Release Notes for CradlePoint rev 2… · Cradlepoint AER16x0LPE-GN / T-Mobile, US Cellular (USA);...

Global Leader in 4G LTE Network Solutions 1111 W Jefferson Street, Ste. 400, Boise, ID 83702-5389 | Toll Free: +1 855-813-3385 | Local: +1 208-424-5054 | Cradlepoint.com | Page: 1

Release Notes for Cradlepoint Rev 6.2.3 Firmware

Products supported/tested:

CBA750B MBR1400/MBR1400 HW v2.0 Note1: Before upgrading to new firmware, it is always a good idea to save the configuration file from your current version. This firmware version will remove a configuration for version 3.2 or lower and will not try to keep your settings.

Modems tested: (new 6.2.0 modems / modem platforms are in blue text)

Cradlepoint Cellular Devices (Embedded & USB Modems)

Cradlepoint AER16x0LPE-AT / AT&T (USA)

Cradlepoint AER16x0LPE-GN / T-Mobile, US Cellular (USA); Generic (North America)

Cradlepoint AER16x0LPE-SP / Sprint (USA)

Cradlepoint AER16x0LPE-VZ / Verizon (USA)

Cradlepoint AER16x0LP4 / AT&T, T-Mobile, Verizon (USA)

Cradlepoint IBR350L / Verizon (USA)

Cradlepoint IBR350LPE-AT / AT&T (USA)

Cradlepoint IBR350LPE-GN / T-Mobile (USA); Generic (North America)

Cradlepoint IBR350LPE-SP/ Sprint (USA)

Cradlepoint IBR350LPE-VZ / Verizon (USA)

Cradlepoint IBR350P2 / AT&T (USA); Generic GSM-compatible locations (World)

Cradlepoint IBR6x0B-LP4 / AT&T, T-Mobile, Verizon (USA)

Cradlepoint IBR6x0LPE-AT / AT&T (USA)

Cradlepoint IBR6x0LPE-GN / T-Mobile, US Cellular (USA); Bell Mobility, Rogers, Telus (Canada); Generic (North America)

Cradlepoint IBR6x0LPE-SP/ Sprint (USA)

Cradlepoint IBR6x0LPE-VZ / Verizon (USA)

Cradlepoint IBR6x0LP3-EU / Generic (Europe)

Cradlepoint IBR9x0LP6 / AT&T, Sprint, T-Mobile, Verizon (USA); Generic (North America, Europe)


Cradlepoint IBR11x0LPE-GN / C-Spire, T-Mobile, US Cellular (USA); Bell Mobility, Rogers, Telus (Canada); Generic (North America)

Cradlepoint IBR11x0LPE-SP / Sprint (USA)


Cradlepoint IBR11x0LPE-VZ / Verizon (USA

Cradlepoint IBR11x0LP3-EU / Generic (Europe), Telstra (Australia)


Cradlepoint MC400L2 / Public Safety Band 14 only (USA)

Cradlepoint MC400LPE-AT / AT&T (USA)

Cradlepoint MC400LPE-GN / T-Mobile, US Cellular (USA); Bell Mobility, Rogers, Telus (Canada); Generic (North America)

Cradlepoint MC400LPE-SP / Sprint (USA)

Cradlepoint MC400LPE-VZ / Verizon (USA)

Cradlepoint MC400LP3-EU / Generic (Europe)

Cradlepoint MC400LP4 / AT&T, T-Mobile, Verizon (USA)

Cradlepoint MC400LP5 / Generic (APAC)

Cradlepoint MC400LP6 / AT&T, Sprint, T-Mobile, Verizon (USA); Vodafone (Worldwide), Generic (North America, Europe)

3rd Party USB Cellular Modems

Franklin U770 (“Sprint Plug-In-Connect Tri-Mode USB Modem”) / Sprint (USA)

Huawei E3276 / Telus (Canada)

Huawei E368 (“AT&T USBConnect Force 4G”) / AT&T (USA)

Netgear AC340U (“AT&T Beam”) / AT&T (USA)

Netgear AC341U (“NETGEAR® 341U USB Modem”) / Sprint (USA)

*supports Netgear firmware 4.07.01.11 and MR2 firmware 45.04.20.00

Novatel 551L LTE (“Verizon USB551L”) / Verizon (USA)

Novatel U620L (“Verizon MiFi© 4G LTE Global USB Modem U620L”) / Verizon (USA)

Novatel U679 (“4G LTE Novatel Wireless U679 Turbo Stick”) / Bell Mobility (Canada)

Pantech UML295VW (“Verizon 4G LTE USB Modem UML2954G LTE”) / Verizon (USA)

*requires Pantech firmware version L0295VWD821F.B4 or later

Portsmith PSA1U1M ("Portsmith USB Client to Analog Modem Adapter") / POTS phone providers

Sierra Wireless 308 USB (“AT&T USBConnect Shockwave”) / AT&T (USA)

Sierra Wireless 313U (“AT&T USBConnect Momentum 4G”) / AT&T (USA)

Sierra Wireless 320U (“Telstra USB 4G (Sierra AirCard 320U)”) / Telstra (Australia)

Sierra Wireless 330U (“4G LTE Sierra Wireless U330 - Turbo Stick”) / Bell Mobility (Canada)

Sierra Wireless 330U (“LTE Rocket Stick – Sierra Wireless AirCard 330U”) / Rogers (Canada)

ZTE MF683 (“T-Mobile Rocket 3.0 4G Laptop Stick”) / T-Mobile (USA)


Analog Modems

Portsmith PSA1U1M (“Portsmith USB Client to Analog Modem Adapter”) / POTS phone providers

Portsmith PS6EX1M ("Portsmith ExCard to Analog Modem Adapter”) / POTS phone providers (ExpressCard format, compatible with MBR1400s, MBR1200B, & CBA750B only)

New features added in this release (Not all features are in all products – see their respective Data Sheets):

No new features, defect fixes only

Additional UI/Usability changes:

None

Defects fixed:

Multiple routers DynDNS fail after update to 6.2.2

Security issues:

Sweet32 mitigation. https://sweet32.info/ describes an attack that is unlikely but possible to recover secure HTTP cookies. To mitigate this attack, we changed the default cryptographic algorithms from the Mozilla recommended Intermediate compatibility list to their Modern compatibility list. The list can be modified by changing /config/system/cipher_list in the CLI. https://wiki.mozilla.org/Security/Server_Side_TLS#Intermediate_compatibility_.28default.29

https://sweet32.info/

https://wiki.mozilla.org/Security/Server_Side_TLS#Intermediate_compatibility_.28default.29




AER1600/AER1650

IBR1100/IBR1150

IBR900/IBR950

IBR600/IBR650

IBR600B/IBR650B

MBR1400/MBR1400 HW v2.0

Note1: Before upgrading to new firmware, it is always a good idea to save the configuration file from your current version. This firmware version will remove a configuration for version 3.2 or lower and will not try to keep your settings.


























Cradlepoint IBR11x0LP3-EU / Generic (Europe), Telstra (Australia)









Cradlepoint MC400LP5 / Generic (APAC)

Cradlepoint MC400LP6 / AT&T, Sprint, T-Mobile, Verizon (USA); Vodafone (Worldwide), Generic (North America, Europe)





















Analog Modems



New features added in this release (Not all features are in all products – see their respective Data Sheets)

System -> Administration -> Router Services -> Enable Proxy. HTTP/HTTPS Proxy Client Support for Router Firmware, Modem Firmware, and IPS rules updates.

(SDK support) Multiple changes to ping support in /control tree to support SDK

◦ Feature parity with CLI

◦ Added the ability to source ICMP traffic from a name:

▪ Interface name

▪ Device UID

▪ Network name

◦ Changed default number of ICMP requests from 40 to 4

(SDK Support) Allow an SDK application to write to an attached USB stick at /var/media (vFAT file format only)

Source ICMP traffic to a name as well as an IP address

Connection Manager -> WAN Interface Profile -> General -> Allow QoS. Per-WAN QoS settings added so that you can specify which WANs are governed by QoS settings and which ones are not.

Additional UI/Usability changes

LP4 modem signal strength modification in LEDs, signal bars

Defects fixed

(SDK support) Applications with subdirectories crash on installation on 6.2.1


(SDK ping) Fixed the ‘status’ field

Fixed duplicate icmp_sequence issue

Fixed and extended CLI ping help (ping -h)

GPS fix does not indicate hemisphere when below 1 degree longitude

Incoming Device – Local:Updates isn’t properly routing traffic

Remote Access to the Primary LAN over an MPLS network to a CP router running VRRP/DMNR routing issue with HTTPs response

WAN connection no longer retries immediately upon link down, only retries if device was connected, now allows failback usage rate setting to trigger appropriately

USB Ethernet adapter UID correction for ECM data usage display

LP6 modem Sprint HFA (Hands Free Activation) timing improvements

LP6 GPS signal drop recovery

LP6 GPS antenna disabled power recovery

Failback issue with BGP over DMVPN with standby enabled

Incoming Device – Local:Updates wasn’t properly routing traffic

Security defects fixed

(SDK support) A security issue where an SDK application could get elevated permissions was fixed. SDK users are encouraged to upgrade to 6.2.2

(SDK support) The router was vulnerable to the “dirtyc0w” exploit (CVE-2016-5195) when using an SDK application.

SDK users are encouraged to upgrade to 6.2.2




AER3100/AER3150

AER2100

AER1600/AER1650

IBR1100/IBR1150

IBR600/IBR650

IBR600B/IBR650B


























Cradlepoint IBR11x0LP3-EU / Generic (Europe), Cradlepoint IBR11x0LP6 / AT&T, Sprint, T-Mobile, Verizon (USA); Generic (North America, Europe)








Cradlepoint MC400LP6 / AT&T, Sprint, T-Mobile, Verizon (USA); Generic (North America, Europe)





















Analog Modems



New features added in this release (Not all features are in all products – see their respective Data Sheets):

None. Defect fix only.

Defects fixed

Replaced an expired certificate that allows Zscaler Internet Security to operate.



AER3100/AER3150

AER2100

AER1600/AER1650

IBR1100/IBR1150

IBR600/IBR650

IBR600B/IBR650B

IBR350

CBA850



Modems tested (New 6.2.0 modems / modem platforms are in blue text)























Cradlepoint IBR11x0LP3-EU / Generic (Europe), Cradlepoint IBR11x0LP6 / AT&T, Sprint, T-Mobile, Verizon (USA); Generic (North America, Europe)









Cradlepoint MC400LP6 / AT&T, Sprint, T-Mobile, Verizon (USA); Generic (North America, Europe)




















Analog Modems



New features added in this release (Not all features are in all products – see their respective Data Sheets)

Disable router bounce pages by default

Dashboard UI alert and set Attention LED if the user has not changed the default admin or WiFi passwords.

(SDK Beta) Updated pyserial to the latest version

(SDK Beta) We made a change to the manifest. A new option “auto_start” was added that


controls whether the SDK application will start upon router boot. If this option does not exist, then the application will not be run. This is a change from 6.1.0 behavior and applications that automatically started in 6.1.0 will stop working until they get this change.

Improved SSH port forwarding

Allow routing policies to match on router-generated traffic

Respond to NTP requests based on router time without having to forward to WAN

6.1.1, 6.1.2, and 6.1.3 features added to multiple products

◦ See full release notes for each release below, in general:

▪ 6.1.1 GPS improvements and WiFi client driver

▪ 6.1.2 Defect fixes

▪ 6.1.3 Routing changes, NTP improvements

(CBA850) Added QoS support to the product

LP4 modem automatic carrier detection and modem image switching support on multiple routers

Security defects fixed

OpenSSL was upgraded to version 1.0.1t. No issues were known to affect our routers

Sanitize strings to mitigate XSRF attacks

Limit exposure to XSS attacks

When debug logging and TACACS authentication was enabled, the user’s password was showing up in log messages

Additional UI/Usability changes

Networking -> WiFi as WAN menu dropdowns changed from “Wireless as WAN” to “WiFi as WAN”

Updated Security -> Cloud-Based Security page

Add priority to Zone Firewall zone matching

Allow the user to upload the HTTPS private certificate

Changes to microstatus improve performance for Remote Administration

Combine static and policy-based routing. Make the system routing policy and table a special entry in a larger list of policies/tables used for policy routing. Allow drag-drop reordering of the routing policies to control the priorities. Generalize the UI for adding/editing/deleting policies and tables to work for both static and policy-based.

Improved the Policy Based Routing UI

Sort help results by relevance

Administration -> Device Control -> Device Console allows the user to save CLI history

Additional Routing Protocol status

Make DHCP server’s start and end range more informative

Added ability to configure IPsec responder only for DMVPN hubs from UI

CLI – Added the “clients” command to show currently connected clients and perform actions on them.

Support backup RADIUS server for WPA Enterprise in AER products

Renamed Web Filter Settings to Upstream Proxy Settings and improved the Network Web Filter


Rules UI

Identities MAC and Host Address Add form should use the same entry form as Ports

Missing help on RIP Interfaces wizard page

AER1600 has 802.11b Wireless Mode for 5Ghz Radio

“Common Name” field in local certificate needs to be a required field

RIP, add split-horizon poisoned-reverse setting

Route map values not getting reset when set action is changed

Clean up edit dialog for status route

GRE tunnel status is not updated when configured as failover/failback tunnel

Added IPsec exclusion policies

Clarified some wording on the NHRP page

QoS settings for modem download was limited to 75Mbps, that number was increased to 300Mbps. WiFi as WAN or client was increased to 600Mbps. The CLI can be used to increase the QoS upload/download settings if the interface is faster than the UI allows.

Dashboard was changed to not display WiFi values if it is disabled

PoE status reports voltage with no current for externally powered CBA850

(AER3100) When a PD is plugged into one of the PoE ports, it may be detected as class 6 (0-4 are allowed)

VLAN interfaces UI does not display new VLAN added until refresh of browser

Zone Definition does not always match against the highest priority Zone Definition rule

LAN Config Name in Zone Definition that has the interfaces field left blank should set the field to "Any". When this is saved, the Zone Definition created displays "Incomplete ()" for the interface in the Zone.

Added help to Zone Priority

RIP authentication should be per interface and not per router

AER1600 Support link broken

Network scheduler help refers to an “interface” scheduler

Added many EMEA cellular operators to the cellular modem’s Auto APN feature

Added Verizon to Auto APN feature, as executed when (modem) > SIM/APN/Auth > Access Point Name (APN) is set to Default

LP6 (Cat 6) modem. Displays carrier aggregation (LTE-A) diagnostic information when connected

LP6 modem, AT&T only. Checkbox now available to disable/enable AT&T Band 30. Enabled by default.

Defects fixed

Advanced NTP takes a long time to set time after VPN establishes

ECM ping results screen showed unexpected behavior when ping host is unreachable

MAC address based content filtering allows all clients access

Router needed to be rebooted to restore a Zscaler tunnel that disconnected

Wired 802.1x authentication doesn’t work after reboot while server is remote

Responder IPsec VPN traffic leaving wrong interface

DHCP Relay didn’t work with VRRP

Firmware version 6.1.1 adds incomplete OSPF Ranges and Virtual Links when upgraded from 6.0.2 or 6.0.5

SNMP Daemon crashes and restarts when using snmpbulkget and modem OIDs

Certificate Signing Request does not list all certificates as options in the Certificate Name


dropdown

WiFi issues with LAN scheduler enabled

(CBA850) Changing name of VID while the interface is associated with a network

When adding Local Networks to Cloud Bases Filtering, Network Address is not showing when saved

GRE keepalive using GRE keys failure

IBR350 didn’t show the correct modem type in its name

Standby modem shows Red in microstatus, not Yellow

WAN Affinity WAN Binding Type not allowing internal modem for Port type on AER1600

Hotspot Services Redirect URL hidden

VLAN, changing name of VID while an interface is associated with a network

WAN Affinity causing failure check to not function

AER3100 showing 50% CPU utilization on default settings

Passthrough reservation field not able to leave blank

PPTP unchecked will not allow GRE traffic to pass

NHRP shortcut fails when default route is not out WAN

Unable to reserve active IPv6 lease via Active Lease Grid

Can’t enable PMTU discovery for VTI

SSH client failed connection gives no feedback from SSH session into router

LLDP did not return all neighbors

Restore and Upgrade error if Factory Reset option selected

Reputation file upload incorrectly reports the wrong number of lines read

MAC address filter rules not matching when using uppercase letters

Netperf will not run speed test on links in “standby” state

Netperf initial control tree missing

OpenVPN Status Exception

OpenVPN site-to-site: Missing Forwarding ACCEPT rules

Connection Manager fails to disconnect AP completely when disable is selected

Default information originate not implemented for RIP

RIP md5 auth mismatch not logged

DHCP relay: responding dhcp server seeing request coming from original network

IPsec “always on” sometimes chooses wrong WAN interface

Network scheduler issues: doesn’t respond to timezone change doesn’t suspend added BSS ignored Sunday is inverted from UI

For dial-up modems, the profile configuration now includes the SIM/APN/Auth menu

Known issues

Reputation Services (6.0.1). If you upload a reputation file to the router, save the configuration, factory reset, then reload the configuration file any firewall entries referencing that reputation file will fail. The reputation file is not saved in the exported configuration file.

If any of the router’s WAN connections (Ethernet, Wi-Fi as WAN, modem) connects to a device that has the same IP subnet as the router, the router will disable the interface and provide a


Bounce Page warning that the WAN interface has a conflict (if bounce pages are enabled). Simply change the LAN IP Address on the Network Settings -> WiFi / Local Network Settings page in the UI.

LTE

Unless you have a specific service from your carrier, LTE modems will not generally provide an externally-available IP address. Services, such as Remote Management, will not work.

Modem

Franklin U770. The Modem’s Ethernet address conflicts with the default address of the Guest LAN. A warning message is placed in the log and the Guest LAN is disabled. If you change the address of the Guest LAN to a non-conflicting address, this restriction will not occur.

Sierra Wireless 313U, 330U. When these modems connect on 2G or 3G bands, specifically on GSM 850, they will sometimes cause interference on the USB bus, resulting in the modem not plugging properly. If this occurs, attaching the modem to a USB extension cable will generally fix the problem.

The following USB modems contain an embedded web server through which many modem

settings are configured. To access the modem’s web pages, you must be logged in as the router

administrator. Once logged in, you can then access the modem web pages at these given IP

addresses:

Franklin U770 / Sprint (USA) -> 192.168.10.1

Netgear AC341U * / Sprint (USA) -> 192.168.1.1 (address is configurable)

Pantech UML295VW * Verizon (USA) -> 192.168.32.2

* The modem web pages are available only when the modem is operating in NAT mode.

Release Notes for CradlePoint rev 2… · Cradlepoint AER16x0LPE-GN / T-Mobile, US Cellular (USA);...

Documents

Transcript of Release Notes for CradlePoint rev 2… · Cradlepoint AER16x0LPE-GN / T-Mobile, US Cellular (USA);...