SonicWall CSE: Server Changelog Netagent

To stay informed about important updates to our product, subscribe to our monthly Release Notes. You may also review past release notes here and current limitations (and workarounds) of the Cloud Secure Edge here.

January 27th 2022 #

v1.42.0

• new Admins can now easily define L7 rules within web policies through the Banyan console.

• new Admins can now create network-level (L4) Service Tunnel policies.

• Download:
  • Netagent v1.42.0

January 6th 2022 #

v1.41.0

• fix Netagent was stripping out invalid HTTP cookies. Now, it forwards invalid cookies.

• fix macOS users now receive the correct IP address when they use Service Tunnel.

• Download:
  • Netagent v1.41.0

October 31st 2021 #

v1.40.0

• Download:
  • Netagent v1.40.0

September 30th 2021 #

v1.39.0

• new Netagent now returns a connection test response when it receives a request from shield with * in the site name.

• new The REST API server now reports for all access-tiers in a cluster.

• Download:
  • Netagent v1.39.0

September 2nd 2021 #

v1.38.0

• Restored “Netagent Details” for hosted websites and infrastructure

• Removed enforcement of “Site Domain Names” configuration parameter

• Download:
  • Netagent v1.38.0

July 7th 2021 #

v1.37.0

• Metrics collection using statsd to send metrics to Datadog via Dogstatsd
• Use Let’s Encrypt certificates for hosted websites

• Frontend domain with upper case letters

• Download:
  • Netagent v1.37.0

May 12th 2021 #

v1.36.1

• Performance and stability improvements.

• Download:

  • Netagent v1.36.1

April 28th 2021 #

v1.36.0

• Various improvements to Access events.
  • User and Device info for TCP service connection-level events.
  • Added reported_by field to display the specific Netagent sending the event.
  • For Access events, the correlation_id identifies the TCP connection.

• Added Headers field under HTTP Settings in the Service Spec.

• Download:
  • Netagent v1.36.0

March 31st 2021 #

v1.35.0

• Optimized standard config parameters down to only four values and updated defaults for many parameters to simplify common Netagent configurations. The following defaults have changed:
  • Shield Connectivity - secure_bootstrap = true
  • Access Tier - access_tier = true, site_domain_names = "*"
  • OIDC Services - code_flow = true, groups_by_userinfo = true, redirect_to_https = true
• Miscellaneous Access event improvements.
  • Service Name shows Service ID.
  • HTTP_CONNECT mode now indicates backend address.
  • Increased the time interval for periodic events to 1 hour from 10 minutes.

• (Bug fix) If a request had two Trust cookies – one that is valid and a second one which is not valid – then depending on the order in which they are getting processed by Netagent, the valid one could end up getting deleted, which would make the user have to re-authenticate. Now, in that scenario the valid cookie will not be deleted.

• Download v1.35.0

March 12th 2021 #

v1.34.1

• (Bug fix) Netagent v1.34.0 did not properly handle expired cookies, which caused end users’ browsers to get stuck in an endless redirect loop when attempting to access a web service.

• Download:

  • Netagent v1.34.1

March 3rd 2021 #

v1.34.0

• Wildcard Web Service definitions (such as *.example.com) now support the root domain (example.com).

• (Bug fix) Netagent handling of cookies for wildcard domains.

• Download v1.34.0

January 27th 2021 #

v1.33.0

• (Bug Fix) Valid short-lived certificates that were older than 24 hours were rejected. Now, short-lived certificates can be up to 72-hours old.

• Download v1.33.0

January 6th 2021 #

v1.32.0

• Performance and stability improvements.

• Download v1.32.0

October 28th 2020 #

v1.31.0

• Performance and stability improvements.

• Download v1.31.0

October 2nd 2020 #

v1.30.0

• OIDC Services - Added ability to exempt specific Source IPs from Policies

• Download v1.30.0

October 1st 2020 #

v1.29.1

• OIDC Services - Add ability for Netagent to query TrustProvider’s userinfo endpoint to obtain a user’s group membership. This is especially useful for organizations where the end users belong to a large number of groups, which increases group information included in the TrustCookie and triggers browser limitations on cookie size.

• (Bug Fix) OIDC Services - the bnn_return cookie logic used to return the end user to the original path they were attempting to access (for example, /foo) now also supports query parameters (such as, foo?bar=123).

• Download v1.29.1

August 26th 2020 #

v1.28.0

• Enriched information collected about a Netagent when generating a one-click support bundle. The bundle now collects additional Netagent configuration files and CIDR ranges as well as common commands support staff needs to better understand the Netagent environment.
• Ability to create allow list of backends and ports (including CIDR ranges) when configuring services.

• (Bug Fix) OIDC Services - Previously, when configuring CORS, the target parameter only supported a wildcard (*). Now, the target parameter supports actual domains.

• Download v1.28.0

July 30th 2020 #

v1.27.1

• Updated a shared-library dependency involving default values for the allow_user_override metadata tag, which (in some scenarios) reset admin-configurations and led to erroneous blocking of end user access.

• Download v1.27.1

July 29th 2020 #

v1.27.0

• Added HTTP_CONNECT mode for Backend routing; when set, Netagent will rely on an HTTP Connect request to derive the backend target address (i.e., ipaddress:port or fqdn:port).
• (Bug Fix) Successful WebSocket closure statuses were returning incorrectly.

• (Bug Fix) Netagent Service configurations were not properly updating.

• Download v1.27.0

June 19th 2020 #

v1.25.1

• (Bug Fix) Netagent v.1.25.0 introduced a regression for Cognito that passed an OAuth “scope” called “groups”, which Cognito does not support.

• Download v1.25.1

June 17th 2020 #

v1.25.0

• Support of exempting CORS traffic.

• Download v1.25.0

May 20th 2020 #

v1.23.0

• Added ability to zip up logs folder and send, via Shield, to the Command Center to create a Support Bundle for troubleshooting.

• Download v1.23.0

May 6th 2020 #

v1.22.0

• Fixed cookie logic for WebSockets and Multi-domain Services so that Banyan TrustCookies are removed from HTTP requests that are forwarded to upstream servers.

• Download v1.22.0

The Banyan TrustCookie still can be forwarded by setting the forward_trust_cookie parameter to true. Banyan TrustCookie removal is performed both with and without the domain parameter to avoid a browser redirect loop scenario.

April 22nd 2020 #

v1.21.1

• Added a configuration option redirect_to_https to redirect traffic from Port 80 (HTTP) to Port 443 (HTTPS).
• Added a configuration option https_proxy to use an HTTP Connect Proxy to make outbound connections to Shield and TrustProvider
• Added a configuration option forward_trust_cookie to not strip out the bnn_trust cookie before sending an HTTP request to the backend application

• (Bug Fix) OIDC Services - Strip out the bnn_ cookies, that are used in OIDC authentication flows, before sending an HTTP request to the backend application. This enables Netagent to proxy traffic to applications that cannot tolerate additional cookies due to their max-http-header-size parameter.

• Download v1.21.1

April 8th 2020 #

v1.20.0

• Service configuration details are now reported from Netagent and displayed in the Banyan Command Center.
• The service spec has a new exempted_paths field which allows specifying a list of HTTP paths that will be accessible without OpenID Connect authentication.
• In the Service Spec, the oidc_settings.service_domain_name URL value can include a wildcard (*) in the first component of the domain name. Including the wildcard enables one Banyan service to permit a dynamic, non-fixed set of OpenID Connect redirect URLs. Please note: The OpenID Connect standard does not support wildcard redirect URLs, and so this feature should be used with care.
• Added a configuration option code_flow for opt-in support for OpenID Connect Authorization Code flow. The default mechanism for OIDC authentication remains OpenID Connect Implicit Code flow.

• Changed wildcard support in site_domain_names parameter in the config.yaml settings file, used when Netagent is run in Access Tier mode. Now, the wildcard (*) will match any prefix, not just the first component, of the SNI name. Previously, "*.example.com" in the service_domain_names parameter would match SNI “www.example.com” but not “alpha.beta.example.com”; now, it will match both.

• Download v1.20.0

March 25th 2020 #

v1.19.0

• (Bug Fix) OIDC Services - Fixed a race condition at the token validation stage that was causing sporadic hanging of connections to applications.

• (Bug Fix) Fixed issue where Netagent stopped working if the underlying host was upgraded.

• Download v1.19.0

March 12th 2020 #

v1.18.0

• Performance and stability improvements.

• Disconnect existing TCP connections (SSH, RDP, etc.) automatically if the device’s TrustScore drops below the level specified in the Policy condition.

• Download v1.18.0

February 26th 2020 #

v1.17.0

• Added name_delimiter field to backend target in Service spec

• Performance and stability improvements

• Download v1.17.0

February 12th 2020 #

v1.16.0

• Configuration guardrails - Require site name, site address, or site domain name

• (Bug Fix) Proxy WebSocket - Passing all headers for WebSocket request

• Download v1.16.0

January 29th 2020 #

v1.15.0

• Improvements to log messages

• Download v1.15.0

December 18th 2019 #

v1.13.0

• (Bug Fix) Workload identification - Improved handling when process or parent process has exited
• (Bug Fix) Workload identification - Client cert issued to Unidentified container even if it has no roles

• (Bug Fix) OIDC Services - robust deep-linking

• Download v1.13.0

November 25th 2019 #

v1.11.1

• Support for Services with mixed (user and workload) client types
• OIDC Services - Trust cookie is a session cookie (auto-removed on browser shutdown)
• (Bug Fix) OIDC Services - Obey Source IP Exceptions as long as Service is non-SNI

• (Bug Fix) Workload Roles - Affix Roles even if workload is “Unidentified”

• Download v1.11.1

October 23rd 2019 #

v1.9.0

• Inactivity & max session timeouts
• “BadActor” module for DoS prevention
• Connection IDs in events & log files for easier troubleshooting

• OIDC Services - deep-linking, HTTP Strict Transport Security (HSTS)

• Download v1.9.0

September 25th 2019 #

v1.7.0

• Support for proxying Websocket
• Send complete cert chain on TLS handshake

• Uninstall script

• Download v1.7.0

July 19th 2019 #

v1.5.0

• GA Release
• Access Tier mode

• Trust Scoring support

• Download v1.5.0

February 4th 2019 #

v0.7.1

• Service definition via Web Console
• CIDRs automatically installed from Service definition
• OIDC workflows

• HTTP authorization policies

• Download v0.7.1

September 10th 2018 #

Netagent v0.6.13

• Forwarding Gateway mode

• Various stability enhancements

• Download v0.6.13