cOS Stream 4.10.02 Clavister cOS Stream

Additional IPsec Hardware Accelerators Supported
Cryptographic acceleration of IPsec ESP is now supported also on Intel® QuickAssist Technology (QAT) devices with hardware version 2.2:

• 4xxx Intel® Communication devices, including 4xxx, 401xx, 402xx, and 420xx

The following platforms are supported:

• Intel® Xeon® 6
• 5th Gen Intel® Xeon® Scalable Processors, including the Intel® Xeon® Gold 6548N Processor
• Intel® C62x Chipset
• Intel® Atom® C3000 processor product family
• Intel® Xeon® processor D family
• Intel® Communications Chipset 8925 to 8955 series

Route Monitoring of Multiple Networks
Route monitoring has been extended to support routes with multiple networks.

ARP/NDP "Resolve Timeout" Log Message Enhancements
The ARP and NDP "resolve timeout" log messages are now governed by the LogARPResolveFailure and NDLogResolveFailure settings. In addition to the unresolved IP address and interface, logs now include the packet header match key, providing insight into the traffic that triggered the resolve operation. The NDP log may also include flow information.

Ethernet Protocol Filtering in pcapdump
The pcapdump CLI command now supports filtering packets by Ethernet protocol, simplifying targeted packet capture during troubleshooting.

TLS v1.3 Support for SSL Inspection
TLS v1.3 is now supported for SSL Inspection.

Geolocation Database Updated
The geolocation database has been updated to a newer version (2025-09-16).

Route Load Balancing
Route Load Balancing (RLB) can now be used to enhance network availability and optimize traffic distribution. It is typically applied to routes with equal coverage or size, allowing network traffic to be balanced across multiple paths. This feature supports the use of multiple ISP connections, enabling increased total bandwidth and reduced load on specific routes. RLB can be enabled per routing table or on individual routes by configuring RLB Profile objects, which define the routing algorithm and stickiness behavior used in traffic decisions.

Call-Home Management
Added support for opening Netcon connections in the reverse direction, allowing management via InControl when the firewall is behind a NAT device. Requires InControl version 4.00.00 or later.

Hyper-V Support (Beta)
Added experimental support for Hyper-V (netvsc) network interfaces.

Faster look up for IP rules with complex IP filter
The traditional handling of IP filters caused each IP rule to be split into multiple "internal" rules. The aim was to have simpler matching logic, but there was no limit to how many times a rule could be split. The new update will greatly decrease the number of splits, trading a slight increase in matching complexity for a faster overall lookup performance.

Configurable IKE ports
It is now possible to configure UDP ports for IKE communication other than the standard port 500. This update allows for greater flexibility in network configurations, while maintaining the use of port 4500 for NAT traversal.

Improved gathering of statistical values
The internal gathering of statistical values has been updated to be more efficient and use less resources.

Statistics for individual route usage
The route statistics have been extended with values for how often each route has been used to lookup destination or source of network traffic.

Extended flow command
The flow command has been extended with a new option "-reverse" that will make other options, such as, "-destip", match against the "reverse" flow instead of the "forward" flow. This can be useful when troubleshooting address translated flows, where "-reverse -destip=.." will compare with the new NAT IP and "-reverse -destport=.." will compare with the new external port (source port) used by a NATed flow.

Extended the "ha" CLI command with additional information in the case of sync failure
In the case of sync problems, the "ha" -CLI command will now show the system modules with outstanding HA objects. Additionally, in the case of "bidirectional heartbeat failure" the individual status of the configured monitor targets, associated with the problematic interface(s), will also be output.

Extended "bgp" CLI-command with "-include-lastupdate"
Added support for listing the "last update" of BGP prefixes.

Tab completion for the "memory" command
Support has been added to be able to auto-complete the application to show memory consumption for, by pressing tab.

Open Source License Information
The about command now includes an option to display information about open source licenses. Additionally, users can download this information via SCP.

wolfSSL upgraded to version 5.7.6
The wolfSSL library used for SSLInspection and SSLVPN has been upgraded to version 5.7.6.

BGP Snooping Timestamps
Extended BGP snooping functionality to include timestamp support.

BGP Restart Option
Added a BGP CLI command for performing a more comprehensive restart of the BGP process.

eBGP Multi-hop
Added support for configuring eBGP Multi-hop/TTL, allowing connections to non-directly connected neighbors.

BGP "AllowAS-In"
Added support for configuring "AllowAS-In" on BGP neighbors, enabling acceptance of routes containing the local AS number with a configurable occurrence limit.

Extended BGP Filtering
Added support for filtering based on numerical tag ranges in BGP export rules. Tags can be set using route maps.

BGP Route Import with Tags
Added support for assigning numerical tags to static routes exported into BGP via export rules, enabling further filtering in route maps.

Geolocation Database Updated
The geolocation database has been updated to a newer version (2025-05-09).

SSM-18975: Attempting to synchronize a large configuration between HA nodes could cause the vsinit process on the sending node to become unstable, potentially leading to a node restart.

SSM-17333: Modifying or removing OSPF configuration would leave old dynamic OSPF routes lingering until the next reboot. The system now discards routes that are no longer valid. Ticket: TIC-46436

SSM-18917: The routing process could become unstable if new configuration was deployed at the same time as an IPsec tunnel was rekeyed.

SSM-18925: After losing contact between nodes, an HA cluster could temporarily end up in a state where the nodes were stuck in a handshake loop and did not return to normal operation.

SSM-18929: An HA node could incorrectly report a "Bi-directional heartbeat failure" error for interfaces immediately after the peer came back online or just before the peer was declared down.

SSM-19146: OSPF configuration was rejected if more than one OSPF neighbor used a point-to-point OSPF interface across the system. If one OSPF neighbor had been configured with a point-to-point interface, it was not possible to add another OSPF neighbor to a different point-to-point interface. This has been changed so that one OSPF neighbor can now be used per point-to-point OSPF interface.

SSM-18826: Fixed an issue where certain configuration changes triggered a system reboot and discarded updates due to internal communication failures. Ticket: TIC-45530

SSM-18818: Resolved an issue where having multiple nodes with the same version in InControl could incorrectly trigger the unique VLAN check.

SSM-18812: The dhcpmux process would become unstable if 170 or more DHCPServerRules were configured. Ticket: TIC-45180

SSM-18736: Stateful SCTP failed silently when configured without a Private IP and HA routes. Logging has been added for cases where the Private IP is missing.

SSM-18754: Fixed a tunnel negotiation failure with SSL VPN clients built on OpenSSL v3 by adding support for TLS v1.3 in SSL VPN.

SSM-18767: Fixed a potential memory management problem in the spsrm process.

SSM-18789: Forcefully terminating InControl while connected could, in some cases, result in a Netcon exception.

SSM-18790: The "ruledb" CLI command could cause an out-of-memory event when a large number of ProxyARP interfaces were configured on a route.

SSM-18793: Fixed a flaw in HA logic where a freshly restarted node could incorrectly assume it was better suited to be active and take over.

SSM-9761: The description for statistics value "Fails" (ssmHAFailureCurrent, /system/ha/failure/[..n]/failures) was not correct.

SSM-13712: A formatting issue with the CLI "help" and "helpconfig" commands was fixed.

SSM-13783: Corrected help text and improved the delete operation response for the "backup" CLI command.

SSM-16746: An HA cluster would not always return to normal status/resume state synchronization after the sync interface connectivity was disrupted and then restored.

SSM-18647: Applying configuration changes that modified the protected networks of an IPsec tunnel during an ongoing IKE negotiation could cause a subsystem restart.

SSM-18702: The system could fail to activate a new configuration if more than 4000 configuration changes had been activated since the last restart.

SSM-18744: The "unit" option of the "memory" CLI command could not be completed by pressing tab.

SSM-18751: When IPsec SAs were migrated between IKE SAs, the statistics counter for active IPsec SAs could show incorrect values for IKEv1.

SSM-18753: Added a log message for flow setup failures caused by an existing flow matching the same traffic-e.g., due to duplicate traffic paths.

SSM-18775: The SCTP log message "Invalid destination route" now includes the destination IP address. The related "Invalid source interface" log has been extended to include the source IP address.

SSM-18784: SCTP flows and associations could linger after timeout, preventing new associations from being established. Timed-out associations will now be treated as restartable upon receiving an SCTP handshake attempt (INIT / INIT-ACK).

SSM-18791: Running the activate CLI command with no changes to activate previously resulted in "Activation failed." This misleading output has been removed.

SSM-18794: Diagnose console logs for HA failovers caused by the inactive node being in better shape have been extended with more detailed information.

SSM-18795: An HA node starting up did not check interface link status before deciding if it was more suitable to be active. This could lead to takeover despite both nodes having link-down on a critical interface.

SSM-18798: Entries in the HA failures table (ssmHAFailuresTable) used different SNMP indices after HA was disabled and re-enabled.

SSM-18799: The statistics value "/system/ha/hbeat_timeslots_missed" (ssmHAHbeatTimeslotsMissed) could become incorrect after reducing the HASettings MaxHeartbeatInterval.

SSM-18804: The current number of HA failures (Fails, /system/ha/failure/[..n]/failures, ssmHAFailureCurrent) was shown in the wrong category/row.

SSM-18817: Certain BGP event sequences could cause the in-memory BGP configuration to become empty during HA state changes.

SSM-18828: The system failed to collect the exit status of temporary threads used during reconfiguration, resulting in a resource leak that grew with each reconfiguration.

SSM-18829: An HA cluster could quickly fail over back to a node that detected an interface connectivity issue if that node still read the link status as "up" and had more HA objects than its peer.

SSM-18837: Status LED on 500-series devices did not light up at system startup.

SSM-18892: InControl could fail to commit deployed configurations in larger installations. Ticket: TIC-45276

SSM-18872: The dhcpserver process could become unstable if dhcpserver statistics were polled during a failing reconfiguration.

SSM-18883: Checks to ensure that both HA nodes are not active or inactive at the same time triggered too soon and caused extra status changes.

SSM-18889: Device-initiated Netcon failed to connect to InControl using a FQDN address.

SSM-18931: The BGP engine would sometimes not remove routes when going HA inactive.

SSM-17957: Repeated HA handovers could cause BGP to lose imported routes.

SSM-18096: Under rare circumstances, a flow could disappear from the flow hash, preventing traffic from being forwarded on the flow and also preventing the flow from being removed. This flow would still be visible in the output from the flow command. Sometimes, when using NAT, an identical flow to the defunct flow in the forward direction could be set up. In that case, traffic would still work, but there would be seemingly identical flows in the output from the flow command.

SSM-18105: Multiple HA failovers in quick succession could, in some scenarios, result in BGP remaining inactive on the active node. Ticket: TIC-42506

SSM-18310: In order to address the "Blast RADIUS" attack the system now includes a Message-Authenticator attribute first in all RADIUS requests, even in the case where the protocol does not require this. In addition, the RadiusServer configuration object now contains a new property called "RequireMsgAuth". It is "false" by default in order to comply with older RADIUS infrastructure, but it is highly recommended to change this to "true". This will cause the system to silently discard RADIUS replies without a corresponding Message-Authenticator attribute.

SSM-18462: Fixed an issue where SCTP associations in High Availability (HA) setups were marked as 'defective' due to route inconsistencies. The system now retries synchronization instead of marking the association as defective, with decreasing frequency if the issue persists. Ticket: TIC-43864

SSM-18601: HA interface monitoring over VLAN would silently fail if no Private IP pair had been configured at the physical interface. This has been corrected.

SSM-18605: Large numbers of configured DHCP Server Rules could cause warnings or instability in the DHCP Multiplexer process. Rule changes are now acknowledged earlier, improving stability and responsiveness during rule setup.

SSM-18699: Resolved an issue where BGP might fail to install routes after transitioning from an HA inactive state to an active state.

SSM-18715: BGP route prefix entries could be incorrectly treated as duplicates when disabled.

SSM-16296: Invalid/discarded packets could still update the timestamp on a flow, preventing it from timing out and making room for a new flow with the same parameters. This could, for instance, make an old instance of a TCP flow discard new TCP SYN packets for a long time, preventing a new TCP flow from being established.

SSM-11728: The log event ID 514, ("Packet dropped by the ruleset"), was uninformative and only contained "pkt=n/a" when the rule lookup was not triggered by a packet. To address this, two new logs have been added. Event ID 1738, ("Flow HA sync disallowed by the ruleset"), used when a deny rule is matched trying to install a flow synced to the inactive HA node. Event ID 1737, ("Denied by the ruleset"), used in all other cases when there is no packet. These new logs contain a matchkey parameter that expands into receive interface and source/destination IP, etc., instead of the pkt parameter of log 514.

SSM-14107: The log messages "threshold is exceeded", "threshold is no longer exceeded", and "random group replacement" have been updated to use action "none" instead of "ignore". This has no effect on what the system does, only the categorization of the log events. Additionally, all threshold log messages have been updated to specify "thresholdset" (threshold set) and "definition" (threshold definition) as parameters, instead of the more anonymous "name". There are also minor updates to the log format strings. Ticket: TIC-26289

SSM-15188: The command "flow -close" was supposed to either require some additional filter parameters, like "-destip", or the "-all" parameter, but acted as if "-all" was given when no other parameters were provided.

SSM-15338: Neighbor Discovery Protocol (NDP) cache entries would become negative at the inactive HA node. The NDP entries will now timeout at the inactive node unless they are in use by the active node. NDP entries used by traffic to and from the inactive node itself will be updated by the inactive node. Ticket: TIC-26041

SSM-16243: Running a series of CLI commands using, for instance, copy-paste, that is entering the next command before the previous command is done, did not always work as intended. Also, information from several commands in the techsupport file got mixed, resulting in hard-to-read techsupport files.

SSM-16256: Information displayed by the "authentication" CLI command could exceed the width of the table column. The content will now either wrap to a new line or be truncated to the column width.

SSM-16257: The "authentication" CLI command now lists authentication profiles by name instead of numerical IDs.

SSM-17551: In specific situations, processing Neighbor Discovery Solicitation messages could incorrectly promote an IPv6 address in the Neighbor Discovery Cache. This issue has been resolved, and the handling of duplicate IPv6 addresses has been improved.

SSM-17861: Authenticated Netcon connections were not displayed by the "authentication" command.

SSM-17865: The system previously ignored the valid state of an IPv6 HA MonitorTarget if it had been in use for ordinary traffic.

SSM-17908: Dynamic rules could in, some scenarios, be incorrectly deleted or leaked.

SSM-17951: Having identical static and BGP routes under High Availability (HA) could lead to incorrect dynamic state markings on the inactive node and might prevent the import of the duplicate BGP route.

SSM-17953: Routes learned from BGP were not listed as "stale" during the transition period following an High Availability (HA) failover.

SSM-17956: If the dataplane froze, causing Kubernetes probes to fail and restart the pod, generating a crash dump could be skipped, making troubleshooting difficult.

SSM-17967: The "shutdown" command could silently fail, requiring re-running the command to shut down the system.

SSM-17970: Users authenticated as part of the "Auditors" group were allowed to run the "system -update-bootloader-configuration" command, which could restart the device.

SSM-18010: The help command output and the output from commands using the "-?" option displayed options not available in the current command view in the usage section.

SSM-18048: The "hwmon" process could fail to terminate, unnecessarily delaying system shutdown.

SSM-18050: The "gtpinspection" process failed to terminate when "shutdown -force" was used, unnecessarily delaying system shutdown.

SSM-18054: An error message that could appear during "backup -restore" or when using the "ha" command to synchronize the configuration; incorrectly suggested to use a non-existing "shutdown -usebackup" as a workaround. The error message has been updated to recommend repeating the same command with the "-reboot" option added.

SSM-18058: Fixed issue with empty AuthProfile configuration property for RemoteMgmtNetcon after upgrade. AuthProfile will now be populated automatically with a default object.

SSM-18062: Assigning more than 32GB of memory to the dataplane could cause the system to suggest updating the bootloader at every boot.

SSM-18088: "WatchdogSettings" were not functioning correctly when running as a container.

SSM-18108: Kubernetes event generation failed in RKE2.

SSM-18110: Depending on the timing of the "cli" process exiting during system shutdown, unnecessary delays could occur.

SSM-18113: During system shutdown, if "dataplane" malfunctioned, "process 'x' did not exit in time" messages could be falsely generated for multiple processes.

SSM-18123: Shutdown signals from Kubernetes were ignored during "shutdown -restart", resulting in hard termination of the pod at the end of the termination grace period.

SSM-18137: The "dataplane" could fail during system start-up if one or more interfaces failed to attach or initialize.

SSM-18151: In scenarios involving uploading a complex configuration, such as IP rules for stateful SCTP traffic, the system could fail to apply the configuration.

SSM-18155: Creating, modifying, or deleting Q-in-Q VLAN interfaces could, in some cases, cause a system restart.

SSM-18165: When more than 10 High Availability (HA) Monitor Targets were configured on a HA-Critical Ethernet Interface, the system silently discarded all monitor targets and set up a HA-Critical interface without monitor targets. This will now generate a configuration warning.

SSM-18170: Some causes for High Availability (HA) synchronization of flows not working did not trigger any logs, making it difficult to pinpoint the reason for the failure. Three new logs have been added to facilitate troubleshooting problems with HA flow synchronization: Event ID 1739 ("Flow HA sync failed due to configuration mismatch"), Event ID 1741 ("Flow HA sync failed due to HA sync status mismatch"), and Event ID 1740 ("Flow HA sync failed unexpectedly").

SSM-18179: Logs containing the matchkey parameter previously expanded the receive interface as a "recvif" parameter, which was not aligned with the generic "recviface" parameter. Additionally, this caused the "log" command not to react to the interface when filtering with the "-iface" or "-srciface" parameter. The expansion of the matchkey parameter has been changed to expand the receive interface as a "recviface" parameter instead.

SSM-18188: Some logs could contain extra "app", "flowusage", and/or "srcroute" parameters with no value.

SSM-18194: HA log with ID 1662 "Source IP not routed on receive interface" did not contain information about which route the inactive node was trying to use.

SSM-18207: A potential buffer overflow when parsing serial console configuration was fixed.

SSM-18216: CLI output from background commands was sometimes distorted.

SSM-18227: "HA bidir heart-beat communication over interface failed" was not logged consistently from both active and inactive HA nodes.

SSM-18229: Logs indicating which HA monitor targets are reachable were not repeated at the start of each period with bidirectional heartbeat communication failure, only when the monitor target's status changed.

SSM-18237: The "HA bidir heart-beat communication over interface failed" dconsole log was logged periodically, which meant that if the problem persisted over a longer period of time, other important logs could be discarded from the log. The event is now only logged at the start of the problem to dconsole, when the fail state is set that can be used to track the duration of the problem. The problem is still logged periodically to other types of log receivers, such as syslog receivers.

SSM-18252: Having only one DNS or NBNS server configured in the lease data on the DHCP server could sometimes result in corrupted DHCP offers.

SSM-18286: Using BGP with BFD over a software-emulated interface in a container would cause the container to restart.

SSM-18321: Traffic shaping was applied before validation with some configurations, primarily when enabling UpdateDSCP on the TrafficProfile and using that TrafficProfile on an IPRule.

SSM-18339: The authsys process could crash during system shutdown due to timing.

SSM-18353: Removed unsupported link speed and duplex data from "ifstat" output on virtual interfaces.

SSM-18379: The number of free ports listed by the portmgr command for an IP pair was off by negative one port.

SSM-18384: An undefined behavior report was fixed in the Geo IP database parsing.

SSM-18402: Under high load, the system could use a port below 1024 as a NAT source port after a local service using that port was removed from the configuration.

SSM-18404: Sometimes NAT could fail to allocate the last available source port to use for an IP pair (external/NAT IP, destination IP pair).

SSM-18454: Port manager, used to assign new source ports for dynamic NAT, could, when trying to set up SIP calls under out-of-memory conditions, "leak" ports, making them unavailable for use until the system is restarted.

SSM-18461: Logs generated when NAT port allocation failed did not provide enough detail to identify affected traffic or determine corrective actions. The log "Could not allocate NAT port" now includes additional parameters: "pool", "reason", "port", "error", and "matchkey". Other improvements include rephrased "reason" values, removal of duplicate logs, and new logs for previously non-logged cases.

SSM-18465: Making configuration changes to a deterministic NAT pool with more than one external IP that allows dynamic port assignments, and where dynamic port assignments have been used, could leak memory.

SSM-18466: Running out of memory while trying to allocate a NAT port from a deterministic NAT pool with dynamic ports enabled could cause already allocated memory to leak.

SSM-18467: Module-level object counts in the HA CLI output were not reset after peer-down events, causing stale sync data. The CLI now tracks object counts per module on the peer for better diagnostics and displays the percentage of the node with fewer objects instead of the peer�s object percentage.

SSM-18473: Trying to allocate a local port-pair for a SIP call handled by the SIP ALG could fail even when there were free port-pairs available.

SSM-18567: Memory usage was multiplied for every IP rule using the same SCTP service because the system did not recognize multiple references as the same service. While this did not cause functional issues, it could waste significant amounts of memory with no benefit.

SSM-18570: The system would sometimes extract the same address as both local IP and broadcast IP, resulting in traffic to the local IP being blocked due to broadcast rules.

SSM-18576: Pressing Ctrl+C to cancel paging did not work properly for some commands in the CLI.

SSM-18581: Output from the "iostat" CLI command could show negative or otherwise invalid values when the command was run for the first time or the first time in a long while. Both of these cases could trigger when capturing tech support information using the "techsupport" command. Those cases will now be detected and won't show any data but will instead encourage the user to run the command again. "techsupport" has also been updated to handle the situation.

SSM-18630: DHCP Server rules were not fully removed from the system after being deleted from the configuration.

SSM-18687: An incorrect bounds check in the "ifstat" command could cause the command to malfunction. This issue has been fixed.

SSM-18705: It was not possible to configure IPsec Tunnel IKE Version when using InControl centralized management tool.

SSM-18764: BGP could encounter internal activation errors when configured with an extensive number of interfaces.