Release Notes for Galaxy VS Firmware 6.82.0

[CDiggin]

New Features

For a list of features available in the NMC 4, refer to the NMC4 Feature List.

New Feature

Support added for RADIUS. NOTE: RADIUS configuration supports Password Authentication Protocol (PAP) and Challenge Handshake Authentication Protocol (CHAP).

You can now upload and download a user configuration file. NOTE: The upload and application of the configuration file, under certain circumstances, can take over 15 minutes to complete. During this time, the Upload/Download Capabilities on the User Config page in the Web UI will be disabled until the settings are uploaded and applied, or the timer expires.

Support added for 802.1x (EAPoL) Protocol. Supported EAP methods: EAP-TLS Supported TLS versions: v1.0, v1.1, and v1.2. It is recommended to configure the minimum and maximum as v1.2 on the RADUIS server side.

Support added for Secure Syslog. Secure Syslog behaves the same way as Standard Syslog, except the messages are encrypted using Transport Layer Security (TLS) before being transmitted. The NMC supports both one-way and two-way authentication between the client (the NMC) and your external Syslog server. Secure Syslog can only be used with TCP.

Reset NMC settings from Web UI and CLI. You now have an option to perform a reset of the NMC settings via the Web UI and the CLI. You can perform a full reset to defaults of all the NMC settings, or a partial reset where the TCP/IP network settings will not be reset but all other NMC setting will be reset.

You can now generate and download a debug dump for Technical Support.

You can now upload and download files to and from the NMC using SCP.

You can now upload files with a size limit of 500 KB.The default for Bad Login Attempts is now set to 5. This had previously been set to 0.

Fixed Issues

Fixed Issue

Email notifications will no longer be sent to the old recipient when notifications are modified for an active alarm.

When the mode is set to “DHCP Only” in the IPv4 Settings page in the Web UI, the DHCP IP settings are now correctly populated in the “Manual” mode section.

When the boot mode is changed from DHCP to manual in the CLI (using the boot command), the previously used static IP address is no longer incorrectly assigned.

Known Issues

Known Issue

The Battery Type may incorrectly be reported as “Value-regulated lead-acid, or maintenance-free” on the UPS Battery Measurements page in the Web UI when a Lithium-ion battery is used. The correct battery configuration can be confirmed in the Battery view on the UPS HMI display.

In the unlikely event that the violation alarms do not trigger on the NMC, reconfiguring the threshold values or removing and plugging the sensor back into the NMC, will resolve this issue.

It is not possible to generate a Technical Support debug file if you are logged into the NMC via RADIUS. You must log in as a local user to generate this file.

Security Notification: There were cyber security fixes in this release resolving vulnerabilities with vertical privilege escalation, File Enumeration, and HTTP Denial of Service.

Schneider Electric is aware of a directory transversal vulnerability in the Galaxy VS Firmware 6.82.0 which may allow system files to be downloaded in compromised networks. The product team is actively working on a remediation in accordance with our Product Vulnerability Management Policy. Until then, we strongly recommend to consult the Firewall section of the NMC4 Security Handbook. In addition, please refer to Schneider Electric’s Recommended Cybersecurity Best Practices document.

Due to security enhancements, downgrading to a previous firmware version may result in some features not working as expected. If a downgrade to a previous firmware version is required, the email authentication password will need to be reset manually.

After a reset of all NMC settings, you may be presented with the error “Maximum number of sessions exceeded” when attempting to login to the NMC Web UI. The NMC should be accessible once again after 3 minutes.

Events related to the temperature and humidity probe connected to the Network Management Card are not displayed in PowerChute Network Shutdown if the probe is connected after registration is complete. To prevent this issue from occurring, connect the temperature and humidity probe to the Network Management Card before completing the registration in PowerChute Network Shutdown. Alternatively, connect the probe after registration is complete and restart the PCNS service.

When you attempt to login to the NMC Web UI following a soft reset, you will be immediately logged out following a successful login. This can be resolved by closing and restarting the web browser.

When using a custom email server for a configured email recipient, if a recipient authentication password is set for the email recipient, the settings for the recipient can no longer be changed using the email CLI command, unless the password (-p) and confirm password (-d) arguments are included. Note that the settings can be changed without any problems from the Web UI.

On very rare occasions following a soft reset, when SNMP is configured, the NMC does not communicate over SNMP. On these occasions, a reboot of the NMC is required to resolve the issue. With some browsers, due to auto-refresh functionalities, an inactive user may not be automatically logged out if the configured session timeout is greater than 15 minutes. It is recommended that the session timeout for a user is no greater than 15 minutes. The default is set to 3 minutes.

SSH and HTTPS connections will be unsuccessful if the private key is not generated in PEM.

It is not possible to register a PowerChute client that is using IPv6 with the NMC.

Disabling Syslog on a per-event basis does not work as expected. You can only disable Syslog using the event action per-group option in the Web UI.

No event is logged when an SSL certificate is removed via the SSL Certificate Configuration page in the Web UI. The “New self-signed certificate loaded” event will be logged if a new certificate is manually added or auto generated if the old certificate is deleted or out of date.

You may be logged out unexpectedly from the Web UI if multiple Web UI tabs are open. This issue only occurs on Google Chrome.

When a user’s password is changed via the user command in the CLI and does not meet the password requirements, a parameter error is displayed instead of “Password did not meet the requirements for a strong password.”

There are discrepancies between the current time displayed in the Web UI and the CLI. The date command in the CLI will report the current time in real-time, whereas the Web UI will display the browser’s current time with respect to the UTC value set. NOTE: The UPS HMI will also display the current time in real-time.

The Configure Events screen in PowerChute Network Shutdown v4.3 displays the “Communication Established with EMC” and “Communication Lost with EMC” events. These events can be ignored as they are not supported.

When the optional NMC (AP9644) is inserted, some alarms and events are not logged on all the configured interfaces (traps, emails, Syslog, Event Log). For example, the “Lost Communication” alarm is not logged as an active alarm or sent as a trap/email.

When the Web UI is locally accessed via an internal IP address (169.254.251.1 / 169.254.252.1) and HTTP/HTTPS is disabled, you can no longer access the UI using the disabled protocol. For example, if HTTP is disabled, you cannot access the Web UI at http://169.254.252.1

When adding a rule via the Firewall Configuration page in the Web UI, the table incorrectly includes the Range/Subnet column, which is not currently supported.

The Notification Delay and Repeat Interval features for event actions do not behave as expected. For example, you may receive multiple notifications for an active event.

You cannot connect to SNMPv1 using an IPv6 address. Use SNMPv3 as an alternative.

When you log out from the NMC serial console interface, the Current Sessions page in the Web UI still shows the session as active.

File Transfer Protocol (FTP) is not available over IPv6.

When credentials are provided in StruxureWare Data Center Expert after adding the NMC via SNMP, the NMC still requires login credentials when attempting to access the Web UI.

When Auto Configuration is disabled in the IPv6 Settings page in the Web UI, the NMC still displays the card’s IPv6 address and the card is accessible using a DHCP IPv6 address.

No browser warning message is displayed in the Web UI when navigating without saving your changes.

When viewing the Event Details page in the Web UI for an event, you cannot disable the logging of an event to the Event Log.

When accessing the Web UI using a smartphone, the Rule Configuration table on the Firewall Configuration page is not responsive.

When an SNMPv3 profile is enabled with a valid NMS IP/Host Name, you can connect to a MIB browser of another system and not the configured SNMP profile. NOTE: The only supported value for NMS IP/Host Name for SNMPv3 is “0.0.0.0”.

[CDiggin]

Due to security enhancements, downgrading to a previous firmware version may result in some features not working as expected. If a downgrade to a previous firmware version is required, the email authentication password will need to be reset manually.

After a reset of all NMC settings, you may be presented with the error “Maximum number of sessions exceeded” when attempting to login to the NMC Web UI. The NMC should be accessible once again after 3 minutes.

Events related to the temperature and humidity probe connected to the Network Management Card are not displayed in PowerChute Network Shutdown if the probe is connected after registration is complete. To prevent this issue from occurring, connect the temperature and humidity probe to the Network Management Card before completing the registration in PowerChute Network Shutdown. Alternatively, connect the probe after registration is complete and restart the PCNS service.

When you attempt to login to the NMC Web UI following a soft reset, you will be immediately logged out following a successful login. This can be resolved by closing and restarting the web browser.

When using a custom email server for a configured email recipient, if a recipient authentication password is set for the email recipient, the settings for the recipient can no longer be changed using the email CLI command, unless the password (-p) and confirm password (-d) arguments are included. Note that the settings can be changed without any problems from the Web UI.

On very rare occasions following a soft reset, when SNMP is configured, the NMC does not communicate over SNMP. On these occasions, a reboot of the NMC is required to resolve the issue. With some browsers, due to auto-refresh functionalities, an inactive user may not be automatically logged out if the configured session timeout is greater than 15 minutes. It is recommended that the session timeout for a user is no greater than 15 minutes. The default is set to 3 minutes.

SSH and HTTPS connections will be unsuccessful if the private key is not generated in PEM.

It is not possible to register a PowerChute client that is using IPv6 with the NMC.

Disabling Syslog on a per-event basis does not work as expected. You can only disable Syslog using the event action per-group option in the Web UI.

No event is logged when an SSL certificate is removed via the SSL Certificate Configuration page in the Web UI. The “New self-signed certificate loaded” event will be logged if a new certificate is manually added or auto generated if the old certificate is deleted or out of date.

You may be logged out unexpectedly from the Web UI if multiple Web UI tabs are open. This issue only occurs on Google Chrome.

When a user’s password is changed via the user command in the CLI and does not meet the password requirements, a parameter error is displayed instead of “Password did not meet the requirements for a strong password.”

There are discrepancies between the current time displayed in the Web UI and the CLI. The date command in the CLI will report the current time in real-time, whereas the Web UI will display the browser’s current time with respect to the UTC value set. NOTE: The UPS HMI will also display the current time in real-time.

The Configure Events screen in PowerChute Network Shutdown v4.3 displays the “Communication Established with EMC” and “Communication Lost with EMC” events. These events can be ignored as they are not supported.

When the optional NMC (AP9644) is inserted, some alarms and events are not logged on all the configured interfaces (traps, emails, Syslog, Event Log). For example, the “Lost Communication” alarm is not logged as an active alarm or sent as a trap/email.

When the Web UI is locally accessed via an internal IP address (169.254.251.1 / 169.254.252.1) and HTTP/HTTPS is disabled, you can no longer access the UI using the disabled protocol. For example, if HTTP is disabled, you cannot access the Web UI at http://169.254.252.1

When adding a rule via the Firewall Configuration page in the Web UI, the table incorrectly includes the Range/Subnet column, which is not currently supported.

The Notification Delay and Repeat Interval features for event actions do not behave as expected. For example, you may receive multiple notifications for an active event.

You cannot connect to SNMPv1 using an IPv6 address. Use SNMPv3 as an alternative.

When you log out from the NMC serial console interface, the Current Sessions page in the Web UI still shows the session as active.

File Transfer Protocol (FTP) is not available over IPv6.

When credentials are provided in StruxureWare Data Center Expert after adding the NMC via SNMP, the NMC still requires login credentials when attempting to access the Web UI.

When Auto Configuration is disabled in the IPv6 Settings page in the Web UI, the NMC still displays the card’s IPv6 address and the card is accessible using a DHCP IPv6 address.

No browser warning message is displayed in the Web UI when navigating without saving your changes.

When viewing the Event Details page in the Web UI for an event, you cannot disable the logging of an event to the Event Log.

When accessing the Web UI using a smartphone, the Rule Configuration table on the Firewall Configuration page is not responsive.

When an SNMPv3 profile is enabled with a valid NMS IP/Host Name, you can connect to a MIB browser of another system and not the configured SNMP profile. NOTE: The only supported value for NMS IP/Host Name for SNMPv3 is “0.0.0.0”.