This release of the product includes these new features that have been added since NGFW 5.5.

Transcription

1 Release Notes Revision A McAfee Next Generation Firewall Contents About this release New features Enhancements Known limitations Resolved issues System requirements Installation instructions Upgrade instructions Additional information Build version Compatibility Known issues Find product documentation About this release This document contains important information about the current release. We strongly recommend that you read the entire document. The Security Engine product name has changed in this release. The Security Engine is now known as the McAfee Next Generation Firewall or NG. NG engines are still represented by Security Engine elements in the Management Client. New features This release of the product includes these new features that have been added since NG 5.5. New features introduced in NG 5.7 Botnet detection McAfee NG now supports botnet detection using the following new Command and Control (C&C) communication detection methods: - Decryption-based detection: Detect known characteristics of the botnet C&C, port number, carrier, encryption protocol, and key material. - Message length sequence analysis detection: Extract message length for sequence analysis for botnet C&C detection. 1

2 New features introduced in NG 5.6 Virtual Security Engines in IPS and Layer 2 Firewall roles McAfee NG now supports Virtual Security Engines in the Virtual IPS and Layer 2 Firewall roles. Support for the Virtual role was added in version 5.5. Virtual Security Engines are logically separate engines that run as virtual engine instances on a physical engine device. You can now use a physical NG device as a Master Engine to provide resources for Virtual Security Engines. This means that the same Master Engine can simultaneously have different security policies, separate routing tables, and overlapping IP addresses for different interfaces (reserved by different Virtual Security Engines). You can configure up to 250 Virtual Firewalls, Virtual IPS engines, or Virtual Layer 2 Firewalls per Master Engine. The Master Engine can be clustered. The Virtual Security Engines are load-balanced between the Master Engine nodes. One Master Engine handles all the traffic of one Virtual Security Engine at any given time. All Virtual Engines hosted by one Master Engine or Master Engine cluster must be in the same role. Virtual Security Engines do not require individual licenses. Instead, the license for the Master Engine defines how many Virtual Resources can be created. The number of Virtual Resources limits the number of Virtual Security Engines. In this major version, Virtual Security Engines can be used in the, IPS, and Layer 2 Firewall roles with some limitations in normal engine features. Virtualization works across several administrative Domains. For example, the Master Engine can be in the Shared Domain and the Virtual Security Engines can be in one or several other Domains. Enhancements This release of the product includes these enhancements added since NG 5.5. Enhancements introduced in NG 5.7 Application detection coverage has been improved The McAfee AppPrism Application signature library is now used for application detection with McAfee NG. Anti-virus engine changed The anti-virus engine used in McAfee NG engines is now based on the McAfee Anti-Virus Scanning Engine. Out of window TCP resets dropped in Normal Connection Tracking Mode without inspection Protection against spoofed TCP reset packets has been improved in Normal Connection Tracking Mode. In the new TCP reset protection feature, RFC 5961 blind reset attack protection is implemented in the engine on behalf of the connection endpoints. The feature is configured through the TCP Reset Sensitivity setting in the DoS Protection Settings in the engine properties. Rule tag logging Connection closed log entries now also contain the rule tag associated with the connection. Related connection log entries now also contain the rule tag of the parent connection. TLS 1.2 support in TLS inspection TLS protocol version 1.2 is now supported in TLS inspection for client protection and server protection. Decompression in inspection By default, the engine now also decompresses.zip archives that have been compressed using the Deflate method when inspecting traffic.

3 Enhancements introduced in NG 5.6 Scan detection You can configure Security Engines and Master Engines to detect if network ports are scanned. When you enable Scan Detection on a Firewall, IPS engine, Layer 2 Firewall, Master Engine, or Virtual Security Engine, a log is generated if scan probes are detected. Security Engines and Master Engines support IPv4 and IPv6 protocols and detect TCP, UDP, and ICMP scan types. Scan detection has been redesigned in version 5.6. Scan detection performance has been optimized for multi-core platforms and the feature activation has been simplified. You can now define a general Scan Detection setting in the engine properties. You can override the general Scan Detection settings in Access rules. SYN flood protection You can configure Security Engines to detect SYN flood attacks. When you enable SYN flood protection on a Firewall, IPS engine, Layer 2 Firewall, or Virtual Security Engine, a log is generated if a SYN flood is detected. The engine uses the SYN cookie method to prevent SYN packets sent from spoofed IP addresses from reaching the target host. When a SYN flood attack ends, a new log event is generated. The SYN flood protection feature has been redesigned in version 5.6. The performance of SYN flood protection has been optimized for multi-core platforms and the feature activation has been simplified. You can define SYN flood protection settings as part of general DoS Protection settings in the engine properties. You can override the general DoS Protection settings in Access rules. Protection against slow HTTP requests You can configure the Security Engines to detect very slow HTTP GET or POST requests that may indicate an attack against web applications and may cause a DoS situation. The engine uses a faster timeout for HTTP connections if the HTTP GET and POST requests are very slow. You can define protection against slow HTTP requests as part of general DoS Protection settings in the engine properties. You can override the general DoS Protection settings in Access rules. VLAN Interface support for IPS engines and Layer 2 Firewalls You can now use VLAN Interfaces and re-tag network traffic on IPS engines and Layer 2 Firewalls. The settings are configured in the engine properties. Ethernet MTU can be defined for IPS engine and Layer 2 Firewall interfaces The Ethernet Maximum Transmission Unit (MTU) can now be defined for IPS engine and Layer 2 Firewall interfaces in the engine properties. Improved connection tracking configuration for IPS engines and Layer 2 Firewalls You can now choose between three connection tracking modes (Strict, Normal, and Loose) in the engine properties. You can override the engine-specific setting in Access rules. Interface link aggregation improved for Firewalls Interface link aggregation performance has been improved in this major version. 3

4 Known limitations High-Security Inspection Policy and Strict TCP mode are not supported in asymmetrically routed networks in IPS and Layer 2 Firewall roles The High-Security Inspection Policy and Strict TCP mode are not supported in asymmetrically routed networks or in environments where an NG in the IPS or Layer 2 Firewall role is directly connected to a load-balancing or High Availability network device. It is recommended to base policies on the Medium-Security Inspection Policy in such cases. In Strict TCP mode and in the High-Security Inspection Policy, the engine controls the progress of a TCP connection and checks that the TCP handshake proceeds according to the TCP protocol. The same engine node must be able to see all the packets in the connection. In Strict TCP mode, the engine also enforces the packet direction (for example, SYN and SYN-ACK packets are not allowed from the same interface). The TLS inspection and URL filtering features use Strict TCP mode and are not supported in asymmetrically routed networks in the IPS and Layer 2 Firewall roles. SSL/TLS inspection and web filtering are not supported in capture (IDS) mode The TLS inspection and URL filtering features are not supported in capture (IDS) mode. Inline Interface Disconnect Mode in IPS role The Inline Interface Disconnect Mode is not supported on IPS Virtual Appliances, IPS software installations, appliance models other than IPS-6xxx, or modular appliance models on bypass NIC modules. Resolved issues These issues have been resolved since version NG For a list of issues that have been fixed in earlier releases, see the Release Notes for the specific release. Issue Role Description NAT might not be applied correctly to VPN connections or VPN connections might not fail over correctly in Firewall Cluster (#109235) Engine may reboot when SIP Protocol Agent is used together with NAT (#112356) VPN related logging can cause performance issues for all traffic (#113462) A Firewall Cluster might apply NAT incorrectly to VPN connections or VPN connections might not fail over correctly in the Firewall Cluster. The engine may reboot when both the SIP Protocol Agent and NAT are applied to connections. Collecting VPN related log data can produce extra diagnostics messages to the engine console. The following types of log messages are shown in the console: "SG: MISP: could not find logical tunnel XX, (skb vpn=x, tunnel_id=xx)." Printing many of these extra diagnostics messages causes all traffic through the engine to slow down. Related connections for active mode FTP might not work when deep inspection is applied on clusters in load balancing mode (#113653) VPN process may restart (#113662) Session limiting may cause high load on engine (#114049) L2 IPS When deep inspection is applied to a connection for active mode FTP, NAT might be incorrectly applied to related connections on clusters in load balancing mode. The VPN process may restart on engine in some rare user authentication related error situations. Session limiting may cause high load on the engine.

5 Engine might reboot when inspecting tunneled traffic (#114225) Browser-based user authentication process might restart (#114325) IPv6 address information for VLAN Interfaces might not be configured correctly on engines (#114352) Virtual Security Engines might not handle VPN traffic correctly when deep inspection is in use (#114430) Next Generation Firewall 3206 appliances can map some interface modules incorrectly (#114624) Engine might not recover automatically when memory has run out (#114685) L2 IPS L2 IPS L2 IPS L2 IPS In some rare situations, an engine might reboot when it inspects tunneled traffic. Workaround: Contact McAfee Support for a workaround. The browser-based user authentication process might restart. In some situations, VLAN Interfaces might not be configured correctly on the engine. This can result in missing IPv6 address information. Virtual Security Engines might not handle VPN traffic correctly when deep inspection is also applied to the VPN traffic. As a result, VPN connections can be slow. You might see log entries in the console similar to: "ssh_interceptor_route_input_ipv4: failed to find net_device for ifnum 'XX' in VE 'X'". McAfee Next Generation Firewall 3206 appliances can map some interface modules incorrectly, for example, the 4-port SFP module or the 4-port bypass module. If the interface module is inserted in slot 2, for example, new network interfaces are numbered eth3_x. This only affects revisions 0 (and possibly 1) of the appliance. Workaround: Contact McAfee Support for a workaround to copy a custom mapping to the engine. The engine might not recover automatically from situations where the engine runs out of memory. Workaround: Reboot the engine. 5

6 System requirements McAfee NG appliances Appliance model Supported roles -315 MIL-320 L321 NGF321, IPS, and Layer 2 Firewall L325 NGF325, IPS, and Layer 2 Firewall IPS-1030 IPS and Layer 2 Firewall IPS-1060 IPS and Layer 2 Firewall IPS-1205 IPS and Layer 2 Firewall 1035, IPS, and Layer 2 Firewall 1065, IPS, and Layer 2 Firewall 1301, IPS, and Layer 2 Firewall 1302, IPS, and Layer 2 Firewall 1402, IPS, and Layer 2 Firewall 3201, IPS, and Layer 2 Firewall 3202, IPS, and Layer 2 Firewall 3205, IPS, and Layer 2 Firewall 3206, IPS, and Layer 2 Firewall 5201, IPS, and Layer 2 Firewall 5205, IPS, and Layer 2 Firewall 5206, IPS, and Layer 2 Firewall Some features in this release are not available for all appliance models. See and for up-to-date appliance-specific software compatibility information. McAfee appliances support only the software architecture version (32-bit or 64-bit) that they are shipped with. Certified Intel platforms McAfee has certified specific Intel-based platforms for the Next Generation Firewall. Tested platforms can be found from McAfee Support Knowledge Center ( under the Next Generation Firewall product. We strongly recommend using certified hardware or a pre-installed McAfee appliance as the hardware solution for new McAfee NG installations. If it is not possible to use a certified platform, the NG can also run on standard Intel-based hardware that fulfills the hardware requirements.

7 Basic NG hardware requirements Intel Core 2 / Intel Xeon based hardware IDE hard disk (IDE RAID controllers are not supported) and CD-ROM drive Memory: 2 GB RAM minimum for 32-bit (i386) installation 8 GB RAM minimum for 64-bit (x86-64) installation VGA-compatible display and keyboard One or more certified network interfaces for the role 2 or more certified network interfaces for IPS with IDS configuration 3 or more certified network interfaces for Inline IPS or Layer 2 Firewall For more information on certified network interfaces, see Requirements for Master Engines Each Master Engine must run on a separate physical NG device. For more details, please read the hardware requirements document at All the Virtual Security Engines hosted by a Master Engine or Master Engine cluster must have the same role and the same Failure Mode ( fail-open or fail-close ). Master Engines can allocate VLANs or interfaces to Virtual Security Engines. If the Failure Mode of the Virtual IPS engines or Virtual Layer 2 Firewalls is Normal (fail-close) and you want to allocate VLANs to several engines, you must use the Master Engine cluster in standby mode. Cabling requirements for Master Engine clusters that host Virtual IPS engines or Layer 2 Firewalls: Failure Mode Bypass (fail-open) requires IPS serial cluster cabling. Failure Mode Normal (fail-close) requires Layer 2 Firewall cluster cabling. For more information on cabling, see the McAfee NG Reference Guide for IPS and Layer 2 Firewall Roles. Requirements for Virtual Appliance Nodes VMware ESXi versions 5.1 and GB virtual disk 1 GB RAM minimum, 2 GB recommended if inspection is used A minimum of one virtual network interface for the role, three for IPS or Layer 2 Firewall roles The following limitations apply when a McAfee NG is run as a virtual appliance node in the role: Only Packet Dispatching CVI mode is supported. Only Standby clustering mode is supported. Heartbeat requires a dedicated non-vlan-tagged interface. The following limitations apply when a McAfee NG is run as a virtual appliance node in the IPS or Layer 2 Firewall role: Clustering is not supported. 7

8 Installation instructions Note The sgadmin user is reserved for McAfee use on Linux, so it must not exist before the McAfee Security Management Center is installed for the first time. The main installation steps for the McAfee Security Management Center (SMC) and the NG engines are as follows: 1. Install the Management Server, the Log Servers, and optionally the Web Portal Servers and the Authentication Servers. 2. Import the licenses for all components (you can generate licenses at 3. Configure the Firewall, IPS, or Layer 2 Firewall elements with the Management Client using the Security Engine Configuration view. 4. Generate initial configurations for the engines by right-clicking each Firewall, IPS, or Layer 2 Firewall element and selecting Save Initial Configuration. 5. Make the initial connection from the engines to the Management Server and enter the one-time password provided during Step Create and upload a policy on the engines using the Management Client. The detailed installation instructions can be found in the product-specific installation guides. For a more thorough explanation of using the McAfee Security Management Center, refer to the Management Client Online Help or the McAfee SMC Administrator s Guide. For background information on how the system works, consult the McAfee SMC Reference Guide. All guides are available for download at Upgrade instructions McAfee NG version requires an updated license if upgrading from version 5.6.x or earlier. The license upgrade can be requested at Install the new license using the Management Client before upgrading the software. The license is updated automatically by the SMC if communication with McAfee servers is enabled and the maintenance contract is valid. Note The anti-virus engine changes from ClamAV to McAfee when upgrading from a version earlier than to version or later. To upgrade and maintain anti-virus scanning capability, these steps must be taken: 1. Upgrade the SMC to version 5.7 or later and the engine to version or a later 5.5 version. 2. Before upgrading the engine, issue this command for each engine in the Monitoring view in the Management Client: Commands Update Anti-Virus Database. 3. Wait until the Appliance Status monitoring confirms that the new anti-virus signature database has been downloaded. 4. Upgrade the engine using the remote upgrade feature normally. If the engine does not have the new anti-virus database available before the upgrade, the upgrade can be done but it takes some time before anti-virus is operational again after the upgrade. To upgrade the engine, use the remote upgrade feature or reboot from the installation CD and follow the instructions. Detailed instructions can be found in the McAfee NG Installation Guide for Role and the McAfee NG Installation Guide for IPS and Layer 2 Firewall Roles. Note McAfee NG appliances support only the software architecture version that they are pre-installed with. 32-bit versions (i386) can only be upgraded to another 32-bit version and 64-bit versions (x86-64) can only be upgraded to another 64-bit version. Clusters can only have online nodes using the same software architecture version. State synchronization between 32-bit and 64-bit versions is not supported. Changing architecture for third-party server machines using software licenses requires full re-installation using a CD. Upgrading to any 5.7.x version is only supported from a 5.5.x, 5.6.x, or 5.7.x version. If you are running an earlier version, upgrade first to the latest 5.5.x version following the instructions in the release notes for that version.

9 Note If you have not changed the root password since engine version 4.x, change the root password before upgrading using the sg-reconfigure tool or the Management Client. If the upgrade is done without changing the root password, root login to the engine does not work after upgrading to or a later version until the password has been reset in the Management Client. It is recommended to change the root password in any case, as the salted hash of the root password is stored using a stronger hash (SHA-512) in versions and later. Additional information In this major version New brand Stonesoft Management Center is now called McAfee Security Management Center. At the same time, we have changed the main application icons, the OS level icons, the look and feel of the SMC installer, the login page, the Getting Started page, the Web Start page, the Web Portal, the browser-based user authentication pages, the Online Help, and the SMC API documentation pages. We have also updated the Windows Service names and the default installation folder paths. The Security Engine product name has also changed in this release. The Security Engine is now known as the McAfee Next Generation Firewall or NG. NG engines are still represented by Security Engine elements in the Management Client. Build version McAfee Next Generation Firewall version build version is Product Binary Checksums sg_engine_ _i386.iso 61e6a19d807d73d771b11e80ea298c08ef507e3f 6955c8e9e19db5abc667a33939d6cb4a6462ddb9a6f bdf35c680a9b b4a7037f2b873 ee523ed5b342d b6b2ba299a3627ad79eea sg_engine_ _i386.zip b d7ca6f25cc8e027f507103b35973ee6b 3ad6ab78629d9fc80bc636cce8a7e1206ae34bb77a96db8c3f1948a34d38032a de8ee225eba518 aa269cab7b9c7c6daf dc9dd847fb14f05 sg_engine_ _x86-64.iso ba864ababe2d347a15f6ae21358be0319f58fea4 8fa7fcc5eed86da6f7de9460db7ccd8bff e94cff794a92fcd675973d68cbcefb295ae6b24ed5d0c2b 21c410cae15b1ab924cf f29371db70e sg_engine_ _x86-64.zip ed31e12fb2b6f80d4aac2dd5ce4c7cffe3302b29 9b7ab4dcb64da560d044cac9f3a4116c9d6a279ae8e05f355086eb62bf8bdb49b8f80912ba7ed26cb4f5ce0 9

10 Compatibility 49c1b758be536c2c526ae2e64d84fdbfd1b00407a sg_engine_ _x86-64-small.iso 03c38eb18ec249ca48b0c28da6a4027fe3ce05dc 9b88e6a6a23d1c805967ef56d97dd917edaa08906de3b c3774c33c582597a4c2b02ffcdf215f38e 0d5deb81c93b093e2c9cd094b0964b84ca27ce3fa sg_engine_ _x86-64-small.zip 2b6a f9aac51dd32b40c5c16578c0fbf3c 76e8390eecdbe143301cca498cc9559c00ce4f6e8b71c27d6fbd4a9141f840fb178b457b30c401b07f150ffd 49edb3aed f2dea bc2caaaab3 Minimum McAfee NG version is compatible with the following component versions: McAfee Security Management Center or later Dynamic Update 545 or later Stonesoft IPsec VPN Client or later Server Pool Monitoring Agent or later User Agent or later Known issues The current important known issues of McAfee NG version are described in the table below. Issue Role Description Link aggregation issues (#109104) The interface link aggregation driver has issues that affect proper LACP operation. The drivers are updated in NG versions and higher. Find product documentation McAfee provides the information you need during each phase of product implementation, from installation to daily use and troubleshooting. After a product is released, information about the product is entered into the online Knowledge Center. 1. Go to the McAfee ServicePortal at and click Knowledge Center. 2. Enter a product name, select a version, then click Search to display a list of documents.

11 Copyright 2015 McAfee, Inc. Do not copy without permission. McAfee and the McAfee logo are trademarks or registered trademarks of McAfee, Inc. or its subsidiaries in the United States and other countries. Other names and brands may be claimed as the property of others. 00-A 11