McAfee Network Security Platform

Transcription

1 Revision B McAfee Network Security Platform ( M-series Release Notes) Contents About this release New features Enhancements Resolved issues Installation instructions Known issues Product documentation 1

2 About this release This document contains important information about the current release. We strongly recommend that you read the entire document. This maintenance release of Network Security Platform is to provide few enhancements and fixes on the Sensor software. Network Security Manager software version: Signature Set: M-series Sensor software version: Network Security Platform version 8.1 replaces 8.0 release. If you are using version 8.0 and require any fixes, note that the fixes will be provided in version 8.1. There will not be any new maintenance releases or hot-fix releases on version 8.0. With release 8.1, Network Security Platform no longer supports the Network Access Control module and N-series Sensors. If you are using Network Access Control with N-series (NAC-only) Sensors, McAfee recommends that you continue to use the version. If you are using the Network Access Control module in M-series Sensors, continue to use the version. That is, you should not upgrade the Manager or the Sensors to 8.1 for such cases. Manager software version 7.5 and above are not supported on McAfee-built Dell based Manager Appliances. This version of 8.1 Manager software can be used to configure and manage the following hardware: 7.1, 7.5, and 8.1 M series and Mxx30-series Sensors 8.1 Virtual IPS Sensors 7.1 and 8.1 NS-series Sensors 7.1, 7.5, and 8.1 XC Cluster Appliances 7.1, 7.5, and 8.1 NTBA Appliance software (Physical and Virtual) 7.1 I-series Sensors Currently port 4167 is used as the UDP source port number for the SNMP command channel communication between Manager and Sensors. This is to prevent opening up all UDP ports for inbound connectivity from SNMP ports on the sensor. Older JRE versions allowed the Manager to bind to the same source port 4167 for both IPv4 and IPv6 communication. But with the latest JRE version 1.7.0_45, it is no longer possible to do so, and the Manager uses port 4166 as the UDP source port to bind for IPv6. Manager 8.1 uses JRE version 1.7.0_51. If you have IPv6 Sensors behind a firewall, you need to update your firewall rules accordingly such that port 4166 is open for the SNMP command channel to function between those IPv6 Sensors and the Manager. New features This release is to provide few bug fixes for some of the previously known Sensor software issues, and does not include any new feature. 2

3 Enhancements This release of Network Security Platform includes the following enhancements: L3/L4 error count enhancement Previously, the error count for L3/L4 errors in a SPAN port could not be viewed even when the errors sometimes crossed the specified threshold limit. With this maintenance release, a new counter, getl3l4errordropcount in the debug command show all datapath error-counters, provides the error count for the L3/L4 errors. SNMP OID enhancement With this release, certain system parameters like the free memory, cache memory and buffer memory are monitored. The following SNMP OIDs are supported with regard to system monitoring: Control Path System Free Memory Control Path System Cached Memory Control Path System Buffer Memory bit certificates for encryption The Manager and Sensor have so far established trust using 1024-bit certificates. With the growing need for enhanced security, this connection is being upgraded to be encrypted using 2048-bit certificates. Network Security Platform 8.1 supports heterogeneous environments, which accommodate both 1024-bit and 2048-bit encryption. That is, the Manager is both 1024 and 2048-bit capable, and can be used to manage Sensors running on 2048-bit capable and/or 1024-bit capable software versions. Trust establishment after upgrade is discussed below for each instance: 1024-bit encryption When a Sensor with software that does not support 2048-bit encryption is loaded and the Manager is upgraded to a version that supports 2048-bit encryption, the Sensor can establish trust with the Manager using 1024-bit certificates bit encryption Both the 8.1 Manager and Sensor software support trust establishment using 2048-bit encryption keys. During upgrade, once you have upgraded the Manager software to 8.1, the 7.x Sensors can continue to connect to the Manager by establishing trust using 1024-bit encryption. After the Sensor upgrade to 8.1 version is also complete, the Sensor will connect to the ports opened for 2048-bit encryption. Once the certificates are updated, the Sensor and Manager establish communication using 2048-bit certificates. The ports necessary for 2048-bit encryption are: Port Description 8506 Install channel (TCP) 8507 Alert channel (TCP) 8508 Packet log channel (TCP) The upgrade from 1024-bit to 2048-bit encryption is done automatically with no user intervention necessary. Once done, use the status command to view the encryption type, and show command to view the ports used for 2048-bit encryption. 3

4 For more information, see McAfee Network Security Platform 8.1 Upgrade Guide. Resolved issues These issues are resolved in this release of the product. For a list of issues fixed in earlier releases, see the Release Notes for the specific release. Resolved Manager software issues The following table lists the medium-severity Manager software issues: ID # Issue Description The Manager using Apache Struts is vulnerable to CVE The Botnet DAT update fails on multiple Sensors The effective time for Firewall and QoS policies is based on the local time zone of the corresponding Sensor The SNMP server setting configuration is not displayed after saving due to incorrect redirection SNMP alert notification fails sometimes due to incorrect calculation of the Manager uptime The Manager sends wrong port speed value to the Sensor while configuring monitoring port with SFP Alert filter in the Real-Time Threat Analyzer shows alerts from unknown country, irrespective of the source and destination countries selected The Manager raises an "INFO" alert for malicious files before the files are sent to ATD for analysis, and "HIGH" alert after the files are confirmed to be malicious by ATD. Both alerts are generated with an "Acknowledged" flag. The "Acknowledged" flag remains the same irrespective of the severity of the alert which makes it difficult to differentiate the alerts generated The Real-Time Threat Analyzer shows an error for multicast host IPv4 addresses while creating a new exception object The Protection Profile page stops responding when opened in Chrome browser and eventually leads to Java crashing The Manager fault for exceeding the 10,000 AD user groups limit is displayed incorrectly in the Manager The scheduled configuration backup cannot be restored completely due to inclusion of all the tables during backup The password control settings displays the wrong error message "minimum number of Characters should be between 1 and 20" The Real-Time Threat Analyzer triggers attack by the host even after creating an exception object The Manager's connection with XC-240 load balancer is not recovered if the link is down for more than 9 minutes When "Layer 7" data is selected to be included in the Next Generation report for alert data, the report is generated for dates not included in the report schedule Incorrect pop-up message is displayed when the SSL flow count entered is more than the maximum allowed limit Scripts for alert notification does not execute if the attack-severity variable ($ATTACK_SEVERITY$) is used The Fault Log report generates events for template Sensors of XC Cluster but no other Cluster members The Chrome browser crashes when the Manager is opened in Windows 8.0 mode. The following table lists the low-severity Manager software issues: 4

5 ID # Issue Description Malware archive fault message is misleading. Resolved Sensor software issues The following table lists the medium-severity Sensor software issues: ID # Issue Description In rare scenarios, the Sensor either goes to layer2 or reboots when new configuration updates are deployed to the Sensor When the Sensor experiences abnormal reboot, or in a failover configuration if one of the Sensor reboots, then the front end processor gets stuck in rare scenarios The SNMP Get/Walk executed on the Sensor returns the SCP file server credentials Firewall policy does not block some HTTPS applications In a rare case scenario, there is traffic delay shortly after a signature or configuration update to the Sensor Filename is missing in Malware Details section of alert details for GTI and ATD When quarantine is enabled in the connection limiting policy, the first quarantined host is not released after the specified release time ARP packets (matching the MAC flip flop event) are dropped which leads to network outage in rare scenarios. This happens when MAC flip flop attack is disabled and Heuristic Web Application Server Protection(WASP) is enabled on any interface of the Sensor After a Sensor name change, the $IV_SENSOR_NAME$ flag is not updated until Sensor reboot In rare scenario, when SSL decryption is enabled, the show sensor-load displays incorrect value of Sensor load In rare scenario, the Sensor reboots due to memory corruption in the malware detection process When the PDF emulator engine is configured for malware detection, the Sensor reboots in certain scenarios The GTI queries fail during DNS resolution when the Sensor processes CNAME instead of A record of the proxy server Layer 7 data are missing for alerts generated by ATD The Sensor throughput value is displayed as 9GB for 1GB ports in the Manager In rare scenarios, routers running EIGRP experience neighbor adjacency flap while the Sensor processes the EIGRP update packets In rare scenarios, malware detection misses can happen while processing SMTP traffic In rare scenarios, when malware policy is applied on the Sensor, the Sensor can suddenly reboot due to low memory resources [Failover] In rare scenarios, the Sensor reboots during trace upload In a rare scenario, the Sensor reboots with exception when snort signatures are present Customizing the Flow Packet logging on the Manager causes excessive packet logging from the Sensor to the Manager. This leads to database tuning failure, alert archival failure etc The Sensor causes RST packets to be sent out of order In extremely rare scenario, the traffic is not forwarded because of internal switch buffer exhaustion In rare scenario with SSL and malware functionality enabled, the SSL attacks are not detected During signature set update, the HTTP: Attempt to read password file attack may go undetected for a very short time The Sensor incorrectly raises the "HTTP: Web Application Server Attack Detected" alert occasionally, when a user edits or submits information in the internal web application. 5

6 ID # Issue Description On rare occasions, the Application Visualization feature can cause database connectivity fault with the "sumbandwidth" error In a failover pair after upgrade, the Active Fail-Open kit status switches between "Inline" and "Bypass". Installation instructions Manager server/client system requirements The following table lists the 8.1 Manager server requirements: Operating system Minimum required Any of the following: Windows Server 2008 R2 Standard or Enterprise Edition, English operating system, SP1 (64-bit) (Full Installation) Windows Server 2008 R2 Standard or Enterprise Edition, Japanese operating system, SP1 (64-bit) (Full Installation) Windows Server 2012 Standard Edition (Server with a GUI) English operating system Windows Server 2012 Standard Edition (Server with a GUI) Windows Server 2012 R2 Standard Edition (Server with a GUI) Windows Server 2012 R2 Standard Edition (Server with a GUI) Windows Server 2012 R2 Datacenter Edition (Server with a GUI) Windows Server 2012 R2 Datacenter Edition (Server with a GUI) Only X64 architecture is supported. Recommended Same as the minimum required. Memory 8 GB 8 GB or more CPU Server model processor such as Intel Xeon Same Disk space 100 GB 300 GB or more Network 100 Mbps card 1000 Mbps card Monitor 32-bit color, 1440 x 900 display setting 1440 x 900 (or above) The following are the system requirements for hosting Central Manager/Manager server on a VMware platform. 6

7 Table 5-1 Virtual machine requirements Component Minimum Recommended Operating system Any of the following: Windows Server 2008 R2 Standard or Enterprise Edition, English operating system, SP1 (64-bit) (Full Installation) Windows Server 2008 R2 Standard or Enterprise Edition,, SP1 (64-bit) (Full Installation) Windows Server 2012 Standard Edition (Server with a GUI) Windows Server 2012 Standard Edition (Server with a GUI) Windows Server 2012 R2 Standard Edition (Server with a GUI) Windows Server 2012 R2 Standard Edition (Server with a GUI) Windows Server 2012 R2 Datacenter Edition (Server with a GUI) Windows Server 2012 R2 Datacenter (Server with a GUI) Only X64 architecture is supported. Same as minimum required. Memory 8 GB 8 GB or more Virtual CPUs 2 2 or more Disk Space 100 GB 300 GB or more Table 5-2 VMware ESX server requirements Component Minimum Virtualization software ESXi 5.0 ESXi 5.1 ESXi 5.5 CPU Intel Xeon CPU ES 2.00 GHz; Physical Processors 2; Logical Processors 8; Processor Speed 2.00 GHz Memory Internal Disks Physical Memory: 16 GB 1 TB The following table lists the 8.1 Manager client requirements when using Windows 7 or Windows 8: Operating system Minimum Windows 7 English or Japanese Windows 8 English or Japanese Windows 8.1 English or Japanese The display language of the Manager client must be same as that of the Manager server operating system. Recommended RAM 2 GB 4 GB 7

8 Minimum Recommended CPU 1.5 GHz processor 1.5 GHz or faster Browser Internet Explorer 9, 10 or 11 Mozilla Firefox Google Chrome (App mode in Windows 8 is not supported) If you are using Google Chrome, add the Manager certificate to the trusted certificate list. Internet Explorer 11 Mozilla Firefox 20.0 or above Google Chrome 24.0 or above For the Manager client, in addition to Windows 7 and Windows 8, you can also use the operating systems mentioned for the Manager server. The following table lists the 8.1 Central Manager / Manager client requirements when using Mac: Mac operating system Lion Mountain Lion Browser Safari 6 or 7 For more information, see McAfee Network Security Platform Installation Guide. Upgrade recommendations McAfee regularly releases updated versions of the signature set. Note that automatic signature set upgrade does not happen. You need to manually import the latest signature set and apply it to your Sensors. The following is the upgrade matrix supported for this release: Component Minimum Software Version Manager/Central Manager software , , , , , , , , M-series Sensor software , , , , , , , Known issues For a list of known issues in this product release, see this McAfee KnowledgeBase article: Manager software issues: KB81373 M-series Sensor software issues: KB

9 Product documentation Every McAfee product has a comprehensive set of documentation. Find product documentation 1 Go to the McAfee ServicePortal at and click Knowledge Center. 2 Enter a product name, select a version, then click Search to display a list of documents. Copyright 2018 McAfee, LLC McAfee and the McAfee logo are trademarks or registered trademarks of McAfee, LLC or its subsidiaries in the US and other countries. Other marks and brands may be claimed as the property of others. 0B00