Check Point Vpn-1/Securemote/Secureclient Version 4.1 SP2 ...

SecuRemote/SecureClient
11 Non-Entrust certificates were sometimes considered invalid for as early as 3-4 months before they actually
expired. This was fixed by ignoring the “PrivateKeyUsagePeriod” extension, which in effect allows the private
key to expire before the certificate does. If this extension is important in your environment, you may instruct
SecuRemote to honor it by adding “:check_PrivateKeyUsagePeriod (true)” in the “options” section
of userc.C.
12 There was a problem running alongside Citrix clients. This problem appears to have been solved by Citrix in
their version 4.20.779.
SecureClient specific Bug Fixes
1 Excessive memory consumption (possible application errors) when SecureClient was blocking heavy load of
unauthorized connections.
2 If you logged on to a Policy Server implicitly (during encryption key exchange), then disabling the Security
Policy did not always block the connection that initiated the key exchange. In particular, in the case of FTP,
data connections may have been blocked while the control connection was not blocked.
3 If a Security Policy was lost implicitly, by logging on to a Policy Server with a user not authorized to receive
a Security Policy, then open connections were not blocked.
Platform specific bug fixes
Windows NT specific
1 SecuRemote did not always recognize the need to re-negotiate IKE keys when its IP address changed (e.g.,
disconnect and re-dial).
2 If SDL was enabled, SecureClient’s IP forwarding is enabled dialog appeared too early, interfering with the
logon process.
3 SecuRemote would fail to initialize if the etc/hosts file was read-only (on NTFS).
Windows 9x specific
1 Occasional blue screen if PCI or PCMCIA slots were not functioning.
2 SecuRemote did not always survive Suspend/Standby events. Now, if severe error conditions are encountered,
SecuRemote will automatically be re-launched. It is possible to configure how long SecuRemote waits before
giving up and re-launching, but it should not be necessary. If defaults are not satisfactory, please contact
Technical Support.
Known Limitations
1 SecuRemote has only limited support for environments using multiple hardware profiles. In particular, there
may be DHCP problems on NT, and there may be unexpected behavior on 9x platforms.
2 In some rare cases, DHCP does not function correctly on the first reboot after installation (NT only). In some
even rarer cases, this problem may persist on subsequent boots. If you encounter this problem, please contact
your Check Point Technical Support.
NTFS permission issues
3 If etc/LMHOST is read-only (NTFS on NT), then the SDL feature will not function properly.
4 SecuRemote will not function correctly in the unlikely event that the directory SecuRemote is installed on
does not grant the interactive user write permissions.
5 For logging to NTFS, you need to make sure the interactive user have write privileges on the log file.
SecureClient specific
6 When a new Security Policy is installed, it will not be applied to existing connections.
7 Even if the Security Policy restricts incoming connections, IKE packets (UDP port 500) will be accepted from
any IP address. SecuRemote will respond to these packets only if they are received from an authorized
source.
8 The Security Policy is applied very early during boot (by means of a service), but some unauthorized packets
may make it through nonetheless.
This applies to protocols that occur very early, for example DHCP.
9 Switching between Policy Servers should be done explicitly. Implicit logon to a Policy Server when already
logged on to some other Policy Server may cause the logon to fail.
10 Some complex services involve opening back connections to the client. In general, a policy of “Outgoing
Only” will prevent these services from running properly. The following complex services are supported with
an Outgoing policy: DHCP, Ping, FTP PORT, FTP PASV, Real Audio (no G2/RTSP), VDOlive.
11 If SecureClient is killed, the policy reverts to “Allow Outgoing and Encrypted”, regardless of the previously
active policy.
12 If you install SecureClient (SecuRemote with Desktop Security), you may receive messages advising you to
logon to a Policy Server, even if no Policy Server is defined. If no Policy Servers are defined, Required Policy
for All Desktops should be set on the management to “No Policy”.
4 VPN-1/SecuRemote/SecureClient Version Version 4.1 SP2 - Release Notes