This release of the product includes these new features that have been added since NGFW 5.5.

Transcription

1 Release Notes Revision A McAfee Next Generation Firewall Contents About this release New features Enhancements Known limitations Resolved issues System requirements Installation instructions Upgrade instructions Additional information Build version Compatibility Known issues Find product documentation About this release This document contains important information about the current release. We strongly recommend that you read the entire document. The Security Engine product name has changed in this release. The Security Engine is now known as the McAfee Next Generation Firewall or NGFW. NGFW engines are still represented by Security Engine elements in the Management Client. New features This release of the product includes these new features that have been added since NGFW 5.5. New features introduced in NGFW 5.7 Botnet detection McAfee NGFW now supports botnet detection using the following new Command and Control (C&C) communication detection methods: - Decryption-based detection: Detect known characteristics of the botnet C&C, port number, carrier, encryption protocol, and key material. - Message length sequence analysis detection: Extract message length for sequence analysis for botnet C&C detection. 1

2 New features introduced in NGFW 5.6 Virtual Security Engines in IPS and Layer 2 Firewall roles McAfee NGFW now supports Virtual Security Engines in the Virtual IPS and Layer 2 Firewall roles. Support for the Virtual role was added in version 5.5. Virtual Security Engines are logically separate engines that run as virtual engine instances on a physical engine device. You can now use a physical NGFW device as a Master Engine to provide resources for Virtual Security Engines. This means that the same Master Engine can simultaneously have different security policies, separate routing tables, and overlapping IP addresses for different interfaces (reserved by different Virtual Security Engines). You can configure up to 250 Virtual Firewalls, Virtual IPS engines, or Virtual Layer 2 Firewalls per Master Engine. The Master Engine can be clustered. The Virtual Security Engines are load-balanced between the Master Engine nodes. One Master Engine handles all the traffic of one Virtual Security Engine at any given time. All Virtual Security Engines hosted by one Master Engine or Master Engine cluster must be in the same role. Virtual Security Engines do not require individual licenses. Instead, the license for the Master Engine defines how many Virtual Resources can be created. The number of Virtual Resources limits the number of Virtual Security Engines. In this major version, Virtual Security Engines can be used in the, IPS, and Layer 2 Firewall roles with some limitations in normal engine features. Virtualization works across several administrative Domains. For example, the Master Engine can be in the Shared Domain and the Virtual Security Engines can be in one or several other Domains. Enhancements This release of the product includes these enhancements added since NGFW 5.5. Enhancements introduced in NGFW 5.7 Application detection coverage has been improved The McAfee AppPrism Application signature library is now used for application detection with McAfee NGFW. Anti-virus engine changed The anti-virus engine used in McAfee NGFW engines is now based on the McAfee Anti-Virus Scanning Engine. Out of window TCP resets dropped in Normal Connection Tracking Mode without inspection Protection against spoofed TCP reset packets has been improved in Normal Connection Tracking Mode. In the new TCP reset protection feature, RFC 5961 blind reset attack protection is implemented in the engine on behalf of the connection endpoints. The feature is configured through the TCP Reset Sensitivity setting in the DoS Protection Settings in the engine properties. Rule tag logging Connection closed log entries now also contain the rule tag associated with the connection. Related connection log entries now also contain the rule tag of the parent connection. TLS 1.2 support in TLS inspection TLS protocol version 1.2 is now supported in TLS inspection for client protection and server protection. Decompression in inspection By default, the engine now also decompresses.zip archives that have been compressed using the Deflate method when inspecting traffic.

3 Enhancements introduced in NGFW 5.6 Scan detection You can configure Security Engines and Master Engines to detect if network ports are scanned. When you enable Scan Detection on a Firewall, IPS engine, Layer 2 Firewall, Master Engine, or Virtual Security Engine, a log is generated if scan probes are detected. Security Engines and Master Engines support IPv4 and IPv6 protocols and detect TCP, UDP, and ICMP scan types. Scan detection has been redesigned in version 5.6. Scan detection performance has been optimized for multi-core platforms and the feature activation has been simplified. You can now define a general Scan Detection setting in the engine properties. You can override the general Scan Detection settings in Access rules. SYN flood protection You can configure Security Engines to detect SYN flood attacks. When you enable SYN flood protection on a Firewall, IPS engine, Layer 2 Firewall, or Virtual Security Engine, a log is generated if a SYN flood is detected. The engine uses the SYN cookie method to prevent SYN packets sent from spoofed IP addresses from reaching the target host. When a SYN flood attack ends, a new log event is generated. The SYN flood protection feature has been redesigned in version 5.6. The performance of SYN flood protection has been optimized for multi-core platforms and the feature activation has been simplified. You can define SYN flood protection settings as part of general DoS Protection settings in the engine properties. You can override the general DoS Protection settings in Access rules. Protection against slow HTTP requests You can configure the Security Engines to detect very slow HTTP GET or POST requests that may indicate an attack against web applications and may cause a DoS situation. The engine uses a faster timeout for HTTP connections if the HTTP GET and POST requests are very slow. You can define protection against slow HTTP requests as part of general DoS Protection settings in the engine properties. You can override the general DoS Protection settings in Access rules. VLAN Interface support for IPS engines and Layer 2 Firewalls You can now use VLAN Interfaces and re-tag network traffic on IPS engines and Layer 2 Firewalls. The settings are configured in the engine properties. Ethernet MTU can be defined for IPS engine and Layer 2 Firewall interfaces The Ethernet Maximum Transmission Unit (MTU) can now be defined for IPS engine and Layer 2 Firewall interfaces in the engine properties. Improved connection tracking configuration for IPS engines and Layer 2 Firewalls You can now choose between three connection tracking modes (Strict, Normal, and Loose) in the engine properties. You can override the engine-specific setting in Access rules. Interface link aggregation improved for Firewalls Interface link aggregation performance has been improved in this major version. 3

4 Known limitations High-Security Inspection Policy and Strict TCP mode are not supported in asymmetrically routed networks in IPS and Layer 2 Firewall roles The High-Security Inspection Policy and Strict TCP mode are not supported in asymmetrically routed networks or in environments where an NGFW in the IPS or Layer 2 Firewall role is directly connected to a load-balancing or High Availability network device. It is recommended to base policies on the Medium-Security Inspection Policy in such cases. In Strict TCP mode and in the High-Security Inspection Policy, the engine controls the progress of a TCP connection and checks that the TCP handshake proceeds according to the TCP protocol. The same engine node must be able to see all the packets in the connection. In Strict TCP mode, the engine also enforces the packet direction (for example, SYN and SYN-ACK packets are not allowed from the same interface). The TLS inspection and URL filtering features use Strict TCP mode and are not supported in asymmetrically routed networks in the IPS and Layer 2 Firewall roles. SSL/TLS inspection and web filtering are not supported in capture (IDS) mode The TLS inspection and URL filtering features are not supported in capture (IDS) mode. Inline Interface Disconnect Mode in IPS role The Inline Interface Disconnect Mode is not supported on IPS Virtual Appliances, IPS software installations, appliance models other than IPS-6xxx, or modular appliance models on bypass NIC modules. Resolved issues These issues have been resolved since version NGFW For a list of issues that have been fixed in earlier releases, see the Release Notes for the specific release. Issue Role Description OpenSSL library update June and July 2015 (#115961) FW L2FW IPS The OpenSSL library has been updated to version 1.0.1p to address the issues listed in CVE and CVE The engine uses vulnerable OpenSSL routines only for its TLS management communications. The ability to abuse these vulnerabilities is limited as access to vulnerable interfaces is limited by IP address-based access controls.

5 System requirements McAfee NGFW appliances Appliance model Supported roles FW-315 MIL-320 FWL321 NGF321, IPS, and Layer 2 Firewall FWL325 NGF325, IPS, and Layer 2 Firewall FW-1030 FW-1060 FW-5000 IPS-1030 IPS and Layer 2 Firewall IPS-1060 IPS and Layer 2 Firewall IPS-1205 IPS and Layer 2 Firewall 1035, IPS, and Layer 2 Firewall 1065, IPS, and Layer 2 Firewall 1301, IPS, and Layer 2 Firewall 1302, IPS, and Layer 2 Firewall 1402, IPS, and Layer 2 Firewall 3201, IPS, and Layer 2 Firewall 3202, IPS, and Layer 2 Firewall 3205, IPS, and Layer 2 Firewall 3206, IPS, and Layer 2 Firewall 5201, IPS, and Layer 2 Firewall 5205, IPS, and Layer 2 Firewall 5206, IPS, and Layer 2 Firewall Some features in this release are not available for all appliance models. See and for up-to-date appliance-specific software compatibility information. McAfee appliances support only the software architecture version (32-bit or 64-bit) that they are shipped with. Certified Intel platforms McAfee has certified specific Intel-based platforms for the Next Generation Firewall. Tested platforms can be found in the McAfee Support Knowledge Center ( under the Next Generation Firewall product. We strongly recommend using certified hardware or a pre-installed McAfee appliance as the hardware solution for new McAfee NGFW installations. If it is not possible to use a certified platform, the NGFW can also run on standard Intel-based hardware that fulfills the hardware requirements. 5

6 Basic NGFW hardware requirements Intel Core 2 / Intel Xeon based hardware IDE hard disk (IDE RAID controllers are not supported) and CD-ROM drive Memory: 2 GB RAM minimum for 32-bit (i386) installation 8 GB RAM minimum for 64-bit (x86-64) installation VGA-compatible display and keyboard One or more certified network interfaces for the role 2 or more certified network interfaces for IPS with IDS configuration 3 or more certified network interfaces for Inline IPS or Layer 2 Firewall For more information on certified network interfaces, see Requirements for Master Engines Each Master Engine must run on a separate physical NGFW device. For more details, please read the hardware requirements document at All the Virtual Security Engines hosted by a Master Engine or Master Engine cluster must have the same role and the same Failure Mode ( fail-open or fail-close ). Master Engines can allocate VLANs or interfaces to Virtual Security Engines. If the Failure Mode of the Virtual IPS engines or Virtual Layer 2 Firewalls is Normal (fail-close) and you want to allocate VLANs to several engines, you must use the Master Engine cluster in standby mode. Cabling requirements for Master Engine clusters that host Virtual IPS engines or Layer 2 Firewalls: Failure Mode Bypass (fail-open) requires IPS serial cluster cabling. Failure Mode Normal (fail-close) requires Layer 2 Firewall cluster cabling. For more information on cabling, see the McAfee NGFW Reference Guide for IPS and Layer 2 Firewall Roles. Requirements for Virtual Appliance Nodes VMware ESXi versions 5.1 and GB virtual disk 1 GB RAM minimum, 2 GB recommended if inspection is used A minimum of one virtual network interface for the role, three for IPS or Layer 2 Firewall roles The following limitations apply when a McAfee NGFW engine is run as a virtual appliance node in the role: Only Packet Dispatching CVI mode is supported. Only Standby clustering mode is supported. Heartbeat requires a dedicated non-vlan-tagged interface. The following limitations apply when a McAfee NGFW is run as a virtual appliance node in the IPS or Layer 2 Firewall role: Clustering is not supported.

7 Installation instructions Note The sgadmin user is reserved for McAfee use on Linux, so it must not exist before the McAfee Security Management Center is installed for the first time. The main installation steps for the McAfee Security Management Center (SMC) and the NGFW engines are as follows: 1. Install the Management Server, the Log Servers, and optionally the Web Portal Servers and the Authentication Servers. 2. Import the licenses for all components (you can generate licenses at 3. Configure the Firewall, IPS, or Layer 2 Firewall elements with the Management Client using the Security Engine Configuration view. 4. Generate initial configurations for the engines by right-clicking each Firewall, IPS, or Layer 2 Firewall element and selecting Save Initial Configuration. 5. Make the initial connection from the engines to the Management Server and enter the one-time password provided during Step Create and upload a policy on the engines using the Management Client. The detailed installation instructions can be found in the product-specific installation guides. For a more thorough explanation of using the McAfee Security Management Center, refer to the Management Client Online Help or the McAfee SMC Administrator s Guide. For background information on how the system works, consult the McAfee SMC Reference Guide. All guides are available for download at Upgrade instructions McAfee NGFW version requires an updated license if upgrading from version 5.6.x or earlier. The license upgrade can be requested at Install the new license using the Management Client before upgrading the software. The license is updated automatically by the SMC if communication with McAfee servers is enabled and the maintenance contract is valid. Note The anti-virus engine changes from ClamAV to McAfee when upgrading from a version earlier than to version or later. To upgrade and maintain anti-virus scanning capability, these steps must be taken: 1. Upgrade the SMC to version 5.7 or later and the engine to version or a later 5.5 version. 2. Before upgrading the engine, issue this command for each engine in the Monitoring view in the Management Client: Commands Update Anti-Virus Database. 3. Wait until the Appliance Status monitoring confirms that the new anti-virus signature database has been downloaded. 4. Upgrade the engine using the remote upgrade feature normally. If the engine does not have the new anti-virus database available before the upgrade, the upgrade can be done but it takes some time before anti-virus is operational again after the upgrade. To upgrade the engine, use the remote upgrade feature or reboot from the installation CD and follow the instructions. Detailed instructions can be found in the McAfee NGFW Installation Guide for Role and the McAfee NGFW Installation Guide for IPS and Layer 2 Firewall Roles. Note McAfee NGFW appliances support only the software architecture version that they are pre-installed with. 32-bit versions (i386) can only be upgraded to another 32-bit version and 64-bit versions (x86-64) can only be upgraded to another 64-bit version. Clusters can only have online nodes using the same software architecture version. State synchronization between 32-bit and 64-bit versions is not supported. Changing architecture for third-party server machines using software licenses requires full re-installation using a CD. Upgrading to any 5.7.x version is only supported from a 5.5.x, 5.6.x, or 5.7.x version. If you are running an earlier version, upgrade first to the latest 5.5.x version following the instructions in the 7

8 release notes for that version. Note If you have not changed the root password since engine version 4.x, change the root password before upgrading using the sg-reconfigure tool or the Management Client. If the upgrade is done without changing the root password, root login to the engine does not work after upgrading to or a later version until the password has been reset in the Management Client. It is recommended to change the root password in any case, as the salted hash of the root password is stored using a stronger hash (SHA-512) in versions and later. Additional information In this major version New brand Stonesoft Management Center is now called McAfee Security Management Center. At the same time, we have changed the main application icons, the OS level icons, the look and feel of the SMC installer, the login page, the Getting Started page, the Web Start page, the Web Portal, the browser-based user authentication pages, the Online Help, and the SMC API documentation pages. We have also updated the Windows Service names and the default installation folder paths. The Security Engine product name has also changed in this release. The Security Engine is now known as the McAfee Next Generation Firewall or NGFW. NGFW engines are still represented by Security Engine elements in the Management Client. Build version McAfee Next Generation Firewall version build version is Product Binary Checksums sg_engine_ _i386.iso c9ab5e21660d5afb9bbf972b1cbcc f4 ae4844cdc0a2a41a8424e1d33abf0e75f48307d8faa1f9256c2166d2b e12405e1600ef1a63863e0 c3c5ba7590f55ff349e6ce550181cca322aa16cb5 sg_engine_ _i386.zip d54cc91ae9c3de8df033c54a7ac9ce7db34d49ed f27dbe61f12e56bf4731da6522e867d92d90e2bc9de497b2929a6d52fa361b4fdbb2e2c14c5d7e6364f d3a38a9819c3e294b5ff3ab4894f6742c06738 sg_engine_ _x86-64.iso b1b545f7192f0574a5507fdab6f41c08de861e6c 04a99037e90c29a7ddcb02a9ba9d5124c7638c c ddcec8ac4a2327d929052b7b2 641df7c23e0f10791cb5a94af358de7d31a4d413a3 sg_engine_ _x86-64.zip 704a303fdaddced14bbf0659c65b6390b287e66d

9 Compatibility fba81d6949f0f ced8c606ef92e6d51479b242f1cae6b765c29d5213f3f563d509d09ae6a6b5b d0952ed06da5634a978c915900dcc9c2da sg_engine_ _x86-64-small.iso 83a1b d61fab4525aeaae13b6d890021c ef4b5df85de3bda109a023408ea594fee25580c612bf522d2de9f5e0aec28053daebb87da5c194934c59cdb 8c924135b33861ebfd1d5e3d8db4fcbac44c103e3 sg_engine_ _x86-64-small.zip 03074e0202c19cf2973de3a9e51fbc42c1f62bb1 eff0bdc55029b df1c1d595692f a50fdefec81345a1db72e97499c8d688ed80c b409bbce bc7e02e03cf8ca2c48df Minimum McAfee NGFW version is compatible with the following component versions: McAfee Security Management Center or later Dynamic Update 545 or later Stonesoft IPsec VPN Client or later Server Pool Monitoring Agent or later User Agent or later Known issues The current important known issues of McAfee NGFW version are described in the table below. Issue Role Description Link aggregation issues (#109104) FW The interface link aggregation driver has issues that affect proper LACP operation. The drivers are updated in NGFW versions and higher. Find product documentation McAfee provides the information you need during each phase of product implementation, from installation to daily use and troubleshooting. After a product is released, information about the product is entered into the online Knowledge Center. 1. Go to the McAfee ServicePortal at and click Knowledge Center. 2. Enter a product name, select a version, then click Search to display a list of documents. 9

10 Copyright 2015 McAfee, Inc. Do not copy without permission. McAfee and the McAfee logo are trademarks or registered trademarks of McAfee, Inc. or its subsidiaries in the United States and other countries. Other names and brands may be claimed as the property of others. 00-A