McAfee Web Gateway

Transcription

1 Release Notes Revision B McAfee Web Gateway Contents About this release Enhancements Resolved issues Installation instructions Known issues About this release This document contains information about the current release. We strongly recommend that you read the entire document. McAfee Web Gateway (Web Gateway) is provided as a main release. It is a maintenance version that includes some enhancements and resolves issues present in previous versions. If you have implemented a bonding configuration, which was available as an unsupported feature before the release of Web Gateway 7.5.2, remove any settings of this configuration before upgrading to this new version. Otherwise you risk creating an unstable state on the appliance. After the upgrade, you can again implement network interface bonding as described in the System configuration chapter of the McAfee Web Gateway Product Guide. 1

2 Enhancements This release of the product includes the following enhancements. SMBv2 support SMBv2 is now used as transport layer in communication between Web Gateway and a domain controller. The risk of vulnerability towards malware that exploited particular bugs in SMBv1 is thus avoided. No administrator activities are required to implement the use of SMBv2 on Web Gateway. /opt partition enlargement The default size of the /opt partition on a Web Gateway appliance can be enlarged, which might prove useful when it comes to storing, for example, large temp files created during downloads. A new option of the volume scheme wizard allows you to enlarge the partition to a default size of up to 100 GiB. The wizard is started using the mwg -cache -wizard command. The enlargement can be configured on the appliances as follows: Model B appliances Model D appliances (except for 4500-D) G9 blades VMware and HyperV with disk sizes greater than 200 GiB Resolved issues The following issues were resolved in this release of the product. Bugzilla reference numbers are in parentheses. Network communication The sysconfd daemon did not handle socket layer errors properly, which led to an excessive increase in consuming CPU resources. ( ) When processing traffic under WCCP, data packets with sizes between 30 and 60 KB were dropped as too big and could not be resent later due to a stuck connection. ( ) Processing data under FTP was slow, as the connection to the data server was terminated with a delay of approximately one second when a transfer of data had been completed while other data was still pending and Web Gateway did not send a FIN message. ( ) When running as an ICAP client, Web Gateway ignored an attempt of the ICAP server to close the connection, failing to evaluate the relevant header in the server response, and continued with sending an OPTIONS request. The ICAP server responded with sending an RST packet, which led Web Gateway to recognizing the server erroneously as unavailable. ( ) Processing was slow and data packets were dropped on several Web Gateway proxies, as the bandwidth control module did not adjust the connect_max setting properly. ( ) 2

3 Web filtering When running in a configuration with Data Exchange Layer (DXL) and a Threat Intelligence Exchange (TIE) server, Web Gateway attempted to connect to DXL while already being connected, which caused the core process to fail with term signal 11 ( ) Media type filtering on Web Gateway failed to recognize tiff files correctly, classifying them as image/x-raw nikon instead of image/tiff. ( ) Vulnerabilities Several PERL-based tools that are available for use on Web Gateway were affected by the CVE vulnerability. The risk of an exploit was low, however, as actual use of these tools Web Gateway is rare. After a fix has been implemented, the tools are not affected anymore. ( ) A vulnerability existed on Web Gateway, as a Set-Cookie header in an HTTP response was truncated and inappropriately forwarded to the requesting client with the response. After a fix has been implemented, the vulnerability does not exist anymore. ( ) ( ) Web Gateway was affected by the CVE , CVE , CVE , and CVE vulnerabilities of the Linux kernel, which were related to using various USB devices. After a fix has been implemented, Web Gateway is not affected anymore.( ) Installation instructions The requirements for installing this new product version depend on the version that you are currently running. 7.3.x to 7.7.x You can upgrade to the new version immediately. See Perform an upgrade. 7.0.x to 7.2.x Complete the following steps to upgrade: 1 Create a configuration backup. Use the options provided under Troubleshooting Backup/Restore on the user interface to create the backup. 2 Upgrade to the new version. See Perform an upgrade. The upgrade process includes a major upgrade of the operating system. It takes several steps and more time than usual. If the upgrade process fails or is interrupted, you can re-image the appliance using an image of the new version and install the configuration backup. Alternatively, you can proceed as follows when upgrading from a 7.2.x or an earlier 7.x version: 1 Create a configuration backup. 2 Re-image the appliance using an image of the new version and install the configuration backup. 6.8.x or 6.9.x You must re-image the appliance using an image of the new version. Download an image of the new version from the download page of the McAfee Content & Cloud Security Portal at For more information about re-imaging, see the McAfee Web Gateway Installation Guide. 3

4 Perform an upgrade You can upgrade to the new version on the user interface or from a system console. Upgrade on the user interface You can work with the options of the user interface to perform the upgrade. Task 1 Select Configuration Appliances. 2 On the appliances tree, select the appliance you want to perform the upgrade on. The appliance toolbar appears on the upper right of the tab. 3 Click Update Appliance Software. The upgrade to the new version is performed. The upgrade process also logs you off from the user interface. 4 Proceed in one of the following ways to complete the installation. When upgrading from a 7.3.x or any later version: 1 Wait until a message informs you that the upgrade has completed and a logon button appears. 2 Log on to the user interface again. 3 Select Configuration Appliances, then select your appliance. 4 On the appliance toolbar, click Reboot. When the restart has completed, a logon button appears. You can now log on to the user interface again and start working with the new version. When upgrading from a 7.2.x or any earlier 7.x version: The appliance restarts automatically after each of the two upgrade phases that are performed. When the second restart has completed, a logon button appears. You can now log on to the user interface again and start working with the new version. Upgrade from a system console You can upgrade from a local system console or remotely using SSH. When upgrading remotely with SSH, consider using a terminal multiplexer to ensure that the update will not fail due to an instable or broken SSH connection. You can use either of the two multiplexers that Web Gateway has installed: tmux or screen. Task 1 Log on to the appliance you want to perform the upgrade on. 2 Run the following commands: yum upgrade yum yum upgrade The upgrade to the new version is performed. 4

5 3 Proceed in one of the following ways to complete the installation: When upgrading from a 7.3.x or any later version: Wait until a message informs you that the upgrade has completed, then run the following command: reboot When the restart has completed, a logon prompt appears. You can now log on to the user interface and start working with the new version. When upgrading from a 7.2.x or any earlier 7.x version: The appliance restarts automatically after each of the two upgrade phases that are performed. If you are using a local system console: When the second restart has completed, a logon prompt appears. You can now log on to the user interface and start working with the new version. If you are using SSH: When the appliance restarts after the first upgrade phase, you are disconnected and the second upgrade phase begins. After this phase has completed, including the automatic restart, you can log on to the user interface and start working with the new version. The following command lets you view messages about the upgrade progress: tail -F /opt/mwg/log/update/mlos2.upgrade.log When you see that the upgrade has completed, press Ctrl+C to stop the process. You can now log on to the user interface and start working with the new version. Known issues For known issues in this product release, see this Knowledge Center article: KB Copyright 2017 McAfee, LLC McAfee and the McAfee logo are trademarks or registered trademarks of McAfee, LLC or its subsidiaries in the US and other countries. Other marks and brands may be claimed as the property of others. 0B00