McAfee Network Security Platform 9.2

Transcription

1 Revision B McAfee Network Security Platform 9.2 ( Manager-Virtual IPS Release Notes) Contents About this release New features Enhancements Resolved issues Installation instructions Known issues Product documentation About this release This document contains important information about the current release. We recommend that you read the whole document. Network Security Platform follows a release process that is based on customer requirements and best practices followed by other McAfee teams. For details, read KB This release of Network Security Platform is to provide new features and enhancements on the Manager and Virtual IPS Sensor software. Release parameters Version Network Security Manager software Signature Set Virtual IPS Sensor software Virtual Network Security Platform Controller (022618a) Virtual Network Security Platform Probe

2 Currently port 4167 is used as the UDP source port number for the SNMP command channel communication between Manager and Sensors. This is to prevent opening up all UDP ports for inbound connectivity from SNMP ports on the Sensor. Older JRE versions allowed the Manager to bind to the same source port 4167 for both IPv4 and IPv6 communication. But with the latest JRE version 1.8.0_153, it is no longer possible to do so, and the Manager uses port 4166 as the UDP source port to bind for IPv6. Manager 9.2 uses JRE version 1.8.0_153 and MySQL version If you have IPv6 Sensors behind a firewall, you need to update your firewall rules accordingly such that port 4166 is open for the SNMP command channel to function between those IPv6 Sensors and the Manager. Manager software version 9.2 is not supported on McAfee-built Dell-based Manager Appliances. McAfee recommends that you use Intel-based Manager Appliances instead. Upgrade support McAfee regularly releases updated versions of the signature set. You can choose to automatically download and deploy the signature set in the Manager. Consider the following before upgrading to Network Security Manager version 9.2: This release is for ESX, AWS, and Azure environments only. You have to follow the specified sequence while upgrading the components deployed in an AWS environment. For the upgrade sequence in an AWS deployment, see the section Upgrade AWS components in McAfee Network Security Platform 9.2 Installation Guide. Upgrade for IPS-VM600 from Sensor software versions 8.1, 8.3, or 9.1 to Sensor software version 9.2 is not supported due to increased Sensor image size. For more information, see the section Upgrade consideration for Virtual Sensors deployed in ESX in the McAfee Network Security Platform 9.2 Installation Guide. Upgrade paths for Manager software versions Current version Upgrade path to , , , , , , , , , , , , , , , , , Virtual IPS: All intermediate Manager versions, such as Hotfixes, below must upgrade to before upgrading to the latest 9.2 Manager version. All Manager versions above can directly upgrade to the latest 9.2 Manager version. Current version Upgrade path to , , , , , , , , , , All intermediate Sensor software versions for Virtual IPS, such as Hotfixes, can directly upgrade to the latest 9.2 Sensor software version. 2

3 Heterogeneous support This version of 9.2 Manager software can be used to configure and manage the following devices: Device NS-series Sensors (NS3100, NS3200, NS5100, NS5200, NS7100, NS7200, NS7300, NS9100, NS9200, NS9300) Version 8.1, 8.3, 9.1, 9.2 Virtual IPS for ESXi server (IPS-VM100, IPS-VM600) IPS-VM100: 8.1, 8.3, 9.1 Virtual IPS for KVM (IPS-VM100, IPS-VM600) 8.3 Virtual IPS for VMware NSX (IPS-VM100-VSS) 8.1, 8.3, 9.1 IPS-VM600: 8.1, 8.3, 9.1, 9.2 Virtual IPS for AWS (IPS-VM100-VSS, IPS-VM600-VSS) IPS-VM100-VSS: 8.3, 9.1 Virtual IPS for Azure (IPS-VM600-VSS) 9.2 M-series Sensors (M-1250, M-1450, M-2850, M-2950, M-3050, M-4050, M-6050, M-8000) IPS-VM600-VSS: , 8.3, 9.1 Mxx30-series Sensors (M-3030, M-4030, M-6030, M-8030) 8.1, 8.3, 9.1 M-8000XC Cluster Appliance 8.1, 8.3, 9.1 NTBA Appliances (T-200, T-500, T-600, T-1200) 8.1, 8.3, 9.1 Virtual NTBA Appliances (T-VM, T-100VM, T-200VM) 8.1, 8.3, 9.1 Integration support The above mentioned Network Security Platform software versions support integration with the following product versions: Table 1-1 Network Security Platform compatibility matrix Product Version supported McAfee epo 5.9.1, 5.9.0, McAfee Global Threat Intelligence McAfee Endpoint Intelligence Agent 2.6 McAfee Logon Collector Compatible with all versions McAfee Threat Intelligence Exchange 2.1.1, 2.1.0, McAfee Data Exchange Layer 4.0.0, McAfee Advanced Threat Defense McAfee Virtual Advanced Threat Defense McAfee MOVE AntiVirus Agentless 4.6 McAfee MOVE AntiVirus Multi-Platform McAfee Vulnerability Manager 7.5 McAfee Host Intrusion Prevention 8.0 3

4 Feature list with supported Sensor models Feature Supported Sensor model Securing Azure public cloud IPS-VM600-VSS 1 Gbps Sensor throughput in AWS IPS-VM600-VSS Integration with Private Global Threat Intelligence (GTI) Cloud IPS-VM600 Device Manager IPS-VM600, IPS-VM600-VSS IAM role for authentication in AWS IPS-VM600-VSS Whitelist and blacklist enhancements IPS-VM600, IPS-VM600-VSS Domain name exceptions enhancements IPS-VM600, IPS-VM600-VSS Performance Charts enhancements IPS-VM600, IPS-VM600-VSS New features This release of Network Security Platform includes the following new features: Securing Azure public cloud The public cloud domain has many cloud service providers. Microsoft Azure is one of the upcoming public cloud platforms that is fast gaining the market. Azure is mainly an application platform for the public cloud which helps users create and run applications easily. Since applications can be created on-the-go, security for applications is a primary concern for users. You can deploy Network Security Platform solution in Azure cloud to protect all your applications and data in public cloud. The Virtual IPS Sensors deployed in Azure environment protect the virtual machines which are a part of a resource group. The Virtual Probe installed on the virtual machines directs the traffic to the Virtual IPS Sensors. The Sensor inspects traffic and an alert is generated in case of an attack. The vnsp Controller deployed in Azure environment establishes the communication channel between the Sensor and the Virtual Probes. Policies are created and enforced on Virtual IPS Sensors and vnsp Clusters through the Network Security Manager thereby giving you the ability to block, send an alert, or drop packets as you would in a physical environment. You can deploy the Manager both on-premises or in Azure cloud. For more information on deploying the vnsp solution in Azure cloud, see McAfee Network Security Platform 9.2 Virtual IPS Administration Guide. 1 Gbps Sensor throughput in AWS In earlier release, Virtual IPS Sensor instance in AWS environment had a throughput of 600 Mbps. With release 9.2, the Virtual IPS Sensor instance deployed in AWS environment has a throughput of 1Gbps. The new Sensor model deployment requires a c4.xlarge instance type with 7.5 GB memory. The Sensor contains 4 logical CPU cores. For more information, see McAfee Network Security Platform 9.2 Virtual IPS Administration Guide. Integration with Private Global Threat Intelligence (GTI) Cloud With this release, Network Security Platform supports integration with McAfee Private Global Threat Intelligence (GTI) Cloud. The Private GTI Cloud offers the option to utilize McAfee s GTI information in your private cloud environment. You can configure Private GTI Cloud to provide reputation scores to the malware files. Network Security Platform Sensors can be configured to send threat information to the Private GTI Cloud instead of the Public GTI Cloud. File reputation and IP reputation scores is retrieved from the private cloud based on which rules and policies can be configured to prevent attacks. 4

5 To configure the GTI Private Cloud, go to Manager <Admin Domain Name> Integration GTI. Telemetry You can configure the telemetry information sent to the McAfee GTI Cloud. When McAfee GTI Cloud is enabled, information about alerts, features, Sensor version, and Manager version are sent to GTI cloud. You can view the details sent to GTI Cloud from the Manager. In previous releases, the telemetry information sent to McAfee GTI Cloud could be viewed in the GTI integration page. With release 9.2, telemetry information can be viewed under Manager <Admin Domain Name> Setup Telemetry. The options to configure the information sent to McAfee GTI Cloud remains the same. When enabled, the show gti config CLI command is enhanced to display the configuration details for Private GTI cloud. For more information about telemetry, see McAfee Network Security Platform 9.2 Integration Guide. Device Manager The Device Manager page provides information about all the devices configured in the Manager. It lists the device information, software, health, status, and so on. NS-series Sensors, M-series Sensors, Mxx30 Sensors, Virtual IPS Sensors, NTBA Appliances, and HIPS devices are displayed in the Device Manager page. It displays the devices configured in an admin domain including the devices configured in the child admin domains. You can view the faults generated for the devices and directly navigate to the System Faults page to view the faults. The Device Manager page does not display details for XC Cluster devices. For more information on Device Manager, see McAfee Network Security Platform 9.2 Manager Administration Guide. Enhancements This release of Network Security Platform includes the following enhancements: IAM role for authentication in AWS Previously, AWS authentication in the Manager was based on access key. This required AWS access key and secret key that is generated when an AWS account is created. To make the authentication more secure, IAM role based authentication is available in release 9.2. When a Network Security Manager is deployed in AWS as an instance, the IAM role authentication is automatically detected for authentication. When a Manager instance is deployed in AWS, the IAM role has to be assigned to it for authentication. The access key method authentication is used for on-premises Network Security Managers. To create a vnsp Controller using IAM role based authentication, go to Devices <Admin Domain Name> Global vnsp Controllers. For more information, see McAfee Network Security Platform 9.2 Virtual IPS Administration Guide. Whitelist and blacklist enhancements With release 9.2, you can edit whitelist and blacklist file hashes. When you double-click on a file hash, a details panel opens on the right side of the page. You can edit the name and comment for the file hash and save. You can now manually add whitelist and blacklist file hash to the records. To manage the whitelist and blacklist file hashes, go to Policy <Admin Domain Name> Intrusion Prevention Exceptions File Hashes. 5

6 For more information, see McAfee Network Security Platform 9.2 Integration Administration Guide. Domain name exceptions enhancements The Callback Detection whitelist is a global list that overrides the botnet DAT list provided with the Callback Detectors bundle. The IPS Inspection list is provided by McAfee that is used by the Sensor for inspection. In the previous release, IPS Inspection whitelist was a view only list provided by McAfee. With release 9.2, you can add new domain names to the list and also edit the existing domain names available in the list. The Domain Type option is displayed if you added the domain name or if the domain name was provided by McAfee. The domain exceptions list is available under Policy <Admin Domain Name> Intrusion Prevention Exceptions Domain Names. With release 9.2, you can perform the following actions in the Whitelist - IPS Inspection tab: Enable/disable domain names Import/export customized domain names list Delete the customized list. The default domain name provided by McAfee cannot be deleted. For more information, see McAfee Network Security Platform 9.2 Integration Administration Guide. Performance Charts enhancements With release 9.2, the performance charts have been enhanced to provide in-depth view of the metrics. A zoom in option is available that helps you view a portion of the chart in detail. Previously only summarized data was displayed in the performance charts. With release 9.2, there is an option to view the raw data as well. The raw data displays the average of three minute intervals of data points. Whereas the summarized data displays the summarized data for an hour for the metric selected. You can view the maximum, average, and minimum values for the summarized data. An Actions option is available in the Performance Charts page where you can save the chart an image, or navigate to the Performance Metrics page to edit the metric collection and data storage. For more information on performance charts, see McAfee Network Security Platform 9.2 IPS Administration Guide. IPS CLI enhancements Following new Sensor CLI commands are available: Table 3-1 Normal Mode CLI Command set hypervisor server ip show ssl config show suricata enginestats show suricata sbstats Description Sets the IPv4 or IPv6 address for the hypervisor server. Shows the configuration details for SSL on the Sensor. Displays the statistics of the Suricata Snort engine. Displays the rule, packet, and alert statistics of the Suricata Snort engine. 6

7 Following Sensor CLI commands are updated: Table 3-2 Normal Mode CLI Command clear gti server Description This command works only for the Public GTI cloud and only when the Private GTI cloud is disabled in the Manager. resolve gti server This command works only for the Public GTI cloud and only when the Private GTI cloud is disabled in the Manager. set gtiserver ip show gti config Following Sensor CLI commands are removed: Table 3-3 Normal Mode CLI Command clear tcp-proxy statistics increasemgmtprocessing show powersupply Table 3-4 Debug Mode CLI Command clearactiveflows flashcheck reset ratelimitstats show fe stat show feswitch port show gmac show ratelimit drops show ratelimit markstats This command works only for the Public GTI cloud and only when the Private GTI cloud is disabled in the Manager. Output displays both Public and Private GTI could configuation information. For more information, see McAfee Network Security Platform 9.2 CLI Guide. Product integration With this release, Network Security Platform supports integration with following products release versions: MOVE Agentless 4.6 MOVE Multi-platform McAfee Data Exchange Layer McAfee Virtual Advanced Threat Defense version McAfee Threat Intelligence Exchange version For more information on the product integration, see McAfee Network Security Platform 9.2 Integration Guide. 7

8 Resolved issues The current release of the product resolves these issues. For a list of issues fixed in earlier releases, see the Release Notes for the specific release. Resolved Manager software issues This release does not contain any resolved issues for the Manager. Resolved Sensor software issues The following table lists the medium-severity Sensor software issues: ID # Issue Description The connections are dropped incorrectly as the Layer 7 DoS response action is ignored Packet log is not available in the Manager for the attack TFTP: TFTP Server Error Packet Handling Buffer Overflow The Sensor health goes to a bad state due to an error from the datapath processor after a configuration update. 8

9 Installation instructions Manager server/client system requirements The following table lists the 9.2 Manager server requirements: Operating system Minimum required Any of the following: Windows Server 2008 R2 Standard or Enterprise Edition, English operating system, SP1 (64-bit) (Full Installation) Windows Server 2008 R2 Standard or Enterprise Edition,, SP1 (64-bit) (Full Installation) Windows Server 2012 R2 Standard Edition (Server with a GUI) Windows Server 2012 R2 Standard Edition (Server with a GUI) Windows Server 2012 R2 Datacenter Edition (Server with a GUI) Windows Server 2012 R2 Datacenter Edition (Server with a GUI) Windows Server 2016 Standard Edition (Server with a GUI) Windows Server 2016 Standard Edition (Server with a GUI) Windows Server 2016 Datacenter Edition (Server with a GUI) Windows Server 2016 Datacenter Edition (Server with a GUI) Only X64 architecture is supported. Recommended Windows Server 2016 Standard Edition operating system Memory 8 GB Supports up to 3 million alerts in Solr. >16 GB Supports up to 10 million alerts in Solr. CPU Server model processor such as Intel Xeon Same Disk space 100 GB 300 GB or more Network 100 Mbps card 1000 Mbps card Monitor 32-bit color, 1440 x 900 display setting 1440 x 900 (or above) The following are the system requirements for hosting Central Manager/Manager server on a VMware platform. 9

10 Table 5-1 Virtual machine requirements Component Minimum Recommended Operating system Any of the following: Windows Server 2008 R2 Standard or Enterprise Edition,, SP1 (64-bit) (Full Installation) Windows Server 2008 R2 Standard or Enterprise Edition,, SP1 (64-bit) (Full Installation) Windows Server 2012 R2 Standard Edition (Server with a GUI) Windows Server 2012 R2 Standard Edition (Server with a GUI) Windows Server 2012 R2 Datacenter Edition (Server with a GUI) Windows Server 2012 R2 Datacenter Edition (Server with a GUI) Windows Server 2016 Standard Edition (Server with a GUI) Windows Server 2016 Standard Edition (Server with a GUI) Windows Server 2016 Datacenter Edition (Server with a GUI) Windows Server 2016 Datacenter Edition (Server with a GUI) Only X64 architecture is supported. Windows Server 2016 Standard Edition operating system Memory 8 GB >16 GB Supports up to 3 million alerts in Solr. Supports up to 10 million alerts in Solr. Virtual CPUs 2 2 or more Disk Space 100 GB 300 GB or more Table 5-2 VMware ESX server requirements Component Minimum Virtualization software ESXi 5.5 Update 3 ESXi 6.0 Update 1 ESXi

11 The following table lists the 9.2 Manager client requirements when using Windows 7, Windows 8, or Windows 10: Operating system Minimum Windows 7, English or Japanese Windows 8, English or Japanese Windows 8.1, English or Japanese Windows 10, English or Japanese The display language of the Manager client must be same as that of the Manager server operating system. Recommended Windows 10, English or Japanese RAM 2 GB 4 GB CPU 1.5 GHz processor 1.5 GHz or faster Browser Internet Explorer 10, 11 Mozilla Firefox Google Chrome (App mode in Windows 8 is not supported) Internet Explorer 11 Mozilla Firefox 20.0 or later Google Chrome 24.0 or later To avoid the certificate mismatch error and security warning, add the Manager web certificate to the trusted certificate list. For the Manager client, in addition to Windows 7, Windows 8, Windows 8.1 and Windows 10, you can also use the operating systems mentioned for the Manager server. The following are Central Manager and Manager client requirements when using Mac: Mac operating system Yosemite El Capitan Browser Safari 8 or 9 For more information, see McAfee Network Security Platform Installation Guide. Known issues For a list of known issues in this product release, see this McAfee KnowledgeBase article: Network Security Platform software issues: KB90337 Product documentation Every McAfee product has a comprehensive set of documentation. Find product documentation Go to docs.mcafee.com to find the product documentation for this product. 11

12 Or 1 Go to the McAfee ServicePortal at and click Knowledge Center. 2 Enter a product name, select a version, then click Search to display a list of documents. 9.2 product documentation list The following software guides are available for Network Security Platform 9.2 release: Quick Tour Virtual IPS Administration Guide Installation Guide (includes Upgrade Guide) CLI Guide Manager Administration Guide Integration Guide Custom Attack Definitions Guide Best Practices Guide Manager API Reference Guide Troubleshooting Guide IPS Administration Guide Copyright 2018 McAfee, LLC McAfee and the McAfee logo are trademarks or registered trademarks of McAfee, LLC or its subsidiaries in the US and other countries. Other marks and brands may be claimed as the property of others. 0B00