New Features & Updates
SNMP Monitoring for Sockets and App Connectors: Monitor your Sockets, vSockets, and App Connectors alongside other network devices in your existing monitoring platform, such as SolarWinds or PRTG. Use SNMPv3 polling to track CPU and memory usage, interface status, and traffic statistics, helping you investigate network issues from a central location.
Centralized Socket WebUI Password Management: Use the CMA to identify Sockets that use default passwords and keep track of password expiration across your account. Change individual Socket passwords without needing to access each Socket’s WebUI.
LAN Access Control for the Socket WebUI: Use the CMA to restrict access to the Socket WebUI to trusted management subnets and jump hosts, reducing exposure to unauthorized access attempts from local devices.
Centrally manage account default access and per-site overrides
Improved WAN Recovery for Hub & Spoke HA Deployments: Restore Off-Cloud connectivity between spokes and hubs faster after a hub HA failover. You can configure a static IP address with port forwarding for the secondary hub Socket, allowing spokes to reconnect without relying on NAT punching.
Improved Performance and Socket WebUI Diagnostics for IPv6 WAN Links: Reduce TCP performance issues on IPv6 WAN links with automatic upstream MSS adjustment to account for the effective path MTU. You can also run IPv6 ping tests from the Socket WebUI to check gateway and Internet connectivity, using custom payload sizes to investigate MTU issues.
Preserve DNS and DHCP Settings During WAN Recovery: Maintain consistent network settings for LAN clients when your site loses connectivity to the Cato Cloud. When acting as the local DHCP server during WAN Recovery, the Socket uses the DNS servers, DNS search suffixes, custom DHCP options, and IP reservations configured in the CMA, helping preserve access to internal resources.
Summary of Minor Versions
v28.0.24851 - Internal enhancements
Resolved Issues
ID | Description | Severity | Issue Found In | Issue Resolved In |
|---|---|---|---|---|
189858 | After receiving an ICMP "Fragmentation Needed" message, the Socket could retain a reduced tunnel MTU even after the network path recovered, disrupting application connectivity until the Socket was restarted. | Critical | v25 | v28.0 |
190259 | On Sockets in China, an Internet speed test could fail when the selected test server was unreachable, even when other test servers were accessible. | Medium | v25.0.22236 | v28.0 |
194602 | Clearing the configured WAN interface MTU did not restore the default value of 1500. The Socket continued using the previously configured MTU, even after the tunnel reconnected. | Medium | v24.0.21499 | v28.0 |
198112 | On Azure vSocket HA sites, a failover could remove custom Azure tags from the vSocket network interfaces. | Critical | v26.0.22806 | v28.0 |
203660 | On X1600 LTE Sockets with automatic SIM failover enabled, a failed SIM switch could leave the cellular modem disconnected until the Socket was restarted. | Medium | v26.0.23517 | v28.0 |
206599 | MSS clamping was not applied to bypassed traffic over PPPoE connections, which could cause TCP retransmissions and stalled connections. | High | v26.0 | v28.0 |
216400 | On AWS vSocket HA sites, insufficient free disk space could prevent the secondary vSocket from upgrading. | High | v25.0 | v28.0 |
217388 | An X1600 Socket could restart repeatedly and enter a degraded stability state, preventing it from learning routes to other sites and disrupting access to resources. | Critical | v26.0.23517 | v28.0 |
221349 | LAN Firewall events could omit user identities even when the users were correctly identified in Internet and WAN Firewall events, affecting identity-based LAN access. | High | v27.0.24419 | v28.0 |
221350 | LAN Firewall events could associate users with incorrect IP addresses, MAC addresses, or device names. Stale user mappings after DHCP address reassignment could cause identity-based rules to block access to internal resources. | High | v27.0.24419 | v28.0 |