Actions required when upgrading

This section describes changes in Airlock Gateway 8.6 that may require manual actions. Read this section carefully to see whether your configuration is affected.

Breaking changes

  • Encrypted cookie values may become longer than in previous Airlock Gateway versions. Depending on the cookie value, the length may either remain unchanged or increase by approximately 22 characters. This change is relevant because all cookies are sent together in the same HTTP request header, the Cookie header. If a request contains many encrypted cookies, the combined header value may exceed the maximum allowed request header size. Affected configurations must increase the maximum allowed request header size. This can be done with the Apache expert setting LimitRequestFieldSize. The Airlock Gateway default is LimitRequestFieldSize 8190.
  • The cookies of an application are forwarded to clients if a mapping is configured to be Sessionless or uses the Passthrough cookies setting. If an application with one of those settings configured uses many cookies, you may need to increase the number of allowed HTTP headers. This limit can be adjusted with the global Apache Expert Setting LimitRequestFields.
    Consult RT-12 for further details.

Upgrading Airlock Anomaly Shield

URL Traversal Model

Anomaly Shield introduces URL Traversal as a new model in Airlock Gateway 8.6. The (default) Malicious session trigger has been updated to include this model.

  • Customers using custom triggers must manually add the URL Traversal model to the appropriate triggers.
  • Customers using the default triggers do not need to take any action. During the upgrade, the default triggers are updated automatically to use the URL Traversal model.
 
Info

We recommend using the default Anomaly Shield rules and triggers whenever possible to benefit from automatic updates and simplified maintenance. For details, see Triggers & Rules detail page.

Model retraining

Airlock Anomaly Shield now ships with a pre-trained model. As a result, model training is no longer required during the upgrade process. To maintain optimal detection quality, models should be retrained after the upgrade:

  • Customers managing model training manually should retrain all models after the upgrade has completed successfully.
  • Customers using Retrain and enforce do not need to take any action. Anomaly Shield automatically retrains all models during the first night after the upgrade.
 
Info

We recommend enabling Training Data Collection and configuring all models with Retrain and enforce to minimize operational effort and maintain optimal model performance. For details, see Anomaly Shield model management page.

Migrate signature algorithm settings

If you have overridden signature algorithm settings using the SSLOpenSSLConfCmd SignatureAlgorithms directive in Virtual Host Expert Settings, migrate these values to the new dedicated Signature algorithms field.

NTLM support ends with Gateway 8.6

Airlock Gateway 8.6 is the last release supporting front-side NTLM, NTLM passthrough and NTLM SSO credential propagation. These features will be removed in the next Airlock Gateway release.

NTLM no longer meets modern security expectations and is being deprecated across the Windows and software ecosystem. We recommend migrating affected integration scenarios to modern authentication protocols such as OIDC or Kerberos.

Add-on Tomcat 9 support ended

Add-on Tomcat 9 is no longer supported and needs to be removed or updated to Add-on Tomcat 11 before upgrading to Airlock Gateway 8.6.0 or later.