This release of the product includes these new features that have been added since NGFW 5.7.

Transcription

1 Release Notes Revision A McAfee Next Generation Firewall Contents About this release New features Enhancements Changes Known limitations Resolved issues System requirements Installation instructions Upgrade instructions Build version Compatibility Known issues Find product documentation About this release This document contains important information about the current release. We strongly recommend that you read the entire document. The Security Engine product name has changed in this release. The Security Engine is now known as the McAfee Next Generation Firewall or NG. NG engines are still represented by Security Engine elements in the Management Client. New features This release of the product includes these new features that have been added since NG 5.7. New features introduced in NG 5.8 New SSL VPN The 5.8 version provides a new SSL VPN feature that is built-in into the Next Generation Firewall (NG). The same Firewall can host multiple SSL VPN Portals that each can have their own SSL VPN Portal Policy. Outlook Web Access (OWA) and intranet browsing are among the assumed key use cases the portal supports. The SSL VPN Portal Services can be based either on URL rewrites or DNS mapping capabilities. The new SSL VPN will eventually replace the separate Stonesoft legacy SSL VPN appliance. File Filtering Policy (including McAfee ATD and McAfee GTI integration) A new policy type has been introduced for File Filtering. Currently this policy type is selected on the Inspection tab of the main policy that you upload on the NG engine. The matching criteria for the File Type Policy rule include the source and destination of the file stream and the File Type. The NG can be configured to allow or discard the traffic that matches the File Type Policy rule directly or allow it only after additional checks have been performed. These checks include the File Reputation (McAfee GTI) check, the McAfee Anti-Virus check, and the McAfee Advanced Threat Defense (ATD) check. 1

2 Enhancements This release of the product includes these enhancements added since NG 5.7. Enhancements introduced in NG Support for inspecting HTTP multipart messages Support for inspecting HTTP multipart messages has been added. Enhancements introduced in NG 5.8 TCP inspection The internal TCP inspection engine has been improved for performance and functionality. The functionality enhancements include: Anti-virus support in a Virtual Context Anti-virus and anti-spam support on Inline Interfaces and Capture Interfaces on and Layer 2 Firewalls URL filtering support on Capture Interfaces Enhanced NAT support with Anti-virus and Anti-spam User Response support in Layer 2 Firewall role TLS inspection for server protection on Capture Interfaces in and Layer 2 Firewall roles. McAfee Logon Collector (MLC) will replace the Stonesoft User Agent McAfee Logon Collector (MLC) is a software component that is very similar to the Stonesoft User Agent. Eventually, support for the legacy Stonesoft User Agent will end and MLC will replace it. In NG 5.8, you can use either MLC or the Stonesoft User Agent to provide user information for Access rules, logs, and reporting. MLC introduces some benefits and new features that do not exist in the Stonesoft User Agent. It supports High Availability, multiple Domains, and multiple AD forests. It can also monitor MS Exchange Servers (in addition to Domain Controllers) for login information, which means that it provides better coverage for user identification. Interface link aggregation Interface link aggregation has been enhanced to support up to 8 interfaces in load balancing mode. Feature stability has been enhanced and Link Status test for aggregated interfaces is improved. 2

3 Changes Strict TCP Mode for Deep Inspection The Strict TCP Mode for Deep Inspection option in engine properties is now only for backward compatibility. The new engine switches automatically between active stream processing and transparent packet forwarding, depending on the configured features and received packets. Anti-virus option moved under File Filtering Policy The Anti-virus option, which was previously part of Access rule Allow Action Options, has been moved to the new File Filtering Policy. TCP Situations available for logging only TCP Situation elements that previously contained options for controlling TCP inspection can now be used only for logging. The TCP Situations now have no configurable options. Anti-virus logging The Anti-Virus_Virus-Found Situation has been replaced by the File_Malware-Blocked Situation. Packet validity checking McAfee NG in all roles checks the validity of packets to protect the engine from processing invalid packets, which can be harmful to the McAfee NG. Depending on the action in the Inspection Policy, McAfee NG in the and Layer 2 Firewall roles can either terminate invalid packets or bypass the traffic without processing the invalid packets. For self-protection reasons, McAfee NG in the Firewall/VPN role always terminates invalid packets without establishing a connection. Invalid Packet Situation logging Configuring logging options for the Invalid Packet Situation Type in the Inspection Policy now enables logging for all McAfee NG roles. Logging for the Firewall/VPN role could previously only be enabled by selecting the Packet Filter diagnostic mode in the Firewall/VPN diagnostics for the engine. More detailed information is now available in the Firewall logs when invalid packets are detected and terminated. Note! Invalid Packet Situations are always log rate limited. Known limitations Inspection in asymmetrically routed networks In asymmetrically routed networks, using the stream modifying features (TLS Inspection, URL filtering, and file filtering) may make connections stall. Even if these features are not configured, the engine may report false positive out-of-window situations and drop those packets after a while. SSL/TLS inspection in capture (IDS) mode Due to SSL/TLS protocol security features, SSL/TLS decryption in capture (IDS) mode can only be applied in a server protection scenario when RSA key exchange negotiation is used between the client and the server. Inline Interface disconnect mode in the role The disconnect mode for Inline Interfaces is not supported on Virtual Appliances, software installations, appliance models other than -6xxx, or modular appliance models that have bypass interface modules. VPN tunnels between contexts in same master cluster are not supported It is not supported to configure VPN tunnels between contexts that are running in same master cluster. 3

4 Resolved issues These issues have been resolved since version NG For a list of issues that have been fixed in earlier releases, see the Release Notes for the specific release. Issue Role Description Inspection-related logs might not be seen with Show Connection option in Logs view (#95325) Virtual Security Engines might not handle fragmented traffic correctly (#109199) Logs by VPN option might not show all relevant log entries (#110414) First policy installation after initial configuration might fail (#111797) Engine might reboot when antispoofing configuration is removed from Virtual Security Engine (#113791) Engine might not apply configured Wireless Mode setting correctly (#113816) Inspection process might restart when handling TLS traffic (#114523) NAT issues with SIP Protocol Agent (#114881) Locking issues when same traffic seen by multiple Capture Interfaces (#114902) Receiving SNMP interface statistics might take long time with Master Engines (#115009) Issues with TCP option handling (#115054) L2 L2 L2 L2 L2 L2 Selecting the Show Connection option using a log entry's right-click menu might not show all log entries related to the connection, specifically inspection-related logs. Virtual Security Engines might not handle fragmented traffic correctly when the same stream is seen by more than one Virtual Security Engine. The Logs by VPN option under Monitoring in a VPN element's right-click menu might not show all related VPN log entries. The first policy installation after an engine's initial configuration might fail. This problem is likely to occur when an ADSL Interface is used as the management interface. Workaround: Disable the Policy Handshake option in the engine properties, then install the first policy. After the installation, reboot the engine. The engine might reboot when the antispoofing configuration is removed from a Virtual Security Engine. In environments where the engine is configured to use Wireless Mode bg or bgn, the correct mode might not be applied. Instead, the engine always uses mode b, which causes degraded performance. The inspection process might restart when the engine handles TLS traffic. The SIP Protocol Agent might apply NAT incorrectly to some SIP messages. The engine might have locking issues when the same traffic is seen by multiple Capture Interfaces within the same Logical Interface. The symptoms include messages like "BUG: soft lockup" on the engine console. Receiving SNMP interface statistics for each individual engine might take an extensive amount of time when Virtual Security Engines are used. Connections through NG engines might not succeed if the TCP client changes the TCP options during SYN retransmits and the connections are processed using Normal or Strict connection tracking mode. The log message contains "Connection timeout in state INVALID" in the information field. 4

5 Issue Role Description Link Status test failure might be triggered inaccurately for Aggregated Link Interface (#115168) A Link Status test failure might be triggered inaccurately for an Aggregated Link Interface. Engine might not apply NAT correctly to related connections (#115271) First policy upload after configuring Virtual Security Engines might fail (#115334) L2 The engine might not apply NAT correctly to related connections when static source translation is used and the connections are inspected. The first policy upload after configuring Virtual Security Engines might fail. The policy is uploaded on the Master Engine, but the upload fails on the first Virtual Security Engine. The following error message is shown: "FATAL: could not acquire lock by file: (errno=11). Another sgcfg running?". Engine might not terminate VPN negotiations with IPsec VPN Clients correctly in error situations (#115412) Engine might not be able to decrypt TLS traffic if OCSP stapling is in use (#115438) Engine might block existing connections if inspection process restarts (#115448) Engine might not report connectivity with the MLC correctly (#115470) When MLC is enabled in Virtual Security Engine, policy upload might hang and cause engine restart (#115475) Engine installed on third-party hardware might restart after installation (#115486) Engine sends files that are too small to the ATD server (#115503) L2 L2 L2 L2 L2 In environments where the IPsec VPN Clients have been configured to use IKEv2, the engine might not terminate the VPN negotiations correctly if the connection to the the DHCP server times out. As a result, the previous negotiation is not cleared on the engine and the following connection attempts from the same IPsec VPN Client fail. Workaround: Use IKEv1 with IPsec VPN Clients. The engine might not be able to decrypt TLS traffic in a server protection scenario if OCSP stapling is in use. If the inspection process restarts, the engine might block existing connections when the connection tracking mode is Normal. Workaround: Allow connections using the Loose connection tracking mode. The engine might not report connectivity with the McAfee Logon Collector (MLC) correctly when Virtual Security Engines are in use. As a result, monitoring can show errors on the connection between the engine and the MLC. When McAfee Logon Collector (MLC) is enabled in a Virtual Security Engine, uploading a policy might hang and cause the engine to restart. An engine installed on third-party hardware might restart once after installation and issuing the sg-reconfigure command. The engine sends very small files that should not be sent to the ATD server for analysis. As a result, ATD might report the following: "File type not supported". 5

6 Issue Role Description Interfaces belonging to removed Virtual Security Engines might not be moved correctly to the Master Engine (#115533) Log flooding if modem is disconnected (#115549) Configuration with static source NAT to alias for interface with dynamic IP address does not work (#115550) False HTTP_Request- Content-Length- Unparseable situations for some HTTP response headers (#115563) L2 L2 Interfaces belonging to removed Virtual Security Engines might not be moved correctly to the Master Engine. As a result, the subsequent policy installation can show errors about the missing interfaces. Workaround: Reboot the Master Engine after removing a Virtual Security Engine. The engine can flood the logs with the message "Failed to open /dev/gsm0: No such file or directory" if a modem is disconnected from the engine while it is in use. A configuration where a NAT rule translates from a static source to an alias for an interface with a dynamic IP address cannot be uploaded to the engine. The following type of message is shown: "FATAL: syntax error in policy configuration: orig and new IP netmasks must be equal." An engine might not parse the HTTP content length header correctly, causing false HTTP_Request-Content-Length- Unparseable Situations. These Situations might cause excessive delays for HTTP traffic if file filtering is used. Workaround: Disable file filtering in Access rules for destinations that generate HTTP_Request-Content-Length- Unparseable Situations. Engine might not optimally handle log sending to the Log Server when heavy logging is in use (#115571) OSPF might not work in activestandby cluster setups that have CVI-only interfaces (#115582) Policy installation can fail if WLAN interface has more than one SSID configured (#115619) Backing up dynamic routing configuration using the Management Client can result in an incorrectly sized file (#115756) Engine might stop processing inspected traffic when GTI is in use (#115776) Route-based VPN tunnels are renegotiated after each policy install (#115792) L2 The engine might not optimally handle log sending to the Log Server when heavy logging is in use. As a result, the log receiving can slow down. OSPF might not work in active-standby cluster setups where there are interfaces configured with CVI addresses only. Policy installation can fail on the engine if the WLAN interface has more than one SSID configured. Backing up a dynamic routing configuration from the Management Client can result in an incorrectly sized file. The engine might stop processing inspected traffic when GTI file reputation checking is in use. Route-based VPN tunnels are re-negotiated after each policy install, even if no changes are applied to them. This can result in latency in the traffic using the VPN tunnel. 6

7 Issue Role Description Engine cannot use a proxy server to get anti-virus database updates (#115817) HTTP inspection URL caching issues (#115818) L2 L2 The engine cannot use a proxy server to get anti-virus database updates. Connections might be incorrectly terminated based on cached information for a URL. Engine might create unnecessary state sync diagnostic log entries when dynamic routing is in use (#115819) Engine can keep terminated connections in the connection state table for too long (#115821) Malware handling issue when both antivirus and ATD are configured (#115903) State sync might not work under heavy load (#115923) OpenSSL library update June 2015 (#115961) Engine can incorrectly log blacklisting failures (#115968) Engine might drop VLAN-tagged, fragmented packets (#116063) Engine might not accept licenses that have an expiry date past 2037 (#116068) L2 L2 L2 L2 L2 L2 The engine might create unnecessary state sync diagnostic log entries when dynamic routing is in use. The following log entries can be seen: "RTNETLINK answers: File exists" and "Command failed /tmp/route_sync_batch:". As a result, the data partition on the engine can fill up, causing the policy installation to fail. Also, the "sg-cluster status" command can incorrectly show the FAILED status for state sync. The engine can keep connections terminated by inspection in the connection state table for too long. If a matching file filtering rule has both antivirus and Advanced Threat Defense (ATD) inspection enabled, and antivirus allows the file, but ATD declares the file harmful, the file is still allowed through. The engine might send corrupted state sync packets from some 1 Gbps interfaces. The result is that clustering might not work properly because other nodes drop these packets with the UDP_Checksum-Mismatch Situation. The OpenSSL library has been updated to version 1.0.1o to address the issues listed in CVE and CVE The engine uses vulnerable OpenSSL routines only for its TLS management communications. The ability to abuse these vulnerabilities is limited as access to vulnerable interfaces is limited by IP address-based access controls. Due to internal timing issues, the engine might report blacklisting failures even if the blacklisting entries have been created successfully. The following log entry can be seen: "Could not create a blacklisting entry to terminate the connection". The engine might drop VLAN-tagged, fragmented packets. The engine might not accept licenses that have an expiry date that is past the year

8 System requirements McAfee NG appliances Appliance model X (MIL-320) Supported roles Firewall/VPN Firewall/VPN Firewall/VPN Firewall/VPN Firewall/VPN and Layer 2 Firewall and Layer 2 Firewall and Layer 2 Firewall 321 Firewall/VPN,, and Layer 2 Firewall 325 Firewall/VPN,, and Layer 2 Firewall 1035 Firewall/VPN,, and Layer 2 Firewall 1065 Firewall/VPN,, and Layer 2 Firewall 1301 Firewall/VPN,, and Layer 2 Firewall 1302 Firewall/VPN,, and Layer 2 Firewall 1401 Firewall/VPN,, and Layer 2 Firewall 1402 Firewall/VPN,, and Layer 2 Firewall 3201 Firewall/VPN,, and Layer 2 Firewall 3202 Firewall/VPN,, and Layer 2 Firewall 3205 Firewall/VPN,, and Layer 2 Firewall 3206 Firewall/VPN,, and Layer 2 Firewall 3207 Firewall/VPN,, and Layer 2 Firewall 5201 Firewall/VPN,, and Layer 2 Firewall 5205 Firewall/VPN,, and Layer 2 Firewall 5206 Firewall/VPN,, and Layer 2 Firewall Some features in this release are not available for all appliance models. See and for up-to-date appliance-specific software compatibility information. McAfee appliances support only the software architecture version (32-bit or 64-bit) that they are shipped with. Certified Intel platforms McAfee has certified specific Intel-based platforms for the Next Generation Firewall. The tested platforms can be found in the McAfee Support Knowledge Center ( under the Next Generation Firewall product. We strongly recommend using certified hardware or a pre-installed McAfee appliance as the hardware solution for new McAfee NG installations. If it is not possible to use a certified platform, the NG can also run on standard Intel-based hardware that fulfills the hardware requirements. 8

9 Basic NG hardware requirements Intel Core 2 / Intel Xeon based hardware IDE hard disk (IDE RAID controllers are not supported) and CD-ROM drive Memory: 2 GB RAM minimum for 32-bit (i386) installation 8 GB RAM minimum for 64-bit (x86-64) installation VGA-compatible display and keyboard One or more certified network interface cards for the Firewall/VPN role 2 or more certified network interface cards for with IDS configuration 3 or more certified network interface cards for Inline or Layer 2 Firewall For more information on certified network interface cards, see Requirements for Master Engines Each Master Engine must run on a separate physical NG device. For more details, see the McAfee NG Installation Guide for Firewall/VPN Role and the McAfee NG Installation Guide for and Layer 2 Firewall Roles. All the Virtual Security Engines hosted by a Master Engine or Master Engine cluster must have the same role and the same Failure Mode ( fail-open or fail-close ). Master Engines can allocate VLANs or interfaces to Virtual Security Engines. If the Failure Mode of the Virtual engines or Virtual Layer 2 Firewalls is Normal (fail-close) and you want to allocate VLANs to several engines, you must use the Master Engine cluster in standby mode. Cabling requirements for Master Engine clusters that host Virtual engines or Layer 2 Firewalls: Failure Mode Bypass (fail-open) requires serial cluster cabling. Failure Mode Normal (fail-close) requires Layer 2 Firewall cluster cabling. For more information on cabling, see the McAfee NG Reference Guide for and Layer 2 Firewall Roles. Requirements for Virtual Appliance Nodes Intel Core 2 / Intel Xeon -based hardware One of the following hypervisors VMware ESXi versions 5.1 and 5.5 KVM (KVM is tested as shipped with Red Hat Enterprise Linux Server release 7.0) Only 64-bit NG guest is supported on KVM 8 GB virtual disk 2 GB RAM minimum, 4 GB recommended if inspection is used A minimum of one virtual network interface for the Firewall/VPN role, three for or Layer 2 Firewall roles The following limitations apply when a McAfee NG is run as a virtual appliance node in the Firewall/VPN role: Only Packet Dispatching CVI mode is supported. Only Standby clustering mode is supported. Heartbeat requires a dedicated non-vlan-tagged interface. The following limitations apply when a McAfee NG is run as a virtual appliance node in the or Layer 2 Firewall role: Clustering is not supported. 9

10 Installation instructions Note The sgadmin user is reserved for McAfee use on Linux, so it must not exist before the McAfee Security Management Center is installed for the first time. The main installation steps for the McAfee Security Management Center (SMC) and the NG engines are as follows: 1. Install the Management Server, the Log Server(s), and optionally the Web Portal Server(s) and the Authentication Server(s). 2. Import the licenses for all components (you can generate licenses at 3. Configure the Firewall,, or Layer 2 Firewall elements with the Management Client using the Security Engine Configuration view. 4. Generate initial configurations for the engines by right-clicking each Firewall,, or Layer 2 Firewall element and selecting Save Initial Configuration. 5. Make the initial connection from the engines to the Management Server and enter the one-time password provided during Step Create and upload a policy on the engines using the Management Client. The detailed installation instructions can be found in the product-specific installation guides. For a more thorough explanation of using the McAfee Security Management Center, refer to the Management Client Online Help or the McAfee SMC Administrator s Guide. For background information on how the system works, consult the McAfee SMC Reference Guide. All guides are available for download at Upgrade instructions McAfee NG version requires an updated license if upgrading from version 5.7.x or lower. The license upgrade can be requested at Install the new license using the Management Client before upgrading the software. The license is updated automatically by the SMC if communication with McAfee servers is enabled and the maintenance contract is valid. To upgrade the engine, use the remote upgrade feature or reboot from the installation CD and follow the instructions. Detailed instructions can be found in the McAfee NG Installation Guide for Firewall/VPN Role and the McAfee NG Installation Guide for and Layer 2 Firewall Roles. Note McAfee NG appliances support only the software architecture version that they are pre-installed with. 32-bit versions (i386) can only be upgraded to another 32-bit version and 64-bit versions (x86-64) can only be upgraded to another 64-bit version. Clusters can only have online nodes that use the same software architecture version. State synchronization between 32-bit and 64-bit versions is not supported. Changing architecture for third-party server machines using software licenses requires full re-installation using a CD. Upgrading to any 5.8.x version is only supported from 5.7.x version. If you are running a lower version, upgrade first to the highest 5.7.x version following the instructions in the release notes for that version. 10

11 Build version McAfee Next Generation Firewall version build version is Product Binary Checksums sg_engine_ _i386.iso SHA1SUM: e4aef33043bb5c378f36f9848ab43fd466b48f05 SHA512SUM: 7d df5c4af73d29c601a2aa1c09b18cdf96d141bfff10727e4eed47fa20122c0fc33929ba9aeb72b5 e8a37725ad0e99e969a7d09c032cbb21b81cf24 sg_engine_ _i386.zip SHA1SUM: 7fb88b5b8010bd742559dba5deaa2cc2ea15922e SHA512SUM: a27d25a543240bac4cc0f29ea0dede683cbe2d5c8aa4e8f99de4adb1700ed3d bd7b4c7621cc04 6bdeab1ce79b b522eca95173a649557ca61 sg_engine_ _x86-64.iso SHA1SUM: ea165b5653d8a9a d071bc40b139ba SHA512SUM: 86c0d1776b0db3f0c2e787e73271da86a81db df3b1259b871d9600b a5fc5e6fe608ae e1de3e524a4cf1df05206f7c2d0092d6a18d sg_engine_ _x86-64.zip SHA1SUM: 48b9a31174a9adafec6870b50926fda84146dc5b SHA512SUM: cf68bee0a4f643f776b66d67702f a7408f2d7d52a5138cb1d8bbacc6f096b25c34661c21c393ca a04297cebf9c800caec0c0e6dfeddd6017 sg_engine_ _x86-64-small.iso SHA1SUM: edbdc087ced06ccb8852c7dc6f SHA512SUM: 675de ba7146bb994d43ec261f befaaa510a7c f18bdee c4f02b829 7c2e148c d1eccaf1e69c113dbd3d2b7b21 sg_engine_ _x86-64-small.zip SHA1SUM: 03d b72bd273b4c426e2a7e44616dfb SHA512SUM: 339c e76cf564c97ce793d1480c53528b16a857566b5b9ecf458d1a4b04c c6c1a69966e5 d405fe685118fba9aee3ff0fe22f54fc91d757eac 11

12 Compatibility Minimum McAfee NG version is compatible with the following component versions: McAfee Security Management Center or higher Dynamic Update 594 or higher Stonesoft IPsec VPN Client or higher Server Pool Monitoring Agent or higher Stonesoft User Agent or higher McAfee Logon Collector (MLC) 2.2 and 3.0 McAfee Advanced Threat Defense (ATD) 3.0 Known issues For a list of known issues in this product release, see this McAfee Knowledge Center article: KB Find product documentation McAfee provides the information you need during each phase of product implementation, from installation to daily use and troubleshooting. After a product is released, information about the product is entered into the online Knowledge Center. 1. Go to the McAfee ServicePortal at and click Knowledge Center. 2. Enter a product name, select a version, then click Search to display a list of documents. Copyright 2015 McAfee, Inc. Do not copy without permission. McAfee and the McAfee logo are trademarks or registered trademarks of McAfee, Inc. or its subsidiaries in the United States and other countries. Other names and brands may be claimed as the property of others. 00-A 12