Network Security Platform 8.1

Transcription

1 Manager-NS-series Release Notes Network Security Platform 8.1 Revision D Contents About this release New features Enhancements Resolved issues Installation instructions Known issues Product documentation About this release This document contains important information about the current release. We strongly recommend that you read the entire document. Network Security Manager software version: Signature Set: NS-series Sensor software version: Network Security Platform version 8.1 replaces 8.0 release. If you are using version 8.0 and require any fixes, note that the fixes will be provided in version 8.1. There will not be any new maintenance releases or hot-fix releases on version 8.0. With release 8.1, Network Security Platform no longer supports the Network Access Control module and N-series Sensors. If you are using Network Access Control with N-series (NAC-only) Sensors, McAfee recommends that you continue to use the version. If you are using the Network Access Control module in M-series Sensors, continue to use the version. That is, you should not upgrade the Manager or the Sensors to 8.1 for such cases. Manager software version 7.5 and above are not supported on McAfee-built Dell based Manager Appliances. 1

2 This version of 8.1 Manager software can be used to configure and manage the following hardware: 7.1 and 8.1 NS9x00-series Sensors 8.1 NS7x00-series Sensors 8.1 Virtual IPS Sensors 7.1 and 8.1 M series and Mxx30-series Sensors 7.1 and 8.1 XC Cluster Appliances 7.1 and 8.1 NTBA Appliance software (Physical and Virtual) 7.1 I-series Sensors Currently port 4167 is used as the UDP source port number for the SNMP command channel communication between Manager and Sensors. This is to prevent opening up all UDP ports for inbound connectivity from SNMP ports on the sensor. Older JRE versions allowed the Manager to bind to the same source port 4167 for both IPv4 and IPv6 communication. But with the latest JRE version 1.7.0_45, it is no longer possible to do so, and the Manager uses port 4166 as the UDP source port to bind for IPv6. Manager 8.1 uses JRE version 1.7.0_51. If you have IPv6 Sensors behind a firewall, you need to update your firewall rules accordingly such that port 4166 is open for the SNMP command channel to function between those IPv6 Sensors and the Manager. New features This release of Network Security Platform supports the following interface modules. 4-port 10/1 Gig SM 8.5 micron with internal fail-open interface module 4-port 10/1 Gig MM 50 micron with internal fail-open interface module 4-port 10/1 Gig MM 62.5 micron with internal fail-open interface module Enhancements This release of Network Security Platform includes the following enhancements: Support for RSA 2048-bit keys (and fall-back RSA 1024-bit keys). Support for file transfers using SCP and TFTP. In this release, the Sensor is upgraded to: OpenSSL v1.0.1o. OpenSSH v6.4p1 which only supports: Ciphers: aes256-cbc, aes128-cbc. MACs: hmac-sha1, hmac-sha1-96, hmac-sha2-256, hmac-sha KexAlgorithms: diffie-hellman-group14-sha1. 2

3 3 rd party SNMPv3 users are required to migrate to AES128-SHA from DES-MD5 for SNMP user association. For the secondary Manager in the MDR, manual or automatic database tuning is enabled. For more information see McAfee Network Security Platform Manager Administration Guide. Resolved issues These issues are resolved in this release of the product. For a list of issues fixed in earlier releases, see the Release Notes for the specific release. Resolved Manager software issues The following table lists the medium-severity Manager software issues: ID # Configuration update fails with error SIGUPDT: ERROR in the signature file Alert signature is triggered even when Observed Value is much less than the Threshold Value configured in the Customized Host Threshold in an NTBA The proxy settings cannot be updated in the Manager and also for the devices at the global level in all browsers The Manager fails the security scan as the Tomcat version is vulnerable to CVE and CVE Upon restarting the Manager or during switch over in an MDR scenario, the alert channel connection faults are generated The Next Generation reports does not display any performance data for NTBA appliance Importing MCAFEE-SENSOR-CONF-MIB to some SNMP Managers generates an error Memory leak in the Manager results in an MDR failover Firewall rules created for a combination of any TCP service with a Deny response action fails An is generated for faults created and cleared for scheduled botnet and signature set download The Executive Summary Report in the Manager does not get generated for the report for last full calendar month beginning from the 1st of the month till the last date of the month The IPS Sensor Configuration report displays the output for jumbo frame parsing as Enabled even when the jumbo parsing feature is disabled in the IP Settings page The events ivsensorstringcontentevent and ivsensorinlayer2switchmodeevent, in the EMS-TRAP-MIB file displays the same description The Scheduled backup failed fault is not generated even when automated archival or backups fails in the Automated Archival page The layer 7 data is not captured for NETBIOS attacks even when NETBIOS-SS is enabled in layer 7 data capture settings Rules deleted from the Custom Attack Editor are not deleted in the rule set The Manager service is causing high CPU usage of 99% twice a week The details for High-Risk Endpoints are not displayed in the Threat Explorer upon navigating from the dashboard An error is generated when you attempt to run Next Generation report (Top 10 Attack Source Countries). 3

4 ID # / During a manual import of certain Snort rules, the Manager displays the ERROR during compiling error: Pattern is too large message does not support McAfee NAC integration; therefore, the Host type column for quarantined hosts must be removed Policy synchronization with a 7.5 Manager fails with Snort rules imported. The following table lists the low-severity Manager software issues: ID # The Analyze Packets option in Alert Details window is disabled for reconnaissance attacks. Resolved Sensor software issues The following table lists the high-severity Sensor software issues: ID # The Sensor sometimes reboots incorrectly because of incorrect low buffer available error In rare scenarios, all fiber ports on pluggable modules go down suddenly In a failover pair, changes made for inline fail-open or inline fail-close mode are applied even to the peer Sensor. The following table lists the medium-severity Sensor software issues: ID # Sensor goes to bad health due to exception in the malware processing engine Large number of small UDP packets, which triggers the UDP fast-forward threshold, causes the firewall rules to stop functioning During file extraction, an error response received from malware processing engine on management processor was not handled correctly by datapath processor. This results in datapath processor experiencing an exception due to which the Sensor autorecovers Sensor packet capture feature truncates captured packets to 980 bytes The alert SENSOR: Host Entries for Connection Limiting Feature Exhausted is continuously displayed in the Threat Analyzer when Protection for Web Servers is enabled When operating in standalone mode, the Sensor sometimes drops LACP (Link Aggregation Control Protocol) traffic The Sensor can occasionally go to layer 2 due to link flap observed on datapath cross connect port When L7 data collection is disabled, sometimes the maximum percentage of L7 Dcap flows shows incorrect usage statistics in the Sensor CLI show mem-usage During certain situations, the Sensor might reboot because it falsely detects a hung process The SNMP query for temperature and fan OID at times returns an incorrect status When OS Fingerprinting and Layer 7 Data Collection are enabled, the Sensor might auto-recover or reboot depending on the configuration At times the ports might remain down after the Sensor upgrade The Sensor sometimes reports incorrect status for the fan or the power supply / The built in fail-open ports on the Sensors do not pass traffic during reboot or power cycle. 4

5 ID # MTU changes on management port are not persisted across reboot Sensor may reboot during auto-recovery because of delay in crypto processor initialization causing data path processes to fail initialization The built-in RJ45 ports leak traffic from span ports after auto-recovery The Sensor sometimes reboots as the monitoring mechanism does not synchronize with the Sensor hardware watchdog within the configured timeout The Sensor forwards some inline packets ahead of others, causing certain applications to send TCP RST responses for packets that arrive out of order The Sensor at times fails to block the Utorrent/BitTorrent application Unable to add IP address ending with.127 to the quarantine list [NS9300] The PSU failure message does not indicate the failed Sensor (Primary or Secondary) The Sensor triggers alerts for IP addresses configured in the firewall policies to be ignored False positive alerts are raised from the Sensor while signature is pushed to the Sensor Alert exception rules does not work for callback detector alerts when server-originated alerts are detected in the client packet The show powersupply command displays incorrect power supply status When SSL is enabled the Sensor may reboot or auto recover occasionally [NS9300] QSFP modules connected with 40G ports on the Sensor does not loop back traffic in layer 2 mode, and instead causes traffic issues when the Sensor is in layer 2 mode [NS9300] Traffic disruptions might be seen on the Sensors that are configured in high availability mode When Sensor resources are exhausted, GTI queries made by the Sensor can fail The Sensor introduces network latency in certain scenarios when the TCP flow violation is set to stateless inspection Invalid memory access in the protocol parsing engine could sometimes result in a Sensor reboot The Sensor is vulnerable to [CVE ] FREAK Vulnerability Sensor packet capture feature truncates captured packets to 980 bytes During simultaneous logging of various log files, the Sensor may reboot The show eventlog command displays incomplete error message for fan removal The EIGRP update packets with large route information that are part of fragments are dropped by the Sensor Several errors for GTI File Reputation query failures are displayed in the Sensor output and attack ID is not supported for syslog forwarding The Sensor is vulnerable to [CVE ] Ghost Vulnerability which is a heap-based buffer overflow that allows execution of arbitrary codes Sensor-load value is incorrectly displayed as 0% in the Sensor incorrectly when there is very low traffic load Internal SNMP communication error causes an exception resulting in Sensor auto-recovery Unable to log into the Sensor using TACACS credentials due to unintentional removal of access to certain files The Sensor raises false fan errors events. 5

6 ID # If a Sensor reboots, the Sensor Power Up fault is not seen The Sensor could reboot when the watchdog gets triggered due to certain critical CPU processes not being able to execute When Port Throughput Utilization in Performance Monitoring is enabled, disabling monitoring ports from the Manager is not possible When a pluggable network interface module is added to a Sensor, the ports are not displayed on the Manager under Devices <Admin Domain Name> Devices <Device Name> Setup Physical Ports Monitoring Ports Traffic is forwarded to SPAN ports after hitless reboot/auto-recovery The Sensor reboots randomly due to enabling of unsupported NAC feature The Sensor is not able to send the event logs to the syslog server on a custom UDP port. By default, it sends the logs on port Inactive user account gets locked unexpectedly The show gti stats file CLI command is deprecated. Information previously shown in the output of this command is now available in show GTI IP reputation statistics The Sensor may reboot after a long run due to exhaustion of system resources The Sensor detects HTTP: Web application server attack detected as a false positive alert. This issue is addressed in the signature set versions later than The Advanced Threat Defense dashboard sometimes displays hash value instead of the file name In an ACL summary alert, country name is missing for the source and destination IP addresses In rare occasions, the Sensor goes into a lockout condition which results in a hung state or reboot An internal hardware event log buffer is not getting cleared in some scenarios Due to incorrect XFF parsing, the non-true client gets quarantined SSL Decryption fails with Internet Explorer 11 on Windows 8 and with TLS enabled The Sensor can sometimes go to layer 2 or reboot when new configuration updates are deployed to the Sensor The Sensor at times generates incorrect fan faults The Sensor connectivity status with GTI server fault is not automatically cleared in the System Faults page Under heavy load, the Sensor can stop transmitting traffic After rebooting a Sensor, the interconnecting port comes up as 1 Gigabit instead of 40 Gigabit File save option does not work when IPv6 is used for Sensor-Manager connectivity Malware blacklist/whitelist feature does not work after hitless reboot due to a race condition When SSL is enabled, CPU utilization is incorrectly reported as High. When L7 data capture is enabled, some delay is seen in the alert response from the Manager. 6

7 Installation instructions Manager server/client system requirements The following table lists the 8.1 Manager server requirements: Operating system Minimum required Any of the following: Windows Server 2008 R2 Standard or Enterprise Edition, English operating system, SP1 (64-bit) (Full Installation) Windows Server 2008 R2 Standard or Enterprise Edition, Japanese operating system, SP1 (64-bit) (Full Installation) Windows Server 2012 Standard Edition (Server with a GUI) English operating system Windows Server 2012 Standard Edition (Server with a GUI) Japanese operating system Windows Server 2012 R2 Standard Edition (Server with a GUI) English operating system Windows Server 2012 R2 Standard Edition (Server with a GUI) Japanese operating system Windows Server 2012 R2 Datacenter Edition (Server with a GUI) English operating system Windows Server 2012 R2 Datacenter Edition (Server with a GUI) Japanese operating system Only x64 architecture is supported. Recommended Same as the minimum required. Memory 8 GB 8 GB or more CPU Server model processor such as Intel Xeon Same Disk space 100 GB 300 GB or more Network 100 Mbps card 1000 Mbps card Monitor 32-bit color, 1440 x 900 display setting 1440 x 900 (or above) The following are the system requirements for hosting Central Manager/Manager server on a VMware platform. 7

8 Table 5-1 Virtual machine requirements Component Minimum Recommended Operating system Any of the following: Windows Server 2008 R2 Standard or Enterprise Edition, English operating system, SP1 (64-bit) (Full Installation) Windows Server 2008 R2 Standard or Enterprise Edition, Japanese operating system, SP1 (64-bit) (Full Installation) Windows Server 2012 Standard Edition (Server with a GUI) English operating system Windows Server 2012 Standard Edition (Server with a GUI) Japanese operating system Windows Server 2012 R2 Standard Edition (Server with a GUI) English operating system Windows Server 2012 R2 Standard Edition (Server with a GUI) Japanese operating system Windows Server 2012 R2 Datacenter Edition (Server with a GUI) English operating system Windows Server 2012 R2 Datacenter (Server with a GUI) Japanese operating system Only X64 architecture is supported. Same as minimum required. Memory 8 GB 8 GB or more Virtual CPUs 2 2 or more Disk Space 100 GB 300 GB or more Table 5-2 VMware ESX server requirements Component Minimum Virtualization software ESXi 5.0 ESXi 5.1 ESXi 5.5 CPU Memory Internal Disks Intel Xeon CPU ES 2.00 GHz; Physical Processors 2; Logical Processors 8; Processor Speed 2.00 GHz Physical Memory: 16 GB 1 TB The following table lists the 8.1 Manager client requirements when using Windows 7 or Windows 8: Operating system Minimum Windows 7 English or Japanese Windows 8 English or Japanese Windows 8.1 English or Japanese The display language of the Manager client must be same as that of the Manager server operating system. Recommended RAM 2 GB 4 GB 8

9 Minimum Recommended CPU 1.5 GHz processor 1.5 GHz or faster Browser Internet Explorer 9, 10 or 11 Mozilla Firefox Google Chrome in not supported since the NPAPI plug-in is disabled by default and will not be supported by Google going forward. This means that Java applet support is also disabled by default. Internet Explorer 11 Mozilla Firefox 20.0 or above For the Manager client, in addition to Windows 7 and Windows 8, you can also use the operating systems mentioned for the Manager server. The following table lists the 8.1 Central Manager / Manager client requirements when using Mac: Mac operating system Lion Mountain Lion Browser Safari 6 or 7 For more information, see McAfee Network Security Platform Installation Guide. Upgrade recommendations McAfee regularly releases updated versions of the signature set. Note that automatic signature set upgrade does not happen. You need to manually import the latest signature set and apply it to your Sensors. The following is the upgrade matrix supported for this release: Component Minimum Software Version Manager/Central Manager software , , , , , , , , NS-series Sensor software NS , , , , NS9200, NS , , , , , NS7300, NS7200, NS , , Known issues For a list of known issues in this product release, see this McAfee KnowledgeBase article: Manager software issues: KB81373 NS-series Sensor software issues: KB

10 Product documentation Every McAfee product has a comprehensive set of documentation. Find product documentation 1 Go to the McAfee ServicePortal at and click Knowledge Center. 2 Enter a product name, select a version, then click Search to display a list of documents. 8.1 product documentation list The following software guides are available for Network Security Platform 8.1 release: Quick Tour Installation Guide Upgrade Guide Manager Administration Guide Manager API Reference Guide (selective distribution - to be requested via support) CLI Guide IPS Administration Guide Custom Attacks Definition Guide XC Cluster Administration Guide Integration Guide NTBA Administration Guide Best Practices Guide Troubleshooting Guide 2016 Intel Corporation Intel and the Intel logo are trademarks/registered trademarks of Intel Corporation. McAfee and the McAfee logo are trademarks/ registered trademarks of McAfee, Inc. Other names and brands may be claimed as the property of others. 0C-00