RV320 v1.1.1.19 Bugs + Feature Requests

[matthew1471]

Firstly thank you for posting the new firmware and fixing some of the annoying bugs in the last version, the update to newer OpenSSL versions was particularly appreciated :-).

There's a few bugs and feature requests I still have that I'd like to share with you, from discussion with Cisco before it sounds like some of these were planned so perhaps these just didn't make it into the final release?

Recently Discovered :

Bugs:

1. Typos and software age : "Resource Management" under "SSL VPN" when you select "Add" under the "Application Icon" drop-down offers "Microsoft Interment Explorer" (sic). Also Microsoft FrontPage has been discontinued for 10 years and since superseded by 2 products (Microsoft Visual Studio is now the best replacement). The Cisco copyright is also (c) 2013 which all in all in 2015 makes the product feel quite old despite the firmware being released a few days ago.

2. The proposed Cisco "Easy VPN" on the VPN screens is actually End-of-Life (EoL) http://www.cisco.com/c/en/us/products/collateral/security/vpn-client/end_of_life_c51-680819.html so I'm not sure what the suggested option is on Windows 8.1

3. Client-To-Gateway settings IKE-with-Certificate expects the client to have a static IP or a DNS record... for a mobile device I'm not sure if it's possible to specify an IP range and the in-built help doesn't suggest anything.. this may however be a lack of VPN knowledge on my part. Group VPN while allowing you to specify other means of authentication also forces pre-shared key (so you cannot use certificates) and has an option referring to Microsoft XP/2000 clients which implies it won't work on newer versions of Windows. Windows XP and 2000 are both End of Life.

4. On the System Statistics page WAN2 is showing as Enabled, despite it being disabled and the system summary stating so. Also nothing is plugged into it and it reports on System Statistics that there have been 4 transmitted packets, 4 total packets and 424 transmitted packet bytes. The interface has been completely disabled from boot-up.

Feature Requests:

1. OpenVPN support.

2. A guide / assistance in the built-in help on how to make this VPN Router work with Android V4 and above clients using the default stock VPN options. The options on Android are "PPTP" (which nobody touches any more for new deployments, Microsoft themselves even recommend you avoid using this), "L2TP/IPSec" (Pre-Shared Key and RSA variants), IPSec Xauth (Pre-Shared Key and RSA variants) and one that allows a mix "IPSec Hybrid RSA".

Carried Over From "RV320 v1.1.1.06 Bugs + Feature Requests":

Bugs:

1. Mirror Port feature allows the device plugged into the port to still interact with the network and mirrored traffic (which is not the behaviour of your small business switches) allowing it to respond to and interact with received traffic. At a minimum the documentation does not warn of this difference in behaviour.

4. Still impossible to set a Daylight Saving rule for the UK. http://en.wikipedia.org/wiki/British_Summer_Time

5. DHCP Status table periodically loses all entries. Particularly after anything that causes the router to reboot. The documentation should explain this is since the router was started and this list is lost when the router is restarted.

8. Help for "System Statistics" and "Processes" is very limited (and not helpful).

9. Clicking "Enabled" or "Disabled" against USB1 or USB2 does not contain a hyperlink to the "USB Failover Settings" tab of the selected interface under Setup->Network where the operation mode can be set to "Disabled" which all the other options do have.

10. Processes like "webBoot" appearing and using port 22088 in the Processes table and "HTTP Server with SSL support" on ports like 5443 and the documentation lists nothing about them.

Feature Request:

1. Ability to choose which port is mirrored (LAN2, LAN3, LAN4, WAN1, WAN2, VLAN1.. etc) and potentially the destination (i.e if we are not using WAN2 why not make it an option to be a mirror port destination?).

2. Tables to be sortable ASCending/DESCending by clicking on the column.

3. "Enable Mirror Port (Port 1)" rename to "Mirror All Traffic (To Port 1)" and/or update documentation to explain a device on Port 1 with this enabled should NOT attempt to reply to the traffic.

4. Web API or Proprietary Telnet API (or even just experimental SSH access) option so we can programmatically add items to the firewall rules table (fail2ban etc) so we can write scripts in Python etc to ban IP addresses on the Firewall.

5. The option to choose what gets syslog'd and what gets written to the non-volatile memory log (worried about device longevity with all the logging turned on). The WAP371 now has this feature.

6. Bandwidth Management cannot set an IP to have a particular priority. The priority only lists services (with no IP address control) and the Rate Control only lists particular rates (but for specific IPs).. would like to say something like 192.168.1.5 has "High" priority.

7. Some of the columns to be sensibly sorted by default instead of the order they were entered.. for example IP & MAC Binding should be sorted by IP address.

8. A wider range of Dynamic DNS providers supported (1 for Europe/America and 1 for China is not really enough!). Perhaps an API/standard for this too so we can make our own.

9. Ability to route all web traffic via a HTTP proxy (like Squid). Sometimes called a transparent web proxy.

10. Ability to ban an IP after they fail to correctly login x number of times to either the VPN/Web Interface/SSL VPN etc.. to prevent bruteforce attacks succeeding.

11. DNS Local Database - Would be nice if there was an option (i.e. could be disabled) for the DNS server to append the domain name to any queries without a "." so Windows users could enter in "NAS" for example in the DNS Local Database and it behave as expected.

Also as an aside, I've noticed on this site when you type in too many tags into the add discussion page it errors and then trashes the form (including whatever you wrote in this box), which is quite frustrating.

Thank you again for fixing a lot of the bugs in the last release. I look forward to seeing the next one which should make the product even better. If there's a better way to be more involved in testing/reviewing Cisco products please let me know as I would love to help out.

Regards,
Matthew

[dancrichton]

I've downloaded it, but not yet installed it. I'll try installing it in the next hour and start testing all the issues I've had with it. I've had this RV320 sat on my desk as an expensive paperweight for 6 months now.

Release notes says SSL VPN component expiration is still an known issue, so still needs a workaround which leaves IE open to malicious code as it requires that unsigned controls are allowed to be downloaded and run - putting the router in the trusted sites zone will help to mitigate the impact of this requirement, but it's still an undesirable option.

Apparently virtual passage should now work on Win7 64bit IE10 and Win 8.1 IE 11, I'll be testing that to confirm as that was one of our biggest stumbling blocks.

EDIT: SSL virtual passage fails at the first hurdle. The javascript check when clicking the link to connect to use has been modified partly to look for either "msie" or "rv:11" in the user agent string, which is the correct thing to do with IE11. But then there's an if statement block that only allows the redirection to the virtual passage installer URL if the string contains "msie" - so that's IE11 ruled out. Here's the code snippet:

  if(webagent.indexOf("msie") != -1 || webagent.indexOf("rv:11") != -1)
  {
   //w_poen_virtual_passage=window.open('/virtual_passage_install.htm','virtual_passage_install','menubar=no,width=50,height=100,status=no');
//    w_poen_virtual_passage=window.open('/virtual_passage_install.htm?' + 'VPTunnelMode=' + document.getElementById("tunnelMode").checked,'virtual_passage_install','menubar=no,width=705,height=505,status=no,resizable=no');
//    document.location.href='/virtual_passage_install.htm?' + 'VPTunnelMode=' + document.getElementById("tunnelMode").checked,'virtual_passage_install','menubar=no,width=705,height=505,status=no,resizable=no';
//    window.parent.frames['virtualpassageframe'].location.href="/virtual_passage_install.htm";
   if(webagent.indexOf("msie") != -1)
   {
    window.parent.frames['virtualpassageFrame'].location.href="/virtual_passage_install.htm?VPTunnelMode=" + document.getElementById("tunnelMode").checked;
   }
   else
   {
    alert(Language.VIRTUAL_Passage_Requires_IE);
   }
  }

It looks like it was set up to allow IE11 at some point, but then that code is commented out and the if statement added to display a warning that IE is required if using IE11. Here's the default user agent string for IE11 on Win8.1:

Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko

So the release notes are blatantly wrong, as they clearly state that Win8.1 IE11 is supported for SSL virtual passage, here's the quote:

Support SSL VPN virtual passage for Win7(64bit) IE10 and Win8.1 IE11.

And seems to fail with IE10 on Win7 64bit, I've enabled download of unsigned controls and it prompts to install the XTunnel_WOW64.cab file, but it doesn't do anything after that. Pretty sure this is because you can't install drivers that are unsigned in Windows 7 without adjusting registry settings to allow it and turning this "feature" on opens the entire system up to yet more malicious code. The only real solution is for Cisco to release another update with controls and drivers that don't use expired certificates. Time to ask for my money back due to false advertising as the SSL VPN is still being touted as a feature of the RV320/325 and it has no hope of working with a currently supporting Windows system.

Where's the facepalm emoticon?

Dan