netspoc-1.7

1. ACLs for secondary packet filter were too permissive for rules having an interface of a full packet filter as source or destination.

netspoc-1.6

1. Introduced policies: A policy is a named group of related rules, which all refer to the same network objects in their source or destination.
2. The functionality of NetSPoC is available as a perl module now.

netspoc-1.5

1. Topology allows simple loops now which must be neither nested nor adjacent.
2. Secondary packet filters are introduced, which have much shorter access lists for traffic which is already filtered by a full packet filter.
3. New option $auto_default_route to optimize the number of routing entries per router.
4. Attribute 'routing=OSPF' for interfaces: disables generation of static routes and generates access lists which automatically permit OSPF packets.
5. NetSPoC warns if different interfaces have an identical IP address.

1. Routing entries were missing for traffic back from dst to src if there was no other rule which allowed traffic from dst to src.
2. It was possible to link an 'any' object to an undefined router object.
3. Script 'newpolicy' now uses 'update -d'.

1. Option $strict_subnets now may have values 0, 'warn' or 1.

netspoc-1.4

1. Some valid configuration was rejected for certain combinations of services with port ranges.
2. Some traffic was rejected even if the traffic was explicitly allowed by another rule. See examples/auto-any-deny for an example.

netspoc-1.3

• Source port may be specified for tcp and udp services

• Changed code generation for stateless IOS routers: Answer packets for tcp and udp connections are no longer restricted to ports > 1023 for two reasons:
  1. This didn't work for services like IKE with source port < 1024.
  2. It was too difficult to handle correctly during optimization.

netspoc-1.2

1. Preliminary support for stateless Cisco IOS routers (without Firewall Feature Set) This is untested until now.
2. Interfaces of managed IOS routers are automatically protected from unwanted access. Permitting access to a network which is directly attached to the interface of an managed router, no longer implicitly gives access to the interface. If desired, access to an interface has to be stated explicitly by a rule. (This feature isn't implemented for PIX firewalls, because they protect themselves.)

1. Switched names for Cisco IOS routers:
   • 'IOS' is used now for stateless IOS routers,
   • 'IOS_FW' is used for stateful IOS routers.

1. Routing to unnumbered networks now works
2. Hosts aren't allowed any longer in unnumbered networks
3. Unnumbered networks must be connected to at most two interfaces
4. Script 'newpolicy': home directory; quotes in messages

1. added some small examples

netspoc-1.1

1. Hosts with successive IP addresses are converted to ranges.
2. Duplicate ACL entries are no longer generated for rules with an 'any' object as src or dst

1. Overlapping networks are rejected unless this relation is declared explicitly using new attributes 'route_hint' or 'subnet_of'. This may be useful for a large topology, where a network may easily be redefined by mistake. Use option 'strict_subnets' to (de)active this new behavior.

1. Warning messages are shown for unused groups and servicegroups. This may be switched off using option 'warn_unused_groups'.
2. NetSPoC doesn't accept rules with an 'any' object both as src and dst any longer.

1. pix security levels: all interfaces except inside and outside got level 1.
2. For rules with an 'any' object as dst, too few deny rules for intermediate networks were generated in some cases.
3. Routing entries were generated for disabled networks in some cases.

netspoc-1.0