Versa Titan Release Notes for Releases 9.3.0 and 9.3.1

Titan Portal

Titan Mobile

• Management Tools menu—The Management Tools menu provides options for the following:
  • Sync Configuration (with Titan)
  • Restart Services (on the device)
  • Reboot Device
    
    
     
• Multiple source and destination IP address and hostname in security, traffic-steering, and TLS decryption rules—(For Releases 9.3.0 and later.) For security, traffic-steering, and TLS decryption rules, in the Match Criteria > Address tab and Hostname tab, you can add and remove multiple source and destination IP addresses and hostnames.
• Ping—You can run a ping test from the dashboard to any LAN port that is up.
  
  
   
• Steering circuit selection based on priority—(For Releases 9.3.0 and later.) You can select WAN circuit priorities for local and remote clients. To select the priority value, go to Steering > Profile > Real Time > Add and click Select Circuit.
• Uplink and downlink bandwidth options—You can configure the uplink and downlink bandwidth for WAN and LTE ports, to use for traffic shaping and QoS on the interfaces. You can enter the local ISP's expected speeds.
  
  

Limitations and Behavior Changes for Release 9.1.0

The following are the limitations and behavior changes in Release 9.1.0.

• To reallocate, add, or delete WAN or LAN interface:
  1. Lock the configuration.
  2. Make all the changes.
  3. Unlock and publish the changes.
• To configure SASE:
  1. Make all the changes and save the configuration.
  2. Publish after you have made all configuration changes.
• You must deploy hubs and spokes before you configure spoke groups.
• You can run a ping from the dashboard on any LAN port that is up.
• The Live Monitoring menu is deprecated.
• Versa Analytics has moved from the left menu bar of the Titan Portal Home page to Settings drop-down with Versa Director access.
• All SASE gateways must have the same services, and SWG and VSA must match essential or professional service tier.
• When you order a private SASE gateway for an MSP, you cannot later upgrade from the Essential service to the Professional.
• The subscription duration for the private SASE gateway for MSP must be more than the subscription duration configured for the tenant SASE gateway.
• MSPs and resellers can use Shop or Dashboard to create customers and add hardware, licenses, and private gateways. However, you cannot use a combination of both, because there is no synchronization between Shop and Dashboard. If you start with Shop, use shop for all activities, and if you start with a Dashboard, use the dashboard to complete the activities.
• In a private SASE gateway, you cannot reassign or add LAN and WAN ports after the ports are activated.
• You can use WiFi or GZTP to activate private SASE gateway devices. You cannot use Versable.
• You cannot activate private SASE gateway in the Titan Mobile application. Use the Titan Portal instead.
• For firewall and steering rules, you cannot configure custom logs for tenants on private multitenant SASE gateways.
• You create hub or hub controller regions from the Titan Dashboard. However, only the Director administrator can delete the regions, because they cannot be deleted from the Titan dashboard. This is because regions are not tenant-specific, and they are used by multiple tenants and provider organizations.
• When you upgrade a security package (SPack) and a device, upgrade the device first and and then upgrade the SPack. If you upgrade both at the same time, one of the upgrades fails.
• Client pools on a private SASE gateway VSA must be large enough to distribute to the tenants. If the pool is exhausted, MSP must buy additional VSA client licenses.
• After you add an IPsec profile, refresh the rules in the Security tab to avoid issues while publishing.
• Before you delete an IPsec profile, you must delete the routes attached to the IPsec profile.
• You must configure VLAN and IP address for sub tenants under the MSP provider tenant. The Ethernet ports section will be grayed out under the tenant organizations.
• You add customized VLAN at the time of orchestration. After you deploy and activate the service, you cannot change the VLAN ID but you can change the IP address.
• If you do not select the customized VLAN at the time of orchestration, you get the VLAN ID (tenant ID) and DHCP auto-assigned those you cannot change.
• PPPoE supports xDSL interfaces. Note that DSL is supported only on CSG355, CSG365, CSG1300, and CSG1500 appliance models.
• You can activate xDSL devices only via Versable.
• You can configure one PPPoE interface each on the WAN1 and WAN2 ports. The WAN3 and WAN4 ports do not support PPPoE.
• PPPoE does not support WAN with VLAN for WAN Port0.
• When you activate CSG300 Series appliances using the Versable activation method, the appliance may experience timeout issues. However, the activation will be successful.
• If you use autodeploy spoke from Shop, Titan does not support the spoke group. To select a spoke group in the Site menu, drag and drop it from the dashboard.
• In the Mobile App, if you activate HA device with the Versable activation method, you must switch off the secondary device to activate primary device, and vice versa.
• If you use cCSG as a private gateway, the device must have two WAN ports and one LAN port.
• Titan Portal does not support deletion of organization on multi-tenant SASE. If you want to delete an organization, contact Versa Support NOC.

Limitations and Behavior Changes for Release 9.1.1

The following are the limitations and behavior changes in Release 9.1.1.

• If you want to delete the rules added before Release 9.1.1, you (or the NOC) must configure services for that rule from the Director node and commit to device before deleting the rule. For example, if you added the rule DNATTEST, create the service with the postfix rule name_frd (DNATTEST_frd).

Limitations and Behavior Changes for Release 9.3.0

The following are the limitations and behavior changes in Release 9.3.0.

• In SD-WAN traffic-steering rules, you cannot select the destination zone as SD-WAN based on source zone only. For DIA traffic steering, the destination zone is available only for spoke device.
• When you delete a profile, the SNAT pool created during the profile creation is not deleted and the SNAT pool is available when you create another profile. To delete the SNAT pool, you must delete it inside the SNAT pool profile and then publish.
• You cannot delete a LAN or WAN interface on an HA primary device in lock mode if a DNS proxy profile is configured with LAN or WAN interfaces on the HA secondary device. You must delete the DNS proxy configuration on the HA secondary device before deleting the LAN or WAN interface on the primary device.
• In the server settings for a DNS proxy rule server, you cannot configure monitor for a LAN network. You can configure monitor only for site and WAN network.
• After you choose the template when you are creating the site, you cannot see which template is selected for the device from the GUI. However, you can view the devices associated with templates from the default configuration.
• DNS proxy profile supports site and network to redirect DNS packets. For undeployed sites, the DNS profile has an incomplete configuration on the Director and Titan Portal.

Recommendations for Release 9.1.0

This section describes recommendations for Release 9.1.0.

• Before you delete the private SASE gateway for MSP, deactivate the tenants and organizations on a private SASE gateway.
• When an upgrade is in progress, do not publish any configurations, and do not reboot or reset the device until the upgrade process completes. Otherwise, the state of the upgrade becomes unknown.
• Creating a private SASE gateway is a multistep process. Before you add tenants, see Deploy SASE Gateway Services, and test the gateway before you add tenants. Note the following:
  • A public FDQN is required.
  • You must upload the CA certificate of MSP before you create a tenant.
  • You must activate the device so that VSA tab is write-enabled.
  • You must configure VSA before trying the VSA client.
• If an MSP wants to use their own SASE gateway, go to the MSP Organizations page, add a device into the organization's cloud gateway, and add the local database or LDAP.
• When you update DNS server settings on WAN interfaces on an HA site, you need to be in lock mode.
• You must download and update SPack on the device from Inventory menu for some advanced security features to work correctly. To download and upgrade SPack, see Upgrade Software.

Recommendations for Release 9.3.1

This section describes recommendations for Release 9.3.1.

• You can also use the existing authentication method to log in to Titan Portal.
• If you are using both the existing and external authentication, you must enter organization name for the external authenticator whenever you log in. Keep the company or organization name short and unique.
• When you create an organization, add the first admin name, and select external SSO is selected, this admin user has local login privileges so that they can select SSO in dashboard and configure the SSO parameters.
• Legacy users created in the dashboard and later added to external SSO receive local user login or external SSO login.
• If external SSO does not provide the roles and privileges when a user logs in, the read and write access privileges are the enterprise's default privileges for enterprise users.
• Ensure that you configure a call back URL, a service provider identity ID, and external ID on the external SSO. These values are provided in the view SSO Profile configuration popup window.
• You cannot add a local user on Titan Portal and an external user on the IdP.
• When a user logs in to Titan Portal, the database stores the user in its profile. Even if you change from Known Titan Users to All IDP Users, the user can log in to Titan Portal.
• For privileges such as read or write access created both locally and on the IdP, the IdP overrides the local privileges during the login process.
• For Release 9.3.1, Titan-generated rules are visible. In previous releases, these rules were hidden. The Titan-generated default rules for SASE gateway, VSA, and SWG are disabled by default. You can enable these rules based on the enterprise's security requirements. Note that you can disable or reorder the Titan-generated rules, but you cannot delete them.
• To change the DSCP value in an existing rule, you must delete the rule and then add a new rule with a new DSCP value. If you edit or update an existing rule with a new DSCP value, the configuration on the device does not change.