Current Release - Release Notes Ransomware Defender AirGap 2.0

• What’s New in Superna Eyeglass Ransomware Defender Edition Release 2.5.12 AirGap 2.0 (05/09/2023)
• Supported OneFS releases
• Target Airgap Cluster
• Supported Eyeglass releases
• Inter Release Functional Compatibility
• End of Life Notifications
• New in Superna Eyeglass Ransomware Defender Edition Release 2.5.11 AirGap 2.0 (04/03/2023)
• New in 2.5.11- 23110
• New in Superna Eyeglass Ransomware Defender Edition Release 2.5.10 AirGap 2.0 (03/06/2023)
• New in 2.5.10-23087
• New in Superna Eyeglass Ransomware Defender Edition Release 2.5.9.1 AirGap 2.0 (02/14/2023)
• End of Support in Release 2.5.9
• Deprecation Notices
• Technical Advisories
• New in Superna Eyeglass Ransomware Defender Edition Release 2.5.9 AirGap 2.0 (11/30/2022)
• New/Fixed for AirGap 2.5.9
• New/Fixed for AirGap 2.5.8.1-22100
• New for AirGap 2.5.8.1-22080
• T22072 AirGap Enterprise Events and Disk Usage Retrieval is now a push
• T19599 Migrate Configuration from Protected to Vault Cluster
• T21214 AirGap Enterprise can now support multiple vaults managed from the same Eyeglass
• T22123 Command to send vault agent logs manually
• T21490 Monitor AirGap SyncIQ Policies for changes to configuration
• T21830 AirGap Enterprise Fiber cutter option
• Fixed in AirGap 2.5.8.1-22080
• T22930 AirGap Enterprise Replication Nodes require access to Production Network
• T20932 AirGap Job Reports CSV does not report failed jobs
• New for AirGap 2.5.8-22028
• New for AirGap 2.5.8-21330
• New for AirGap 2.5.8-21306
• T20945 AirGap - Alarm Conditions (AirGap Enterprise)
• New for AirGap 2.5.8-21240 - Controlled Availability
• T21212 AirGap Enterprise does not require Static Route configuration
• T21042 Automated retrieval of vault cluster logs (AirGap Enterprise required)
• New for AirGap 2.5.8-21213/21222 - Controlled Availability
• T19522 AirGap Enterprise
• Fixed in 2.5.8-21330
• T22171 - Log4j Vulnerability - Upgrade to Log4j 2.17.0 (2.5.8-21330 and higher Log4j 2.17.0 )
• Fixed in 2.5.8-21306
• T22033 Log4j Vulnerability - CVE-2021-44228
• Fixed in 2.5.8-21222
• T20770 AirGap Event Retrieval Job Fails with No route to host
• T20358 Not able to create an AirGap Job Report for a selected period
• T19195, T19221 AirGap Job shows success when failed
• Fixed in 2.5.8-21213
• T20766 Cannot view second page of AirGap Config AirGap job list
• Known Issues
• T15104 Default schedule does not run the job
• T15300 Error on manually connecting Airgap not displayed
• T16199 No alarm if Airgap event retrieval from Powerscale cluster is in error
• T16436 Airgap Jobs cannot be manually run from the Airgap window
• T16456 Customized Airgap schedules reset to default after upgrade
• T16457 Airgap window not refreshed
• T16470 Renaming Airgap SyncIQ policy does not preserve original settings
• T16476 AirGap Job continues to run after Powerscale cluster deleted from Eyeglass
• T19609, T19632 User Disabled AirGap Job may have status of having been run when it has not
• T19631 AirGap Config window time uses Eyeglass appliance timezone
• T20966 AirGap Job Configuration lost on rediscover or anyrelease restore
• T21134 AirGap Basic Job can be started from Jobs window without AirGap role
• T21863 AirGap Basic static route remains on error
• T21327 Managed Device Alarms have incorrect date and are sorted oldest to newest
• T21224 Snapshot schedule job created for AirGap Job
• T21147 Customizing AirGap policy prefix results in job errors
• T21659 AirGap state - network disconnected in UI
• T20945 AirGap Open Check may not detect vault open
• T23094 Vault Cluster Event Retrieval fails for AirGap Basic in 2.5.8.1
• T20525 Connectivity check does not work for AirGap Enterprise with Fiber Cutter
• T23399 No validation when adding vault cluster
• T23400 Fiber Cutter Error Handling
• AIRGAP- 404 [Airgap Reports] It shows an Error for the Job when creating a report manually
• AIRGAP 416-Vault Agent log archive has incorrect naming
• AIRGAP-429 Data is replicated when there are active ransomware events
• AIRGAP- 434 CAS jobs are not pushed into Eyeglass
• AIRGAP-490 The event Retrieval job fails for Basic AirGap
• AIRGAP-501 9.5 protected cluster cannot be added in AirGap Enterprise
• AIRGAP-529 Duplicated heartbeat when the vault cluster is not connecting to the protected cluster
• AIRGAP-528 Error message displayed in vault agent console for failed command needs to be fixed
• Known Issues ECS
• Airgap-147 Total number of jobs in AirGap report is incorrect
• Airgap-221 NULL is displayed for Source in Managed Devices Alerts
• Airgap-224 Job update to Eyeglass is not working as expected
• Airgap-289 Active RWD events are ignored when starting AirGap ECSsync jobs from UI using Run Now
• Airgap-226 Docker issues in Vault Agent
• AIRGAP-372 Not all the AirGap ECSsync jobs are started when scheduled
• Known Limitations
• T19614 AirGap Job consideration of Easy Auditor Active Auditor Active Event not configurable
• T21316 Vault stays open for vault cluster event retrieval
• T21274 Alarm raised for vault open in Eyeglass is not cleared after maintenance window is finished
• T21851 AirGap Enterprise vault open alarm limitation
• Airgap-329 Vault agent names must be case-insensitively unique
• AIRGAP-427 Airgap ECS sync jobs get duplicated sometimes

Deprecation Notices

Fixed in 2.5.8-21330

T22171 - Log4j Vulnerability - Upgrade to Log4j 2.17.0 (2.5.8-21330 and higher Log4j 2.17.0 )

Fixed in 2.5.8-21306

T22033 Log4j Vulnerability - CVE-2021-44228

Resolution: log4j version has been updated to 2.15.0, which has a patch for the vulnerability.

Fixed in 2.5.8-21222

T20770 AirGap Event Retrieval Job Fails with No route to host

AirGap Event Retrieval job uses the IP address configured in Eyeglass to manage the production Powerscale cluster. If that IP address is not associated with a node that is configured in the AirGap pool for replication to the vault then event retrieval fails because the static route applied to the AirGap pool is only applied to the nodes in the pool.

Resolution: The IP address from a node in the AirGap pool is now used for event retrieval. Note that additional sudoer permissions are required as documented here.

T20790 AirGap SyncIQ policy timeout uses a failover timeout setting

The amount of time that RansomwareDefender will wait for an AirGap SyncIQ job to complete is defined in the Eyeglass system.xml "failovertimeout" setting. Impact: If the "failovertimeout" setting is lower than the time required for the SyncIQ policy to complete, the AirGap job will timeout and remove the static routes causing the AirGap SyncIQ job to fail with an incomplete update to the vault copy of the data.

Resolution: Eyeglass system.xml now has a separate tag for the timeout setting for AirGap SyncIQ policy: airgapJobTimeout. This tag will need to be upgraded to the desired value. Default is 240 minutes.

T20358 Not able to create an AirGap Job Report for a selected period

The AirGap Reports tab feature to Create Report for a custom time frame results in an error and the report is not produced. Impact: This does not affect the daily AirGap job report that is sent out. The issue is specific to custom report generation.

Resolution: Specific timeframe can now be selected.

T19195, T19221 AirGap Job shows success when failed

Under some circumstances if an AirGap job fails, such as running the AirGap SyncIQ job or AirGap job source cluster unreachable, the AirGap Config window job status shows success.

Resolution: Alarm and running job info and job history correctly show the failure.

Fixed in 2.5.8-21213

T20766 Cannot view second page of AirGap Config AirGap job list

The AirGap Config list of AirGap jobs list is limited to 10 jobs per page. If you have configured more than 10 jobs, when you navigate to the second page the display is blank.

Resolution: AirGap Jobs are now displayed on all pages.

Known Issues

T15104 Default schedule does not run the job

Airgap jobs are created with a default schedule (daily at midnight) but Status shows as Not Scheduled and jobs never run.

Workaround: Set a manual schedule.

T15300 Error on manually connecting Airgap not displayed

If the command to manually establish connectivity igls airgap connect fails it correctly does not apply the static route but the status message indicates that connectivity has been established.

Workaround: Verify from Isilon interface whether pool has static route applied.

T15333 No notification if Airgap jobs are globally disabled

After using the command igls airgap disable to globally disable Airgap jobs there is no alarm to notify administrator of this action and no indication in the GUI that action has been taken.

Workaround: Airgap last run date can be used to determine whether it is running on it's schedule.

T16199 No alarm if Airgap event retrieval from Powerscale cluster is in error

If the job to retrieve events from Powerscale cluster encounters an error there is no alarm raised to notify administrator.

Workaround: Login to the Eyeglass GUI and check the status of the event retrieval job.

T16436 Airgap Jobs cannot be manually run from the Airgap window

Airgap Jobs cannot be manually run from the Airgap window.

Workaround: Airgap jobs must be manually run from the Eyeglass Jobs window.  

T16456 Customized Airgap schedules reset to default after upgrade

After an upgrade, the Airgap schedules get reset to the default once a day setting.

Workaround: Document schedules prior to upgrade and reapply post upgrade.

T16457 Airgap window not refreshed

After adding a new job the Airgap window is not refreshed to show the new job.

Workaround: Close and reopen the Airgap window.

T16470 Renaming Airgap SyncIQ policy does not preserve original settings

If an Airgap SyncIq policy is renamed the settings related to this SyncIQ policy are not preserved in Eyeglass.

Workaround: Reapply settings in Eyeglass once Inventory has run and the Airgap job with new name is visible in Eyeglass.

T16476 AirGap Job continues to run after Powerscale cluster deleted from Eyeglass

If there are Airgap jobs related to Powerscale cluster that has been deleted from Eyeglass, Eyeglass will continue to attempt to run them but the job will not succeed.

Workaround: None required. No alarm is generated.

T19609, T19632 User Disabled AirGap Job may have status of having been run when it has not

If an AirGap Job is User Disabled in the Jobs window, it may appear in Running Jobs, AirGap Jobs History or show a Last Run date as though it had run after being user disabled even though it did not actually open the vault and run the airgap SyncIQ job.

Workaround: Check on Powerscale directly to confirm that AirGap SyncIQ job has not been run.

T19631 AirGap Config window time uses Eyeglass appliance timezone

The date and time shown in the AirGap Config window uses the Eyeglass appliance timezone instead of the timezone of the computer which is accessing Eyeglass as is done elsewhere in the GUI.

Workaround: If Eyeglass appliance and local browser time zone are different, manually convert the date / timestamps in the AirGap Config window to the local browser time zone to be able to compare run times in different windows.

T20966 AirGap Job Configuration lost on rediscover or anyrelease restore

If the igls rediscover command is executed on Eyeglass with AirGap configuration or an anyrelease restore to a new appliance the AirGap Job Configuration for subnet mask and gateway are lost. Schedule is maintained.

Workaround: Consult with support.superna.net before performing either of those operations. Keep an independent record of AirGap job configuration.

T21134 AirGap Basic Job can be started from Jobs window without AirGap role

Any member of a User Role with the Jobs Modify permission can run an AirGap Basic job.

Workaround: Only include Jobs Modify permission for roles where it is required and limit membership to Roles with the Jobs Modify permission.

T21863 AirGap Basic static route remains on error

If an error occurs which leaves the static route behind, there is no mechanism that will automatically remove the static route and it will cause the next scheduled AirGap job to fail.

Workaround: Static route must be removed manually. Introduced in Release 2.5.8 there is a check every 5 minutes to determine whether the vault is open when it shouldn't be that can be used to alert to this condition and that manual removal of static route is required.

T21327 Managed Device Alarms have incorrect date and are sorted oldest to newest

The vault cluster events displayed in Managed Device Alarms have the date/time they were retrieved rather than the actual event date and are sorted oldest to newest.

Workaround: Use pagination to navigate to newer alerts.

T21224 Snapshot schedule job created for AirGap Job

A Snapshot Schedule Configuration Replication job is incorrectly created for each AirGap job and is enabled.  When Configuration Replication runs the Snapshot Schedule jobs are also run and result in error for AirGap jobs as the target cluster (vault cluster) is not reachable.

Workaround: Set the Snapshot Schedule jobs for the AirGap Jobs to User Disabled.

T21147 Customizing AirGap policy prefix results in job errors

If the AirGap Job SyncIQ policy prefix is customized, existing and new AirGap jobs are in error.

Workaround: Contact support.superna.net for assistance to remove references to previous prefix jobs.

T21659 AirGap state - network disconnected in UI

If a scheduled AirGap job runs and finishes while a maintenance window is active to keep the vault open, on the GUI the AirGap State shows Network Disconnected even though the AirGap is still open as per the maintenance window parameters.  Impact: Display only, the AirGap stays open as expected until the maintenance window timer expires at which point it is closed.

Workaround:  None required.  Once the maintenance window expires, the vault will be closed and you will receive notification as an informational alert 

T20945 AirGap Open Check may not detect vault open

AirGap Open Check uses the IP address configured in Eyeglass to manage the production Powerscale cluster. If that IP address is not associated with a node that is configured in the AirGap pool for replication to the vault then the open check will find that the vault cluster is always closed and not detect an open state.

Workaround: For AirGap basic the next AirGap job will error due to static route still being present. For AirGap Enterprise, the vault agent will detect the open vault and close it without any manual intervention and no alarming.

T23094 Vault Cluster Event Retrieval fails for AirGap Basic in 2.5.8.1

As of 2.5.8.1, the task to retrieve alarms from vault cluster during the AirGap job fails and no alarms from the vault cluster are gathered.

Workaround:  None available.  Until this issue is fixed, AirGap basic customer should not upgrade.  Plan to address in a patch release.

T20525 Connectivity check does not work for AirGap Enterprise with Fiber Cutter

The connectivity check command ecactl airgap check --prod <cluster> run from the vault agent does not work for AirGap Enterprise configured with Fiber Cutter.

Workaround: Manually open the vault and manually check connectivity.

T23399 No validation when adding vault cluster

There is no validation when adding vault cluster that all required parameters have been configured and that entries have valid format.  If misconfigured, AirGap jobs will not run.

Workaround: Use manual process and connectivity check to verify configuration.

T23400 Fiber Cutter Error Handling

If there is an configuration or environmental issue that prevents connectivity on the Fiber Cutter deployment, no error is provided when the AirGap jobs fail.

Workaround: Contact support.superna.net for assistance.

AIRGAP- 404 [Airgap Reports] It shows an Error for the Job when creating a report manually

Manual report creation test- Failed

Reports are getting generated when create manually but It shows an Error for Job

When clicking on AIRGAP Icon & Navigate to Airgap reports and creating a report you observe an error in the jobs window

AIRGAP 416-Vault Agent log archive has incorrect naming

Vault Agent log archive has incorrect naming

AIRGAP-429 Data is replicated when there are active ransomware events

Setup:

1. Pause data replication when active ransomware events detected option checked
2. ransomware events raised
3. Airgap ECS sync job runs on schedule

Reproduced on: 2.5.9-22231

Expected behaviour: The job failed due to active rsw events

Actual behaviour: the job is finished, data replicated, and only a warning message showed

AIRGAP- 434 CAS jobs are not pushed into Eyeglass

AIRGAP-490 The event Retrieval job fails for Basic AirGap

Once the AirGap job starts to run, the Event Retrieval job also starts.

AIRGAP-501 9.5 protected cluster cannot be added in AirGap Enterprise

When trying to add a 9.5 prod cluster in AirGap Enterprise getting the error.

AIRGAP-529 Duplicated heartbeat when the vault cluster is not connecting to the protected cluster

While the connection between the vault cluster and the protected cluster is broken can be seen that heartbeats are duplicated in vault agent logs.

Known Issues ECS

Airgap-147 Total number of jobs in AirGap report is incorrect

In some cases, there can be a discrepancy between the total shown in the pagination view of airgap jobs history and the number shown in the job report. The number in the report is accurate.

Workaround: use the job report to determine the actual number of jobs run.

Airgap-221 NULL is displayed for Source in Managed Devices Alerts

When proxying alerts from the vault ECS cluster in the ECS airgap solution, the Source is listed as null.

Workaround: none

Airgap-224 Job update to Eyeglass is not working as expected

Airgap-289 Active RWD events are ignored when starting AirGap ECSsync jobs from UI using Run Now

AirGap ECSsync jobs with the ‘Pause data replication when active ransomware events detected’ option selected and the jobs are started from UI using Run Now, the jobs will continue to run with active RWD events.

Workaround: Setup the schedule for the jobs or start the job with CLI command 'ecactl ecssync startjob --job xxx'

Airgap-226 Docker issues in Vault Agent

Docker may stop working if the ECS sync cluster up for a long period of time.

Workaround: Contact Superna customer support or run

• ecactl cluster down

• sudo systemctl restart docker

• remove docker network: docker network rm <TAB>

• ecactl cluster up

AIRGAP-372 Not all the AirGap ECSsync jobs are started when scheduled

On the multi-vault system that has 3 vaults managed by the same eyeglass, each vault has 5 jobs. All 15 AirGap ECSsync jobs are scheduled to run at the same time, every 15 minutes. On the second vault agent, only 3 out of 5 jobs are started automatically

Known Limitations

T19614 AirGap Job consideration of Easy Auditor Active Auditor Active Event not configurable

Suppose in the Easy Auditor Active Auditor "Active Events" list, and there is an Active Event listed at the time when the AirGap job is scheduled to run. In that case, the AirGap Job will be blocked from running with the message "Found active RSW events, will not run AirGap job...." In the AirGap Config GUI, the job AirGap State is "Disabled for Active Events", and the Status is Error.

Easy Auditor Active Events should be managed and cleared not to impact AirGap jobs. This behaviour may be configurable in a future release to specify whether or not active auditor events block AirGap jobs.

T21316 Vault stays open for vault cluster event retrieval

If event retrieval from the vault cluster takes longer than running the AirGap SyncIQ job, the vault will stay open until the event retrieval step completes after which it will be closed.

T21274 Alarm raised for vault open in Eyeglass is not cleared after maintenance window is finished

Alarm raised when vault manually opened for maintenance window is not cleared once the maintenance window is ended and vault is closed again. Alarm is able to be manually cleared.

T21851 AirGap Enterprise vault open alarm limitation

In the interval between when the the vault is opened and the associated task is started, a vault open alarm may be triggered as the related task has not been started so the condition of vault open when it should not be is detected. 

Workaround: Verify that an associated vault task such as running airgap job or checking for schedule has started shortly after the alarm was raised.

Airgap-329 Vault agent names must be case-insensitively unique

Vault agent names must be case-insensitively unique when you have multiple vault agents added. 

AIRGAP-427 Airgap ECS sync jobs get duplicated sometimes

Airgap ECS sync jobs get duplicated sometimes

workaround:

Remove the duplicated job from ECS sync UI