New hardware support

This version supports the RG-CF50XS.

NAT64/NAT66

NAT64 and NAT66 support active-standby synchronization in high availability (HA) scenarios.

Application identification

The maximum number of custom application groups has been expanded to 150.

DDoS

DDoS protection is supported for SYN packets of the SSL VPN service.

SSL proxy

The maximum number of concurrent SSL proxy sessions for the RG-CF50XS has been increased.

DHCP service

The DHCP service supports Options 66 and 67.

GRE

The IP address of the local loopback interface can be configured as the source address of a GRE tunnel.

PPPoE client

The PPPoE dial-up status and logs can be queried.

Service Name can be configured.

User authentication

l   The authentication feature on Cybrey Cloud supports account-based rate limiting.

l   Ruijie Cloud and Cybrey Cloud support local voucher authentication.

l   Supports integration with the property management system (PMS).

Dynamic routing

Supports basic BGP capabilities.

Web-based authentication

l   Web-based authentication logs are supported, including connection and disconnection reason fields.

l   Logs can be viewed on the web interface.

Web usability

Device names can be configured on the web interface.

Device names can be displayed on the home page.

Device names can be displayed on the browser tabs.

Syslog

The Syslog functionality is improved and the types of logs that can be forwarded are expanded.

l   The source IP address or source interface can be selected for forwarding logs via Syslog.

l   The types of logs that can be forwarded via Syslog are expanded, including operation logs, SSL VPN logs, and IPsec VPN logs.

AI-based threat detection

AI-based threat detection capabilities are enhanced to detect abnormal heartbeat callback behaviors in outbound TCP-encrypted protocol traffic.

Traffic control policy

Policies based on source MAC addresses are supported.

PBR

Policies based on source MAC addresses are supported.

Patch upgrade

Forced patch upgrades are not supported; automatic and manual patch upgrades are supported.

URL library

Local URL libraries are supported.

Web

The web interface supports Indonesian and Turkish.

SSL VPN

The configuration page for SSL VPN tunnel resources has been optimized to improve usability.

Security policy

All regions can be selected on the configuration page for security policies.

Alarm

When multiple WAN ports belong to the same subnet, alarms are no longer displayed on the web home page.

Defaults restoration

A prompt is added to the Defaults Restoration page, reminding users that personal information can be deleted after the operation.

User authentication

Passwords containing ruijie (case-insensitive) are not supported.

Operation logs

After the IP allowlist/blocklist or custom threat intelligence configuration is modified, the operation log description includes detailed modification information, making it easier to compare the configuration before and after the modification.

VPN

l   A mechanism for detecting idle tunnels is supported for IPsec VPN.

l   Response speed for SSL VPN access to management devices has been improved.

Compliance

Individual Internet access information can be queried and downloaded based on IPv4 or IPv6 addresses.

Behavior analysis

Some features (including IM, search engines, microblogs, forums, and web email) are removed from behavior analysis, and their corresponding web pages are removed as well.

Threat intelligence

Logs can be aggregated based on intelligence categories.

Security policy

The policy list supports viewing address, address groups, services, service groups, users, user groups, and user tags, and allows quick editing.

WAF

Supports URL and Base64 decoding as well as gzip decompression, improving the rule-based detection capabilities.

Interface

A mechanism is added to handle IPv4 subnet conflicts between LAN and WAN ports.

Security dashboard

IPS, AV, and WAF cards are added to the security dashboard.

1609132

After the DHCP address assignment is configured, the copy running startup command must be executed to save the configuration. Otherwise, the configuration is lost when the device is powered off or restarted.

1617479

The session statistics of ICMP Echo Request packets are abnormal.

1592294

The idle-time logout function for authenticated users needs optimization when the device has been running for a long period.

1641830

When DDoS SYN flood protection is triggered, certain non-standard IPv6 packets may cause the DDoS function to operate abnormally.

1616210

In a routing loop scenario, endpoints can access and manage the local device through the address configured on an interface in Down state.

1591411

The data displayed for the same day in the attack trend card on the home page is inconsistent between the Recent 7 Days and Recent 24 Hours views.

1642056

When a port mapping rule is configured, the automatically generated security policy uses any as both the source address object and destination address object.

1594092

The IP address conflict check is not performed on the destination IP address of a GRE tunnel. When the destination IP address of a tunnel is consistent with the IP address configured on the SSL VPN gateway, no IP address conflict prompt is displayed, resulting in the failure of the GRE over IPsec service.

1618287

After an interface is added to a security zone, it cannot be added as a member of an aggregate interface. The web interface prompts that the interface must be removed from the security zone before it can be added to the aggregate interface.

1636879

When the exported log content contains invalid characters, the export fails.

1616535

Under high database load, some traffic report content is missing.

1600090

When the variable-bindings field in an SNMP request packet is empty, the device cannot receive the corresponding response packet.

1648160

Users must read and accept the user privacy policy before they can log in.

1642641

In the WiFiDog V1 authentication scenario, non-UTF8 characters in the account name cause abnormal log display.

1649078

When all features in Content Security are disabled, HTTP requests with excessively long headers may cause high CPU usage.

1637946

Cloud-based analysis is unstable, and its timeouts may cause a memory leak.

1650157

Hardware encryption/decryption fails for the SSL proxy.

1613313

After flow control is enabled, traffic may fail to match the corresponding flow control policy due to incorrect URL identification.

1644916

In the security policy simulation space, clicking Apply to Real Network twice consecutively causes the real policies to be cleared.

1601443

SA creation fails due to device capacity limitations, resulting in service interruption.

1594201

In an IPsec VPN active/standby tunnel scenario with multiple peers, stale states during peer switching cause abnormal tunnel status.

1615086

SSL VPN tunnels cannot forward oversized single packets (greater than or equal to 28,000 bytes).

1589038

Entries with empty hardware signatures cannot be deleted on the Hardware Signature management page.

1648150

The promiscuous mode is enabled on the MGMT port by default, which may cause it to receive a large number of junk frames from connected devices. This leads to frequent system interruptions and high CPU utilization.