Network Security Platform 8.1

Transcription

1 NS9x00-series Release Notes Network Security Platform 8.1 Revision A Contents About this release New features Enhancements Resolved issues Installation instructions Known issues Product documentation About this release This document contains important information about the current release. We strongly recommend that you read the entire document. This maintenance release of Network Security Platform is to provide minor enhancements and few fixes on the Sensor and Manager software. Network Security Manager software version: Signature Set: NS9x00-series Sensor software version: Network Security Platform version 8.1 replaces 8.0 release. If you are using version 8.0 and require any fixes, note that the fixes will be provided in version 8.1. There will not be any new maintenance releases or hot-fix releases on version , 7.5, and 8.1 M series and Mxx30-series Sensors 8.1 Virtual IPS Sensors 7.1, and 8.1 NS-series Sensors 1

2 7.1, 7.5, and 8.1 XC Cluster Appliances 7.1, 7.5, and 8.1 NTBA Appliance software (Physical and Virtual) 7.1 I-series Sensors Currently port 4167 is used as the UDP source port number for the SNMP command channel communication between Manager and Sensors. This is to prevent opening up all UDP ports for inbound connectivity from SNMP ports on the sensor. Older JRE versions allowed the Manager to bind to the same source port 4167 for both IPv4 and IPv6 communication. But with the latest JRE version 1.7.0_45, it is no longer possible to do so, and the Manager uses port 4166 as the UDP source port to bind for IPv6. Manager 8.1 uses JRE version 1.7.0_51. If you have IPv6 Sensors behind a firewall, you need to update your firewall rules accordingly such that port 4166 is open for the SNMP command channel to function between those IPv6 Sensors and the Manager. With release 8.1, Network Security Platform no longer supports the Network Access Control module and N-series Sensors. If you are using Network Access Control with N-series (NAC-only) Sensors, McAfee recommends that you continue to use the version. If you are using the Network Access Control module in M-series Sensors, continue to use the version. That is, you should not upgrade the Manager or the Sensors to 8.1 for such cases. Manager software version 7.5 and above are not supported on McAfee-built Dell based Manager Appliances. New features This release is to provide few bug fixes for some of the previously known Sensor software issues, and does not include any new feature. Enhancements This release of Network Security Platform includes the following enhancements: IPS CLI command enhancement The show command previously displayed the primary and secondary serial numbers but did not display information for the master serial number of the Sensor in case of NS9300. With this release, the master serial number is displayed as the "System Serial number". The system serial number is mainly used for support purpose will reporting any issue to the support engineers. For further information, refer the Network Security Platform CLI Guide. Resolved issues These issues are resolved in this release of the product. For a list of issues fixed in earlier releases, see the Release Notes for the specific release. Resolved Manager software issues The following table lists the medium-severity Manager software issues: 2

3 ID # SR# Issue Description , Java takes 20% more RAM every day and CPU load is 100% NA On the Active Botnets page, the DNS, operating system, and user information is missing Shutting down the Sensor from the Manager, logs out the user from the Manager When Vulnerability Manager is configured with the Network Security Manager, error "Asset information not available for the given host" is displayed in the Manager upon selecting Destination Host Details The NSCM alert set is not applying to the regional peer manager The Destination Country filter does not display any alert results in the Threat Analyzer If VirusScan Enterprise is installed and uninstalled on system, the TIE VirusScan Enterprise hotfix does not upgrade The DATGTICommunicationFailure:ConnectionFailure error due to connection failure is not included in the faults report The Manager logs out when a user is assigned a specific user role The Firewall rule, FW- International Offices does not load in the Manager The Select or Deslect All checkbox does not function in the Now page in Automatically Generated Reports. When viewing pre-generated reports in Google Chrome, upon clicking the back icon the browser displays an error Host Intrusion Prevention attack IDs are not resolved to names after installing hot fix The Dashboard does not display high-risk endpoints, malware detection and botnet detectors data even though there are alerts raised in the Threat Analyzer Duplicate entries for Hourly/Daily Data Mining are generated for Automated Pruning The Modification Time" is not included in the faults report for an alert generated as the fault flag is not deleted in the fault log The configuration update status displays as In Progress under long running process even after the signature sets are successfully downloaded The Name field in Advanced Malware Policy cannot be deleted upon reaching the limit When generating a new Next Generation Report, the report shows the attack count for signature attacks instead of alert count The Next Generation Report displays only 10 attack results even when are there more than 10 attack results in the Threat Analyzer The error "srleap:dev Prof Alert Queue" is displayed as the device profiling queue flags have reached the limit notifications are sent even after disabling the Enable Forwarding option in the Manager The Manager includes unexpected characters like "MNAC Forwarder Alert" to syslog messages The Physical Ports page does not display ports for a configured NTBA Appliance The syslog settings are not synchronized between the MDR pair after switchover to the secondary. 3

4 ID # SR# Issue Description The Alert Channel Down fault takes 12 hours to be cleared after the channel comes online The file name cannot be added for an NTBA communication rule The primary Manager switches to standby mode due to overloading of the heapdump The IPS Event Logging feature cannot be configured for older M-series Sensor softwares before The Next Generation reports filter accepts only abbreviation for source and destination countries The View Connectivity Data is not displayed correctly when extracted from NTBA response logs The time zone formats on the Manager and the report generated from the Threat Analyzer are different The Running Tasks report displays the Sensor configuration update as failed even though the configuration update was completed successfully The options for Additional Constraints are empty in the Historical Threat Analyzer The user cannot perform certain actions in the Manager even after a custom role is assigned During scheduled backup, the temporary tables are also included in the process The secondary Manager displays the "Incompatible custom attack" fault when synchronization is initiated with the primary Manager due to SSID.bin file corruption While viewing the configuration update table, the Last Updated column does not sort correctly The user once logged out of the Manager cannot login back without restarting the Manager service , , The Top Attacks in the Threat Explorer displays a numeral instead of the attack name Bulk signature set update for 20 or 30 Sensors fails The Botnet DAT update fails on multiple Sensors In rare scenarios, after Sensor reboot the SSL certificates are not enabled on the Sensor due to concurrent SNMP error The Manager versions / are vulnerable to "HTTP Server Prone To Slow Denial Of Service Attack" when configured with Vulnerability Manager NA The Protection Profile page stops responding when opened in Chrome browser and eventually leads to Java crashing NA The Manager fault for exceeding the 10,000 AD user groups limit is displayed incorrectly in the Manager NA The Chrome browser crashes when the Manager is opened in Windows 8.0 mode The Sensor performance report provides incorrect data and labels , The synchronization between the Central Manager and MDR pair is generating the fault Manager mssmcf03: unreachable. 4

5 Resolved Sensor software issues The following table lists the medium-severity Sensor software issues: ID # SR# Issue Description In rare scenarios, the Sensor goes into a lockout condition which results in a hung state or reboot The User Defined Report in Traditional Report shows McAfee NAC for Alert/Attack Type The source IPs are reversed in ARP spoofing alerts , , The GTI alert Connection from high risk internal IP is incorrectly triggered even when it is not present in the signature set The CPU utilization graph and show sensor-load values do not match , SSL Decryption fails with Internet Explorer 11 on Windows 8 and with TLS enabled In some scenarios, the Sensor reboots which causes some loss of data due sudden reboot In rare scenarios, the Sensor either goes to layer2 or reboots when new configuration updates are deployed to the Sensor In rare scenario, the Sensor may raise incorrect fan faults In rare scenarios, the Sensor may reboot or autorecover when multiple malware files are processed in the same flow Under certain error conditions in HTML decoder (under Advanced Traffic Inspection), the control packet buffers are not released The exception objects are not taking effect for some reconnaissance attacks. As a result the alerts are still displayed in the Threat Analyzer The fault Sensor connectivity status with GTI server is not automatically cleared in the System Faults page The deployment of Botnet update to the Sensor fails, due to which the Internal configuration error critical fault is generated When the Sensor experiences abnormal reboot, or in a failover configuration if one of the Sensor reboots, then the front end processor gets stuck in rare scenarios When the Sensor configuration update fails, the Sensor is in uninitialized state. The Sensor then rejects the configuration update as the maximum number of supported CIDR interface is incorrectly calculated by the Sensor software for inline port The SNMP Get/Walk executed on the Sensor returns the SCP file server credentials In high availability setup, the show layer2 forward intfport CLI command shows incorrect port for the failover pair When the shutdown CLI command is issued, the Sensor does not shutdown but reboots when there is no signature set initialized The Firewall policy does not block some HTTPS applications The Sensor switches to layer 2 mode in certain scenarios during signature set/configuration update [NS9300] In a high availability pair, once the pair is created, the multicast data and protocol traffic is dropped. 5

6 ID # SR# Issue Description After updating to the signature set version , false postive alerts are generated with the attack name ICMP: Nachi-like Ping 0x In a rare case scenario, there is traffic delay shortly after a signature or configuration update to the Sensor NA Filename is missing in Malware Details section of alert details for Global Threat Intelligence and Advanced Threat Defense When quarantine is enabled in the connection limiting policy, the first quarantined host is not released after the specified release time ARP packets (matching the MAC flip flop event) are dropped which leads to network outage in rare scenarios. This happens when MAC flip flop attack is disabled and Heuristic Web Application Server Protection (WASP) is enabled on any interface of the Sensor After a Sensor name change, the $IV_SENSOR_NAME$ flag is not updated until Sensor reboot The Reconnaissance alerts are not filtered correctly when the alert filter contains rules as Any internal IP or Any external IP NA File save option does not work when IPv6 is used for Sensor-Manager connectivity NA Malware blacklist/whitelist feature does not work after hitless reboot due to a race condition In rare scenarios, when SSL is enabled, CPU utilization is incorrectly reported as High In rare scenario, the Sensor reboots due to memory corruption in the malware detection process NA When the PDF emulator engine is configured for malware detection, the Sensor reboots in certain scenarios Layer 7 data are missing for alerts generated by Advanced Threat Defense The Sensor throughput value is displayed as 9GB for 1GB ports in the Manager In rare scenarios, routers running EIGRP experience neighbor adjacency flap while the Sensor processes the EIGRP update packets NA In rare scenarios, when there is heavy traffic load, the UDLD packets are dropped by front end processor The L3/L4 error count in SPAN port cannot be viewed even after it crosses the threshold limit The Sensor causes RST packets to be sent out of order In extremely rare scenario, the traffic is not forwarded because of internal switch buffer exhaustion In rare scenario with SSL and malware functionality enabled, the SSL attacks are not detected NA In a Failover pair, the changes made for inline failopen or inline failclose mode is applied even to the peer Sensor , , In a failover pair after upgrade, the Active Fail-Open kit status switches between Inline and Bypass NA With high amount of SSL traffic being decrypted, the Sensor throughput could temporarily drop during the signature file update process. 6

7 The following table lists the low-severity Sensor software issues: ID # SR# Issue Description The Sensor management port is affected by shellshock vulnerability. Installation instructions Manager server/client system requirements The following table lists the 8.1 Manager server requirements: Operating system Minimum required Any of the following: Windows Server 2008 R2 Standard or Enterprise Edition, SP1 (Full Installation), English operating system Windows Server 2008 R2 Standard or Enterprise Edition, SP1 (Full Installation), Japanese operating system Windows Server 2012 Standard Edition (Server with a GUI) English operating system Windows Server 2012 Standard Edition (Server with a GUI) Japanese operating system Windows Server 2012 R2 Standard Edition (Server with a GUI) English operating system Windows Server 2012 R2 Standard Edition (Server with a GUI) Japanese operating system Windows Server 2012 R2 Datacenter Edition (Server with a GUI) English operating system Windows Server 2012 R2 Datacenter Edition (Server with a GUI) Japanese operating system Only X64 architecture is supported. Recommended Same as the minimum required. Memory 8 GB 8 GB or more CPU Server model processor such as Intel Xeon Same Disk space 100 GB 300 GB or more Network 100 Mbps card 1000 Mbps card Monitor 32-bit color, 1440 x 900 display setting 1440 x 900 (or above) The following are the system requirements for hosting Central Manager/Manager server on a VMware platform. 7

8 Table 5-1 Virtual machine requirements Component Minimum Recommended Operating system Any of the following: Windows Server 2008 R2 Standard or Enterprise Edition with SP1 English operating system Windows Server 2008 R2 Standard or Enterprise Edition with SP1 Japanese operating system Windows Server 2012 Standard Edition (Server with a GUI) English operating system Windows Server 2012 Standard Edition (Server with a GUI) Japanese operating system Windows Server 2012 R2 Standard Edition (Server with a GUI) English operating system Windows Server 2012 R2 Standard Edition (Server with a GUI) Japanese operating system Windows Server 2012 R2 Datacenter Edition (Server with a GUI) English operating system Windows Server 2012 R2 Datacenter (Server with a GUI) Japanese operating system Only X64 architecture is supported. Same as minimum required. Memory 8 GB 8 GB or more Virtual CPUs 2 2 or more Disk Space 100 GB 300 GB or more Table 5-2 VMware ESX server requirements Component Minimum Virtualization software ESXi 5.0 ESXi 5.1 ESXi 5.5 CPU Memory Internal Disks Intel Xeon CPU ES 2.00 GHz; Physical Processors 2; Logical Processors 8; Processor Speed 2.00 GHz Physical Memory: 16 GB 1 TB The following table lists the 8.1 Manager client requirements when using Windows 7 or Windows 8: Operating system Minimum Windows 7 English or Japanese Windows 8 English or Japanese Windows 8.1 English or Japanese The display language of the Manager client must be same as that of the Manager server operating system. Recommended RAM 2 GB 4 GB 8

9 Minimum Recommended CPU 1.5 GHz processor 1.5 GHz or faster Browser Internet Explorer 9, 10 or 11 Mozilla Firefox Google Chrome (App mode in Windows 8 is not supported) If you are using Google Chrome, add the Manager certificate to the trusted certificate list. Internet Explorer 11 Mozilla Firefox 20.0 or above Google Chrome 24.0 or above For the Manager client, in addition to Windows 7 and Windows 8, you can also use the operating systems mentioned for the Manager server. The following table lists the 8.1 Central Manager / Manager client requirements when using Mac: Mac operating system Lion Mountain Lion Browser Safari 6 or 7 For more information, see McAfee Network Security Platform Installation Guide. Upgrade recommendations McAfee regularly releases updated versions of the signature set. Note that automatic signature set upgrade does not happen. You need to manually import the latest signature set and apply it to your Sensors. The following is the upgrade matrix supported for this release: Component Minimum Software Version Manager/Central Manager software , , , , , , , , , , NS-series Sensor software NS9100, NS , , , , NS , , , Known issues For a list of known issues in this product release, see this McAfee KnowledgeBase article: Manager software issues: KB81373 NS-series Sensor software issues: KB

10 Product documentation Every McAfee product has a comprehensive set of documentation. Find product documentation 1 Go to the McAfee ServicePortal at and click Knowledge Center. 2 Enter a product name, select a version, then click Search to display a list of documents. 8.1 product documentation list The following software guides are available for Network Security Platform 8.1 release: Quick Tour Installation Guide Upgrade Guide Manager Administration Guide Manager API Reference Guide (selective distribution - to be requested via support) CLI Guide IPS Administration Guide Custom Attacks Definition Guide XC Cluster Administration Guide Integration Guide NTBA Administration Guide Best Practices Guide Troubleshooting Guide Copyright 2015 McAfee, Inc. Intel and the Intel logo are trademarks/registered trademarks of Intel Corporation. McAfee and the McAfee logo are trademarks/ registered trademarks of McAfee, Inc. Other names and brands may be claimed as the property of others. 0A-00