Monday, August 17, 2020

HPE/Silver Peak - Features by software release

This is a summary of VAOX/ECOS and GMS/Orchestrator software features and the version from which they were added.


▶ Features by VXOA software release


  • ECOS 9.0

• Advanced Segmentation (VRF)
• Secure Shell Access
• Enhanced Multicast Support
• Improved Software Upgrade Stability
• Enhancements to Disabled Subnet Sharing via IP SLA
• Custom Tags in YAML Preconfig
• IPSec Anti-Replay Improvements to support a window size of up to 64K
• Multiple Domain Matches in DNS Cache
• Port Flexibility for Bonding 
• (9.0.2) Enable or Disable Portal WebSocket Connection 
• (9.0.2) Configure Encryption and Hash Algorithms 
• (9.0.2) Subnet Sharing Metric Enhancements 
• (9.0.2) ECMP Support for BGP 
• (9.0.2) Dynamic Subnet Sharing Hold-down Timer 
• (9.0.2) Route Map Enhancements 
• (9.0.2) Added Appliance CPU Stats 
• (9.0.2) Multicast Enhancements 
• (9.0.2) New HTTP Ping Metrics Loss and latency metrics for HTTP ping monitor 
• (9.0.2) Enhancements for Cleared and Acknowledged Alarms 
• (9.0.3) Support for Link Aggregation 
• (9.0.3) Show BGP Routes via CLI 
• (9.0.3) Import Management Routes to Routing Table 
• (9.0.3) NSSA Support in OSPF 
• (9.0.3) DSCP Marking per Interface 
• (9.0.3) Source Interface Configuration for DNS 
• (9.0.3) TCP Application Delay Stats for IPFIX 
• (9.0.3) Advanced Segmentation Supported in OSPF 
• (9.0.3) DHCP Support in Advanced Segmentation 
• (9.0.3) Custom CA Certificate Trust Store

  • ECOS 8.3

• Remote IP Logged for TACACS+ and RADIUS
• (8.3.0.4) - The spsadmin account has been removed.
• (8.3.0.4) - Appliances can now be configured to reject self-signed certificates. This feature addresses CVE-2020-12143 and CVE-2020-12143.
• (8.3.0.4) - A new IKE-less seed distribution mechanism is now supported in ECOS. This feature addresses CVE-2020-12142.
• (8.3.0.4) - API changes have been made to restrict traversal of other directories, limiting access to sensitive data.
• (8.3.1.0) - Changes have been made that greatly reduce or eliminate the possibility of a cross-site forgery request (CSRF) on the appliance.
• (8.3.1.0) - Support for 25 Gbps fiber interface cards in the EC-XL appliance.
• (8.3.1.0) - Added a new custom bonding option that performs load-balancing based on tunnel capacity.
• (8.3.1.0) - Added a new link bonding option that supports user-configurable link prioritization and traffic steering/load balancing policies.
• (8.3.1.0) - IPSec anti-replay window protection has been enhanced to support window size of up to 64K.
• (8.3.1.0) - Traceroute is now supported across stateful-SNAT firewall type, across allow-all type with NAT configured, as well as across EdgeHA links.
• (8.3.1.0) - The Top Applications report now excludes Silver Peak control (non-user) traffic.
• (8.3.1.0) - Ping IPSLA monitor has been enhanced to include loss/latency measurements and thresholds.
• (8.3.1.0) - Ping IPSLA can now be directed into a 3rd party IPSec or GRE tunnel.
• (8.3.1.0) - EC-V now supports up to 32 interfaces along with auto-mac configuration.
• (8.3.1.0) - IPv6 DHCP is now supported on WAN interfaces.
• (8.3.1.0) - The internet breakout feature has been enhanced, enabling selection of the best quality internet link for local break-out based on user-defined criteria. 
• (8.3.2.0) - Secure WebSocket Connection to Orchestrator
• (8.3.2.0) - Multiple Ranges for DHCP Server
• (8.3.2.0) - Custom Tags in YAML Preconfig
• (8.3.2.1) - API Support for Route Redistribution Templates
 

  • VXOA 8.2

• Branch NAT
• Multi-Region Subnet Sharing
• IPSec Service Chaining IKEv2
• BGP over IPSec
• Multicast GUI Support
• BGP Configuration of Source Address
• (8.2.1) - Route Filtering
• (8.2.1) - IPFIX Enhancements
• (8.2.1) - LAN-side VTI
• (8.2.1) - Dead Peer Detection (DPD) for IPSec Service Chaining
• (8.2.1) - Application Inference Engine

  • VXOA 8.1 

• Enhanced Application Visibility
• BGP Routing
• Interface bonding on 10Gbps ports
• IPv6 UPD, GRE and IPSec tunnels
• SHA-2 Hash for IPSec
• Extended DHCP Server Options
• SNMPv3 Enhancements
• Custom HTTPS certificate support for appliance management
• Flow redirection on any configured physical interface
• Return passthrough traffic to L2 sender
• (8.1.3) Fine grained control of management traffic
• (8.1.4) DNS Application Classification Enhancement
• (8.1.4) Internet Breakout with Stateful Firewall and NAT
• (8.1.5) IP SLA tracking
• (8.1.5) PPPoE Interfaces
• (8.1.5) Redesigned Configuration > Interfaces page
• (8.1.5) Improved Application Classification by Port
• (8.1.5) Per-Flow Maximum Rate Control
• (8.1.5.3) EC-US Appliance Support
• (8.1.5.3) Modified High Efficiency Bonding
• (8.1.6) Edge High Availability
• (8.1.6) IPSec UDP Overlays (IKEless tunnels)
• (8.1.6) Mini License (supports up to 50mbps)
• (8.1.6) Configurable BGP Parameters (Local Preference • MED (Multi-Exit Discriminator) • AS Prepend Count • Keep Alive Timer • Hold Timer)
• (8.1.6) Configurable Interface for SAAS Probes
• (8.1.7) IPv6 Support for Inline Router Mode
• (8.1.7) BGP Enhancements (Soft reset • Input Metric • Communities)
• (8.1.7) Inbound Port Forwarding
• (8.1.7) Shaper Enhancements (Rebalance)
• (8.1.7) TCP MSS Clamping for Internet Breakout
• (8.1.7) Flow Redirection on WAN Interfaces
• (8.1.7) TCP Acceleration for IPv6
• (8.1.7) Cloud-Init Support
• (8.1.7) OSPF (Beta)
• (8.1.8) Zone Based Firewall
• (8.1.8) 3rd party IPSec Tunnels
• (8.1.8) IPFIX
• (8.1.8) IP SLA Enhancements
• (8.1.9) Multicast (Sparse Mode on MPLS only via CLI)
• (8.1.9) ACL match for IP Address by allowing ranges and wildcards
• (8.1.9) Application Inference Engine
• (8.1.9) User-defined SaaS applications and configuration of SaaS optimization probe interface via labels
• (8.1.9) Displays built-in policies via “Support > User Documentation > Built-in Policies"
• (8.1.9) Inbound port forwarding enhancement to allow in-bound WAN packets to pass un-modified (not translated) to the LAN
• (8.1.9) SSL optimization now supports ECDHE named curve 29
• (8.1.9) MOS Estimation
• (8.1.9.1) DNS Application Classification Enhancement
• (8.1.9.1) SSL optimization now supports ECDHE ECDSA with AES 256 GCM SHA384
• (8.1.9.1) Protection from Port Scanning
• (8.1.9.1) “Fail Open” in Bridge Mode
• (8.1.9.1) ATA Secure Erase
• (8.1.9.1) Disabling Support for OSPF Opaque LSAs
• (8.1.9.1) Support for Multiple LANside Interfaces in the Same Subnet
• (8.1.9.1) “Comments” Field for Configuration > Deployment
• (8.1.9.1) "Find Preferred Route" in Configuration > Routes
• (8.1.9.1) Support for additional hardware appliances: EC-L-B, EC-XL-B, EC-L-B-NM, EC-XL-B-NM, EC-L-P, EC-XL-P, EC-L-P-NM, EC-XL-P-NM
• (8.1.9.1) Support for the Orchestrator Boost report
• (8.1.9.3) BGP Graceful Restart
• (8.1.9.4) Admin Distance Enhancements and new defaults (for new installations): Subnet-shared static = 10 • Subnet-shared-BGP = 15 • Subnet-shared-OSPF = 15 • EBGP = 20 • IBGP = 200 • OSPF = 110
• (8.1.9.4) Port forwarding now supports protocol wildcard specifier “any”
• (8.1.9.4) AS Path Propagate
• (8.1.9.4) BGP Next-Hop Self
• (8.1.9.4) Multi-hop BGP
• (8.1.9.4) Zscaler Orchestration
• (8.1.9.5) USB ZTP Configuration
• (8.1.9.5) Loopback Interfaces and VTI Interfaces (VTI not supported until 8.2.0)
• (8.1.9.5) Zone Based Firewall Flow Logging
• (8.1.9.5) Support for Multiple DHCP Relay Agents
• (8.1.9.5) DNS Proxy
  

  • VXOA 8.0 

• Business Intent Overlays
• Deployment Profiles
• Packet-Based Dynamic Path Control (DPC) or Bonded Tunnels
• Built-in DHCP server and relay
• Inbound QoS
• Support for IPv6 PBR deployments
• (8.0.3) - Support for additional hardware appliance part numbers

  • VXOA 7.3 

• Support for the Unity EdgeConnect XS and V.
• Current Flows tab can report on flows that are experiencing slow LAN-side performance.
• Reset non-accelerated TCP connections.
• DRC configuration now available on web interface: Configuration > Shaper
• (7.3.1) - Support for the Unity EdgeConnect L, XL
• (7.3.2) - Support for the Unity EdgeConnect S
• (7.3.3) - Fast fail (sub-second failover) for Dynamic Path Control (DPC)
• (7.3.3) - Support for the Unity EdgeConnect M




Features by GMS/Orchestrator Software Release


  • Orchestrator 9.0

• Increased Retention for New Daily Stats, now 3 months.
• Advanced Segmentation (VRF)
• YAML Preconfig Support for Routing Segmentation
• YAML Preconfig Supports Custom Tags
• Secure Shell Access
• SAML 2.0 Integration
• Enhanced Authentication Between Orchestrator and Cloud Portal
• Allowed External IPs in Cloud Orchestrator
• Live Troubleshooting for Down Tunnels
• (9.0.3) Routes Template Enhancements
• (9.0.3) Multiple Ranges for DHCP Server
• (9.0.3) Zone Orchestration for AWS TGNM and Azure
• (9.0.3) Appliance CPU Usage Charts
• (9.0.3) Updates to BGP Template
• (9.0.3) Added Details for Cleared and Acknowledged Alarms
• (9.0.3) Peer-based Subnet Sharing Metric
• (9.0.3) Increased Retention for new Daily Stats, now 3 months
• (9.0.4) Support for Link Aggregation
• (9.0.4) NSSA Support in OSPF
• (9.0.4) Source Interface Configuration for DNS
• (9.0.4) Configurable Confidence Value for Address Map Definitions
• (9.0.4) Custom CA Certificate Trust Store
• (9.0.4) Route Map Enhancements

  • Orchestrator 8.10

• Intelligent Upgrades
• (8.10.10) - Support for Zscaler Sub-Locations
• (8.10.10) - Integration with AWS Transit Gateway Network Manager (TGNM)
• (8.10.10) - New Route Redistribution Map Template
• (8.10.11) - Allowed External IPs in Cloud Orchestrator
• (8.10.12) IP SLA Enhancement
• (8.10.15) DSCP Marking per Interface
• (8.10.15) Disable Cloud Portal Data Collection
• (8.10.15) Three-step OIDC Authorization for JWT
• (8.10.15) Peer-based Subnet Sharing Metric
• (8.10.15) Improvements in Zscaler ZEN Discovery
• (8.10.15) Enhanced Authentication Between Orchestrator and Cloud Portal

  • Orchestrator 8.9

• IKE-less Seed Distribution To address CVE-2020-12142
• Portal Migration Wizard The Orchestrator
• Auto-prune Tunnels from Removed Appliances
• Improved Response Times for Top ‘X’ Charts
• Support for New Alarm: Insufficient Bandwidth for Tunnels
• OAuth 2.0 Support for Identity Access Management (IAM)
• (8.9.2) - Disable Self-signed Certificates To address CVE-2020-12143 and CVE-2020-12144
• (8.9.2) - Loopback Orchestration
• (8.9.10) - Improvements in IPSec UDP Key Material Defaults and Configuration
• (8.9.10) - Default RBAC Role for Full Appliance Access
• (8.9.10) - JSON Web Token (JWT) Authentication
• (8.9.10) - WebSocket API option for Remote Log Receiver
• (8.9.10) - Aggregate Shaper Stats
• (8.9.10) - New Routes and Route Map Templates

  • Orchestrator 8.8

• PPPoE in preconfiguration
• Loopback & VTI in preconfig
• Ikev2 enhancements
• Reset flows confirmation
• BGP ASN and Local communities
• Maintenance Mode
• Notification Banner
• Tunnels to Hubs in other region
• DHCP Failover
• Bandwidth tier licensing
• (8.8.3) IPFIX UI Enhancements
• (8.8.3) Increased Capacity for Inbound Port Forwarding Rules, up to 100
• (8.8.3) Route Map Enhancements
• (8.8.3) Microsoft Virtual WAN Orchestration (beta)
• (8.8.3) Zscaler Orchestration to support load balancing of IPSec tunnels and support for new geo-location APIs
• (8.8.3) Check Point Integration

  • Orchestrator 8.7

• Branch NAT
• DHCP relay per VLAN
• Source address for BGP
• ACL Policy enhancement
• Display peer role (hub/spoke) in routes
• Added capability to configure the logging level for implicit firewall drop between zones.
• Loopback interfaces in Appliance Wizard
• VTI and Loopback Interfaces
• Redesigned BIO and regional overlays
• Realtime updates from Microsoft Office 365
• Role based access
• Alarm Suppression
• TACACS and RADIUS enhancements. Support “Remote only” and “Local if Remote Unavailable”

  • Orchestrator 8.6

• Multicast routing
• Firewall rule logging
• Tech Support - Orchestrator tab improvement. Files can now be downloaded to the Orchestrator first
• Routes Tab Filter
• Flows tab improvements - new filters:Overlay and Transport filters, Flow characteristics, • Duration filters, Include built-in and HA, and various other checkboxes
• Zscaler Orchestration
• Support Any Protocol in Inbound Port Forwarding
• Verify Email Address optional if Orchestrator is configured with a custom SMTP server
• Regions Tab
• License revocation and grant support for metered license model
• Firewall logging for Security Policies

  • Orchestrator 8.5

• Orchestrator has been redesigned to handle large networks.
• MOS Statistics
• Define Custom severity for Alarms
• Delay Alarm Emails
• Backup Orchestrator to HTTPS or SFTP servers as well as FTP, HTTP and SCP
• Pre-Configuration using YAML files in Orchestrator before Zero Touch Provisioning occurs.
• HTTP/HTTPS IPSLA ping monitors
• IPFIX support
• Wild Card Based prefix Matching in Policies
• Block Network Orchestation via Cloud Portal
• Preconfiguration
• Allow ECDSA certificates for Saas
• Health map sorting
• 'Find Preferred Route' dialog available when editing Configuration > Routes
• Configurable Statistics Retention
• Overlapping LAN side subnets
• Support IPv6 internal subnets on the Business Intent Overlay page
• Configurable tunnel alarm aggregation
• Notes for interfaces on Deployment page
• Boost Trends report
• Software Versions tab redesigned
• Preconfiguration Passthrough Tunnels and Flow Redirection
• IP Directed Broadcast available in templates
• Nonaccelerated TCP Inactivity Timeout available in System template
• New routes states that indicate peer’s role as Hub or Spoke
• BGP Graceful restart
• Zone based Firewall Statistics
• Suppress Tunnel creation using Tunnel Exceptions tab
• (8.5.2) Orchestration ETA progress and prioritization

  • Orchestrator 8.4

• Overlay ACL
• Maximum Orchestrator backups to retain now configurable
• RMA Wizard
• Upgrade appliances via Configuration Wizard
• Tree filters
• Transceiver information for EC-M-B and EC-M-P models SFP interfaces
• Admin up/down datapath interfaces
• Account key protection
• IP/Port wildcard pattern match
• IPFIX Flow Export
• IPSLA HTTP Ping
• Enable / Disable Default DNS Lookup
• Auto-MTU Discovery Scheduler
• Interface Dynamic Rate Control
• Compound Applications
• IPSec Pass-Through Tunnels

  • Orchestrator 8.3

• Overlay Region Support
• Orchestration of Templates (Groups)
• Inbound Port Forwarding Orchestration
• Cross Connect Grouping
• (8.3.3) OSPF support
• (8.3.3) Interface Bandwidth Summary report
• (8.3.3) Orchestrator in-place upgrade (no revert to previous Orch version from this point on)
• (8.3.3) Appliance Flow Trends tab enhancements
• (8.3.3) Authentication protocols for TACACS and RADIUS
• (8.3.3) Alarms in CSV format
• (8.3.3) CLI shell from UI
• (8.3.3) Remote assistance
• (8.3.3) TCP MSS clamping
• (8.3.6) Unreachable appliances are now shown grey in the tree
• (8.3.6) Network Manager role deprecated
• (8.3.6) Saas ping interface configurable
• (8.3.6) Configurable VLAN for Edge HA
• (8.3.6) Pause Orchestration

  • Orchestrator 8.2

• IPSec UDP overlays
• Packets per second trends tab
• Tech Support improvements (appliance and Orchestrator tabs)
• Orchestrator system dump
• Application Visibility and Classification (AVC)
• Edge Connect High Availability HA Support
• Controlling statistics collection
• IP Whitelist

  • Orchestrator 8.1

• Improved Health Dashboard
• Dynamic Topology Geomap
• Live View
• Traceroute support in the GUI
• Policy maps enhancements
• BGP support
• Flow tab enhancement
• Top Talkers, domains, countries and ports
• Tunnel Bandwidth, DSCP, Jitter and Traffic Class Pie Charts
• Appliance Flow, DSCP, QoS and Jitter Trends
• Scheduled reports improvements
• HTTPS Certificates Upload template
• Custom SSL certificate for Orchestrator UI
• Geo location support for Discovered Appliances tab
• Deployment configuration tab improvements
• DHCP leases by appliance
• Built-in applications
• Overlay Manager controls
• Overlay boost button improvement

  • Orchestrator 8.0

• Health Dashboard
• Deployment Profiles
• Overlay Topology
• Tunnel charts per overlay
• Labels (VXOA 8.0)
• Tunnel Groups replace Tunnel Builder (VXOA 6.2.11)
• Shaper, policy and ACL template support (VXOA 8.0)
• Registration removed from Cloud Portal template (VXOA 7.0)
• VRRP Template (VXOA 6.2.11)
• Tunnel templates now support fast fail threshold (VXOA 7.3.3)
• New Shaper report (VXOA 8.0)
• Consolidated Audit Log tab
• Appliance Configuration backup (VXOA 6.2.11)
• New Deployment report
• Bulk import subnets from .csv now supported

  • Orchestrator 7.3 (EoL)

• Appliance discovery (VXOA 6.2.11)
• Tunnel summary report
• Scheduled group reboot/shutdown
• Scheduled group QoS map activation
• SMTP settings dialog
• Scheduled timezone dialog
• Third party licenses page
• Silver Peak appliances licenses page
• Cloud Portal registration template (VXOA 7.2)
• SaaS Optimization template (VXOA 7.2)
• CLI template (VXOA 6.2.11)

  • GMS 7.2 (EoL)

• HTML email reports (VXOA 6.2)
• Appliance discovery (VXOA 6.2.10)
• Alarms via email
• Time based QoS (VXOA 6.2)
• GMS Backup
• Historical Jobs
• VMware vROps Integration (VXOA 6.2.10)
• New charts added
• New templates added
• New configuration reports added
• REST API


No comments:

Post a Comment