Patch Release Notes. Release Juniper Secure Analytics. Juniper Networks, Inc.

Transcription

1 Juniper Secure Analytics Pch Release Notes Release Juniper Networks, Inc North Mhilda Avenue Sunnyvale, CA USA Published:

2 Copyright Notice Copyright 2014 Juniper Networks, Inc. All rights reserved. Juniper Networks, Junos, Steel-Belted Radius, NetScreen, and ScreenOS are registered trademarks of Juniper Networks, Inc. in the United Stes and other countries. The Juniper Networks Logo, the Junos logo, and JunosE are trademarks of Juniper Networks, Inc. All other trademarks, service marks, registered trademarks, or registered service marks are the property of their respective owners. Juniper Networks assumes no responsibility for any inaccuracies in this document. Juniper Networks reserves the right to change, modify, transfer, or otherwise revise this publicion without notice. The following terms are trademarks or registered trademarks of other companies: Java TM and all Java-based trademarks and logos are trademarks or registered trademarks of Oracle and/or its affilies. FCC Stement The following informion is for FCC compliance of Class A devices: This equipment has been tested and found to comply with the limits for a Class A digital device, pursuant to part 15 of the FCC rules. These limits are designed to provide reasonable protection against harmful interference when the equipment is opered in a commercial environment. The equipment generes, uses, and can radie radio-frequency energy and, if not installed and used in accordance with the instruction manual, may cause harmful interference to radio communicions. Operion of this equipment in a residential area is likely to cause harmful interference, in which case users will be required to correct the interference their own expense. The following informion is for FCC compliance of Class B devices: The equipment described in this manual generes and may radie radio-frequency energy. If it is not installed in accordance with Juniper Networks installion instructions, it may cause interference with radio and television reception. This equipment has been tested and found to comply with the limits for a Class B digital device in accordance with the specificions in part 15 of the FCC rules. These specificions are designed to provide reasonable protection against such interference in a residential installion. However, there is no guarantee th interference will not occur in a particular installion. If this equipment does cause harmful interference to radio or television reception, which can be determined by turning the equipment off and on, the user is encouraged to try to correct the interference by one or more of the following measures: Reorient or reloce the receiving antenna. Increase the separion between the equipment and receiver. Consult the dealer or an experienced radio/tv technician for help. Connect the equipment to an outlet on a circuit different from th to which the receiver is connected. Caution: Changes or modificions to this product could void the user's warranty and authority to opere this device. Disclaimer THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT, SUBJECT TO THE MODIFICTAIONS SET FORTH BELOW ON THIS PAGE, ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR JUNIPER NETWORKS REPRESENTATIVE FOR A COPY. JSA Pch Release Notes Release Copyright 2014, Juniper Networks, Inc. All rights reserved. Printed in USA. Revision History August 2014 JSA Pch Release Notes The informion in this document is current as of the de listed in the revision history. END USER LICENSE AGREEMENT The Juniper Networks product th is the subject of this technical documention consists of (or is intended for use with) Juniper Networks software. Use of such software is subject to the terms and conditions of the End User License Agreement ( EULA ) posted as modified by the following text, which shall be treed under the EULA as an Entitlement Document taking precedence over any conflicting provisions of such EULA as regards such software: As regards software accompanying the JSA products (the Program ), such software contains software licensed by Q1 Labs and is further accompanied by third-party software th is described in the applicable documention or merials provided by Juniper Networks. 2

3 For the convenience of Licensee, the Program may be accompanied by a third party opering system. The opering system is not part of the Program, and is licensed directly by the opering system provider (e.g., Red H Inc., Novell Inc., etc.) to Licensee. Neither Juniper Networks nor Q1 Labs is a party to the license between Licensee and the third party opering system provider, and the Program includes the third party opering system AS IS, without represention or warranty, express or implied, including any implied warranty of merchantability, fitness for a particular purpose or non-infringement. For an installed Red H opering system, see the license file: /usr/share/doc/redh-release-server-6server/eula. By downloading, installing or using such software, you agree to the terms and conditions of th EULA as so modified. 3

4 4

5 CONTENTS 1 JSA RELEASE NOTES Installing r4 Pch Clearing the Cache Resolved Issues Issues resolved in JSA r Issues resolved in JSA

6

7 1 JSA RELEASE NOTES r pch resolves several known issues in Juniper Secure Analytics (JSA). Installing r4 Pch Clearing the Cache Resolved Issues Known Issues Installing r4 Pch If your deployment is installed with version of r3 or ler, you can install r pch. Before you begin Ensure th you take the following precautions: Back up your da before you begin any software upgrade. For more informion about backup and recovery, see the Juniper Secure Analytics Administrion Guide. To avoid access errors in your log file, close all open JSA webui sessions. During the deployment, all appliances should run on the same software revision to pch the complete deployment. You cannot run the pch if the software revisions are different. Verify th all changes are deployed on your appliances. The pch cannot be installed on appliances th have changes th are not deployed. About this task Pches are cumulive software updes to fix known software issues in your JSA deployment. JSA pches are installed by using an SFS file. Step 1 Step 2 Procedure Download the r pch from the Juniper Customer Support website. Using SSH, log into your system as the root user. JSA Pch Release Notes

8 8 JSA RELEASE NOTES Step 3 Copy the pch to the /tmp directory on the JSA console. NOTE Note: If space in the /tmp directory is limited, copy the pch to another locion th has sufficient space. Step 4 Step 5 Step 6 Step 7 Step 8 Unzip the file in the /tmp directory using the bunzip utility: bunzip r sfs.bz2 To cree the /media/updes directory, type the following command: mkdir -p /media/updes Change to the directory where you copied the pch file. For example, cd /tmp To mount the pch file to the /media/updes directory, type the following command: mount -o loop -t squashfs r sfs /media/updes/ To run the pch installer, type the following command: /media/updes/installer NOTE Note: If you have logged in through serial-based console, run the following command to install the pch automically: /media/updes/installer --no-screen NOTE Note: The first time th you run the pch, there might be a delay before the pch Step 9 install menu is displayed. Using the pch installer, select all. The all option updes the software on all systems in your deployment. In HA deployments, primary HA appliances are pched and replice the pch upde to the secondary HA appliance. If you do not select the all option, you copy the pch to each appliance in your deployment and install the pch. If you manually install the pch in your deployment, you must upde your appliances in the following order: 1 Console 2 Event Processors 3 Event Collectors 4 Flow Processors 5 Flow Collectors If your Secure Shell (SSH) session is disconnected while the upgrade is in progress, the upgrade continues. When you reopen your SSH session and rerun the installer, the pch installion resumes. JSA Pch Release Notes

9 Clearing the Cache 9 Results A summary of the pch installion advises you of any managed host th were not upded. If the pch fails to upde a managed host, you can copy the pch to the host and run the installion locally. Wh to do next You are now ready to clear the Java cache and the browser cache. Clearing the Cache After you install the pch, you must clear your Java cache and your web browser cache before you log into the JSA appliance. Before you begin Ensure th you have only one instance of your browser open. If you have multiple versions of your browser open, the cache might fail to clear. Ensure th the Java Runtime Environment is installed on the desktop system th you use to view the user interface. You can download Java version 1.7 from the Java website: About this task If you use the Microsoft Windows 7 opering system, the Java icon is typically loced under the Programs pane. Step 1 Step 2 Step 3 Step 4 Procedure Clear your Java cache: a On your desktop, select Start > Control Panel. b c d e f g Double-click the Java icon. In the Temporary Internet Files pane, click View. On the Java Cache Viewer window, select all Deployment Editor entries. Click the Delete icon. Click Close. Click OK. Open your web browser. Clear the cache of your web browser. If you use the Mozilla Firefox web browser, you must clear the cache in the Microsoft Internet Explorer and Mozilla Firefox web browsers. Log in to JSA. JSA Pch Release Notes

10 Resolved Issues 10 Resolved Issues Issues resolved in JSA r4 The following issues are resolved in the pch for r4: The following issues are resolved in JSA r4: Default ecs-ec memory configurions are insufficient for certain appliances An Out of Memory message may present when a box is heavily loaded or is low on memory (typically less than 64GB). The default memory configurion for ecs-ec needs to be tuned. Workaround: Contact Juniper Customer Support for assistance to modify the memory settings. Cannot popule reference sets if it is creed with a name containing a forward slash "/" In JSA reference sets th contain the "/" character in the name no longer work. When tempting to popule a reference set with the offending name you will see: com.q1labs.core.ui.servlet.remotejavascript: [ERROR] [NOT: ][IPADDRESS/- -] [-/- -]An exception occurred while executing the remote method 'addtoreferenceset' java.lang.exception: The element(s) could not be added to the reference set. Check logs for details. com.q1labs.sem.ui.util.referencesetutils.addtoreferenceset (ReferenceSetUtils.java:555) When using the offending reference set in a rule you will see the following in the logs on your processing appliances: java.lang.runtimeexception: Error initializing spillover cache com.q1labs.frameworks.cache.spillovercacheprovider.getcache (SpilloverCacheProvider.java:106) com.q1labs.frameworks.cache.spillovercacheprovider.getcache (SpilloverCacheProvider.java:65) com.q1labs.frameworks.cache.frameworkscachemanager.getcache (FrameworksCacheManager.java:66) com.q1labs.frameworks.cache.frameworkscachemanager. getcache(frameworkscachemanager.java:51) com.q1labs.core.dao.referenceda.light. AReferenceDaCache.creeICaches(AReferenceDaCache.java:664) JSA Pch Release Notes

11 Resolved Issues 11 com.q1labs.core.dao.referenceda.light. ReferenceDaCacheSet.creeCaches (ReferenceDaCacheSet.java:1528) com.q1labs.core.dao.referenceda.light. ReferenceDaCacheSet.contains(ReferenceDaCacheSet.java:945) com.q1labs.core.dao.referenceda.light. ReferenceDaCacheSet.contains(ReferenceDaCacheSet.java:1091) com.q1labs.semsources.cre.tests.referencesettest.test (ReferenceSetTest.java:195) com.q1labs.semsources.cre.tests.referencesettest.test (ReferenceSetTest.java:246) com.q1labs.semsources.cre.tests. ReferenceSetTest.test(ReferenceSetTest.java:299) com.q1labs.semsources.cre.gen.testexecutor_0_2.test (TestExecutor_0_2.java) com.q1labs.semsources.cre.customrule.test(customrule.java:470) com.q1labs.semsources.cre.customrule.test(customrule.java:423) com.q1labs.semsources.cre.customrulesetexecutor.testrule (CustomRuleSetExecutor.java:294) com.q1labs.semsources.cre.gen.rulesetexecutor_1_localevent.test (RuleSetExecutor_1_LocalEvent.java) com.q1labs.semsources.cre.localruleexecutor. processeventinpropertymode(localruleexecutor.java:200) com.q1labs.semsources.cre.localruleexecutor. processevent(localruleexecutor.java:129) com.q1labs.semsources.cre.creeventprocessor. processevent(cre.java:989) com.q1labs.semsources.cre.creeventprocessor.run(cre.java:961) Caused by: java.io.ioexception: No such file or directory java.io.file.creenewfile(file.java:1017) com.q1labs.frameworks.cache.spillovercacheutils.openreadchannel (SpilloverCacheUtils.java:68) JSA Pch Release Notes

12 12 JSA RELEASE NOTES com.q1labs.frameworks.cache.spillovercache.bootup (SpilloverCache.java:966) com.q1labs.frameworks.cache.spillovercacheprovider.getcache (SpilloverCacheProvider.java:97) more Workaround: Recree the reference sets by removing / from the name. Config backups in JSA are incomplete In JSA ( r2 and r3 pches and inclusive), the configurion backup for the console is missing configurion files th are required to restore the config to a new piece of hardware. Workaround: Please contact Juniper Customer Support for assistance. Reference sets accessed by rules stop working after a short period of time Reference sets th are being accessed by rules will initially fire when approprie but then will stop firing when they should after approximely six hours. A full deploy will restart ecs and correct this problem temporarily, but the problem will be reintroduced in approximely six hours. Workaround: Please contact Juniper Customer Support. Issues resolved in JSA The following issues are resolved in JSA : Sort order of IP address column in assets tab is incorrect The IP Address column on the Assets tab sorts incorrectly. The column sorts numerically as displayed in the following example: (1 More) The sorted IP addresses should be sorted in an order th represents adjacent IP addresses: JSA Pch Release Notes

13 Resolved Issues Source or destinion IP filter fails on search results th are already filtered by Source or Destinion IP If you perform an event or flow search th uses the Source or Destinion IP filter, and then right-click a result to add another Source or Destinion IP filter to the search results, the search will not return any results. JSA Pch Release Notes