Nokia Horizon Manager Release Notes. Version 1.8

Transcription

1 Nokia Horizon Manager Release Notes Version 1.8 Part No. N Rev 001 December 2008

2 COPYRIGHT 2008 Nokia. All rights reserved. Rights reserved under the copyright laws of the United States. RESTRICTED RIGHTS LEGEND Use, duplication, or disclosure by the United States Government is subject to restrictions as set forth in subparagraph (c)(1)(ii) of the Rights in Technical Data and Computer Software clause at DFARS Notwithstanding any other license agreement that may pertain to, or accompany the delivery of, this computer software, the rights of the United States Government regarding its use, reproduction, and disclosure are as set forth in the Commercial Computer Software-Restricted Rights clause at FAR IMPORTANT NOTE TO USERS This software and hardware is provided by Nokia Inc. as is and any express or implied warranties, including, but not limited to, implied warranties of merchantability and fitness for a particular purpose are disclaimed. In no event shall Nokia, or its affiliates, subsidiaries or suppliers be liable for any direct, indirect, incidental, special, exemplary, or consequential damages (including, but not limited to, procurement of substitute goods or services; loss of use, data, or profits; or business interruption) however caused and on any theory of liability, whether in contract, strict liability, or tort (including negligence or otherwise) arising in any way out of the use of this software, even if advised of the possibility of such damage. Nokia reserves the right to make changes without further notice to any products herein. TRADEMARKS Nokia is a registered trademark of Nokia Corporation. Other products mentioned in this document are trademarks or registered trademarks of their respective holders Nokia Horizon Manager Release Notes v1.8

3 Nokia Contact Information Corporate Headquarters Web Site Telephone Mail Address Nokia Inc. 102 Corporate Park Drive White Plains, NY USA Regional Contact Information Americas Nokia Inc. 102 Corporate Park Drive White Plains, NY USA Tel: usa@nokiaforbusiness.com Europe, Middle East, and Africa Nokia House, Summit Avenue Southwood, Farnborough Hampshire GU14 ONG UK Tel: (UK) Tel: (France) Tel: (Middle East, Africa, Dubai) europe@nokiaforbusiness.com mea@nokiaforbusiness.com Asia-Pacific 438B Alexandra Road #07-00 Alexandra Technopark Singapore Tel: asia@nokiaforbusiness.com Nokia Global Technical Assistance Center Web Site Voice Americas Europe, Middle East, Africa Asia-Pacific International Non-Technical Support For non-technical support issues, including your Nokia Support Agreement, licensing, and Web site access, use the following contact information: es.service@nokia.com Nokia Horizon Manager Release Notes v1.8 3

4 4 Nokia Horizon Manager Release Notes v1.8

5 Nokia Horizon Manager v1.8 Release Notes This document lists new functionality for Nokia Horizon Manager v1.8, describes configuration information and useful tips for using new functionality, and known issues and limitations at the time of this release. Nokia Horizon Manager v1.8 can be installed as a Standalone (Server and Client) or Client-only version and can be installed over Nokia Horizon Manager v1.7 only. Nokia Horizon Manager v1.8 delivers functionality for the following additional managed products and delivers the following new features and feature enhancements. Automated Web Updates for do no harm (DNH) rules, upgrade path definitions for IPSO applications, configuration templates, and meta-data files for Check Point configuration actions Support for managing IPSO 6.1 on the following appliances: IP150, IP290, IP390, IP560, IP690, IP2450, and IP1280 Support for managing IPSO-LX 7.1 and IPSO-LX 7.2 on the following Intrusion Prevention Solutions: IP290 IPS, IP390 IPS, IP690 IPS, and IP2450 IPS Nokia ADP services module support: RJ45/SFP and 10G Support for IPSO 5.0 (Nokia Virtual Firewall for Check Point VSX R65) Support for IPSO and Check Point Core XL Support for upgrading IPSO 4.1 and IPSO 4.2 to IPSO 6.1, and IPSO 6.0 to IPSO 6.1. Supported platforms: IP150, IP290, IP390, IP560, IP690, IP2450, and IP1280. NHM Client Support for Windows XP SP3 Support for VMware-enabled management platforms Automated export capability For more information about using Nokia Horizon Manager v1.8, see the following documentation: Nokia Horizon Manager Getting Started Guide, Version 1.8 Nokia Horizon Manager Basic Operations Reference Guide Nokia Horizon Manager User s Guide Nokia Horizon Manager and Check Point Guide Nokia Horizon Manager Online Help Nokia Horizon Manager Release Notes v1.8 5

6 Nokia Horizon Manager v1.8 Release Notes You can access the Online Help by selecting the Nokia Horizon Manager Help command from the Help menu or by clicking the Help icon on the Nokia Horizon Manager toolbar. For information about how to install Nokia Horizon Manager, see the Nokia Horizon Manager Getting Started Guide, Version 1.8. Note Nokia Horizon Manager v1.8 does not support older versions of IPSO and 3rd party packages that have reached end of life. See the Nokia Horizon Manager Getting Started Guide, Version 1.8 for more information about supported IPSO versions and packages or, see the Nokia Support site listed in Nokia Contact Information on page 3 for the most current list of supported software and operating systems. Configuring Automated Export The automated export capability in Nokia Horizon Manager v1.8 allows you to export device data from Nokia Horizon Manager by defining and configuring file-based export definitions. This export capability is built into Nokia Horizon Manager v1.8 and requires that the Nokia Horizon Manager Server be running. Automated export can be configured to execute at regular intervals to export device data by defining desired settings in an export definition file. The export definition file specifies which group data to export, which view to use, and in which format to save the exported data. Private data, such as passwords, cannot be exported using this functionality. Export definition files must be located in the Server\Config\Export folder. You can create multiple export definition files, each defining a different set of export definitions to be used to complete specific export actions. If no such Export folder exists in the Config directory, or no such export definition files exist, then the automated file-based export function is disabled. Automated export is disabled by default. To enable automated export 1. Create a folder named Export in the Config folder under the NHM Server directory. For example, in Windows, C:\Nokia\NHM18\Server\Config. 2. Create a text file defining the desired export definition parameters, as described in Table Save the export definition text file to the Export folder you created in step 2. Nokia Horizon Manager will scan all files in the Export directory, regardless of name or extension, so you can name the text file anything you choose. For example, action.export, or HighSchools.txt. 6 Nokia Horizon Manager Release Notes v1.8

7 Configuring Automated Export Note It is important that you specify an export path to which Nokia Horizon Manager can write. In other words, Nokia Horizon Manager must have permission to create and write to the file specified in the export definitions file. Table 1 Export Definition File Parameter Definitions Parameter frequency view group format exportfile Definition Specifies how often the export should occur: Once performs the export action one time, after which the export definitions file will be deleted (meant for CLI-type use). Action Action name using the word "Action" followed by all or part of an action name will perform an export when that named action completes. When the action completes, only the appliances that are both in the group and in the action will be exported. Timed time performs an export every specified amount of time, in minutes (for example, Timed 120). Specifies the name of the view in Nokia Horizon Manager. Any view name can be used, but must be exact, for example, Default, not default. User-created views can also be used. Specifies the name of the group to export. Hierarchies are separated with a colon. For example, All Devices:Monitored:APAC. Only this group will be exported. Specifies an export format. Options are: Text:Tab, Text:Comma, Text:Space, XML, HTML:Detailed, and HTML:Summary. Specifies the name of the export file. For example, in Windows, C:\MyExports\exportedFile.txt. Use $DATE$ and/or $TIME$ in the file name to insert the date and time of the export into the export file name. For example, export$date$.txt will expand to export2008_04_04_12_56.txt. Note Export files are overwritten each time automated export executes a Timed export unless the user adds $DATE$ and/or $TIME$ to the file name, thus giving the export file a unique name. Nokia Horizon Manager Release Notes v1.8 7

8 Nokia Horizon Manager v1.8 Release Notes Table 1 Export Definition File Parameter Definitions Parameter title Definition Optional. Specifies a title to use when exporting to HTML. Titles can use $DATE$ (shows date) and $TIME$ (shows time). Note HTML export files will only effectively if you keep the compressed and attached defaults. Otherwise, all images and links will fail. startdate Optional. Specifies a start time. Must use yyyy/mm/dd HH:mm format. If this option is used, no export will be done before the specified time. Example Export Definition Files An export definition file in the Server\Config\Export folder named action.export (any valid name can be used) containing: frequency = Action Software Inventory view = Default group = All Devices:Sample format = XML exportfile = C:\\MyExports\\action$DATE$.xml exports all devices in the group named Sample (using the Default view) that are part of a Software Inventory action any time such an action is run until the export definition file is deleted. An export definition file that contains: frequency = Once view = MyView group = All Devices:Monitored format = HTML:Detailed exportfile = C:\\MyExports\\once$DATE$.html title = My Title $DATE$ $TIME$ exports all devices in the Monitored group (using the MyView view) one time to a file in HTML format. After the data is exported, the export definition file is automatically deleted. ing Export Data Files You can also export data files to an address specified in the Options > NHM Options > Notifications tab. To use this address, the export definition file must include a line specifying sendmail=true. Including this line in the export definition file will a zipped version of the export data file as an attachment to the address specified on the Notifications tab. If the sendmail option is used, there is a Compress option (default is true), which, when specified as false (compress=false), will not compress the attachments (some viewers, especially 8 Nokia Horizon Manager Release Notes v1.8

9 Configuring Automated Export phone-based viewers, will not be able to view the attachment if it is zipped). You only need to specify the Compress option when you want to not compress the attachments. You can specify to include the text of the export data file directly in the by setting the Attach option (default is true) to false (attach=false). This option is used for the express purpose of enabling ed data to be more readable on mobile browsers. You only need to specify the Attach option when you want to not use attachments. Nokia Horizon Manager Release Notes v1.8 9

10 Nokia Horizon Manager v1.8 Release Notes Useful Tips In Devices > Table > Table Views > Configure Table Views... > Create, you have the option of creating Integer (whole number) and Decimal (numbers that can contain decimal points) columns (in addition to the Text, Boolean, and Selection List options in previous releases). When defining Filtered Groups using these columns, ranges can be specified. For example, you could have a group composed of appliances with a user-specified integer value between 5 and 10 (or, for example, a decimal value between 57.6 and 62.3). The Actions > General > Execute Command action and the Actions > General > Run Script action can both use the new Integer and Decimal user-created columns (in addition to Text columns) for the "Copy Result to Column". If the Execute Command or Run Script results are sent to a numeric (Integer or Decimal) column, attempts will be made to convert the result to a number. If those attempts fail, the result will be saved in the column as a '0'. Known Issues and Limitations Nokia Horizon Manager v1.8 has the following known issues and limitations: On some Solaris systems, the reachability icon may not reflect the actual state of devices. Workaround Contact Nokia customer support. See Nokia Contact Information on page 3. After upgrading Check Point NGX using the Nokia Horizon Manager Package Upgrade action, a default IPSO CheckPoint policy will be in effect. Note You must check the default filter checkbox on the Upgrade Package dialog to maintain Nokia Horizon Manager connectivity. 10 Nokia Horizon Manager Release Notes v1.8

11 Useful Tips Note You must reboot the appliance after the upgrade. When the upgrade process is complete on the gateway, perform the following on the Management Server to reload your firewall policy: a. Using SmartDashboard, log in to the NGX SmartCenter Server that controls the upgraded gateway. b. Open the Gateway Object Properties window that represents the upgraded gateway and change the version to match the upgraded version. c. Perform Install Policy on the upgraded gateway. VSX and CPinfo compatibility "<Constraint name="rule 6101" creator="nokia" targetdevicetype="nsp">" is failing because cpinfo is installed. SMTP over SSL is not supported for notifications. Please make sure that the Use SSL checkbox is OFF under Options > NHM options > Notifications. Nokia Horizon Manager v1.7 and later supports upgrading Check Point NGX R6x for IPSO 4.x to Check Point NGX R65 for IPSO 6.0 only when the device is running IPSO 6.0 Build 070, or later. If the device is not running IPSO 6.0 Build 070 or later, the Upgrade Package Action Setup screen will not show the upgrade path as an option. If the Check Point NGX package is enabled when upgrading IPSO 4.x to IPSO 6.x, after the upgrade is completed the device will appear to be unreachable due to boot-level security features implemented in IPSO 6.x. However, SSH traffic is allowed by the boot-level security policy, therefore the device is available for management by Nokia Horizon Manager. After adding a device to an unfiltered group that is the child of another group, the added device is not visible as member of the group, unless that device is also a member of the parent group. Solution When adding a device to an unfiltered groups, add the device to the parent group first, and then to the child group. Due to monitoring-related high memory usage, it is highly recommended that you monitor a limited set of devices at a time (100 devices maximum) and select only those monitored parameters (in NHM Options > Monitoring) that are critical. On older Windows systems, the Nokia Horizon Manager Client process might show excessive processor load and degraded performance after user interaction with the client UI. This is attributed to older versions of Windows DirectDraw driver and an incompatibility with the latest Java runtime. For more information, see Nokia Horizon Manager Release Notes v1.8 11

12 Nokia Horizon Manager v1.8 Release Notes Workaround update your display driver to the latest version, and make sure your Windows OS is updated to the latest service pack available from Microsoft. If the problem persists, disable the DirectDraw capability in the Nokia Horizon Manager Client as follows: a. Stop the Nokia Horizon Manager client application. b. Edit the <NHM installation folder>\client\nhmclient.bat file as follows: Locate -Dsun.java2d.d3d=false and replace it with -Dsun.java2d.noddraw=true c. Restart the Nokia Horizon Manager client. In the CheckPoint Server Details dialog box, not all fields and values are shown. Due to the potentially large amount of data acquired from CheckPoint Smart Center, some information has been intentionally removed from processing by Nokia Horizon Manager. As a result, certain values and fields (for example, in the Netmask column in the Network Gateways table) are not shown by Nokia Horizon Manager. This is expected behavior. Information critical for Nokia Horizon Manager-related tasks remains available, either in the Checkpoint Server Details dialog, or in the main devices table in Nokia Horizon Manager. Installation of Check Point NGX R65 on flash-based devices using Nokia Horizon Manager requires a minimum of 1 GB flash memory. This limitation does not apply when the installation is performed manually using the console. When installing manually from the console, a minimum of 512 MB flash memory is required. If you did not previously modify the default settings in NHM Options > Actions > Backup Directory, make sure that after you perform a migration of Nokia Horizon Manager v1.7 data, the backup directory path is pointing to a location that will not be removed if you uninstall Nokia Horizon Manager v1.7. Manually change the path by choosing NHM Options > Actions > Backup Directory. Installation of IP40 v3.0.0 on IP40 v2.0 and v fails. Upgrading IP40 v1.0 to v2.0, or v1.0 to v3.0 results in a warning and a significant time to complete the upgrade action. After the upgrade action is completed, any action on the device fails. You can only upgrade to v3.0 from IP40 versions 1.0.0, , , 1.1, and Reboot the device to show the upgraded version in the software inventory OS Versions field. After you successfully install Check Point NGX R65, Check Point CPInfo for R60, R61, or R62 is deleted. You can safely ignore this issue; functionality of Check Point NGX R65 is not affected. When you execute the start_nhmclnt script, warning messages are displayed in the command console. You can safely ignore the warning messages; they are generated for log information only. 12 Nokia Horizon Manager Release Notes v1.8

13 Useful Tips Nokia Horizon Manager cannot connect to the OPSEC database on the Management Server if SmartDashboard, or any other OPSEC application with write access, is connected to that Management Server. During Check Point configuration action targeted for an Enforcement Module, Nokia Horizon Manager connects to the specified Management Server to add the Enforcement Module to the OPSEC database on that server. If the database is locked, the Enforcement Module cannot be added and Nokia Horizon Manager displays a warning in the Action Results. Workaround Disconnect SmartDashboard, or any other OPSEC application, from the management server when using Nokia Horizon Manager to configure enforcement modules. In Check Point NGX R65, the Group Permission option cannot be configured by using Nokia Horizon Manager. Workaround Configure Group Permissions through the IPSO device console. When you run the Apply Patch action for HFA packages, you must uncheck the Start Check Point Firewall option (checked by default) and leave the Reboot Device option unchecked (unchecked by default), otherwise the action results show as Failed, even though the Action completed successfully. Nokia Horizon Manager Release Notes v1.8 13

14 Nokia Horizon Manager v1.8 Release Notes 14 Nokia Horizon Manager Release Notes v1.8