McAfee Web Gateway

Transcription

1 Relese Notes Revision C MAfee We Gtewy Contents Aout this relese Enhnement Resolved issues Instlltion instrutions Known issues Additionl informtion Find produt doumenttion Aout this relese This doument ontins informtion out the urrent relese. We strongly reommend tht you red the entire doument. MAfee We Gtewy (We Gtewy) is provided s min relese. It is mintenne version tht inludes n enhnement nd resolves issues present in previous versions. If you hve implemented onding onfigurtion, whih ws ville s n unsupported feture efore the relese of We Gtewy 7.5.2, remove ny settings of this onfigurtion efore upgrding to this new version. Otherwise you risk reting n unstle stte on the ppline. After the upgrde, you n gin implement network interfe onding s desried in the System onfigurtion hpter of the MAfee We Gtewy Produt Guide. 1

2 Enhnement This relese of the produt inludes the following enhnement. Alerts for privte key nd ertifite hndling Alerts hve een implemented tht pper fter instlling or upgrding We Gtewy if ny defult privte keys re in use on the ppline, s these must e repled with privte keys of your own to ensure we seurity. Alerts will pper with regrd to the following funtions on We Gtewy. Centrl Mngement luster Hrdwre Seurity Module SSL lient ontext settings Settings for loud single sign-on If n lert ppers, reple the privte key for the funtion tht the lert refers to. For instrutions on how to omplete the replement in eh se, see Additionl informtion t the end of this doument. Resolved issues The following issues were resolved in this relese of the produt. Bugzill referene numers re in prentheses. Network ommunition In onfigurtion tht hd n IPS sensor instlled etween two We Gtewy pplines, prtiulr IP pkets ould not e sent from one ppline to the other, s the IPS sensor dropped the pkets euse their TTL vlue ws zero. ( ) When We Gtewy ws running s proxy in diret L2 trnsprent mode, proessing FTP trffi did not work properly for pssive onnetions. ( ) We filtering Downloding file on We Gtewy ould not e ompleted, s performing nti-mlwre snning for the file with nti-mlwre heuristis enled led to timeout, whih ws due to indequte ommunition etween the ore nd nti-mlwre proesses. ( ) When We Gtewy forwrded URL to Advned Thret Defense (ATD) for dditionl snning of we ojet, the URL ontined Polish hrter tht ws not enoded ording to the ASCII formt, whih used n ATD error. ( ) Misellneous We Gtewy ws ffeted y the CVE vulnerility, whih hd n impt on the NTP pkge used for time setting. After fix ws implemented, We Gtewy is not ffeted nymore. ( ) Memory usge inresed on We Gtewy until the ore proess filed, whih ws due to memory lek tht ws triggered y the log nonymiztion feture. ( ) 2

3 Instlltion instrutions The requirements for instlling this new produt version depend on the version tht you re urrently running. 7.3.x to 7.6.x You n upgrde to the new version immeditely. See Perform n upgrde. 7.0.x to 7.2.x Complete the following steps to upgrde: 1 Crete onfigurtion kup. Use the options provided under Trouleshooting Bkup/Restore on the user interfe to rete the kup. 2 Upgrde to the new version. See Perform n upgrde. The upgrde proess inludes mjor upgrde of the operting system. It tkes severl steps nd more time thn usul. If the upgrde proess fils or is interrupted, you n re-imge the ppline using n imge of the new version nd instll the onfigurtion kup. Alterntively, you n proeed s follows when upgrding from 7.2.x or n erlier 7.x version: 1 Crete onfigurtion kup. 2 Re-imge the ppline using n imge of the new version nd instll the onfigurtion kup. 6.8.x or 6.9.x You must re-imge the ppline using n imge of the new version. Downlod n imge of the new version from the downlod pge of the MAfee Content & Cloud Seurity Portl t For more informtion out re-imging, see the MAfee We GtewyInstlltion Guide. Perform n upgrde You n upgrde to the new version on the user interfe or from system onsole. Upgrde on the user interfe You n work with the options of the user interfe to perform the upgrde. 1 Selet Configurtion Applines. 2 On the pplines tree, selet the ppline you wnt to perform the upgrde on. The ppline toolr ppers on the upper right of the t. 3 Clik Updte Appline Softwre. The upgrde to the new version is performed. The upgrde proess lso logs you off from the user interfe. 4 Proeed in one of the following wys to omplete the instlltion. When upgrding from 7.3.x or ny lter version: 1 Wit until messge informs you tht the upgrde hs ompleted nd logon utton ppers. 2 Log on to the user interfe gin. 3

4 3 Selet Configurtion Applines, then selet your ppline. 4 On the ppline toolr, lik Reoot. When the restrt hs ompleted, logon utton ppers. You n now log on to the user interfe gin nd strt working with the new version. When upgrding from 7.2.x or ny erlier 7.x version: The ppline restrts utomtilly fter eh of the two upgrde phses tht re performed. When the seond restrt hs ompleted, logon utton ppers. You n now log on to the user interfe gin nd strt working with the new version. Upgrde from system onsole You n upgrde from lol system onsole or remotely using SSH. 1 Log on to the ppline you wnt to perform the upgrde on. 2 Run the following ommnds: yum upgrde yum yumonf\* yum upgrde The upgrde to the new version is performed. 4

5 3 Proeed in one of the following wys to omplete the instlltion: When upgrding from 7.3.x or ny lter version: Wit until messge informs you tht the upgrde hs ompleted, then run the following ommnd: reoot When the restrt hs ompleted, logon prompt ppers. You n now log on to the user interfe nd strt working with the new version. When upgrding from 7.2.x or ny erlier 7.x version: The ppline restrts utomtilly fter eh of the two upgrde phses tht re performed. If you re using lol system onsole: When the seond restrt hs ompleted, logon prompt ppers. You n now log on to the user interfe nd strt working with the new version. If you re using SSH: When the ppline restrts fter the first upgrde phse, you re disonneted nd the seond upgrde phse egins. After this phse hs ompleted, inluding the utomti restrt, you n log on to the user interfe nd strt working with the new version. The following ommnd lets you view messges out the upgrde progress: til -F /opt/mwg/log/updte/mlos2.upgrde.log When you see tht the upgrde hs ompleted, press Ctrl+C to stop the proess. You n now log on to the user interfe nd strt working with the new version. Known issues For known issues in this produt relese, see this Knowledge Center rtile: KB Additionl informtion Alerts hve een implemented tht pper fter instlling or upgrding We Gtewy if ny defult privte keys re in use on the ppline, s these must e repled to ensure we seurity. If n lert ppers, reple the privte key for the funtion tht the lert refers to. To reple privte key you generte or import privte key of your own, whih n inlude generting or importing new ertifite, depending on the funtion tht the privte key is used for. For informtion out how to reple privte key in eh se, see the following susetions. For the privte key used in Centrl Mngement luster, see Import ertifite nd privte key for luster CA. For the privte keys used on Hrdwre Seurity Module, see Generte or import ertifites nd privte keys for server nd lient identifition. 5

6 For the privte key tht is speified s prt of the SSL lient ontext settings, whih n e the SSL Client Context with CA or the SSL Client Context without CA settings, see Generte or import ertifite nd privte key for the SSL lient ontext. For the privte key tht is speified s prt of the settings for loud single sign-on, see Generte nd import privte key for loud single sign-on. Import ertifite nd privte key for luster CA Import ertifite nd privte key for CA (Certifite Authority) to ensure seure ommunition in Centrl Mngement luster of We Gtewy pplines. 1 On the user interfe of We Gtewy, selet Configurtion Applines. 2 At the top of the onfigurtion pne, lik Cluster CA. 3 In the Cluster CA window tht opens, lik Chnge CA. 4 In the Import Certifite Authority for Cluster window omplete the following. Browse for ertifite, then rowse for privte key. The ertifite must e CA, not ertifite for ommunition etween lient nd server. It n e self-signed or issued y the CA of your orgniztion. Enter pssword for the privte key. Clik Import. A ertifite nd privte key for use in luster ommunition re imported to the We Gtewy ppline. 5 Clik Sve Chnges. Generte or import ertifites nd privte keys for server nd lient identifition To generte or import ertifites nd privte keys for server nd lient identifition, work with the options for Hrdwre Seurity Module system settings. 1 On the user interfe of We Gtewy, selet Configurtion Applines. 2 On the pplines tree, selet the ppline tht you wnt to generte or import ertifites nd privte keys on, then selet the Hrdwre Seurity Module system settings. 3 Generte or import ertifite nd privte key for server identifition. Under HSM Server mke sure tht Allow remote onnetions is enled nd lik Server Identifition. The options for Server Identifition pper. Clik Generte or Import next to Server Certifite, ording to how you wnt to otin the new ertifite nd privte key. In the Generte Server Certifite window, provide ll neessry informtion for ertifite, then lik OK. Alterntively, rowse to ertifite nd privte key in the Import Server Certifite window, then enter pssword there nd lik Import. A ertifite nd privte key for server identifition re generted or imported. 6

7 4 Generte or import ertifite nd privte key for lient identifition. Under HSM Client mke sure tht Use remote HSM server is enled nd lik Client Identifition. The options for Client Identifition pper. Clik Generte or Import next to Client Certifite, ording to how you wnt to otin the new ertifite nd privte key. In the Generte Client Certifite window, provide ll neessry informtion for ertifite, then lik OK. Alterntively, rowse to ertifite nd privte key in the Import Client Certifite window, then enter pssword there nd lik Import. A ertifite nd privte key for lient identifition re generted or imported. 5 Clik Sve Chnges. Generte or import ertifite nd privte key for the SSL lient ontext To generte or import ertifite nd privte key for the SSL lient ontext, work with the SSL Client Context with CA or the SSL Client Context without CA settings. 1 On the user interfe of We Gtewy, selet Poliy Settings. 2 On the settings tree, selet ny of the settings tht exist under SSL Client Context with CA or SSL Client Context without CA or dd new settings under one of them. 3 If you re deling with settings under SSL Client Context with CA, omplete the following susteps, otherwise ontinue with step 4. In the onfigurtion pne, lik Generte or Import next to Certifite Authority, ording to how you wnt to otin the new ertifite nd privte key. In the Generte Certifite Authority window, provide ll neessry informtion for ertifite, then lik OK. Import. Alterntively, rowse to ertifite nd privte key in the Import Certifite Authority window, then enter pssword there nd lik Import. A ertifite nd privte key for the SSL Client Context with CA settings re generted or imported. 4 If you re deling with settings under SSL Client Context without CA, omplete the following susteps, otherwise proeed immeditely to step 5. In the onfigurtion pne, lik the Add ion ove the Selet server ertifite y host or IP list. In the Add Host to Certifite Mpping window, lik Generte or Import next to Server ertifite, ording to how you wnt to otin the new ertifite nd privte key. In the Generte Server Certifite window, provide ll neessry informtion for ertifite, then lik OK. Alterntively, rowse to ertifite nd privte key in the Import Certifite Authority window, then enter pssword there nd lik Import. A ertifite nd privte key for the SSL Client Context without CA settings re generted or imported. 5 Clik Sve Chnges. 7

8 Generte nd import privte key for loud single sign-on Generte privte key for loud single sign-on on We Gtewy ppline using system onsole, then work with the Single Sign On settings to import it s the signture key for n SSO token. 1 Log on to We Gtewy ppline from lol system onsole or remotely using SSH. 2 Run the following ommnd to generte privte key: openssl genrs -out signturekey.pem Store the privte key on lotion within your file system. 4 On the user interfe of the We Gtewy ppline tht you wnt to import the privte key to, selet Poliy Settings. 5 On the settings tree, selet ny of the settings tht exist under Single Sign On or dd new settings. 6 Under Privte Key to Sign SSO Token in the onfigurtion pne, lik Import Key. 7 In the Import Key window tht opens omplete the following. Browse to the lotion within your file system where you stored the privte key tht you generted. Enter pssword for the privte key. Clik Import. A privte key for use s signture key in n SSO token is imported to the We Gtewy ppline. 8 Clik Sve Chnges. Find produt doumenttion On the ServiePortl, you n find informtion out relesed produt, inluding produt doumenttion, tehnil rtiles, nd more. 1 Go to the ServiePortl t nd lik the Knowledge Center t. 2 In the Knowledge Bse pne under Content Soure, lik Produt Doumenttion. 3 Selet produt nd version, then lik Serh to disply list of douments. Produt doumenttion Every MAfee produt hs omprehensive set of doumenttion. For We Gtewy, this inludes the following: MAfee We Gtewy Produt Guide Desries the fetures nd pilities of We Gtewy, providing n overview of the produt, s well s detiled instrutions on how to onfigure nd mintin it MAfee We Gtewy Instlltion Guide Desries how to set up We Gtewy, s well s severl devies tht n e run with the produt 8

9 MAfee We Gtewy Referene Guide - Rule Sets Chnge Log Provides list of hnges to existing rule sets nd dditions of new rule sets for poliy onfigurtion on We Gtewy MAfee We Gtewy Tehnil Note - SSO Ctlog Provides list of the loud pplitions nd servies tht re supported y We Gtewy with preonfigured onnetors or onnetor templtes Copyright 2017 MAfee, LLC MAfee nd the MAfee logo re trdemrks or registered trdemrks of MAfee, LLC or its susidiries in the US nd other ountries. Other mrks nd rnds my e limed s the property of others. 0C00