StoneGate IPS. Release Notes for Version 4.3.9

Transcription

1 StoneGate IPS Release Notes for Version Created: November 19, 2010

2 Table of Contents What s New... 3 Features... 3 Fixed Issues... 3 System Requirements... 4 Stonesoft StoneGate IPS Appliances... 4 Certified Intel Platforms... 4 Build Version... 5 Product Binary Checksums... 5 Compatibility... 5 Installation Instructions... 6 Upgrade Instructions... 6 Known Issues... 7 Appendix: Driver Versions... 8

3 What s New Features StoneGate IPS v4.3.9 contains no new features compared to v Fixed Issues Issues that have been fixed since StoneGate IPS v4.3.8 are described in the table below. Synopsis Description Workaround Rate limiting for non-ip packets may lead to busy-loop in kernel Using throughput rate limiting for non-ip packets with IPS 4.3 appliances may lead to a busy-loop of random duration in the kernel, and cause the engine to become unresponsive. 3 StoneGate IPS Release Notes for version 4.3.9

4 System Requirements Stonesoft StoneGate IPS Appliances At the time of release, this software version is supported in all StoneGate IPS Appliances except in SGI- 100, SGI-1000, SGI-100A, SGI-ANZ, SGI-2000S, SGI-20A, SGI-200S, SGI-200C, SGI-200N, and SGI- 200ANZ. Some features of this release are not available for all appliance models. See for up-to-date appliance-specific software compatibility information. Certified Intel Platforms Stonesoft has certified specific Intel-based platforms for the StoneGate IPS engine. The list of certified platforms can be found at We strongly recommend using the certified hardware or a preinstalled StoneGate appliance as the hardware solution for new StoneGate IPS installations. If it is not possible to use a certified platform, the StoneGate IPS engine can also run on standard Intel-based hardware that satisfies the StoneGate hardware requirements. Basic IPS Hardware Requirements Intel Pentium 4 or higher hardware recommended (the suggested minimum processor speed is 2.4 GHz) IDE hard disk (IDE RAID controllers are not supported) and CD-ROM drive 1024 MB memory Minimum of 1 certified network interface for an Analyzer Minimum of 2 certified network interfaces for a Sensor with IDS configuration Minimum of 3 certified network interfaces for a Sensor with Inline IPS configuration VGA-compatible display and keyboard For more information on the generic hardware requirements for StoneGate IPS, see Requirements for Virtual Node VMware ESX Server version GB virtual disk 1024 MB RAM for each Virtual IPS node Minimum of 3 virtual network interfaces The following limitations apply when StoneGate IPS is run as a virtual node: Sensor clustering is not supported. 4 StoneGate IPS Release Notes for version 4.3.9

5 Build Version The StoneGate IPS v4.3.9 build version is Product Binary Checksums sgips_engine_ _i386.iso MD5SUM 10a565ef8aff188df974e7a477b9add6 SHA1SUM 030c5aeb90392dbb99ee511f87aa6bac0c23e394 sgips_engine_ _i386.zip MD5SUM 46fc6fe2a74a53e b83 SHA1SUM 4856cbfd ceb90fa784f24cf601d14fa08 Compatibility StoneGate IPS version is recommended to be used with the following StoneGate component versions: Component Minimum Compatible Version Recommended Version StoneGate Management Center 4.3 Latest 5.0 maintenance version StoneGate Dynamic Update 154 Latest available 5 StoneGate IPS Release Notes for version 4.3.9

6 Installation Instructions The main installation steps for a StoneGate IPS engine are as follows: 1. Install the Management Server, the Log Server(s), and the Management Client to host(s) to be used as the management system. The Web Portal Server needs to be installed if StoneGate Web Portal is used. 2. Configure the IPS element using the Management Client. 3. Generate an initial configuration for the IPS engines by right-clicking the IPS engines and selecting Save Initial Configuration from the menu that opens. 4. If not using Stonesoft IPS appliances, install the IPS engines by rebooting the machines from the installation CD-ROM. 5. Make the initial connection from the engines to the Management Server and enter the one-time password provided during step Create and upload a policy on the Sensor using the Management Client. This operation also uploads the relevant parts of the policy on the related Analyzer. 7. Command the Sensor engine online by right-clicking the Sensor and selecting CommandsGo Online. Analyzer engines automatically go online after you install a policy on a related Sensor. The detailed installation instructions can be found in the StoneGate IPS Installation Guide. For a more thorough explanation on using StoneGate, refer to the Online Help system or the StoneGate Administrator s Guide. For background information on how the system works, consult the StoneGate IPS Reference Guide. Upgrade Instructions StoneGate IPS v4.3 requires an updated license if upgrading from StoneGate v4.2 or earlier version. The license upgrade can be requested on our Web site at Activate the new license using the StoneGate Management Client before upgrading the software. StoneGate evaluation licenses can be requested on our Web site at To upgrade the Sensor or Analyzer engines, use the remote upgrade feature or reboot from the installation CD-ROM and follow the instructions. NOTE - After the upgrade has finished, activate the latest Dynamic Update available and refresh the policy. Command the Sensor node(s) into the online state. The Analyzer engine policies are automatically refreshed during sensor policy installation. 6 StoneGate IPS Release Notes for version 4.3.9

7 Known Issues The current known issues in StoneGate IPS v4.3.9 are described in the table below. For an updated list of known issues, consult our Support Web site at Synopsis Description Workaround False Positive: Valid response to PASV causes Situation FTP_Reply-Syntax-Incorrect (#43739) IPS Sensor cluster does not provide monitoring for heartbeat connection (#22635) Analyzer compression situations cannot be disabled in System Policy (#33364) Rule Validity Time in Inspection Rules ignored for Correlation Situations (#20153) Traffic recording not reliable with fragmented IP datagrams (#28111) FTP PASV reply may incorrectly trigger the FTP_Reply-Syntax-Incorrect Situation. For example, an extra dot '.' in a valid PASV response (227) triggers the Situation: PASV 227 Entering Passive Mode (172,16,0,1,212,196). LIST The IPS Sensor cluster does not provide monitoring for the heartbeat connection. The following monitoring information is available for IPS engines: - Connectivity from the Analyzer to the Log Server (Log, Alert) - Connectivity from the Sensor to the Log Server (Record) - Connectivity from the Sensor to the Analyzer (Log, Alert) A rule with the Analyzer_Compress-SIDs Situation and a Log Level of None does not disable compression event logging on the Analyzer engine. The Rule Validity Time in the Inspection Rules does not affect Correlation Situations. Correlation Situations are always considered valid. Network traffic capturing with the Record option in the IPS policy does not work reliably for fragmented IP datagrams. In some cases, parts of the fragments are missing from the recorded.pcap/.snoop output. 7 StoneGate IPS Release Notes for version 4.3.9

8 Appendix: Driver Versions NIC Drivers Network interface card (NIC) drivers and versions included in the kernel of StoneGate IPS are listed in the table below. Note that not all drivers listed have been tested by Stonesoft. For a list of StoneGate certified NICs, see Driver Version 3c59x <no version> 8139cp too cvs acenic 0.92 amd8111e atl b bnx cassini 1.4 cxgb 2.2 cxgb3 1.0-ko de4x5 V0.546 dgrs 1.13 dl2k v1.18 dmfe e k4 e patch e1000bp silc patch eepro epic fealnx 2.52 forcedeth 0.60 hamachi 2.1 hp Igb ixgb k2 Ixgbe myri10g Driver Version natsemi 2.1 ne2k-pci 1.03 Netxen_nic ns pcnet qla3xxx v k4 r LK s2io sc c sis sis sk98lin 6.23 skge 1.11 sky starfire 2.0 Sundance 1.2 Sungem 0.98 Sunhme 3.00 tg Tlan 1.15 Tulip Typhoon uli526x via-rhine via-velocity 1.14 vmxnet winbond e Yellowfin StoneGate IPS Release Notes for version 4.3.9

9 SCSI Drivers SCSI drivers and versions included in the kernel of StoneGate IPS are listed in the table below. Note that not all drivers listed have been tested by Stonesoft. Device Driver Version 3Ware 9xxx SATA_RAID CONFIG_SCSI_3W_9XXX ACARD AEC-6710/6712/67160 PCI Ultra/W/LVD SCSI-3 CONFIG_SCSI_ACARD 2.6+ac Adaptec / IBM ServeRAID CONFIG_SCSI_IPS Adaptec AACRAID CONFIG_SCSI_AACRAID Adaptec I2O RAID CONFIG_SCSI_DPT_I2O 2.4 Build 5go Adaptec SAS/SATA 3Gb/s CONFIG_SCSI_AIC94X Adaptec Ultra160 CONFIG_SCSI_AIC7XXX 7.0 Adaptec Ultra320 CONFIG_SCSI_AIC79XX BusLogic MultiMaster and FlashPoint SCSI CONFIG_SCSI_BUSLOGIC Domex DMX3191D SCSI CONFIG_SCSI_DMX3191D No version Fusion MPT ScsiHost for FC/SPI/SAS CONFIG_FUSION_FC/SPI/SAS Initio INIA100 SCSI CONFIG_SCSI_INIA d Intel PIIX/ICH PATA/SATA CONFIG_SCSI_ATA_PIIX 2.12 LSI Logic MegaRAID (LEGACY) CONFIG_MEGARAID_LEGACY LSI Logic MegaRAID (NEWGEN) CONFIG_MEGARAID_NEWGEN LSI Logic MegaRAID (SAS) CONFIG_MEGARAID_SAS rc5 NVIDIA nforce SATA CONFIG_SCSI_SATA_NV 3.5 Pacific Digital ADMA CONFIG_SCSI_PDC_ADMA 1.0 Promise SATA CONFIG_SCSI_SATA_SX Promise SATA TX2/TX4 CONFIG_SCSI_SATA_PROMISE 2.10 QLogic IPS2x00 CONFIG_SCSI_QLA2XXX k3 QLogic ISP1240/1x80/1x160/1020/1040 SCSI CONFIG_SCSI_QLOGIC_ ServerWorks / Apple K2 SATA CONFIG_SCSI_SATA_SVW 2.3 Silicon Image 3124/3132 SATA CONFIG_SCSI_SATA_SIL Silicon Image SATA CONFIG_SCSI_SATA_SIL 2.3 Silicon Integrated Systems SATA CONFIG_SCSI_SATA_SIS 1.0 Symbios/LSI logic 53C8XX/53C101 CONFIG_SCSI_SYM53C8XX_ Tekram DC390(T) PCI SCSI CONFIG_SCSI_DC390T 2.05 ULi Electronics SATA CONFIG_SCSI_SATA_ULI 1.3 VIA SATA CONFIG_SCSI_SATA_VIA 2.3 Vitesse VSC7174 SATA CONFIG_SCSI_SATA_VITESSE 2.3 Vortex GDT Disk Array / Intel Storage RAID CONFIG_SCSI_GDTH StoneGate IPS Release Notes for version 4.3.9

10 Block Device Drivers Block device driver versions included in the new kernel of StoneGate IPS are listed in the table below. Note that not all drivers listed have been tested by Stonesoft. Device Version 3ware Storage controller AMD / NS 5535 IDE 09/20/2005 CMD-Technologies CMD640 IDE 1.02 CMD-Technologies CMD64x IDE 1.50 Compaq Smart Array 5xxx Compaq SMART2 Array Cyrix / NS 5530 IDE 0.74 Highpoint 34x IDE 0.40 Highpoint 366 IDE 1.2 HP SA5xxx and SA6xxx Intel PIIX IDE 0.51 ITE 8211 IDE/8212 IDE RAID 0.16 Mylec DAC960 / AcceleRAID / extremeraid PCI RAID RZ1000 IDE 0.06 Serverworks OSB4 / CSB5 / CSB Silicon Image SiL IDE StoneGate IPS Release Notes for version 4.3.9

11 Copyright and Disclaimer Stonesoft Corporation. All rights reserved. These materials, Stonesoft products, and related documentation are protected by copyright and other laws, international treaties and conventions. All rights, title and interest in the materials, Stonesoft products and related documentation shall remain with Stonesoft and its licensors. All registered or unregistered trademarks in these materials are the sole property of their respective owners. No part of this document or related Stonesoft products may be reproduced in any form, or by any means without written authorization of Stonesoft Corporation. Stonesoft provides these materials for informational purposes only. They are subject to change without notice and do not represent a commitment on the part of Stonesoft. Stonesoft assumes no liability for any errors or inaccuracies that may appear in these materials or for incompatibility between different hardware components, required BIOS settings, NIC drivers, or any NIC configuration issues. Use these materials at your own risk. Stonesoft does not warrant or endorse any third party products described herein. THESE MATERIALS ARE PROVIDED "AS-IS." STONESOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, AS TO, THE INFORMATION CONTAINED HEREIN. IN ADDITION, STONESOFT MAKES NO EXPRESS OR IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE OR USE WITH RESPECT THE INFORMATION CONTAINED IN THESE MATERIALS. IN NO EVENT SHALL STONESOFT BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL OR INCIDENTAL DAMAGES, INCLUDING, BUT NOT LIMITED TO, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING FROM THE USE OF THESE MATERIALS, EVEN IF ADVISED IN ADVANCE OF THE POSSIBILITY OF SUCH DAMAGES. Trademarks and Patents Stonesoft, the Stonesoft logo and StoneGate are all trademarks or registered trademarks of Stonesoft Corporation. Multi-Link technology, Multi-Link VPN, and the StoneGate clustering technology-as well as other technologies included in StoneGate-are protected by patents or pending patent applications in the U.S. and other countries. All other trademarks or registered trademarks are property of their respective owners. Stonesoft Corporation Itälahdenkatu 22A FI Helsinki Finland Tel Fax Stonesoft Inc Crown Pointe Parkway Suite 900 Atlanta, GA USA Tel Fax Copyright 2010 Stonesoft Corporation. All rights reserved. All specifications are subject to change.