McAfee Network Security Platform 9.2

Transcription

1 Revision C McAfee Network Security Platform 9.2 ( Manager-NS-series Release Notes) Contents About this release New features Enhancements Resolved issues Installation instructions Known issues Product documentation About this release This document contains important information about the current release. We recommend that you read the whole document. Network Security Platform follows a release process that is based on customer requirements and best practices followed by other McAfee teams. For details, read KB This release of Network Security Platform is to provide new features and enhancements on the Manager and NS-series Sensor software. Release parameters Version Network Security Manager software Signature Set NS-series Sensor software NS-series Sensor software (For outbound SSL decryption feature) McAfee SSL Agent (For inbound SSL decryption using DHE/ECDHE ciphers) 1.0 Suricata Snort Engine

2 Currently port 4167 is used as the UDP source port number for the SNMP command channel communication between Manager and Sensors. This is to prevent opening up all UDP ports for inbound connectivity from SNMP ports on the Sensor. Older JRE versions allowed the Manager to bind to the same source port 4167 for both IPv4 and IPv6 communication. But with the latest JRE version 1.8.0_153, it is no longer possible to do so, and the Manager uses port 4166 as the UDP source port to bind for IPv6. Manager 9.2 uses JRE version 1.8.0_153 and MySQL version If you have IPv6 Sensors behind a firewall, you need to update your firewall rules accordingly such that port 4166 is open for the SNMP command channel to function between those IPv6 Sensors and the Manager. Manager software version 9.2 is not supported on McAfee-built Dell-based Manager Appliances. McAfee recommends that you use Intel-based Manager Appliances instead. Upgrade support McAfee regularly releases updated versions of the signature set. You can choose to automatically download and deploy the signature set in the Manager. Upgrade paths for Manager software versions Current version Upgrade path to , , , , , , , , , , , , , , , , , , All intermediate Manager versions, such as Hotfixes, below must upgrade to before upgrading to the latest 9.2 Manager version. All Manager versions above can directly upgrade to the latest 9.2 Manager version. Upgrade paths for Sensor software versions NS-series (NS3100, NS3200, NS5100, NS5200, NS7100, NS7200, NS7300, NS9100, NS9200, NS9300): Component , , , , , , , , , , , Upgrade path to 9.2 (without outbound SSL decryption) To enable outbound SSL decryption feature, follow the upgrade path below: (Outbound SSL decryption is supported only on NS9100, NS9200, NS7200, and NS7300 sensor models) You must first purchase a license to enable outbound SSL decryption feature. To obtain a license for outbound SSL decryption, contact MB Licensing. An containing the license will be sent from MB Licensing. The Sensor software version for outbound SSL decryption is available at Patches and Downloads. If you are a first time user, you must register with your ID and Grant number to log in to the portal. In the Service Portal, click Patches and Downloads to register and log in to the portal. Component Upgrade path to 9.2 (with outbound SSL decryption) , , , , , ,

3 Component Upgrade path to 9.2 (with outbound SSL decryption) , , , , , All intermediate Sensor software versions, such as Hotfixes, below must upgrade to before upgrading to the latest 9.2 Sensor software version. All Sensor software versions above can directly upgrade to the latest 9.2 Sensor software version. Heterogeneous support This version of 9.2 Manager software can be used to configure and manage the following devices: Device NS-series Sensors (NS3100, NS3200, NS5100, NS5200, NS7100, NS7200, NS7300, NS9100, NS9200, NS9300) Version 8.1, 8.3, 9.1, 9.2 Virtual IPS for ESXi server (IPS-VM100, IPS-VM600) IPS-VM100: 8.1, 8.3, 9.1 Virtual IPS for KVM (IPS-VM100, IPS-VM600) 8.3 Virtual IPS for VMware NSX (IPS-VM100-VSS) 8.1, 8.3, 9.1 IPS-VM600: 8.1, 8.3, 9.1, 9.2 Virtual IPS for AWS (IPS-VM100-VSS, IPS-VM600-VSS) IPS-VM100-VSS: 8.3, 9.1 Virtual IPS for Azure (IPS-VM600-VSS) 9.2 M-series Sensors (M-1250, M-1450, M-2850, M-2950, M-3050, M-4050, M-6050, M-8000) IPS-VM600-VSS: , 8.3, 9.1 Mxx30-series Sensors (M-3030, M-4030, M-6030, M-8030) 8.1, 8.3, 9.1 M-8000XC Cluster Appliance 8.1, 8.3, 9.1 NTBA Appliances (T-200, T-500, T-600, T-1200) 8.1, 8.3, 9.1 Virtual NTBA Appliances (T-VM, T-100VM, T-200VM) 8.1, 8.3, 9.1 Integration support The above mentioned Network Security Platform software versions support integration with the following product versions: Table 1-1 Network Security Platform compatibility matrix Product Version supported McAfee epo 5.9.1, 5.9.0, McAfee Global Threat Intelligence McAfee Endpoint Intelligence Agent 2.6 McAfee Logon Collector Compatible with all versions McAfee Threat Intelligence Exchange 2.1.1, 2.1.0, McAfee Data Exchange Layer 4.0.0, McAfee Advanced Threat Defense McAfee Virtual Advanced Threat Defense McAfee MOVE AntiVirus Agentless 4.6 McAfee MOVE AntiVirus Multi-Platform

4 Table 1-1 Network Security Platform compatibility matrix (continued) Product Version supported McAfee Vulnerability Manager 7.5 McAfee Host Intrusion Prevention 8.0 Feature list with supported Sensor models Feature Suricata Snort support Outbound SSL Decryption Inbound SSL Decryption using DHE/ECDHE ciphers Integration with Private Global Threat Intelligence (GTI) Cloud Device Manager Whitelist and blacklist enhancements Domain name exceptions enhancements Performance Charts enhancements Gateway Anti-Malware enhancement Reverse proxy porting Supported Sensor model NS9x00, NS7x00, NS5x00, NS3x00 NS9100, NS9200, NS7200, NS7300 NS9x00, NS7x00, NS5x00 NS9x00, NS7x00, NS5x00, NS3x00 NS9x00, NS7x00, NS5x00, NS3x00 NS9x00, NS7x00, NS5x00, NS3x00 NS9x00, NS7x00, NS5x00, NS3x00 NS9x00, NS7x00, NS5x00, NS3x00 NS9x00, NS7x00, NS5x00, NS3x00 NS9x00, NS7x00, NS5x00, NS3x00 New features This release of Network Security Platform includes the following new features: Suricata Snort support McAfee Snort engine is the existing Snort engine available in Network Security Platform that performs attack detection. With release 9.2, you can use Suricata Snort engine as well. The Suricata Snort engine provides a dedicated Snort environment which supports most of the third-party Snort constructs that are available in the public domain. This allows you to import most of the custom and third-party Snort rules without modification. To enable the preferred Snort engine at the admin domain level, go to Devices <Admin Domain Name> Global IPS Device Settings Advanced Device Settings. To enable the preferred Snort engine at device level, go to Devices <Admin Domain Name> Devices <Device Name> Setup Advanced Advanced Device Settings. The Advanced Device Settings page at the global and device levels allow you to select the Snort engine you prefer to use. McAfee Snort engine is selected by default. For more information on the supported constructs, see McAfee Network Security Platform 9.2 Custom Attack Definitions Guide. Outbound SSL decryption As web content increasingly becomes encrypted with SSL, so does the need to inspect and analyze encrypted traffic. Network Security Platform IPS Sensors are equipped to decrypt SSL packets for inspection and respond in case of an attack. 4

5 For outbound SSL traffic, when you access a secure server using SSL, the Sensor acts as a proxy between the client and the server. The Sensor intercepts the client request and forwards the request to the server as the client. The server receives the request and sends its certificate to the Sensor. The Sensor then validates the server certificate using Trusted CA Certificates and the trusted resigning certificates to create a secure communication channel. You can enable outbound SSL decryption at the domain level or the device level. You must first purchase a license to enable outbound SSL decryption feature. To obtain a license for outbound SSL decryption, contact MB Licensing. An containing the license will be sent from MB Licensing. The Sensor software version for outbound SSL decryption is available at Patches and Downloads. If you are a first time user, you must register with your ID and Grant number to log in to the portal. In the Service Portal, click Patches and Downloads to register and log in to the portal. To enable outbound SSL decryption at the domain level, go to Devices <Admin Domain Name> Global IPS Device Settings SSL Decryption. To enable outbound SSL decryption at the device level, go to Devices <Admin Domain Name> Devices <Device Name> Setup SSL Decryption. Notes: You can configure Outbound SSL only on NS9100, NS9200, NS7200, and NS7300 Sensor version 9.2 or later. To enable outbound SSL decryption, you will require a license. Send a mail to MB Licensing to receive a license. You must first upgrade to Sensor software version and then upgrade to for using Outbound SSL irrespective of whether you are upgrading your existing deployment or installing 9.2 for the first time. Outbound SSL Decryption is disabled by default. Jumbo frame parsing is automatically disabled when Outbound SSL Decryption is enabled. The Sensor decrypts outbound SSL traffic only on TCP port 443. Outbound SSL Decryption is not supported on non-standard ports. Ensure that the trust between the Manager and the Sensor is established using 2048-bit encryption and not 1024-bit encryption. If you are using a firewall in your network ensure that the ports (listed in the table below) used to establish trust using 2048-bit certificates are open. Port Description 8506 Install channel (TCP) 8507 Alert channel (TCP) 8508 Packet log channel (TCP) Re-signing Certificates You have an option to either import your own re-signing certificates or to use the default re-signing certificates bundled with the Manager. To upload Re-signing Certificates for outbound SSL traffic, go to Devices <Admin Domain Name> Global IPS Device Settings SSL Decryption Re-Signing Certificate. 5

6 Once the client sends a request to access a secure server using SSL, the Sensor acts as a proxy between the client and the server. The server receives the request and sends its certificate to the Sensor. The Sensor then validates the server certificate which uses Trusted CA Certificates and the trusted resigning certificates to create a secure communication channel. The Sensor uses the trusted re-signing certificate to encrypt traffic between the Sensor and the client. You can configure your own customized trusted certificate and untrusted certificate issued by the Certificate Authority (CA) in the Re-Signing Certificates tab. Trusted CA Certificates The Trusted CA Certificates tab displays the list of digital certificates issued by CAs which the Sensor uses when validating the certificates from the server. The difference between Re-Signing Certificates and Trusted CA Certificates is as follows: When the Sensor acts as a proxy for the server to the internal clients being protected, it uses the Re-Signing Certificates to maintain end to end validation of the external servers' trustworthiness. When the Sensor acts as a proxy for the client to the external servers, it uses the Trusted CA Certificates to validate the external servers' trustworthiness. The Sensor has a default set of trusted CA certificates. You could also import additional trusted CA certificates if any. To upload Trusted CA Certificates for outbound SSL traffic, go to Devices <Admin Domain Name> Global IPS Device Settings SSL Decryption Trusted CA Certificates. Trusted CA Certificates can be managed only at the root admin domain. Various fault messages related to SSL decryption are generated in the System Faults page. To view the faults, go to Manager <Admin Domain Name> Troubleshooting System Faults. For example, an imported re-signing certificate might have become invalid. This causes the client browser to raise a certificate error. For more information on fault messages, see McAfee Network Security Platform 9.2 Troubleshooting Guide. SSL Decryption Exceptions SSL Decryption Exceptions provide a way to skip decryption of flows that would normally be decrypted. You can exclude certain outbound SSL traffic from decryption based on source or destination IP address, destination domain name, and URL category. For example, if you have an internal domain located at a different geographical location, then you can create an exception for that domain so that the SSL traffic is not decrypted. To manage outbound SSL decryption exceptions, go to Policy <Admin Domain Name> Intrusion Prevention Exceptions SSL Decryption Exceptions. Export and import of SSL decryption Exceptions The SSL decryption exceptions list can be exported and imported. You can export the list and reimport it only between the same versions of the Manager. The SSL decryption exceptions list is exported as a.xml file. To import SSL decryption exceptions list, go to Policy <Admin Domain Name> Intrusion Prevention Advanced Policy Import SSL Decryption Exceptions. To export SSL decryption exceptions list, go to Policy <Admin Domain Name> Intrusion Prevention Advanced Policy Export SSL Decryption Exceptions. For more information on Outbound SSL Decryption, see McAfee Network Security Platform 9.2 IPS Administration Guide 6

7 Inbound SSL Decryption using DHE/ECDHE ciphers Users are now moving to a more secure cipher suite like the DHE (Diffie-Hellman), ECDHE (Elliptic Curve Diffie-Hellman) ciphers. The RSA cipher suites have vulnerabilities and hence, there is a requirement to use stronger ciphers for secure connections. In case of inbound SSL decryption for DHE/ECDHE cipher suites, McAfee SSL Agent is installed in the web servers to be protected. The Agent passes the keys to the Sensor every time a connection is established with the web server. In the Agent based approach for inbound SSL decryption, the Network Security Platform IPS Sensor is placed between the client and server. When the client sends a request to the web server, the Sensor intercepts the connection. The Sensor then initiates a connection with the server. The Agent and the Sensor communicates over the management port for session key exchange. You can specify the number of concurrent connections between the Sensor and Agent in the Manager. The IP address of the web server should be added in the Manager which allows the server to communicate with the Sensor for inbound decryption. Telemetry data is collected for the number of Agents deployed on the web servers. You can download the McAfee SSL Agent from the McAfee Download Server. The link is available in the SSL Decryption page in the Manager. You can log into the Download Server using your Grant Number. The SSL Agent download file is available under Utilities & Connectors in the Download Server. The web server to be protected should have the Agent installed on it. In case of DHE/ECDHE ciphers suites since the public keys are dynamically generated, the Agent passes the keys to the Sensor every time a new connection is established. When the traffic flows through the Sensor, the keys are already available in the Sensor which helps in inspecting the traffic. When an attack is detected, the Sensor generates an alert in the Manager. To enable inbound SSL decryption at the domain level, go to Devices <Admin Domain Name> Global IPS Device Settings SSL Decryption. To enable inbound SSL decryption at the device level, go to Devices <Admin Domain Name> Devices <Device Name> Setup SSL Decryption. Notes: Inbound SSL decryption using the Agent method is supported only on NS9x00, NS7x00, and NS5x00 series Sensors. One Agent must be installed per web server to be protected. Any number of Agents can be installed across different web servers. When you disable an enabled inbound SSL decryption feature, you must uninstall the Agent manually from the web servers. In case of a failover pair, IP addresses of both the primary and secondary Sensors must be available in the Agent. Port 8501 must be opened for communication between the Agent and the Sensor. For more information on Inbound SSL Decryption using DHE/ECDHE ciphers, see McAfee Network Security Platform 9.2 IPS Administration Guide. Traffic Statistics In release 9.2, the Traffic Statistics page has been enhanced to display the statistics for inbound SSL Decryption as well. To view the SSL Decryption statistics, navigate to Devices <Admin Domain Name> Devices <Device Name> Troubleshooting Traffic Statistics SSL Decryption. 7

8 For SSL decryption, the Traffic Statistics page displays the following data: Inbound Statistics: This tab displays the count for the following for SSL traffic: Recycled SSL Flows - Total number of SSL flows that are not used recently and freed by the Sensor. SSL Flow Allocation Errors - Total number of SSL flows the Sensor could not allocate due to resource unavailability. Skipped SSL Flows Due to Flow Allocation Errors - Indicates total SSL flows that were skipped as the Sensor could not process them due to resource unavailability. Packets Received from Unknown SSL Flows - Total number of SSL packets received that did not have a corresponding SSL flow. SSL Flows Using Unsupported Diffie-Hellman Cipher Suite - SSL flows that are negotiated and not decrypted by the Sensor due to unsupported ciphers DH cipher suite in the traffic. SSL Flows Using Unsupported Export Cipher - Total flows with SSLv3/TLS export cipher that are negotiated and not decrypted by the Sensor due to unsupported RSA cipher suite. SSL Flows Using Unsupported or Unknown Cipher - Total flows with unsupported or unknown ciphers. Shared Key Lookup Hits - Displays the number of times the Sensor uses the session key table provided by the Agent to decrypt inbound traffic using Diffie-Hellman cipher suite. Internal Web Server Certificate Matches: This tab displays the count for unmatched and matched certificates for inbound SSL traffic. For more information on traffic statistics, see McAfee Network Security Platform 9.2 IPS Administration Guide Integration with Private Global Threat Intelligence (GTI) Cloud With this release, Network Security Platform supports integration with McAfee Private Global Threat Intelligence (GTI) Cloud. The Private GTI Cloud offers the option to utilize McAfee s GTI information in your private cloud environment. You can configure Private GTI Cloud to provide reputation scores to the malware files. Network Security Platform Sensors can be configured to send threat information to the Private GTI Cloud instead of the Public GTI Cloud. File reputation and IP reputation scores is retrieved from the private cloud based on which rules and policies can be configured to prevent attacks. To configure the GTI Private Cloud, go to Manager <Admin Domain Name> Integration GTI. Telemetry You can configure the telemetry information sent to the McAfee GTI Cloud. When McAfee GTI Cloud is enabled, information about alerts, features, Sensor version, and Manager version are sent to GTI cloud. You can view the details sent to GTI Cloud from the Manager. In previous releases, the telemetry information sent to McAfee GTI Cloud can be viewed in the GTI integration page. With release 9.2, telemetry information can be viewed under Manager <Admin Domain Name> Setup Telemetry. The options to configure the information sent to McAfee GTI Cloud remains the same. When enabled, the show gti config CLI command is enhanced to display the configuration details for Private GTI cloud. For more information about telemetry, see McAfee Network Security Platform 9.2 Integration Guide. 8

9 Device Manager The Device Manager page provides information about all the devices configured in the Manager. It lists the device information, software, health, status, and so on. NS-series Sensors, M-series Sensors, Mxx30 Sensors, Virtual IPS Sensors, NTBA Appliances, and HIPS devices are displayed in the Device Manager page. It displays the devices configured in an admin domain including the devices configured in the child admin domains. You can view the faults generated for the devices and directly navigate to the System Faults page to view the faults. The Device Manager page does not display details for XC Cluster devices. For more information on Device Manager, see McAfee Network Security Platform 9.2 Manager Administration Guide. Enhancements This release of Network Security Platform includes the following enhancements: Whitelist and blacklist enhancements With release 9.2, you can edit whitelist and blacklist file hashes. When you double-click on a file hash, details panel opens on the right side of the page. You can edit the name and comment for the file hash and save. You can now manually add whitelist and blacklist file hash to the records. To manage the whitelist and blacklist file hashes, go to Policy <Admin Domain Name> Intrusion Prevention Exceptions File Hashes. For more information on whitelist and blacklist, see McAfee Network Security Platform 9.2 IPS Administration Guide. Domain name exceptions enhancements The Callback Detection whitelist is a global list that overrides the botnet DAT list provided with the Callback Detectors bundle. The IPS Inspection list is provided by McAfee that is used by the Sensor for inspection. In the previous release, IPS Inspection whitelist was a view only list provided by McAfee. With release 9.2, you can add new domain names to the list and also edit the existing domain names available in the list. The Domain Type option is displayed if you added the domain name or if the domain name was provided by McAfee. The domain exceptions list is available under Policy <Admin Domain Name> Intrusion Prevention Exceptions Domain Names. With release 9.2, you can perform the following actions in the Whitelist - IPS Inspection tab: Enable/disable domain names Import/export customized domain names list Delete the customized list. The default domain name provided by McAfee cannot be deleted. For more information on domain name exceptions, see McAfee Network Security Platform 9.2 IPS Administration Guide. 9

10 Performance Charts enhancements With release 9.2, the performance charts have been enhanced to provide in-depth view of the metrics. A zoom in option is available that helps you view a portion of the chart in detail. Previously only summarized data was displayed in the performance charts. With release 9.2, there is an option to view the raw data as well. The raw data displays the average of three minute intervals of data points. Whereas the summarized data displays the summarized data for an hour for the metric selected. You can view the maximum, average, and minimum values for the summarized data. An Actions option is available in the Performance Charts page where you can save the chart an image, or navigate to the Performance Metrics page to edit the metric collection and data storage. For more information on performance charts, see McAfee Network Security Platform 9.2 IPS Administration Guide. Gateway Anti-Malware enhancement With release 9.2, Gateway Anti-Malware 2017 is supported on NS-series Sensors. With the support for new version, proxy server for Gateway Anti-Malware engine is available. For more information on Gateway Anti-Malware engine, see McAfee Network Security Platform 9.2 IPS Administration Guide. Reverse proxy porting In case of persistent HTTP traffic when XFF is enabled, the alerts previously displayed the proxy IP information for the first HTTP request. With this release, the XFF information for all the HTTP connections are displayed in the alerts. To view the XFF information for an alert, go to Analysis <Admin Domain Name> Attack Log. IPS CLI enhancements Following new Sensor CLI commands are available: Table 3-1 Normal Mode CLI Command clear ssl outbound urlcache show snort config show ssl config show ssl stats inbound agents Description Clears the URL cache generated for outbound SSL traffic where exceptions are set for specific URLs. Displays the Snort engine configuration as selected through the Network Security Manager. Shows the configuration details for SSL on the Sensor. Displays the number of Agents connected to the Sensor. show sslagentaccesscontrol status Displays the SSL Agent status and the number of connections from the Agents to the Sensor. sslagentaccesscontrol resetlist Table 3-2 Debug Mode CLI Command packetcapture Description Deletes the entire access list of SSL agents that are configured for accessing the Sensor. Starts or stops packet capture in VMware NSX, AWS, and Azure Platforms, or uploads captured packet files. set gzip decode limit Sets maximum size for http response to be decompressed upon gzip encoding. show ssl stats sensor Displays the Inbound SSL Task connection, packet, and session statistics. suricata Enables or disables packet forwarding to the Suricata engine. 10

11 Following Sensor CLI commands are updated: Table 3-3 Normal Mode CLI Command clear gti server Description This command works only for the Public GTI cloud and only when the Private GTI cloud is disabled in the Manager. resolve gti server This command works only for the Public GTI cloud and only when the Private GTI cloud is disabled in the Manager. set gtiserver ip show gti config show ssl stats Following Sensor CLI commands are removed: Table 3-4 Normal Mode CLI Command clear tcp-proxy statistics increasemgmtprocessing show powersupply Table 3-5 Debug Mode CLI Command clearactiveflows flashcheck reset ratelimitstats show fe stat show feswitch port show gmac show ratelimit drops show ratelimit markstats This command works only for the Public GTI cloud and only when the Private GTI cloud is disabled in the Manager. Output displays both Public and Private GTI could configuration information. Earlier it displayed information only for the inbound SSL traffic with RSA ciphers. This command now displays information related to the outbound SSL traffic and the inbound SSL traffic with the DHE/ECDHE ciphers. For more information, see McAfee Network Security Platform 9.2 CLI Guide. Product integration With this release, Network Security Platform supports integration with following products release versions: MOVE Agentless 4.6 MOVE Multi-platform McAfee Data Exchange Layer McAfee Virtual Advanced Threat Defense version McAfee Threat Intelligence Exchange version For more information on the product integration, see McAfee Network Security Platform 9.2 Integration Guide. 11

12 Resolved issues The current release of the product resolves these issues. For a list of issues fixed in earlier releases, see the Release Notes for the specific release. Resolved Manager software issues This release does not contain any resolved issues for the Manager. Resolved Sensor software issues The following table lists the high-severity Sensor software issues: ID # Issue Description The management process experiences an exception due to resource exhaustion. The following table lists the medium-severity Sensor software issues: ID # Issue Description The connections are dropped incorrectly as the Layer 7 DoS response action is ignored The power supply status is incorrectly reported in the SNMP responses When the Sensor is idle for a long duration, it reboots as the watchdog times out [NS3x00] Datapath processor stops transmitting packets after Sensor reboot as one of the processors is not initialized correctly Packet log is not available in the Manager for the attack TFTP: TFTP Server Error Packet Handling Buffer Overflow The Sensor is unable to reach the DNS server immediately after reboot The Sensor health goes to a bad state due to an error from the datapath processor after a configuration update. 12

13 Installation instructions Manager server/client system requirements The following table lists the 9.2 Manager server requirements: Operating system Minimum required Any of the following: Windows Server 2008 R2 Standard or Enterprise Edition, English operating system, SP1 (64-bit) (Full Installation) Windows Server 2008 R2 Standard or Enterprise Edition, Japanese operating system, SP1 (64-bit) (Full Installation) Windows Server 2012 R2 Standard Edition (Server with a GUI) English operating system Windows Server 2012 R2 Standard Edition (Server with a GUI) Japanese operating system Windows Server 2012 R2 Datacenter Edition (Server with a GUI) English operating system Windows Server 2012 R2 Datacenter Edition (Server with a GUI) Japanese operating system Windows Server 2016 Standard Edition (Server with a GUI) English operating system Windows Server 2016 Standard Edition (Server with a GUI) Japanese operating system Windows Server 2016 Datacenter Edition (Server with a GUI) English operating system Windows Server 2016 Datacenter Edition (Server with a GUI) Japanese operating system Only X64 architecture is supported. Recommended Windows Server 2016 Standard Edition operating system Memory 8 GB Supports up to 3 million alerts in Solr. >16 GB Supports up to 10 million alerts in Solr. CPU Server model processor such as Intel Xeon Same Disk space 100 GB 300 GB or more Network 100 Mbps card 1000 Mbps card Monitor 32-bit color, 1440 x 900 display setting 1440 x 900 (or above) The following are the system requirements for hosting Central Manager/Manager server on a VMware platform. 13

14 Table 5-1 Virtual machine requirements Component Minimum Recommended Operating system Any of the following: Windows Server 2008 R2 Standard or Enterprise Edition, English operating system, SP1 (64-bit) (Full Installation) Windows Server 2008 R2 Standard or Enterprise Edition, Japanese operating system, SP1 (64-bit) (Full Installation) Windows Server 2012 R2 Standard Edition (Server with a GUI) English operating system Windows Server 2012 R2 Standard Edition (Server with a GUI) Japanese operating system Windows Server 2012 R2 Datacenter Edition (Server with a GUI) English operating system Windows Server 2012 R2 Datacenter Edition (Server with a GUI) Japanese operating system Windows Server 2016 Standard Edition (Server with a GUI) English operating system Windows Server 2016 Standard Edition (Server with a GUI) Japanese operating system Windows Server 2016 Datacenter Edition (Server with a GUI) English operating system Windows Server 2016 Datacenter Edition (Server with a GUI) Japanese operating system Only X64 architecture is supported. Windows Server 2016 Standard Edition operating system Memory 8 GB >16 GB Supports up to 3 million alerts in Solr. Supports up to 10 million alerts in Solr. Virtual CPUs 2 2 or more Disk Space 100 GB 300 GB or more Table 5-2 VMware ESX server requirements Component Minimum Virtualization software ESXi 5.5 Update 3 ESXi 6.0 Update 1 ESXi 6.5 Update 1 14

15 The following table lists the 9.2 Manager client requirements when using Windows 7, Windows 8, or Windows 10: Operating system Minimum Windows 7, English or Japanese Windows 8, English or Japanese Windows 8.1, English or Japanese Windows 10, English or Japanese The display language of the Manager client must be same as that of the Manager server operating system. Recommended Windows 10, English or Japanese RAM 2 GB 4 GB CPU 1.5 GHz processor 1.5 GHz or faster Browser Internet Explorer 10, 11 Mozilla Firefox Google Chrome (App mode in Windows 8 is not supported) Internet Explorer 11 Mozilla Firefox 20.0 or later Google Chrome 24.0 or later To avoid the certificate mismatch error and security warning, add the Manager web certificate to the trusted certificate list. For the Manager client, in addition to Windows 7, Windows 8, Windows 8.1 and Windows 10, you can also use the operating systems mentioned for the Manager server. The following are Central Manager and Manager client requirements when using Mac: Mac operating system Yosemite El Capitan Browser Safari 8 or 9 For more information, see McAfee Network Security Platform Installation Guide. Known issues For a list of known issues in this product release, see this McAfee KnowledgeBase article: Network Security Platform software issues: KB90337 Product documentation Every McAfee product has a comprehensive set of documentation. Find product documentation Go to docs.mcafee.com to find the product documentation for this product. 15

16 Or 1 Go to the McAfee ServicePortal at and click Knowledge Center. 2 Enter a product name, select a version, then click Search to display a list of documents. 9.2 product documentation list The following software guides are available for Network Security Platform 9.2 release: Quick Tour Virtual IPS Administration Guide Installation Guide (includes Upgrade Guide) CLI Guide Manager Administration Guide Integration Guide Custom Attack Definitions Guide Best Practices Guide Manager API Reference Guide Troubleshooting Guide IPS Administration Guide Copyright 2018 McAfee, LLC McAfee and the McAfee logo are trademarks or registered trademarks of McAfee, LLC or its subsidiaries in the US and other countries. Other marks and brands may be claimed as the property of others. 0C00