Before You Upgrade (READ ME FIRST)

Please pay special attention to the issues below before you begin an upgrade to this LMOS release.

Generation of 4096-bit DHE Key

During an upgrade to this version of LMOS from a version prior to 7.2.53.0, a new 4096-bit DHE key is generated. On smaller LoadMasters, this can lead to significant CPU and memory consumption that could impact regular virtual service traffic. So, Kemp strongly recommends that this update be performed in a maintenance interval. 

Best Practices Cipher Set

In LMOS 7.2.52.0, the BestPractices cipher set was updated. If you are upgrading from a version prior to 7.2.52.0, this change is effective immediately after upgrade to this release. This change was made to improve LoadMaster security and conform to the latest industry best practices.

It is recommended, however, that you migrate your services as soon as possible to use the new BestPractices cipher set. For more information on the cipher suites removed from the set, please see the LMOS 7.2.52.0 Release Notes.

Supported Models for Upgrade

This release of LMOS is supported on the Hardware and Virtual models shown in the first three columns of the table below. It is not supported and should not be installed on any model listed in the two columns at right. This update patch can be applied to any supported model regardless of licensing (e.g., SPLA, MELA) or platform (e.g., hardware, local cloud, public cloud).

If your model number is not listed above, please see the list of End of Life models.

Upgrade Path

You can upgrade to this release of LMOS from any previous 7.2.x release. For full upgrade path information, please see the article Kemp LoadMaster Firmware Upgrade Path.

Upgrade Patch XML File Verification Notes

By default, verification of the digital signature on upgrade images is required in LMOS 7.2.50.0 and above. See the Update Verification Options setting under System Administration > Miscellaneous Options > WUI Settings. If the unit you are upgrading is set to require validation, you'll need to supply the XML Verification File supplied with this release.

Note that:

• In previous releases, two verification files were provided: one for pre-7.2.51 systems and one for later systems. This restriction has been removed with the 7.2.53.0 release; if upgrading from firmware 7.2.51.0 / 7.2.48.3 and above you can use the XML file provided with this release. If upgrading from any other firmware version you must following the upgrade path detailed in Kemp LoadMaster Firmware Upgrade Path article.
• LoadMasters running an LMOS version prior to 7.2.49 do not provide the option of XML file verification in the UI or API. If you are upgrading from one of these releases to this release, you can verify the digital signatures offline using a manual process documented on the support website.

Downgrading to Earlier Versions

Downgrading a LoadMaster running LMOS 7.2.55.0 to LMOS 7.2.51.0 (or a later release) can be performed using any desired Update Verification Options setting.

Downgrading to LMOS 7.2.50.0 or a previous release can only be done when the Update Verification Options setting is set to Optional or Legacy. When performing the downgrade, do not specify an XML file. If you want to verify the digital signature on the image before downgrading, you can do so using a manual process documented on the support website.

New Features

TLS 1.3 Cipher Suite Selection

Controls have been added to the Virtual Service UI and API that allow you to select the TLS 1.3 ciphers suites offered by LoadMaster to incoming clients when a TLS 1.3 connection is negotiated. By default, all TLS 1.3 ciphers are selected (as in previous releases). Using the controls, any mix of the 5 ciphers supported by TLS 1.3 can be configured. Note that the controls for selecting TLS 1.3 ciphers are visible in the UI only if TLS 1.3 has been selected.

Change Notices

SNMPv3 Authentication Updates

Several enhancements have been made to SNMP Version 3 functionality, to provide better security and separation of controls when configuring the system for for SNMP Version 3 (SNMPv3):

• When the SNMP V3 check box is enabled, options specific to SNMPv2 are hidden (the values are saved).
• SNMPv3 options now include an optional Privacy Password. This optional feature provides a second level of security, in addition to the required Authentication Password. To enable it, click the Enable privacy check box; the Privacy Password text box appears (along with the Privacy protocol selection box from previous releases).  

SSO Domain Configuration Field Character Limit Increased

The text field character limit for SSO client-side and server-side domain configurations has been increased from 98 to 255 characters. If 256 characters are entered, the UI will reject the entered value as invalid and no change will be made. (These controls are available for each VS by clicking Virtual Services > Manage SSO > Modify.)

Downgrading on AWS

Starting with version 7.2.55.0, LMOS can only be deployed on an AWS Nitro-based instance type -- and in 7.2.55.0 could not be downgraded to a release prior to 7.2.55.0. Starting with 7.2.56.0, LMOS running on a Nitro instance can be downgraded to any prior release subsequent to and including 7.2.48.5.

UI Usability Updates

The following changes have been made to the organization and functionality of the LoadMaster UI.

1. The System Configuration > System Administration > AFE Configuration page has been removed from the UI, and the several screen elements moved to their own separate pages. You can navigate to the new pages following the click paths below. Most use the same as on the removed page, with the one exception noted below. The click paths below show the new locations:
   • • Virtual Services > Cache Configuration
     • Virtual Services > Compression Options
     • Certificates and Security > IPS / IDS (formerly: Intrusion Detection Options)
2. The five SSL related options on the System Configuration > Miscellaneous Options > Network Options page have been moved to a new page at Certificates & Security > SSL Options.
   • • Enable SSL Renegotiation
     • Disable Master Secret Handling
     • Size of SSL Diffie-Hellman Key Exchange
     • Log SSL errors
     • OpenSSL Version
3. The Virtual Service WAF properties UI has been revised to provide:
   • • a Rule Filter for listing a subset of the rules
     • the ability to Clear All and Set All rules
     • icons to indicate that rule groups can be expanded to display the individual rules
4. The following utilities have been moved from the System Configuration > Logging Options > Debug Options page to a new page at System Configuration > Troubleshooting.
   • • Perform a PS
     • Perform Top
     • Include Top in Backups
     • Display Meminfo
     • Display Slabinfo
     • Perform an Ifconfig
     • Perform a Netstat
     • Include Netstat in Backups
     • Netconsole Host
     • Ping Host
     • Ping6 Host
     • Traceroute Host
     • TCP dump

Security Updates

CLI Security Fix (Privilege Escalation)

On Virtual LoadMaster (VLM) only: In previous releases, a malicious, privileged user, who had already gained access to the CLI, could (through a properly constructed series of commands) obtain unrestricted access to the VLM disk image and thereby obtain a debug password to the running system. This vulnerability has been closed. [CVE-2021-45080]

Issues Resolved

New Known Issues

Existing Known Issues

<FQDN>:794 Uncaught ReferenceError: disp_addrr_elements is not defined
    at <FQDN>:794
(anonymous) @ <FQDN>:794