Blue Coat SGME 5.5.1.

1 Release Notes

Version: SGME 5.5.1.1 Release Date: 09/22/2010 Document Revision: 1.2 on 06/02/2011 Release Notes Contents
These SGME 5.5.1.1 Release Notes contain the following sections:

Section A: "READ ME FIRST" on page 2 Section B: "Release Information" on page 5 Section C: "Content Sync Module" on page 32 Section D: "Support" on page 34

SGME 5.5.1.1 Release Notes

Section A: READ ME FIRST

Introduction
These release notes apply to Blue Coat Director appliances running SGME 5.5.1.1 or that will be upgraded to the SGME 5.5.1.1 release. Before starting the upgrade process, please review these notes.
Important:

Before you upgrade to SGME 5.5.1.1, see the following sections:

"Ports Used by Director" on page 17 "Upgrade/Rollback Information" on page 22

ProxyClient Version 3.2.x is a release of the Blue Coat ProxyClient software that adds functionality discussed in "New Features in this Release" on page 3 and resolves defects discussed in Section B: "Release Information" on page 5.

Support
For general information about Blue Coat: bcs.info@bluecoat.com. Direct support questions regarding this release to Blue Coat Support. For more information, visit: http://www.bluecoat.com/support/contact.html.

Blue Coat Knowledge Base

Blue Coat now has a Knowledge Base, which contains information about this product that might not be available in the documentation or Release Notes. The Knowledge Base contains information in the following categories:

Solutions FAQs Alertsincluding security alerts Technical field information

Blue Coat recommends you regularly search the Knowledge Base for latebreaking information that might not be available in product documentation or Release Notes.
To view articles in the Knowledge Base:

1. Enter the following URL in your browsers address or location field: https://kb.bluecoat.com 2. Do any of the following:
question

To get an answer to a specific question, enter the question in the Ask a field, and click Ask.

SGME 5.5.1.1 Release Notes

To view a specific set of articles, click a selection in the horizontal navigation bar (Solutions, FAQs, and so on). All of the sections enable you to browse by product, operating system, type of deployment, or topic.

3. Follow the prompts on your screen to locate the desired information.

New Features in this Release

The Director 5.5.1.1 release includes the following new features:
Feature Delegated administration of content filtering allow lists and block lists Benefit A new user, sadmin, has the ability to create users with the capability of pushing content filtering policy to devices. Content filtering policywhich can be categories or URLs specified as either allow lists or block listscan be applied to devices using substitution variables. The delegated users can then push those policies to devices associated to them by the sadmin user. In addition, delegated users can push content filtering policy to all devices in custom groups. Upgrade Director locally You can now upgrade Director from an image stored in a location accessible from the computer on which you run the Director Management Console. You are no longer required to download the image from a Web server. This feature can be used only to upgrade from SGME 5.5.1.1 to a later version.

SGME 5.5.1.1 Release Notes

SGOS/SGME Compatibility Matrix

Consult the following table before attempting to manage ProxySG appliances:
SGME version SGME 5.5.x Manages SGOS versions.... SGOS 6.1.x and 6.2.x SGOS 5.3.x, SGOS 5.4.x, and SGOS 5.5.x SGOS 4.3.x SGME 5.4.2.5 SGME 5.4.2.x SGOS 5.3.x, SGOS 5.4.x, and SGOS 5.5.1.1 SGOS 4.3.x SGOS 5.3.x and SGOS 5.4.x SGOS 4.3.x SGME 5.4.1.x SGME 5.3.x SGOS 5.4.x and all SGOS versions supported by SGME 5.3.x SGOS 5.3.x, SGOS 5.2.x, SGOS 5.1.x SGOS 4.2.9 and later, including 4.3.x Limitation: You can use VPM in SGME 5.2.x and later to push policy to devices running SGOS 4.2.x, where x > 9 or SGOS 5.2.2.x or later only. If a device runs SGOS 4.2.9 or earlier or 5.2.1 or earlier, use the SGOS Management Console on each device to change policy on the device. SGME 5.2.1.x, 5.2.2.x SGOS 5.2.x, SGOS 5.1.x SGOS 4.2.9 and later, including 4.3.x Limitation: You can use VPM in SGME 5.2.x and later to push policy to devices running SGOS 4.2.x, where x > 9 or SGOS 5.2.2.x or later only. If a device runs SGOS 4.2.9 or earlier or 5.2.1 or earlier, use the SGOS Management Console on each device to change policy on the device. SGME 5.1.4.x SGOS 5.1.x SGOS 4.2.9 and later, including 4.3.x SGME 5.1.4.x supports SGOS 4.2.9 and later, but the SGME 5.1.4 Management Console does not have the Content tab page.

Notes: For information on upgrading ProxySG appliances, refer to the Release Notes for the version of SGOS to which you are upgrading. For details about upgrading SGME, see "Upgrade/Rollback Information" on page 22.

SGME 5.5.1.1 Release Notes

Section B: Release Information

This section discusses the following topics:

"SGME 5.5.1.1"

SGME 5.5.1.1
Release Date: 09/22/2010 Document Revision: 1.2 on 06/02/2011 This section discusses the following topics:

"Fixed in This Release" "Known Issues in This Release" on page 8 "Ports Used by Director" on page 17 "Director Management Console Notes" on page 18 "General Notes" on page 20

Fixed in This Release

This section discusses issues that are fixed in this release.

If you attempt to connect to Director using the Management Console and Domain Name System (DNS) host name resolution is not set up properly, the following error displays:
Unable to establish connection to Director. Hostname resolution may not have been enabled in the Director.

To work around this issue, connect to Director using an SSH application and use the following command to set the host name:
director (config) # hostname hostname

In addition, make sure your DNS servers are set up to translate Directors DNS host name to its IP address. Before this issue was resolved, a Java NullPointer exception displayed. (B#127994, SR2-260894582)

If the amount of memory used by the configd process was around 440MB and if the audit logs had become more than 1GB in size, any remote-config execution command caused configd to hang. An attempt to delete older audit log files is done using an API that calls loops in a while loop until the audit log disk usage was less than 1GB. If configd memory usage is high at the same time, Director was unable to execute the system API, which in turn leads to indefinite while looping, causing configd to hang. (B#129868, SR2-204212172)

SGME 5.5.1.1 Release Notes

The following error dialog box no longer displays when you create, edit, or push a profile or overlay:
The Director CLI console returned unprintable characters

Any errors are logged on Director but no dialog box displays. (B#131708)

The following standard mode commands now displays the expected output:
director > show arp director > show ip route

(B#133254)

Director standby sync was improved to make sure the secondarys known_hosts key path is updated properly. (B#130667) Changing SMTP mail settings authentication parameters were not updated in any existing scheduled jobs, and caused the jobs to fail when sending e-mail. Two Simple Mail Transfer Protocol (SMTP) settings can now be set on the Mail Settings tab of the Options dialog: Local and Director. The Director Setting contains the SMTP information for jobs that are scheduled and executed on the Director. Changes to the Director Setting are automatically reflected in the scheduled jobs using this setting. During the upgrade to 5.5.1.1, the existing information in the Mail Settings dialog will be used to populate both the Local Setting and Director Setting fields. If username and password parameters exist, they will only be applied to the Local Setting. The Director username and password will remain blank. (B#136056)

The Director Simple Networking Monitoring Protocol (SNMP) server public community string responded to public even though the community string had been changed to a unique value. (SR2-215619568, SR2-290622272, B#128403, B#138017, B#139160) After disconnecting the network cable, the device recorded Unable to fork ssh process as the reason in the event log. The correct message Connection could not be established is recorded in the event log. (B#133308) An internal error occurred while applying changes to a remote-config profile. (SR2-165761967, SR2-177485182, B#107650) Schedule jobs were not appearing in the Job Queue table after the Managment Console was restarted. (SR2-167956852, B#108176) The warning message "The Director CLI console returned unprintable characters" displayed while loading SG proxy services. (SR2-186473892, SR2189511442, B#108922) When trying to FTP a backup file, the error <configd.crit> fork: Cannot allocate memory" was logged. (SR2-167698378, SR2-168916592, B#109942) After upgrading from SGME 5.3.1.3 to 5.4.1.1, Director users with an RSA key were not able to connect to Director Management Console. (SR2-175292219, B#116288)

SGME 5.5.1.1 Release Notes

The CLI command show interface displays the wrong ethernet speed. (SR2178663292, B#116818) While constructing the ip route command the "-net" or "-host" prefix was missing and the route commands were failing. (SR2-170064301, SR2185830122, B#116914) Description of Overlays missing from the Director Management Console (SR2-180646922, B#117358) Errors generated when verifying archive creation. (SR2-184509682, B#118974) The Director CLI console displays an unprintable characters" warning dialog while loading SG proxy services. (SR2-190243450, SR2-192423602, SR2194928102, SR2-195413672, B#119963) Large XML policy files causes Director to crash. (SR2-178425802, SR2189740853, B#120591) Director Management Console assumes the time from Director as ETC/UTC and converts the alert time to the Director's timzone, resulting in wrong time being displayed in the Management Console. (SR2-184528562, SR2-200180166, B#120623) Running the CLI show interfaces in enable and configuration modes adds extra loop references. (SR2-194792830, B#121772) Standby pair doesn't recover the heartbeat after the pair has been disconnected for a long period of time. (SR2-215619331, B#125684) After remanufacturing the Director using a SGME 5.4.2.4 USB, the database connection was not established, Tomcat did not exist, and the Management Console was not been launched. (SR2-223103905, B#127371) Director Management Console fails if the Director hostname resolution or external IP access fails from within Director. (SR2-260894582, SR2-311335802, B#127994) JNLP file for connecting to the Director stores the username and password of the user in a hash/crypt format. (SR2-219181312, SR2-273978888, B#128603) After upgrading to SGME 5.4.2.4 Director displays "Database connection not established" error. (SR2-223103905, SR2-24385893, B#129511) Director reports incorrect reason for the disconnect in the Device Summary column. (SR2-230948352, B#130856) A Director User with Enable privilege (level 7) is able to make configuration changes. (SR2-234317592, B#131097) Tomcat and progress users missing from the /etc/password, causing Director to log the "DB connection not established" message. (SR2-245735070, SR2223103905, SR2-243858931, SR2-273734362, B#132933, B#132100) CLI commands show arp and show ip route return no or incorrect information respectively. (SR2-247381072, B#132333) The Director CLI console displays an unprintable characters" warning dialog while editing or viewing a profile. (SR2-221011201, B#132524)

SGME 5.5.1.1 Release Notes

Unable to delete folders with special characters. (SR2-252935047, B#132622) Director becomes unresponsive approximately every two months (SR2204212172, SR2-214720312, B#132810) Refreshables overlay appears when no device is selected. (SR2-264080837, B#134339) Selectable dates missing from drop down menu in Director 5.4.2.4 Job Scheduler. (SR2-274460392, B#134491) Remove unused users and prevent system users like postgres from direct ssh login to Director. (SR2-264001876, B#134733) JVM crashes randomly when RADIUS/ TACACS authentication is setup in Director. (SR2-263395892, SR2-281830322, SR2-285973734, SR2-291798732, SR2296769964, SR2-297446438, SR2-301280165, SR2-307505719, SR2-321381301, B#135487) 'Launch Device MC' is displayed instead of the 'Configure Device' button for a radius privilege-15 user. (SR2-284563592, SR2-296495652, SR2-301334462, SR2314604442, B#135624) Error launching Management Console when the password contains a '+' character. (SR2-285410142, SR2-289449935, SR2-307652729, B#136778) Director SSH console hangs when entering invalid an IP address for upgradepackage fetch command, and are unable to SSH device for 3 minutes even if command is aborted. (SR2-286863422, B#137702) Unable to generate debug dump. (SR2-284324424, SR2-289350243, B#138697) DNS host removed from the profile by Director when the profile contains a health check with DNS host. (SR2-291761842, B#139402) Hyphen ('-') not accepted as a character in email address field for jobs. (SR2303007412, B#141090) JVM and Tomcat Crash due to RADIUS or TACACS configuration in Director. (SR2-307505719, B#141446)

Known Issues in This Release

This section discusses the following known issues in this release:

"Known Issues in the Release" "Other Issues in this Release" on page 11

Known Issues in the Release

This section discusses known issues in the SGME 5.5.1.1 release:

Windows 7 only When the Director Management Console launches, the latest version of Java JRE is not automatically downloaded. To workaround this issue, download the latest version of the Java JRE from the Sun Java Web site. (B#137103)

SGME 5.5.1.1 Release Notes

The Director Management Console versions 5.4.2.4 and later require port 8085 to be available for downloading the Management Console Java Network Launch Protocol (JNLP) application. If port 8085 is not available, the following exception displays in the Web browser:
"Application error: Unable to launch the application"

A portion of the full exception follows:

java.net.SocketException: Connection reset at java.net.SocketInputStream.read(Unknown Source) at com.sun.net.ssl.internal.ssl.InputRecord.readFully(Unknown Source) at com.sun.net.ssl.internal.ssl.InputRecord.read(Unknown Source) at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(Unknown Source) at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake (Unknown Source) at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake (Unknown Source) at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake (Unknown Source) ... (exception continues)

(B#133807)

From the command line, if you delete a group that is associated either with a delegated user group or with two or more devices, the Director Management Console hangs (if it is open) and the Actions menu does not display. (B#134440) If you switch to a different Director configuration while the Management Console is open, the Management Console hangs. (B#134462) A user who has no password can log in to either the Director Management Console or in to Director using an SSH application using SSH-RSA authentication even if an incorrect identity file is used. To work around this issue, make sure every user has a password configured in Director using the following command:
(config) # username username password {cleartext_password | 0 cleartext_password | 7 encrypted_password}

For more information about this command, see the Blue Coat Director Command Line Interface Reference. (B#132221)

There is a new feature that enables you to upgrade Director using the Management Console. Because SGME 5.5.x is the first release in which this capability exists, you can use it to upgrade from SGME 5.5.x to the next patch or major release of SGME only. This feature cannot be used to upgrade to SGME 5.5.x. XML API only. Do not use a space in a job name. Doing so prevents the job from being created, and the following error is displayed:

SGME 5.5.1.1 Release Notes

<result status="Failure">Error: Unrecognized command 'job'.Perhaps the configuration lock has been lost.</result>

(B#134486)

Alert comments containing double-quotes generates an error, and using a backslash to comment the double-quotes causes the alert contents to be truncated. Including double-quotes in alert comments is not supported. (B#136226) When opening the Director Management Console, in the message The name of the site does not match the name of the certificate. Do you want to continue? the Director Management Console opens whether you click Yes or No. (B#135898) Group names that start with a slash (/) do not display in the list of groups, and the slash should not be used as the first character. Group names can contain a slash within the name. (B#135059) While launching the Director Management Console, if the progress dialog is closed and the user interacts with the interface (for example, switching to the Configure tab) an exception is logged. (B#144304) On a remanufactured Director, creating an archive through an archive job fails. Workaround: Create the archive using the CLI. After the archive has been created through the CLI, the archive job completes successfully. (SR2-332272522, B#138624)

10

SGME 5.5.1.1 Release Notes

Other Issues in this Release

The remainder of this section discusses the following issues:

"Authentication Issues" "Upgrade/Rollback Issues" on page 11 "Standby Issues" on page 12 "Command Line Issues" on page 13 "Profile, Overlay, and Job Issues" on page 16 "All Other Issues" on page 16 "Important Information about Profiles" on page 21

Authentication Issues
This section discusses known issues related to authentication.

In SGME 5.3 and later, RADIUS One-Time Passwords (OTP) cannot be used to authenticate with Director. (B#104078) The following harmless errors display when configuring RADIUS:
director (config) # radius-server host 192.168.1.211 retransmit 5 director (config) # write memory Jul 18 23:46:23 director configd: <configd.crit> lsec_decrypt_binary(), security .c:298, build 000000: Precondition failed, bailing out. Jul 18 23:46:23 director configd: <configd.crit> cd_decrypt_binding(), cd_semant ics.c:519, build 000000: Error 5 returned, bailing out.

(B#98617)

After modifying or adding the enable password, the Director Management Console unexpectedly closes. Workaround: After changing or adding the enable password, close and restart the Management Console. (B#131526)

Upgrade/Rollback Issues
This section discusses issues related to upgrades and rollbacks.
Important: If you are upgrading from one or major earlier releases to SGME 5.5.1.1, it is very important you read the Release Notes for the intermediate versions so you understand any issues you might encounter during your upgrade.

For example, if you are upgrading from SGME 5.2.x, make sure you review the SGME 5.3.x Release Notes before you upgrade to SGME 5.3.x. These Release Notes do not document issues specific to earlier SGME releases.

After rollback, Directors DNS server information is lost. To add it back, use the following command:
director (config) # ip name-server DNS-ip-address

(B#123830)

11

SGME 5.5.1.1 Release Notes

After rolling back from SGME 5.4.1.1 to the previous release, all information about devices and jobs is lost. Workarounds: Archive the Director configuration before upgrading to SGME 5.4.2.x. If you roll back to the previous release, restore the archive. (B#100521) Starting with SGME 5.4.1.1, Director backs up your configuration when you upgrade. After rolling back, switch back to this configuration using the configuration switch-to command. For more information, see "Upgrade/Rollback Information" on page 22.

Entering upgrade-package verify before a rollback causes the rollback to fail with the following error:
% Image verification failed for rollback

(B#106915)

Standby Issues

Standby-related traps are not supported on Director for SNMP v1. To use standby traps, your SNMP server must support SNMP v2c or later. (B#104246) A custom banner created using the banner input command is not synchronized between primary and standby Directors. (B#108256) Alerts can be lost when you switch from the primary being active to the secondary being active. The typical scenario follows: a. Take the primary, active Director down (for example, to perform maintenance) by making it standalone. b. Make the secondary Director active. The secondary processes alerts and stores them in its database. c. The primary Director comes back online is made active. You have the option to pull the configuration from the secondary so the primary is updated with all changes that occurred while the primary was down. (This includes pulling the alerts from the secondary.) d. After its configuration is updated, the primary reboots. Somewhere in the process (probably during the reboot), alerts can be lost. (B#107947)

After entering the Director configuration command snmp-server traps standby-state all enable, several unexpected standby traps appear. Blue Coat recommends you ignore these benign traps. (B#79379) If the secondary Directors Management Console displays the partner state as Active, after making the secondary active, wait five minutes before starting its Directors Management Console. (B#85119)

12

SGME 5.5.1.1 Release Notes

When the secondary Director is made standalone it does not keep the primary partner's IP address, but maintains all the other configuration settings of the primary Director. (B#79946) If the secondary Director is made active before the primary Director syncs its initial configuration, the secondary might overwrite the primary's IP address when the primary is made active again. (B#81422) You must manually clean your known_hosts file after changing a secondary Director to active. For example: a. Set up an SSH-RSA connection to both standby Directors. Setting up SSH-RSA authentication with Director is discussed in the Blue Coat Director Configuration and Management Guide. b. Connect to both Director appliances using an SSH application. c. Follow the prompts or consult the documentation provided with the SSH application to accept the connection from both Directors; when you accept the connection, the Directors should be added to your clients known_hosts file. d. Set up one Director as the primary active Director in the standby pair. e. Set up the second Director as the secondary in the standby pair. f. Synchronize the two Directors. g. Change the secondary Director to active and reboot it. h. After rebooting, the secondary Directors public key is changed (that is, overwritten). This is a normal part of making a Director active. i. Attempt to connect to that Director using your SSH application. Because the public key has changed, your SSH application refuses the connection. Consult the documentation provided with your SSH application to remove the secondary, active Directors host name or IP address from your known_hosts file.

j.

k. Exit your SSH application and attempt to connect to the same Director again. Follow the prompts on your screen or consult the documentation provided with your SSH application to accept the connection from that Director, which adds it to your known_hosts file. (B#80030)

Command Line Issues

This section discusses known issues with commands that can be executed only using the command line (sometimes referred to as the command-line interface or CLI).

Changes to the CLI time out settings are not applied to any already open sessions. The updated CLI time out settings are only enforced in new sessions. (B#144913)

13

SGME 5.5.1.1 Release Notes

The username monitor is disabled and cannot be used to connect to the CLI. (B#132383) If you set the interface speed of any interface to 1Gbps when Director is not connected to a 1Gbps port, Director hangs and becomes responsive again only after a hard reboot. (B#123251) The SGOS command clear-cache dns-cache can be used only with devices that run SGOS 5.2 and later. It is not compatible with earlier versions of SGOS. (B#120310) The Director command clear interface statistics has been removed. (B#119283.)
reject} icmp

The following subcommands of the access-list name {permit | deny | command do not work as expected:
echo, echo-reply, unreachable, source-quench, redirect

(B#113646)

The following command has no effect:

director (config)# telnet-management args args

The following commands work:

director (config)# telnet-management director (config)# no telnet-management

You can use Telnet with the default configuration options (port 21 and so on) only. (B#110068)

In many cases, Director does not validate entry fields for the presence of illegal characters. For example, the following characters are not valid when used as a Device ID: ( ) (open and closed parenthesis), < > (angle brackets), and # (pound). Director might not warn you about these characters being forbidden but connections to devices will fail if you enter them as a Device ID in either the Management Console or using the command line. (B#90762, 92073)

The tcpdump command does not accept ether-0 as an argument; instead, use eth0. (B#99653) Entering the no interface interface_number command results in the error message Unsupported Speed/Duplexity configuration. This error is harmless and can be ignored. (B#63522) The licensing key-update command returns different output (when executed on a device) from the Director command remote-config licensing-key update. The device returns the correct response; Director returns the incorrect response. Samples follow: Command executed on a device:
192.168.1.163 - Blue Coat SG200 Series# licensing update-key

14

SGME 5.5.1.1 Release Notes

Downloading license-key (block 0)LICENSING configuration installation Compiling new configuration file: Thu, 13 Mar 2008 10:14:15 UTC % Bluecoat backend error ERROR: Currently Installed License Key is already the most recent. There were 1 error and 0 warnings 192.168.1.163 - Blue Coat SG200 Series#

This message is correct. Command executed from Director:

director (config) # remote-config license-key update group group_name username username password password +------------------------------------------| Output for device "192.168.1.163" +------------------------------------------192.168.1.163 - Blue Coat SG200 Series#licensing update-key Downloading license-key (block 0)LICENSING configuration installation Compiling new configuration file: Thu, 13 Mar 2008 10:15:42 UTC % Bluecoat backend error ERROR: Currently Installed License Key is already the most recent. There were 1 error and 0 warnings Licensing execution complete for device "192.168.1.163" Licensing execution complete. 1 device successful. 0 devices had errors.

This message is incorrect. (B#93519)

If the speed and duplex settings are set to auto and one of them is subsequently changed, the setting that was not changed will not display in the show config output. If the other setting is then changed, it will reappear in show config output. Additionally, the values displayed in the show interface output are incorrect if you change the setting from auto. (B#84645)

An slogin operation that fails does not output any error message. (B#87449) The command content query priority subcommands returns invalid characters. An example follows:
director #content query priority all all director #"3 ^http://www\.blucoat\.com/"

The errors are harmless and do not indicate a problem with the URLs stored on the devices. (B#91736)

After configuring the primary Director's eth-0 duplex is half, critical messages are displayed in the secondary Director while making a redundancy-pair. (B#138420)

15

SGME 5.5.1.1 Release Notes

Profile, Overlay, and Job Issues

This section discusses issues related to profiles, overlays, and jobs.

The SGOS CLI command policy reset is not supported in profiles and overlays. (B#126484) Make sure you understand the information discussed in "Important Information about Profiles" on page 21. If an access control list (ACL) on a device should prevent you from being able to download ProxySG .jar files, the .jar files download anyway. When you start the Director overlay editor using the Director Management Console, Director attempts to download .jar files from the ProxySG appliance. If the appliance is not reachable for any reason, the .jar files are downloaded from Director instead. This is not working as expected in SGOS 5.4.x. (B#116979)

If you create a job using the command line where the job name has space characters at the beginning or end, the job does not execute in the Management Console. It does, however, execute properly in the command line. Executing the job in the Management Console fails with the following error:
Job name has not been defined as a job

(B#110315)

If a profile, overlay, or job contains commands that are not supported on ProxySG devices to which it is applied, Device buffer overflowed errors display and the profile, overlay, or job do not execute successfully on those devices. To avoid these issues, make sure all commands contained in profiles, overlays, and jobs are compatible with the ProxySG devices on which they are applied. (B#109617)

If the ID of a profile, overlay, or job, is 240 characters or more in length, it will not accept input. In other words, you can create the profile, overlay, or job, but it cannot be used. (B#107868)

All Other Issues

This section discusses all other issues with this release.

Director workgroups cannot currently be used to limit access to ProxySG devices. Workgroups are designed for use only with CDN, which is now deprecated. (B#63569) If you switch to a Director configuration before registering ProxySG devices, those devices appear as Disconnected until after you reboot Director. (B#108649)

16

SGME 5.5.1.1 Release Notes

Rapidly switching Director configurations causes the command line to crash sporadically. Workaround: Wait a few minutes after you switch to a configuration before switching to another configuration. (B#109901)

When you upgrade the license on a device or a group of devices, your BlueTouch Online credentials are not validated. BlueTouch Online credentials are necessary to fetch the license from BlueTouch and to install the license on devices. (BlueTouch Online was previously referred to as WebPower.) (B#93035)

If you switch to another configuration using the following command, all Director users are affected.
director (config)# configuration switch-to name

where name is the name of a previously saved configuration. For example, if you switch to a configuration that has 50 devices, 100 jobs, 100 profiles, and 100 overlays from a configuration that had 55 devices, 150 jobs, 150 profiles, and 150 overlays, all currently logged in users see those changes immediately. All users means every user currently logged in to the command line, Management Console, and serial console. Users who are not currently logged in see the changes the next time they log in. Note: Administrators currently logged in to the Management Console when a new configuration is loaded see all devices as Disconnected until Director can establish a connection to those devices. (B#106838)

Ports Used by Director

For a discussion of what ports are used by Director and why those ports are used, see KB article 3457. For more information about the Blue Coat Knowledge Base, see "Blue Coat Knowledge Base" on page 2.

17

SGME 5.5.1.1 Release Notes

Director Management Console Notes

This section discusses general information you need to know to run the Director Management Console:

The Director Management Console option to Clear SG Jars does not work as expected if the SGOS Management Console has been started for more than one device. This option is available on the Configure tab page (Actions > Clear SG Jars). Workaround: Exit the Director Management Console, restart it, and try the command again. (B#117822)

General Notes About the Management Console

This section discusses general, legacy information about the Director Management Console.

If communication with a device fails, the message Network Error displays instead of the error I/O error. (B#132332) After upgrading to SGME 5.4.2.4, to start the Director Management Console, use a URL of the following format:
https://director_ip_or_host:8082

To address Director using a host name, Director must be configured to use a DNS server with the following command:
(config) # ip name-server ip_address

Failure to configure a DNS server means the Management Console will not start.

In the Director Management Console, on the Configure tab page, if you click Actions > Reset Trial Edition on Device, there are two options: MACH5 and Proxy. Errors display if you choose either option on a device that runs an SGOS version earlier than 5.2.1 because those SGOS versions did not support MACH5 or Proxy Editions. (B#85165) SGOS 5.4.x ships with an application named Blue Coat Sky that displays by default if you select Acceleration as your deployment mode during initial ProxySG setup. If you click Configure Device on the Configure tab page in the Director Management Console, the ProxySG Management Console displays. Blue Coat Sky is not available. For more information about Blue Coat Sky, log in to the ProxySG and consult its on-line help.

There is a very remote possibility of database corruption if the system is power-cycled. The corruption causes the Director Management Console to fail because it requires health monitoring information that cannot be provided if the database is corrupt. (B#88724) If the Management Console fails to start, enter the following command:
director # show monitoring health all

If the preceding command returns no output, the database is corrupted.

18

SGME 5.5.1.1 Release Notes

To restore the database, do any of the following: Enter the following commands to restart the database:
director (config) # monitoring db reset director (config) # write memory

Reboot the Director appliance.

Using the Director Management Console or command line, you can upgrade the SGOS license of a device running SGOS 5.x or later. You cannot upgrade an SGOS license of a device running SGOS 4.x or earlier. Workaround: To apply licensing changes to a device running an SGOS version 4.x or earlier, use an overlay. (B#97756)

A user with privilege level 7 cannot execute any commands in the Director Management Console (for example profiles, overlays, backups, or jobs). Workaround: The user can execute these commands using the command line. (B#105597)

If you log in to the Management Console between the times a scheduled job runs, the job might not display. (B#108176) The overlay editor available in the Director Management Console in SGME 5.2.x and later can be used to push policy to ProxySG appliances running the following versions of SGOS only: SGOS 4.2.x, where x > 9 SGOS 5.2.2.x or later

Workaround for earlier SGOS versions: Use the ProxySGs Management Console or command line to push policy. (B# 85292, B#103507, SR2-152793719)

In the Director Management Consoles Content tab page, do not enter empty URL lists or regular expression lists. The Management Console does not warn against empty lists, and any content jobs that refer to empty lists fail to execute. (B#84075) ProxySG appliances running SGOS 4.2.x and 5.1.x do not display in Model groups. (B#109982, 109964, 103290) Workaround: Upgrade your SGOS 5.1.x devices to SGOS 5.2.x or later. A compatible SGOS 4.2.x release is expected in the near future, where x > 9. (B#103290)

The Director Management Console enables you to set an incorrect value for a device front panel PIN: On the Configure tab page, right-click the name of a device and, from the pop-up menu, click Edit. In the Edit Device dialog box, click Advanced Settings. In the Advanced Settings dialog box, enter a value in the Frontpanel Pin field. This method validates the PIN so you cannot enter an invalid value.

19

SGME 5.5.1.1 Release Notes

On the Configure tab page, right-click the name of a device and, from the pop-up menu, click Set Passwords. In the Enter Passwords dialog box, enter a value in the Frontpanel Pin field. This method does not properly validate the PIN.

Regardless of which method you use, a device front panel PIN must be a fourdigit value in the range 0000-9999. If you enter an invalid value (such as alphanumeric characters), errors might not display. If you have problems accessing a devices front panel after setting it using Director, set the front panel PIN back to a valid value using the Management Console or the SGOS command line. (B#93425)

Importing a URL list consumes computer RAM at a rate proportional to the number of URLs in the URL list. If you attempt to import a very large URL list, a Java heap space error displays. To avoid this error, either import a smaller number of URLs in the URL list or perform the same import on a machine with at least 1GB of RAM. (B#93825)

General Notes
This section discusses general information you must understand before deploying Director in your network; however, this information does not necessarily indicate errors or issues with Director.

JobsA successful push profile job sometimes results in error messages. If you push a profile and view the job results, you might see the following errors if the device is running an SGOS version earlier than 5.3:
% Keyring "appliance-key" exists, delete keyring first % Keyring "passive-attack-protection-only-key" exists, delete keyring first % Certificate "passive-attack-protection-only-key" already exists, delete existing certificate first

The errors are for informational purposes and do not indicate problem in profile execution. (B#88497)

Use the following procedure to shut down Director. a. Connect to the Director serial console. Note: You can also connect to the CLI through SSH but you will not receive a system message indicating it is safe to power down Director. b. Enter any of the following sets of commands to shut down Director: Command set 1:
director # write memory director # reload halt

20

SGME 5.5.1.1 Release Notes

Command set 2:
director # reload halt force

Use the reload halt force command only if you do not want to save any configuration changes. c. Unplug Director when the LCD panel goes blank. The serial console displays Power down.

Scalability to 300 Devices

This section discusses general information related to using Director to manage ProxySG appliances.

If the network goes down and connections to all devices are lost, Director can take up to an hour to reconnect to all of the devices. If Director is rebooted or in the Management Console if you switch between connected Directors, there is a delay for loading configuration that can be at least five minutes. Additionally, when you connect to another Director, parts of the Monitor tab page might be inconsistent for several minutes. For example, the Health Monitor device counts might still reflect the first Director, not the new one. Also, if the first Director happened to have reached the maximum of 50,000 alerts, another line displays that might not be erased for several minutes when going to a Director that is under the maximum. (B#86081)

Important Information about Profiles

Director profiles are SGOS-version-specific and device-model-specific; executing a profile created for a ProxySG appliance that runs a different SGOS version can result in errors due to features that might not exist or that might have changed between versions. This also applies to different ProxySG models. A profile is a set of commands that transforms a ProxySGs configuration from the default for that version to its current configuration. The SGOS version value is an integral part of a profile. In other words, the reason two identically configured devicesone running SGOS 5.3.x and one running SGOS 5.4.xhave different profiles is due to the fact their starting points or default configurations are different. This also explains why when you apply an SGOS 5.3.x profile to an SGOS 5.4.x appliance you do not get the results you expect. The assumed starting point for the series of commands is different and will likely result in an error when the profile is executed. Blue Coat recommends you use the following procedure to create and update profiles for upgraded ProxySG appliances: 1. Create a profile for a device that runs a particular SGOS version. For example, create a profile for an SG510 that runs SGOS 5.4.1.1. 2. After you upgrade that device, either create a new profile or refresh the existing profile.

21

SGME 5.5.1.1 Release Notes

Continuing the example, upgrade the SG510 to SGOS 5.4.2.1 and refresh the profile. (You can optionally create a new profile, for example, if you still need the 5.4.1-based profile for other devices running SGOS 5.4.1.x.) 3. Upgrade other devices of the same model to the same SGOS version. 4. Execute the new profile on those devices. Continuing the example, use the profile you created for the SG510 running SGOS 5.4.2.1 on other SG510s that have been upgraded to 5.4.2.x only. Do not execute the profile on SG210s, SG810s, and so on. Do not execute the profile on other SG510s running SGOS 5.3.x, SGOS 4.x, or a later SGOS version. (B#115945, SR2-175001672)

Upgrade/Rollback Information
This section discusses information about upgrading the SGME software version on Director and rolling it back to an earlier version:

"Supported Upgrade and Rollback Paths" "Saving and Archiving the Director Configuration" on page 23 "Upgrading the SGME Software" on page 24 "Getting Director Documentation" on page 27 "Rolling Back the SGME Software" on page 27

Important: If you are upgrading from one or major earlier releases to SGME 5.5.1.1, it is very important you read the Release Notes for the intermediate versions so you understand any issues you might encounter during your upgrade.

For example, if you are upgrading from SGME 5.2.x, make sure you review the SGME 5.3.x Release Notes before you upgrade to SGME 5.3.x. These Release Notes do not document issues specific to earlier SGME releases.

22

SGME 5.5.1.1 Release Notes

Supported Upgrade and Rollback Paths

This section discusses supported paths for upgrade and rollback.

Supported Upgrade Paths

The following table shows valid upgrade paths to SGME 5.5.x:
Upgrade to 5.5.1.1 5.4.2.4 5.4.1.2 5.4.1.1 Upgrade from 5.4.2.4 or 5.4.2.5 5.4.1.1 or 5.4.1.2 5.4.1.1 only 5.3.1.4 SGME 5.3.1.3 or later SGME 5.2.2.5 > 5.3.1.4 > 5.4.1.1 SGME 5.2.2.xa > 5.3.1.3 > [5.3.1.4]b > 5.4.1.1 SGME 4.2.2.x > 5.2.2.1 > 5.3.1.3 > [5.3.1.4]b > 5.4.1.1

SGME 5.3.1.3 or 5.2.2.5 Note: Two SGME 5.3.1.4 upgrade packages are available (one for SGME 5.2.2.5 and one for 5.3.1.3). Make sure you choose the correct package.

5.3.1.3

5.3.1.1 Limited Availability, 5.2.2.1, 5.2.2.2, 5.2.2.3, 5.2.2.4

a. x can be 1 through 4, but not 5 b. Optional

Supported Rollback Paths

You can roll back to the release from which you upgraded. For example, if you upgraded from SGME 5.4.1.1 to SGME 5.4.2.4, you can roll back from 5.4.2.4 > 5.4.1.1 only.
Note: Devices and jobs are lost during rollback and any Content Policy

overlays are removed. To avoid losing these objects, create an archive before rolling back.

Saving and Archiving the Director Configuration

The following procedure discusses a summary of the commands required to create an archive and to upload it to an external server. Use the following commands in the order shown: 1. Save any pending changes to Directors configuration.
director (config) # write memory

2. Archive all Director components. a. Create an archive key to encrypt the archive.
director # archive generate key {default | keyname}

23

SGME 5.5.1.1 Release Notes

b. Enter a passphrase and save the key.

director # show archive key {default | keyname} Enter pass phrase here:

c. Create the archive.

director # archive config create name.tgz

3. Upload the archive to an external server.

director # archive config upload name.tgz url username username password password

For example,
director # archive config upload ftp://192.168.0.2//uploads/sgme/ sgme_5.5.1.1_05-07-10.tgz username director password bluecoat

For additional information about these tasks, see Chapter 16, Upgrading Director, in the Blue Coat Director Configuration and Management Guide. 4. Continue with the next section.

Upgrading the SGME Software

This section discusses the following topics:

"Getting an Appliance Certificate" "Installing the Upgrade Package" on page 25

Getting an Appliance Certificate

To run the Director Management Console after you upgrade, Director must have an appliance certificate. Before you upgrade, use the following command to verify whether or not Director already has an appliance certificate:
director (config)# show ssl appliance-certificate

Examine the output for one of the following:

Output An error message displays, such as:
appliance-certificate does not exist. Please request/import one first.

Meaning Director has no appliance certificate. See the instructions following this table.

No message displays. Displays the certificate, starting with

-----BEGIN CERTIFICATE -----

Director already has an appliance certificate. Continue with "Getting an Appliance Certificate" .

24

SGME 5.5.1.1 Release Notes

If Director has no appliance certificate, you must do either of the following:

Make sure Director has Internet connectivity during the upgrade. During the upgrade process, an appliance certificate will be installed automatically.

Get an appliance certificate manually as discussed in KB article 3288.

Installing the Upgrade Package

Before you begin, make sure your Director appliance has either Internet connectivity or an appliance certificate as discussed in "Getting an Appliance Certificate" on page 24.
To install the upgrade package:

1. Log in to Director using a secure shell (SSH) application. 2. At the director > prompt, enter enable. 3. If prompted, enter the enable mode password. 4. At the director # prompt, enter configure terminal. 5. At the (config) command prompt on Director, download the upgrade package using the following command:
director (config) # upgrade-package fetch url_to_upgradepackage_.tgz_file [username username password password]

If you placed the upgrade image on an external server, enter the upgrade package URL in one of the following formats:
http://host_or_ip/path_to_tgz ftp://host_or_ip//path_to_tgz scp://host_or_ip//path_to_tgz

For example,
http://wwww.example.com/SGME/Director_5.5.1.1_345678_510.tgz

Specifying a username and password in the URL is not supported. The following messages confirm the upgrade package was fetched successfully:
Image downloaded OK. Image verifies OK.

6. OptionalVerify the installation package (this command is useful if you did not use the upgrade-package fetch command line to copy the upgrade package to local disk).
director (config) # upgrade-package verify filename

One of the following messages displays:

Message
Image verifies OK.

Meaning The upgrade image verified successfully so it is safe to proceed.

25

SGME 5.5.1.1 Release Notes

Message
Image verification failed for image-name

Meaning There are errors in the upgrade image. Download the upgrade image again before continuing with your upgrade. Make sure the image verifies successfully before proceeding.

7. Install the new Director image file you just downloaded.

director (config) # upgrade-package install filename

8. You are required to confirm the installation. During installation, your current Director configuration is saved and a message similar to the following displays:
Configuration File config-5.4.2.4-2010.03.15-210215 is created

Note: The name of the configuration file for your system will be different. The preceding sample name is for your information only.

9. Write down the name of this configuration file. In the event of issues after you upgrade, you can restore this configuration to recover and return Director to its pre-upgrade state. This includes restoring devices, alerts, jobs, and so on that would otherwise be deleted. 10. Verify Director booted from the correct image file by re-connecting to Director and using the show version command as follows.
Director > show version System version: 5.5.1.1 Build date: 2010/05/07 04:28:34 Build number: 345678 Platform type: 510 Build version: #35927 2009.09.15-042834 Serial number: 0000000000

Related CLI Commands for Upgrading and Rolling Back Director

On the new Director, the image command has been replaced by the installation command upgrade-package.

The syntax of the upgrade-package command is as follows:

director (config) # upgrade-package delete filename

Deletes the specified upgrade package.

director (config) # upgrade-package fetch url username password

Retrieves the upgrade-package from the specified location, places it on the local disk with the identical filename, and verifies that it is a valid system upgrade-package. Enter the upgrade package URL in one of the following formats:
http://host_or_ip/path ftp://host_or_ip//path

26

SGME 5.5.1.1 Release Notes

scp://host_or_ip//path

Specifying a username and password in the URL is not supported.

director (config) # upgrade-package install filename

Installs the specified upgrade package. During installation, a snapshot of the current OS version is packaged and saved so you can roll back to it later.

director > upgrade-package rollback

Revert to the previously installed system.

director (config) # configuration switch-to config_file_created_during_upgrade

Switches your configuration back to its pre-upgrade state. config_file_created_during_upgrade is the name of the configuration file Director creates for you during the upgrade process.

director (config) # upgrade-package verify filename package fetch

Verifies the validity of the specified upgrade package. Because the upgradecommand verifies the upgrade package, this command is useful only if you did not use the upgrade-package fetch command to download the upgrade package.

Getting Director Documentation

This section discusses how to download Director documentation.
To get the Director Release Notes and documentation:

1. Go to http://support.bluecoat.com, enter your BlueTouch Online user name and password in the fields at the top of the page, and click Login. If you do not have a user name and password, fill in the form at http:// www.bluecoat.com/support/supportservices/btorequest. 2. Click the Documentation tab. 3. On the Documentation tab page, click Director. 4. Follow the prompts on your screen to download the documentation and Release Notes. 5. After reading the Release Notes, save them on your local computer.

Rolling Back the SGME Software

This section discusses how to roll back a Director 510 to an older SGME release. You can roll back a Director 510 to the most recent installed package only. You cannot roll back a Director 510 to an older image.
Note: You can only perform a roll back once. For example, if the Director is running 5.4.2.5, you can roll back to 5.4.2.4. From 5.4.2.4 you cannot roll back to 5.4.2.1.

27

SGME 5.5.1.1 Release Notes To roll back Director:

1. Enter the following command:

director > upgrade-package rollback

The following message displays:

Rollback will change the running system to the last running software revision. Proceed to rollback? (yes or no)

2. To proceed with the rollback, enter yes. 3. Wait several minutes for Director to roll back and reboot. 4. Close the SSH session. 5. After Director reboots, start a new SSH session and enter the following command:
director > show version detail

Following is sample output:

SG-ME director 5.4.2.4 #45678 2009.09.17-133633 x

6. Recommended. Restore the configuration Director saved before you upgraded.

director (config) # configuration switch-to config_file_created_during_upgrade

To view a list of available configuration names, enter the following command:

director (config) # show configuration

Note: Devices and jobs are lost during rollback and any Content Policy overlays are removed. To avoid losing these objects, create an archive before rolling back.

28

SGME 5.5.1.1 Release Notes

System Requirements and Supported Applications

This section describes the supported applications and associated system requirements.

Management Console
The following table discusses system and Web browsers that were tested with the Director Management Console.
Windows 2000 Version Windows 2000 Service Pack 4 Windows XP Windows XP Professional, Service Packs 2 and 3 32 bit only. The 64 bit version of XP Professional is not supported. Internet Explorer 6 Firefox 1.5 Java JRE Internet Explorer 6, 7, 81 Firefox 3.x, including 3.5 Safari 3 Windows Vista All Vista versions are supported (including SP1) except Starter Edition. 32 bit only. 64 bit versions of Windows Vista are not supported. Internet Explorer 7, 8 Firefox 3.x, including 3.5 Safari 3 Windows 7 Ultimate Edition

32/64 bit

n/a

32 bit only. The 64 bit version of Windows 7 Ultimate is not supported Internet Explorer 8 FireFox 3.6

Browser

Java version 6, update 1 or later. For details, see the next section. Minimum Recommended 1 GHz 32-bit x86 Minimum Pentium 233 MHz Recommended Pentium 300 MHz Minimum 1+ GHz 32-bit (x86) processor Recommended 2+ GHz 32-bit (x86) processor Minimum 1+ GHz (GHz) 32bit (x86) Recommended 2+ GHz multicore 32bit (x86) processor

CPU

Pentium IV

RAM

In addition to RAM required for the operating system, at least 1GB available RAM for the Director Management Console

1Do not set Internet Explorers Internet zone security level setting to High. Doing so prevents you from downloading the JNLP application. Blue Coat recommends you set it to Medium-High or lower.
Note: Operating systems running in virtual machines are not supported.

Blue Coat strongly recommends you apply all current patches to your operating system and Web browser.

Important:

29

SGME 5.5.1.1 Release Notes

More Information About the Java JRE

The Director Management Console requires the Sun Java JRE version 6, update 1 or later. If your computer has an earlier version (or if it has no JRE installed), the Director Management Console directs you to the Sun Java Web site to download the latest JRE.
Note: If you have an earlier JRE installed and you install JRE version 6, both versions will be present on your computer. Blue Coat recommends you do not uninstall an existing JRE if it is used by another application on your computer.

Installing the latest JRE does not remove your existing JRE. To avoid having multiple JRE versions installed on your computer, you can optionally uninstall your existing JRE and install the latest JRE before you start the Management Console. To determine your current Java JRE version: 1. Click Start > Control Panel. 2. Double-click Java. 3. In the Java Control Panel, click the General tab. 4. On the General tab page, click About. The About Java dialog box displays.

If you have an earlier JRE is installed, you can optionally uninstall it before running the Director Management Console. To uninstall your existing JRE, use the Windows Control Panels Add/Remove Programs application. (On Windows Vista, the application is named Programs and Features.)
Note: To avoid errors when launching the Director Management Console in

Internet Explorer 8 or FireFox 3.6 or later, enable JRE caching.

30

SGME 5.5.1.1 Release Notes

RADIUS and TACACS+ Servers

Director has been tested with the following:

Certain versions of the Steel-Belted RADIUS server (see the following limitations) Cisco Secure Access Control Server 4.0 Clearbox Tacacs+ is not supported with Director. (B#82854) The following are the server error logs:
[#498] Authentication failed: fields length does not match header value [Director-IP-address] [ID=9] - 0 [#415] Access was denied to the NAS with specified IP address Director-IP-address

Limitations:

Steel-Belted RADIUS server version 6.0 is not supported; however, version 5.4.1 is supported. (B#82328) RADIUS RSA-Token authentication is not supported. (B#110453) TACACS+ authenticated users see a Launch Device MC tab instead of a Manage Device tab. (B#131097)

31

SGME 5.5.1.1 Release Notes

Section C: Content Sync Module

Windows Vista is now supported (tested with 32-bit Ultimate Edition) with the following known issues: Because the CSM installer does not install all files required to run CSM, you cannot connect to Director using SSHV2 as discussed in the section about the Director pane in Chapter 3, Using the Content Sync Module Management Console, in the Blue Coat Director Content Sync Module Guide. Because SSHV2 is the default protocol, you must change the protocol to Telnet. (B#94420, 94384) You either install the CSM Management Console as the Administrator user or as a user with administrative privileges or run the CSM Management Console as a user with administrative privileges. Use either of the following procedures: To install the CSM Management Console as an administrative user, either: Log in as Administrator before installing the CSM Management Console Copy the CSM setup application to your computer, right-click the setup application name, and, from the pop-up menu, click Run as Administrator. In the dialog box that follows, enter the credentials of a user with administrative privileges.

If you perform these tasks, you can run the CSM Management Console as a user without administrative privileges. To run the CSM Management Console as an administrative user: Install the CSM Management Console as a non-administrative user. Right-click the shortcut or executable you use to start the CSM Management Console and, from the pop-up menu, click Run as Administrator. For example, if you start the Management Console from the Start menu, click Start > [All] Programs > Blue Coat Content Sync Module and right-click Blue Coat Content Sync Module. From the pop-up menu, click Run as Administrator. In the dialog box that follows, enter the user name and password of an administrative user. The default location of the CSM Management Console executable follows:
C:\Program Files\Expect-5.21\bin\CSMConfigApp.exe

(B#94374)

Windows XP is supported (tested with Professional Edition, SP2 and SP3). Queries are not supported.

32

SGME 5.5.1.1 Release Notes

You can use queries in CSM only as a means of doing a proof of concept for very small content sets, but queries are not supported for enterprise traffic. CSM queries do not scale well and require a great deal of resources on Director and on the CSM computer.

The Content Sync Module has not been tested with Windows 98, ME, 2000, Linux, or Solaris. Solaris installation instructions included in the Blue Coat Director Content Sync Module Guide are to be used at your own risk.

Known defect with the CSM installation: When installing the CSM, the installer skips the fourth step and does not allow you to choose the installation folder. This is because the default path must be used or the CSM will fail. The following files erroneously display as version 5.2 when they are in fact version 5.3:
csm_windows.exe expect-5.21r1b1-setup.exe

(B#95399)

33

SGME 5.5.1.1 Release Notes

Section D: Support
Direct support questions regarding this release to Blue Coat Support. For more information, visit: http://www.bluecoat.com/support/contact.html.
Copyright 1999-2011 Blue Coat Systems, Inc. All rights reserved worldwide. No part of this document may be reproduced by any means nor modified, decompiled, disassembled, published or distributed, in whole or in part, or translated to any electronic medium or other means without the written consent of Blue Coat Systems, Inc. All right, title and interest in and to the Software and documentation are and shall remain the exclusive property of Blue Coat Systems, Inc. and its licensors. ProxyAV, ProxyOne, CacheOS, SGOS, SG, Spyware Interceptor, Scope, ProxyRA Connector, ProxyRA Manager, Remote Access and MACH5 are trademarks of Blue Coat Systems, Inc. and CacheFlow, Blue Coat, Accelerating The Internet, ProxySG, WinProxy, PacketShaper, PacketShaper Xpress, PolicyCenter, PacketWise, AccessNow, Ositis, Powering Internet Management, The Ultimate Internet Sharing Solution, Cerberian, Permeo, Permeo Technologies, Inc., and the Cerberian and Permeo logos are registered trademarks of Blue Coat Systems, Inc. All other trademarks contained in this document and in the Software are the property of their respective owners. BLUE COAT SYSTEMS, INC. AND BLUE COAT SYSTEMS INTERNATIONAL SARL (COLLECTIVELY BLUE COAT) DISCLAIM ALL WARRANTIES, CONDITIONS OR OTHER TERMS, EXPRESS OR IMPLIED, STATUTORY OR OTHERWISE, ON SOFTWARE AND DOCUMENTATION FURNISHED HEREUNDER INCLUDING WITHOUT LIMITATION THE WARRANTIES OF DESIGN, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL BLUE COAT, ITS SUPPLIERS OR ITS LICENSORS BE LIABLE FOR ANY DAMAGES, WHETHER ARISING IN TORT, CONTRACT OR ANY OTHER LEGAL THEORY EVEN IF BLUE COAT SYSTEMS, INC. HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

34