McAfee Network Security Platform 9.1

Transcription

1 Manager-Virtual IPS Release Notes McAfee Network Security Platform 9.1 Revision C Contents About this release New features Enhancements Resolved issues Installation instructions Known issues Product documentation About this release This document contains important information about the current release. We recommend that you read the whole document. Network Security Platform follows a release process that is based on customer requirements and best practices followed by other McAfee teams. For details, read KB This release of Network Security Platform is to provide new features and enhancements on the Manager and Virtual IPS Sensor software. Release parameters Version Network Security Manager software version Signature Set Virtual IPS Sensor software version Virtual Network Security Platform Controller Virtual Network Security Platform Probe

2 Currently port 4167 is used as the UDP source port number for the SNMP command channel communication between Manager and Sensors. This is to prevent opening up all UDP ports for inbound connectivity from SNMP ports on the Sensor. Older JRE versions allowed the Manager to bind to the same source port 4167 for both IPv4 and IPv6 communication. But with the latest JRE version 1.8.0_131, it is no longer possible to do so, and the Manager uses port 4166 as the UDP source port to bind for IPv6. Manager 9.1 uses JRE version 1.8.0_131. If you have IPv6 Sensors behind a firewall, you need to update your firewall rules accordingly such that port 4166 is open for the SNMP command channel to function between those IPv6 Sensors and the Manager. Manager software version 9.1 is not supported on McAfee-built Dell-based Manager Appliances. McAfee recommends that you use Intel-based Manager Appliances instead. Upgrade support McAfee regularly releases updated versions of the signature set. You can choose to automatically download and deploy the signature set in the Manager. Consider the following before upgrading to Network Security Manager version 9.1: If you are using the Manager version with McAfee Cloud Threat Detection (McAfee CTD) environment only, then you can upgrade to Manager version 9.1. This version supports integration with McAfee CTD. If you are on Manager version , note that the Manager version 9.1 does not support the KVM and NSX environments. In this case, McAfee recommends you to continue using the Manager version Manager versions and does not support Virtual IPS Sensor version deployed in ESX environment. You have to follow the specified sequence while upgrading the components deployed in an AWS environment. For the upgrade sequence in an AWS deployment, see the section AWS sequence for upgrade in McAfee Network Security Platform 9.1 AWS Deployment Guide. With this release, upgrade for Virtual IPS Sensors deployed in an AWS environment is not supported. You have to replace the old AMI of the Virtual IPS Sensor with the new AMI. For steps on how to replace the Virtual IPS Sensor AMI, see the section Upgrade Virtual IPS Sensor in McAfee Network Security Platform 9.1 AWS Deployment Guide. After upgrading a vnsp Controller, you should stop the Controller instance, update the user data according to the new format, and then restart the Controller instance. For more information on vnsp Controller upgrade, see the section Upgrade a vnsp Controller in McAfee Network Security Platform 9.1 AWS Deployment Guide. The following is the upgrade matrix supported for this release: Component Manager/Central Manager software Virtual IPS Sensor (IPS-VM100 and IPS-VM600) Minimum Software Version 8.1: , : , (only for McAfee CTD), : (only for AWS) 8.1: , : , (only for KVM, VMware NSX, and McAfee CTD environments), (only for AWS),

3 Heterogeneous support This version of 9.1 Manager software can be used to configure and manage the following devices: Device NS-series Sensors (NS3100, NS3200, NS5100, NS5200, NS7100, NS7200, NS7300, NS9100, NS9200, NS9300) Virtual IPS Sensors (IPS-VM100 and IPS-VM600) Version 8.1, 8.3, , 8.3, 9.1 Network Security Manager version 9.1 does not support KVM environment. Virtual Security System (IPS-VM100-VSS) 8.3, 9.1 Network Security Manager version 9.1 does not support VMware NSX environment. M-series Sensors (M-1250, M-1450, M-2750, M-2850, M-2950, M-3050, M-4050, M-6050, M-8000) 8.1, 8.3, 9.1 Mxx30-series Sensors (M-3030, M-4030, M-6030, M-8030) 8.1, 8.3, 9.1 M-8000XC Cluster Appliance 8.1, 8.3, 9.1 NTBA Appliances (T-200, T-500, T-600, T-1200) 8.1, 8.3, 9.1 Virtual NTBA Appliances (T-VM, T-100VM, T-200VM) 8.1, 8.3, 9.1 Integration support The above mentioned Network Security Platform software versions support integration with the following product versions: Table 1-1 Network Security Platform compatibility matrix Product Version supported McAfee epo 5.9.0, McAfee Global Threat Intelligence McAfee Endpoint Intelligence Agent 2.6 McAfee Logon Collector McAfee Threat Intelligence Exchange 2.1.0, McAfee Data Exchange Layer 3.0.1, Compatible with all versions McAfee Advanced Threat Defense , McAfee Virtual Advanced Threat Defense , McAfee Cloud Threat Detection McAfee MOVE AntiVirus Agentless McAfee MOVE AntiVirus Multi-Platform McAfee Vulnerability Manager , McAfee Host Intrusion Prevention 8.0 New features This release of Network Security Platform includes the following new features: 3

4 Migration from SHA1 to SHA256 signing algorithm With this release, the Network Security Platform announces the deprecation of SHA1 certificates to sign Sensor-Manager communication and replaces this with SHA256 certificates for this signature. This results in more secure communication between the Sensor and the Manager. Previous Releases In Network Security Platform early 8.1 deployments, both the Sensor and Manager certificates used 1024-bit RSA keys and were signed with Sha1WithRSAEncryption based signature. The Manager ports 8501, 8502, and 8503 serve the TLS channels from the Sensor. The cipher used by the Sensor and Manager was TLS1.0-RSA-AES128-SHA1. Starting with release upto but does not include , and , the Virtual IPS Sensor certificate used 2048-bit RSA keys and Sha256WithRSAEncryption based signature. The Manager certificate used 2048-bit RSA keys but retained Sha1WithRSAEncryption based signature. The Manager ports 8506, 8507, and 8508 served the TLS channels from the Sensor. The cipher used by the Sensor was TLS1.0-RSA-AES128-SHA1. Current Release From release , the Manager supports 2048-bit RSA keys with Sha256WithRSAEncryption based signature. This release of the Manager reuses ports 8501, 8502, and 8503 to support this new posture that was previously allocated to certificates using 1024-bit RSA keys. The cipher used by the Sensor is TLS1.2-RSA-AES128-GCM-SHA256. Hence, after upgrading the Manager, Sensors deployed on these ports using 1024-bit RSA keys and weaker signatures will not be supported. The Manager and Sensor supports 2048-bit RSA keys with Sha256WithRSAEncryption based signature in release If you are upgrading from versions 8.2 (EOL) or 8.3, you must activate ports 8501, 8502, and 8503 for Sensor-Manager communication. For more information, refer to the section Migration from SHA1 to SHA256 signing algorithm in the McAfee Network Security Platform 9.1 Installation Guide. The following table captures the migration of certificates. Table 2-1 Ports used based on encryption keys, certificates, and cipher suites Manager Port Channel Description Sensor software with 2048-bit RSA keys, 2048-bit RSA keys, 1024-bit RSA keys, SHA256 certificate, and SHA1 certificate, and SHA1 certificate, and TLS1.2-RSA-AES128- TLS1.0-RSA- TLS1.0-RSA- GCM-SHA256 AES128-SHA1 AES128-SHA Install Sensor Applicable --- Applicable 8502 Alert/Event Applicable --- Applicable 8503 Packet Log Applicable --- Applicable 8506 Install Sensor --- Applicable Alert/Event --- Applicable Packet Log --- Applicable File transfer Proprietary (file transfer channel) Proprietary (file transfer channel) Proprietary (file transfer channel) 8509 File transfer 2048-bit RSA Encryption 2048-bit RSA Encryption 1024-bit RSA Encryption 8510 File transfer 2048-bit RSA Encryption 2048-bit RSA Encryption 1024-bit RSA Encryption 4

5 For more information, see McAfee Network Security Platform 9.1 Installation Guide. On-premise Network Security Manager managing Sensors in an AWS environment McAfee Network Security Manager that is installed on-premises within your network can be used to manage Virtual IPS Sensors deployed in the AWS environment provided that the Manager is connected to AWS through a VPN. This Manager can also be used to manage physical Sensors. For more information, see McAfee Network Security Platform 9.1 AWS Deployment Guide. vnsp solution high availability With this release, the Virtual Network Security Platform provides high availability of the complete solution with the Manager Disaster Recovery (MDR), Controller High Availability (HA), and the Virtual IPS Sensor auto scaling feature. This enables the vnsp solution to work seamlessly without any interruption. Controller High Availability (HA) The Controller High Availability (HA) provides a failover mechanism where one of the Controllers is always active and reachable. In a Controller HA pair, one Controller is in Active mode and the other Controller is in Standby mode. The Controller that completes deployment first registers with the Network Security Manager and becomes Active. The second Controller after registration with the Network Security Manager will be in Standby mode. The Controller HA pair uses elastic IP addresses to establish trust with the Network Security Manager. To configure a Controller HA pair, go to Devices <Admin Domain Name> Global vnsp Controllers. For more information on Controller high availability, see McAfee Network Security Platform 9.1 AWS Deployment Guide. Manager Disaster Recovery (MDR) in an AWS environment With this release, the Network Security Manager supports Manager Disaster Recovery (MDR) for the cloud environment. An MDR pair consists of a Primary Manager and a Secondary Manager. Usually the Primary Manager is in Active state and the Secondary in Standby state. When one of the Managers is not reachable, the other Manager becomes active which allows the Sensor to parse the traffic without any disruption. The functionality of an MDR pair in an AWS environment is similar to an on-premise MDR pair which manages the hardware appliances. You can use the on-premise MDR pair to manage the Virtual IPS Sensors deployed in AWS. MDR for Virtual Sensors uses the same concept as an MDR which manages the hardware appliances. The Virtual IPS Sensor sends alerts to both the Managers. Hence when the Secondary Manager becomes active, all the alerts are available. Policies, clusters, and protected groups configured in the Primary Manager are replicated in the Secondary Manager. Once the Primary Manager becomes active again, data from the Secondary Manager are updated in the Primary Manager. To create an MDR pair, go to Manager <Admin Domain Name> Setup MDR. For more information on MDR, see McAfee Network Security Platform 9.1 AWS Deployment Guide. Auto scaling of Virtual IPS Sensors Failover mechanism for Virtual IPS Sensors is provided by AWS auto scaling feature. This feature also provides increased traffic throughput as many Sensors can be used to load balance the traffic. Alarms are configured for the auto scaling group which launches new Sensor instances when the traffic reaches the threshold limit. Parameters like CPU utilization is configured for a certain threshold limit beyond which the auto scaling group launches an extra instance of the Sensor to load balance the excess traffic. Thus, the traffic to be inspected is redirected to the new Sensor instance with no downtime. As there are multiple Sensor instances within an auto scaling group, the traffic is distributed among the Sensors thus reducing latency in the network during inspection. 5

6 To create an auto scaling group, in the AWS console, go to Services EC2 Compute AUTO SCALING. For more information on the auto scaling feature for Sensor, see McAfee Network Security Platform 9.1 AWS Deployment Guide. IDS deployment This release of Network Security Platform supports deployment of Virtual IPS Sensors in detection mode (IDS). Previously, the Virtual IPS Sensors in an AWS environment, could be deployed only in prevention mode (IPS). In IDS mode, a copy of the packet is sent to the Virtual IPS Sensor for inspection. The Virtual IPS Sensor does not prevent or block the attack. Once an attack is detected, the Virtual IPS Sensor resets the TCP channel to prevent further attacks. To change the inspection mode for a protected group, go to Devices <Admin Domain Name> Global vnsp Clusters. For more information on IDS load balancer, see McAfee Network Security Platform 9.1 AWS Deployment Guide. Product integration With this release, Network Security Platform supports integration with following products release versions: McAfee epolicy Orchestrator version McAfee Advanced Threat Defense and Virtual Advanced Threat Defense version Threat Intelligence Exchange version McAfee Cloud Threat Detection version For more information on the product integration, see McAfee Network Security Platform 9.1 Integration Guide. Enhancements This release of Network Security Platform includes the following enhancements: Jumbo frame parsing In the earlier release, you configured jumbo frame parsing using this command: set jumboframeparsing <enable disable> From this release you can enable jumbo frame parsing in the Manager. To enable jumbo frame parsing perform the following steps: 1 Select Devices <Admin Domain Name> Devices <vnsp_cluster_name> Setup Advanced IP Settings. 2 In the Common IP Parameters section, select Enabled from the Jumbo Frame Parsing drop-down list and click Update to update the Sensor of the configuration change. If the Virtual IPS Sensors are pre-9.1 software, reboot the Sensors to update it. Jumbo frame parsing is not supported for Virtual IPS Sensors deployed on KVM even though the option is available in the Manager. For more information on the status dashboard, see McAfee Network Security Platform 9.1 AWS Deployment Guide. 6

7 Shared secret key enhancements In the earlier release, you could set the shared secret key using two methods: 1 Log in to the Sensor and set the Shared secret key using the CLI command set cloud-cluster sharedsecretkey. 2 While configuring the instance details in AWS, scroll down to Advanced Details, and provide the User data in the format shown below. {"Sensor Shared Key":"Sensor_Sharet_Key"} With this release, you can also store the Sensor and Controller shared secret keys in Amazon S3 Bucket and pass the URL in the User Data in the Advanced area while launching the Sensor or Controller instance. For Sensor: {"Primary NSM IP":" 10.x.x.x", "Cluster Name": "Cluster_Name", "Cloud Data URL":"URL_for_S3_bucket"} For Controller: {"Primary NSM IP":" 10.x.x.x", "Controller Name": "Controller_Name", "Cloud Data URL":"URL_for_S3_bucket"} For more information on the status dashboard, see McAfee Network Security Platform 9.1 AWS Deployment Guide. VM (agent) Status Dashboard for AWS Each vnsp Controller maintains its own list of managed endpoints, and because the Manager can manage multiple vnsp Controllers, this list contains the managed endpoints across all vnsp Controllers. The earlier release of Network Security Platform, provided the option to check status of the managed endpoints by entering an IP address in the Devices <Admin Domain Name> Global vnsp Clusters Endpoint Actions Check Endpoint Status page. In release 9.1, to provide a per-cluster view of managed endpoints, the Check Endpoint Status option has been enhanced to View Managed Endpoints option. To view the managed endpoints per-cluster, go to Devices <Admin Domain Name> Global vnsp Clusters Endpoint Actions View Managed Endpoints. For more information on the status dashboard, see McAfee Network Security Platform 9.1 AWS Deployment Guide. Licensing and telemetry Licensing With release 9.1, you are able to use a Virtual IPS Sensor license to add vnsp Clusters. Each license supports a pre-defined number of Virtual IPS Sensors and this number is specific to the license file you have procured. The Manager periodically compares the number of Virtual IPS Sensors supported by your licenses with the installed number of Virtual IPS Sensors, and provides a compliance report. The Virtual IPS Sensor Compliance Report provides you the information whether if you are compliant with the maximum number of Virtual IPS Sensors allowed by your licenses. The report also lists the licenses added to the Manager and the Virtual IPS Sensors currently managed by it. Telemetry In the previous release of Network Security Platform, telemetry was used to ascertain proper functioning of Virtual IPS Sensors and Virtual Probes. 7

8 In 9.1 release, telemetry is supported for vnsp clusters. Telemetry for vnsp clusters is used to ascertain proper functioning of Virtual IPS Sensors and Virtual Probes. This information is sent to the McAfee GTI Server. Telemetry is automatically enabled when the first vnsp Cluster is defined in the Manager. For more information on licensing and telemetry, see McAfee Network Security Platform 9.1 AWS Deployment Guide. Network Security Manager benchmarking for vnsp Clusters The Virtual Network Security Manager components optimum limits in an AWS environment are listed below: Component Limits Virtual IPS Sensors 100 per Cluster vnsp Clusters 100 per Controller vnsp Controllers 30 Central Manager UI redesign to migrate away from Java In release 9.1, the following existing UI pages have been enhanced to use the extjs framework: Attack Log With release 9.1, the alerts that were previously displayed in the Alerts tab in the Real-Time Threat Analyzer in the Central Manager are now displayed in Attack Log. The following actions can be performed in the Central Manager Attack Log. Update Policy Delete Alerts Create exceptions Save Attack Log Perform GTI Forensics Acknowledge alerts Assignment of alert Unacknowledge alerts To view the alerts, go to Analysis <Admin Domain Name> Attack Log. To view Endpoint information, go to the Analysis <Admin Domain Name> Quarantine in the corresponding Manager. For more information, see McAfee Network Security Platform 9.1 Manager Administration Guide. Grouping alerts in the Attack Log page The Attack Log page, depending on the traffic passing through your network, might display several alerts that run into multiple pages. It becomes inefficient to search for specific groups of alerts. Version 9.1 enables you to filter the display of alerts based on specific criteria. The Group by this field option has been made available to group and view a consolidated list of alerts in the Attack Log page. Alerts can be grouped by any of the categories in the Attack Log page, except the following: Time, Attack Count, and Alert ID under the Event column NSP ID under the Attack column Packet Capture Layer 7 Data In a Central Manager setup, you can additionally group the alerts based on the version of the Manager. For more information, see McAfee Network Security Platform 9.1 Manager Administration Guide. 8

9 Configuration option changes for custom attack signatures While configuring user-defined signatures (UDS) for M-series Sensors from the Custom Attack Editor (under Policy <Root Admin Domain> Intrusion Prevention Policy Types IPS Policies), you only had the option to apply the UDS with a combination of both M-series and NS-series Sensors and not specific to either. In release 9.1, you have the following options to apply UDS specific to each Sensor: M-series only NS-series only Virtual IPS Sensors only In release 9.1, in addition to the options available to apply UDS for specific Sensor models, you have options to apply UDS in the following new combinations: Any M-series and NS-series Sensors only M-series and Virtual IPS Sensors only NS-series and Virtual IPS Sensors only For more information, see McAfee Network Security Platform 9.1 Custom Attack Definitions Guide. Resolved issues The current release of the product resolved these issues. For a list of issues fixed in earlier releases, see the Release Notes for the specific release. Resolved Manager software issues The following table lists the high-severity Manager software issues: ID # Issue Description Attack detection occurs even after the protected group is removed or the subnet is removed from a protected group Virtual Probe status is displayed as inactive when active and vice versa In the Snort Variables window under Custom Attack Editor, after deleting and then adding a Snort variable displays the error, Please enter macro name Creation of new UDS fails with the error Number of Characters > 255 even when the number of characters are less than Characters specified within the specified range generates the error Number of Characters > The Manager user interface fails to load in Internet Explorer version The device integrated with the NTBA appliance is not displayed in the device list under Devices <Admin Domain Name> Devices Incorrect description is displayed in the alert details panel in Attack Log for Endpoint Executables and Malware Files The Attack Log does not display data for EIA executables Incorrect quarantined IP address is displayed for MAID alerts. The following table lists the medium-severity Manager software issues: 9

10 ID # Issue Description Traffic is blocked using SmartBlocking even when SmartBlocking is disabled Custom attacks are not saved In the Quarantine page, the quarantined IP with the option Until explicitly released is not displayed The Quarantine page in the Manager does not display the list of all quarantined hosts In the Custom Attack Editor, Snort variable created to replace all variables fails with errors The Executive Summary report generation fails after a Manager upgrade High-risk endpoints are not displayed in the Manager Creating custom signature with fixed source or destination IP addresses causes test compilation failure Sensor settings cannot be saved under Devices <Admin Domain Name> Global IPS Device Settings Advanced Device Settings Snort signatures are not triggered for HTTP response data The Manager displays the error SensorConfigurationException: Agent Not Supported when an IP address is removed from the quarantined list in the Quarantine page Summary page of the failover peer displays two different names The Manager attempts to connect to msas.mcafee.com without using a proxy The epo Dashboard Data retriever user role does not allow epo integration with the Manager under Manager <Admin Domain Name> Users and Roles Roles Unable to view the source user information in Attack Log The RADIUS servers page under Manager <Admin Domain Name> Setup External Authentication RADIUS Servers displays the error An unexpected error occurred during the processing of your request. Check the log file for possible errors The Manager fails to enable the option Restrict SSH Access to CLI under Devices <Admin Domain Name> Devices <Device Name> Setup Advanced Advanced Device Settings The attempt to add a username that includes an apostrophe in the Add a User page fails The Manager health check fails due to database login under Manager <Admin Domain Name> Troubleshooting Health Check Snort rule for UDP packets does not generate alerts and drops the packets on port The Manager Dashboard page does not display the Throughput Usage, Memory Usage, and CPU Usage monitors LDAP over SSL does not work after a Manager upgrade The performance charts does not display data for Minutes filter under Devices <Admin Domain Name> Devices <Device Name> Troubleshooting Performance Charts The Faults report displays Scheduled botnet detectors download is in progress even after the callback detectors are successfully updated Quarantined hosts generates alerts in the Threat Analyzer Sensor performance alert causes alert channel to go down Running a health check fails when the Manager is connected through proxy settings A difference exists between severity of detected alerts and configured severity An error is displayed while exporting packet captures of an alert from the Attack Log page The Manager uses SHA128 bit encryption algorithm instead of SHA In the Attack Log page, filtering attacks for Attack SmartBlocked are not displayed in the Results column When adding an Ignore Rule from the Attack Log page, the action to create a new rule object fails in the Add Ignore Rule window. 10

11 ID # Issue Description The malware confidence (severity) for the same alert displays inconsistent value in the Manager (Attack Log, Alert Details, and Malware Files) and Syslog Message The configuration options are disabled for alert relevance in Manager <Admin Domain Name> Integration Vulnerability Assessment MVM Alert Relevance The Manager incorrectly considers a Sensor to be part of a failover pair Login for epo Dashboard Data Retriever user role displays an error Manually quarantined IP address from the Attack Log page is not displayed in the Manager quarantine list The Manager sends additional messages in the syslog notification for some alerts The Manager is vulnerable to CVE The actions performed to enable or disable the monitoring ports in the Sensor are displayed incorrectly in the User Activity Log page. For example, if the port action is from Enabled to Disabled, it is displayed as Disabled to Enabled in the Manager In the Manager, the list to select the child domain is disabled Expired SSL certificate can be imported to the Manager which is displayed as Valid Alert count mismatch exists between the Primary and Secondary Manager The Devices tab does not display the tab options When an attack is blocked using the Recommended for Smart Blocking (RfSB) feature, its attack result in the SNMP trap displays [777] instead of Smart Blocked The data truncation error description is very long The Result column does not display attacks for smartblocked attacks in the Attack Log after Manager upgrade notifications are incorrectly sent for alerts that are not configured to send notifications Direct link to view the Sensor status on the System Health monitor of the Dashboard page is disabled The An internal application error occurred message is displayed when trying to access the Global Threat Intelligence from the Manager Error is displayed in the Manager when the number of quarantined IP addresses exceeds Attacks names are displayed as --- after a signature set upgrade under Policy <Admin Domain Name> Intrusion Prevention Policy Types IPS Policies The Manager automatically deploys the signature sets even when automatic deployment is disabled The performance charts for Device Throughput Usage, Port Throughput, and CPU Usage under Devices <Admin Domain Name> Devices <Device Name> Troubleshooting Performance Charts does not display weekly data When deploying updates to the Sensor, the Running Tasks and User Activity Log pages displays the device name as null Importing user-defined signatures in the Manager causes error In an MDR scenario, both the Primary and Secondary Managers send fault notification for port link failures Communication between the Manager and the Sensor is disconnected after restarting the Manager service The trend analysis report scheduled for weekly or monthly time period does not display the data for the last day The fault for Gateway Anti-Malware file update is displayed in the Manager even when it successfully updated in the Sensor File pruning option does not delete old signature files. 11

12 ID # Issue Description The syslog fault notifications for a high-availability Sensor cluster from the Manager contains the cluster name instead of the node name Executive Summary report shows several Address Not Resolved results in the Hostname columns in the Top N Source IP and Top N Destination IP sections The Policy <Admin Domain Name> Intrusion Prevention Policy Types Inspection Options Policies page freezes when you enable endpoint reputation analysis and disable name resolution/global Threat Intelligence The Manager update date is not displayed in the Manager <Admin Domain Name> Troubleshooting Health Check page The Manager command channel should request for TLS1.2 connection with NTBA In the Attack Log page, the policy update fails when selecting a policy under Update Policy options from the Other Actions list SNMP trap displays incorrect port name The Traffic Statistics page displays an error when clicked Unable to export custom attacks in the Policy <Admin Domain Name> Intrusion Prevention Policy Types IPS Policies Custom Attacks Snort Format Other Actions Export page The clean files count for the Blacklist engine should be changed to NA instead of 0 in the Devices <Admin Domain Name> Devices <Device Name> Troubleshooting Traffic Statistics page. The following table lists the low-severity Manager software issues: ID # Issue Description The syslog notifications for performance faults does not include the value that triggered the fault or the threshold. Resolved Sensor software issues The following table lists the high-severity Manager software issues: ID # Issue Description Request to Controller to create policy fails if Cluster name is greater than 9 characters Controller registration fails if special characters are used in the shared secret key. The following table lists the medium-severity Sensor software issues: ID # Issue Description The Sensor reads the incorrect input without proper validation and starts establishing trust using SHA2 based signature methods The Sensor logs have text error in the reboot message After an upgrade, the Sensor experiences exception while processing signature set causing it to go to bad health or experience auto recovery. This happens more often when there are Ignore Rule with Any Any or IPv6 Ignore Rule and IPv6 scanning is disabled The Sensor fails to decrypt SSL traffic due to which attacks are not detected Configuration update fails after a certain number of times when there are Ignore Rule with Any Any or IPv6 Ignore Rule and IPv6 scanning is disabled. Internal resources fail to free for such configurations Invalid characters are sent as URL information to Advanced Threat Defense Incorrect alert is generated for high layer 2 drop in the Manager The Sensor cannot extract the file name when SMTP traffic has multiple attachments After Sensor upgrade, FTP traffic does not flow through the Sensor. 12

13 ID # Issue Description For XFF traffic, the Sensor does not send true client IP address to the syslog server Syslog alerts sent from the Sensor displays the timestamp incorrectly with a 12-hour difference Auto configuration template does not work Filename and domain in URL path contains duplicate domain name information when submitted to Advanced Threat Defense Whitelisted entries with more than two labels does not generate an exact match Sensor reboots or auto recovers when entries to the IP Reputation caches are added even after reaching the maximum table size In a rare condition, the malware processing engine experiences an exception while processing an SMTP attachment file having large encoded content Internal resource leak in the malware processing modules causes the Sensor to stop sending files to the Advanced Threat Defense appliance The output for resolve gti server CLI command displays incorrect destination / Sensor fails to trigger a match in a SNORT rule when the pattern is embedded in a HTTP response beyond 256 bytes Layer 7 DDOS response action configuration does not work correctly FTP file transfer cannot be blocked with advanced malware policy The Sensor fails to block retransmitted packets for malware attacks configured for blocking. 13

14 Installation instructions Manager server/client system requirements The following table lists the 9.1 Manager server requirements: Operating system Minimum required Any of the following: Windows Server 2008 R2 Standard or Enterprise Edition, English operating system, SP1 (64-bit) (Full Installation) Windows Server 2008 R2 Standard or Enterprise Edition, Japanese operating system, SP1 (64-bit) (Full Installation) Windows Server 2012 R2 Standard Edition (Server with a GUI) English operating system Windows Server 2012 R2 Standard Edition (Server with a GUI) Japanese operating system Windows Server 2012 R2 Datacenter Edition (Server with a GUI) English operating system Windows Server 2012 R2 Datacenter Edition (Server with a GUI) Japanese operating system Windows Server 2016 Standard Edition (Server with a GUI) English operating system Windows Server 2016 Standard Edition (Server with a GUI) Japanese operating system Windows Server 2016 Datacenter Edition (Server with a GUI) English operating system Windows Server 2016 Datacenter Edition (Server with a GUI) Japanese operating system Only X64 architecture is supported. Recommended Windows Server 2016 Standard Edition operating system Memory 8 GB Supports up to 3 million alerts in Solr. >16 GB Supports up to 10 million alerts in Solr. CPU Server model processor such as Intel Xeon Same Disk space 100 GB 300 GB or more Network 100 Mbps card 1000 Mbps card Monitor 32-bit color, 1440 x 900 display setting 1440 x 900 (or above) The following are the system requirements for hosting Central Manager/Manager server on a VMware platform. 14

15 Table 5-1 Virtual machine requirements Component Minimum Recommended Operating system Any of the following: Windows Server 2008 R2 Standard or Enterprise Edition, English operating system, SP1 (64-bit) (Full Installation) Windows Server 2008 R2 Standard or Enterprise Edition, Japanese operating system, SP1 (64-bit) (Full Installation) Windows Server 2012 R2 Standard Edition (Server with a GUI) English operating system Windows Server 2012 R2 Standard Edition (Server with a GUI) Japanese operating system Windows Server 2012 R2 Datacenter Edition (Server with a GUI) English operating system Windows Server 2012 R2 Datacenter Edition (Server with a GUI) Japanese operating system Windows Server 2016 Standard Edition (Server with a GUI) English operating system Windows Server 2016 Standard Edition (Server with a GUI) Japanese operating system Windows Server 2016 Datacenter Edition (Server with a GUI) English operating system Windows Server 2016 Datacenter Edition (Server with a GUI) Japanese operating system Only X64 architecture is supported. Windows Server 2016 Standard Edition operating system Memory 8 GB >16 GB Supports up to 3 million alerts in Solr. Supports up to 10 million alerts in Solr. Virtual CPUs 2 2 or more Disk Space 100 GB 300 GB or more Table 5-2 VMware ESX server requirements Component Minimum Virtualization software ESXi 5.1 Update 2 ESXi 5.5 Update 3 ESXi 6.0 Update 1 ESXi

16 The following table lists the 9.1 Manager client requirements when using Windows 7, Windows 8, or Windows 10: Operating system Minimum Windows 7, English or Japanese Windows 8, English or Japanese Windows 8.1, English or Japanese Windows 10, English or Japanese The display language of the Manager client must be the same as that of the Manager server operating system. Recommended RAM 2 GB 4 GB CPU 1.5 GHz processor 1.5 GHz or faster Browser Internet Explorer 10, 11 Mozilla Firefox Google Chrome (App mode in Windows 8 is not supported) To avoid the certificate mismatch error and security warning, add the Manager web certificate to the trusted certificate list. Internet Explorer 11 Mozilla Firefox 20.0 or later Google Chrome 24.0 or later In Mozilla Firefox version 52 or Google Chrome version 42 and above, the NPAPI plug-in is disabled by default. For the Manager client, in addition to Windows 7, Windows 8, Windows 8.1 and Windows 10, you can also use the operating systems mentioned for the Manager server. The following are Central Manager and Manager client requirements when using Mac: Mac operating system Yosemite El Capitan Browser Safari 8 or 9 For more information, see McAfee Network Security Platform Installation Guide. Known issues For a list of known issues in this product release, see this McAfee KnowledgeBase article: Network Security Platform software issues: KB88813 Product documentation Every McAfee product has a comprehensive set of documentation. Find product documentation 1 Go to the McAfee ServicePortal at and click Knowledge Center. 2 Enter a product name, select a version, then click Search to display a list of documents. 16

17 9.1 product documentation list The following software guides are available for Network Security Platform 9.1 release: Quick Tour AWS Deployment Guide Installation Guide (includes Upgrade Guide) CLI Guide Manager Administration Guide XC Cluster Administration Guide Custom Attack Definitions Guide Integration Guide Manager API Reference Guide Best Practices Guide IPS Administration Guide Troubleshooting Guide Copyright 2017 McAfee, LLC McAfee and the McAfee logo are trademarks or registered trademarks of McAfee, LLC or its subsidiaries in the US and other countries. Other marks and brands may be claimed as the property of others. 0C-00