•  Ports 7800 and 7810 must be open.

•  Make sure your firewall doesn’t strip TCP options.

•  The management plane requires communication between the SteelHead and the SCC on TCP port 9443 and TCP port 22.

•  The control plane between the SteelHead acting as the controller and the SteelHeads acting as group members is over TCP port 9443.

•  Encryption service flows over ESP (IP protocol 50). Or, if the network is public, over UDP port 4500.

•  Insufficient WAN bandwidth

•  Inefficient transport protocols in high-latency environments

•  Inefficient application protocols in high-latency environments

•  Data streamlining - SteelHeads and SteelHead Mobile can reduce WAN bandwidth utilization by 65% to 98% for TCP-based applications using data streamlining. In addition to traditional techniques like data compression, RiOS also uses a Riverbed proprietary algorithm called scalable data referencing (SDR). SDR breaks up TCP data streams into unique data chunks that are stored in the hard disk (RiOS data store) of the device running RiOS (a SteelHead or SteelHead Mobile host system). Each data chunk is assigned a unique integer label (reference) before it’s sent to a peer RiOS device across the WAN. When the same byte sequence is seen again in future transmissions from clients or servers, the reference is sent across the WAN instead of the raw data chunk. The peer RiOS device (a SteelHead or SteelHead Mobile host system) uses this reference to find the original data chunk on its RiOS data store, and reconstruct the original TCP data stream.

•  Transport streamlining - SteelHeads use a generic latency optimization technique called transport streamlining. Transport streamlining uses a set of standards and proprietary techniques to optimize TCP traffic between SteelHeads. These techniques:

•  Application streamlining - In addition to data and transport streamlining optimizations, RiOS supports a rich set of application protocols that includes but is not limited to Microsoft Exchange, CIFS, SMB, SharePoint, HTTP/HTTPS, Lotus Notes, FCIP, SRDF, and SnapMirror.

•  Path selection for hybrid networking - These solutions maximize multiple WAN services based on business needs, service quality, and costs. Path selection redirects specific traffic or applications through one of three alternate paths determined by destination availability in cascading order. The path selection technology deterministically redirects select traffic and application flows through alternate networks based on service metrics, such as path availability, application priority, and policies you create.

•  Management streamlining - Management streamlining refers to the methods that Riverbed has developed to simplify the deployment and management of RiOS devices. These methods include:

•  In-Path rules - In-path rules determine the action a SteelHead takes when a connection is initiated, usually by a client. In-path rules are used only when a connection is initiated. Because connections are usually initiated by clients, in-path rules are configured for the initiating, or client-side SteelHead. You configure one of these types of in-path rule actions:

•  Peering rules - Peering rules determine how a SteelHead reacts when it sees a probe query. Peering rules are an ordered list of fields a SteelHead uses to match with incoming SYN packet fields. For example, source or destination subnet, IP address, VLAN, or TCP port, as well as the IP address of the probing SteelHead. This is especially useful in complex networks. These types of peering rule are available:

•  The Intercept/Bypass status light on the bypass card is triggered. For detailed information about bypass card status lights, see the appendices that follow.

•  The Dashboard of the Management Console displays the Critical health icon next to the appliance name.

•  SNMP traps are sent (if you have set this option).

•  The event is logged to system logs (syslog).

•  Email notifications are sent (if you have set this option).

•  Perpetual licenses for VCX10 through VCX90 models.

•  570-SD

•  770-SD

•  3070-SD

•  New licensing format - A common licensing framework based on a customer key is introduced for these models, which replaces token-based licensing. Licenses are tied to the customer key instead of the SteelHead-v appliance, which allows the licenses to be used across appliances.

•  Web proxy support - The Optimization > Network Services: In-Path Rules page allows configuration of the web proxy feature for these new SteelHead-v appliances.

•  VCX flexible management disk size - A reduced management disk size accommodates customer premises equipment (CPE).

•  Upgrade/downgrade flexibility - System configuration is retained when upgrading or downgrading between the new SteelHead-v models, and upgrades or downgrades are possible between any of the new models.

•  VCX provisioning - You can provision a virtual machine (VM) with a configuration that can be applied to more than one SteelHead-v.

•  ESXi 6.0 support - SteelHead-v appliances can now run on VMware ESXi version 6.0.

•  1Gbps VCX over KVM - High performance, 1Gbps WAN optimization throughput models for KVM and Hyper-v hypervisors.

•  FIPS and SCPS support - Support for Federal Information Processing Standards (FIPS) and Space Communications Protocol Specifications (SCPS) is added and does not require a separate license.

•  CCX-SUB-PERF-TIER1

•  CCX-SUB-PERF-TIER2

•  CCX-SUB-PERF-TIER3

•  You can instantiate the SteelHead-c instance directly from the AWS marketplace.

•  You update the SteelHead-c image directly from the SteelHead Management Console. You accomplish this task by downloading the image from the Riverbed Support site and then using the SteelHead Management Console to select the downloaded image and install it.

•  You can use a license from the Riverbed Cloud Portal to activate the SteelHead-c for AWS Marketplace. This feature is known as Bring Your Own License (BYOL).

•  No NTLM fallback for MAPI and signed/encrypted SMB optimization - End-to-end Kerberos can be configured as a configuration option without falling back to Windows NT LAN Manager (NTLM) delegation mode. To enable this feature, enter the protocol mapi encrypted ntlm-bypass enable command. For more information, see the Riverbed Command-Line Interface Reference Manual.

•  Support temporary password when user is created - A check box has been added to the Administration > Security: Password Policy page to support a temporary password.

•  Safety accounts - Administrator users can create safety accounts so that users with Administrator-level roles can login to the SteelHead, even if remote authentication servers are unreachable. A safety account increases security and conforms to DISA requirements.

•  Bandwidth optimization support for HTTP/2 - Data reduction for Transport Layer Security (TLS)-encrypted HTTP/2 traffic is supported, which includes support for the Application-Layer Protocol Negotiation (ALPN) TLS extension.

•  TLS extended master secret extension support - Support for the TLS extended master secret extension is added.

•  You can’t upgrade the SteelHead CX 555 or CX 755 to RiOS version 9.5 or later.

•  You can’t upgrade Series x50 or xx50 hardware to RiOS version 9.2 or later.

•  If you mix RiOS software versions in your network, the releases might support different optimization features and you can’t take full advantage of the features that aren’t part of the older software versions.

•  If you have deployed Path Selection or QoS in a RiOS 9.x deployment, we recommend that you temporarily disable the Path Selection and QoS features after upgrading to 9.2 or later and prior to rebooting the appliance. For more information, see the Riverbed Knowledge Base article at https://supportkb.riverbed.com/support/index?page=content&id=S28250.