where /phion0 is the first partition and /boot is a logical partition (partition number 5 or higher). [BNNGF-102408] Box-Update – Updating the CC to 10.5.1 from 10.0.x versions will result in a dirty release. [BNNGF-102224] Authentication – MFA in combination with RADIUS is not working for CC admins. [BNNGF-100489] Authentication – SAML Single-Sign-On doesn't work on remote-managemant connections between a Control Center and a box. [BNNGF-100594] Barracuda Firewall Admin – GTI Tunnels are not displayed in Firewall Admin 10.5 for non root users. [BNNGF-101179] Barracuda Firewall Admin – Filtering for App Context does not show sessions blocked due to urlcat in Firewall > History. [BNNGF-102159] Barracuda OS – GUI soft-activate causes fibre ports to go down. [BNNGF-98179] Barracuda OS – A model change (e.g. from F380B to F400C) might cause interface issues due to the different interface naming scheme (p<n> vs. port<n>). This will require the firewall to be set up from scratch. [BNNGF-101807] Barracuda OS – Licenses valid until the beginning of 2030 or later show the expiry date "never". [BNNGF-101858] Barracuda OS – A dirty release is detected if SCEP is enabled. [BNNGF-102163] Control Center – The import of large archive.pgz fails. [BNNGF-99857] A workaround is to unpack the pgz with the zcat command and then import the par file. Control Center - The update status in the Control Center is not shown correctly anymore. [BNNGF-101632] CudaLaunch – iPad Pro devices with a MagicKeyboard cause issues. [BNNGF-95273], [BNNGS-4004] This is effectively not a known issue caused by our product, but rather by the iPadOS. We recommend to update your iPad OS to version 18.2 or higher! DNS – New DNS records are only added after a DNS service restart. [BNNGF-101808] Firewall – Inspecting traffic for QUIC/UDP 443 is currently not supported.    [BNNGF-74540] Workaround: Blocking UDP/443 makes clients fall back to TCP, and then that app can be inspected. Firewall – Block pages only show the related application rule, but not the policy rule. [BNNGF-101617] Firewall – A client using SE Agent and ZTNA policy rules can unauthorizedly access internal resources, if the resource is not HTTP/HTTPS and the access is done via the IP address of the resource and not using the FQDN. [BNNGF-102226] REST - Calling the REST-API endpoint for interfaces frequently can report inconsistent interface metrics in specific situations. [BNNGF-100213] SecureEdge Integration – HA standalone integrated in SE: the secondary box does not fetch the config when it is the active box. [BNNGF-100288] SSL-VPN and Cuda-Launch – Shared folders and files are no longer accessible via CudaLaunch if the name of the shared folder or file contains a blank space.    [BNNGF-102208] [BNNGS-3970] Workaround: You can make the folder accessible if you share it yourself and replace any blank character with %20. VPN – TINA UDP fail over ends up in "Ignore Fast Request (Decryption failed)" log messages. [BNNGF-99407] [BNNGF-100967] Note: An EA-hotfix is available for firmware 9.0.5. VPN – Customized welcome messages and bitmaps for Client2Site VPN are not applied properly. [BNNGF-101827]