Stonesoft Next Generation Firewall

Transcription

1 Stonesoft Next Generation Firewall Release Notes Revision B

2 Contents About this release on page 2 Lifecycle model on page 2 System requirements on page 3 Build version on page 6 Compatibility on page 7 New features on page 7 Enhancements on page 9 Resolved issues on page 10 Installation instructions on page 11 Known issues on page 12 Find product documentation on page 13 About this release This document contains important information about this release of Stonesoft Next Generation Firewall (Stonesoft NG); formerly known as McAfee Next Generation Firewall. We strongly recommend that you read the entire document. Lifecycle model This release of Stonesoft NG is a Feature Stream (FS) version. Support for Feature Stream versions is discontinued when a new major version of Stonesoft NG is available. We recommend using the most recent Long-Term Support (LTS) version if you do not need any features from a later Feature Stream version. For more information about the Stonesoft NG lifecycle policy, see Knowledge Base article

3 System requirements Make sure that you meet these basic hardware and software requirements. Stonesoft NG appliances We strongly recommend using a pre-installed Stonesoft NG appliance as the hardware solution for new Stonesoft NG installations. Note: Some features in this release are not available for all appliance models. See Knowledge Base article 9743 for up-to-date appliance-specific software compatibility information. Two Stonesoft NG engine images are available: x86-64 A 64-bit image that includes the Local Manager. x86-64-small A 64-bit image that does not include the Local Manager. Note: If you do not use the Local Manager, we recommend that you use the x86-64-small image. Some appliance models support only the x86-64-small image. The following table shows whether you can use an appliance model in the Firewall/VPN (), IPS, or Layer 2 Firewall (L2) role, and the image that is supported. Appliance model Roles Images -315 The image that does not include the Local Manager is supported 320X (MIL-320) Both images are supported IPS-1205 IPS, L2 Both images are supported L321 The image that does not include the Local Manager is supported NGF321, IPS, L2 Both images are supported L325 The image that does not include the Local Manager is supported NGF325, IPS, L2 Both images are supported 110 The image that does not include the Local Manager is supported 115 The image that does not include the Local Manager is supported 1035, IPS, L2 Both images are supported 1065, IPS, L2 Both images are supported 1301, IPS, L2 Both images are supported 1302, IPS, L2 Both images are supported 1401, IPS, L2 Both images are supported 1402, IPS, L2 Both images are supported 3201, IPS, L2 Both images are supported 3

4 Appliance model Roles Images 3202, IPS, L2 Both images are supported 3205, IPS, L2 Both images are supported 3206, IPS, L2 Both images are supported 3207, IPS, L2 Both images are supported 3301, IPS, L2 Both images are supported 3305, IPS, L2 Both images are supported 5201, IPS, L2 Both images are supported 5205, IPS, L2 Both images are supported 5206, IPS, L2 Both images are supported Sidewinder S-series appliances These Sidewinder appliance models can be re-imaged to run Stonesoft NG software. Appliance model Roles Images S-1104 Both images are supported S-2008 Both images are supported S-3008 Both images are supported S-4016 Both images are supported S-5032 Both images are supported S-6032 Both images are supported Certified Intel platforms We have certified specific Intel-based platforms for Stonesoft NG. The tested platforms can be found at under the Stonesoft Next Generation Firewall product. We strongly recommend using certified hardware or a pre-installed Stonesoft NG appliance as the hardware solution for new Stonesoft NG installations. If it is not possible to use a certified platform, Stonesoft NG can also run on standard Intel-based hardware that fulfills the hardware requirements. Basic hardware requirements You can install Stonesoft NG on standard hardware with these basic requirements. (Recommended for new deployments) Intel Xeon -based hardware from the E5-16xx product family or higher 4

5 Note: Legacy deployments with Intel Core 2 are supported. IDE hard disk and CD drive Note: IDE RAID controllers are not supported. Memory: 4 GB RAM minimum for x86-64-small installation 8 GB RAM minimum for x86-64 installation VGA-compatible display and keyboard One or more certified network interfaces for the Firewall/VPN role Two or more certified network interfaces for IPS with IDS configuration Three or more certified network interfaces for Inline IPS or Layer 2 Firewall For information about certified network interfaces, see Knowledge Base article Master Engine requirements Master Engines have specific hardware requirements. Each Master Engine must run on a separate physical device. For more details, see the Stonesoft Next Generation Firewall Installation Guide. All Virtual Security Engines hosted by a Master Engine or Master Engine cluster must have the same role and the same Failure Mode (fail-open or fail-close). Master Engines can allocate VLANs or interfaces to Virtual Security Engines. If the Failure Mode of the Virtual IPS engines or Virtual Layer 2 Firewalls is Normal (fail-close) and you want to allocate VLANs to several engines, you must use the Master Engine cluster in standby mode. Cabling requirements for Master Engine clusters that host Virtual IPS engines or Layer 2 Firewalls: Failure Mode Bypass (fail-open) requires IPS serial cluster cabling. Failure Mode Normal (fail-close) requires Layer 2 Firewall cluster cabling. For more information about cabling, see the Stonesoft Next Generation Firewall Installation Guide. Virtual appliance node requirements You can install Stonesoft NG on virtual appliances with these hardware requirements. Also be aware of some limitations. (Recommended for new deployments) Intel Xeon -based hardware from the E5-16xx product family or higher Note: Legacy deployments with Intel Core 2 are supported. One of the following hypervisors: VMware ESXi 5.5 and 6.0 KVM (KVM is tested as shipped with Red Hat Enterprise Linux Server 7.1 and 7.2) 8 GB virtual disk 4 GB RAM minimum 5

6 A minimum of one virtual network interface for the Firewall/VPN role, three for IPS or Layer 2 Firewall roles When Stonesoft NG is run as a virtual appliance node in the Firewall/VPN role, these limitations apply: Only Packet Dispatching CVI mode is supported. Only standby clustering mode is supported. Heartbeat requires a dedicated non-vlan-tagged interface. When Stonesoft NG is run as a virtual appliance node in the IPS or Layer 2 Firewall role, clustering is not supported. Build version Stonesoft Next Generation Firewall build version is Product binary checksums Use the checksums to make sure that the installation files downloaded correctly. sg_engine_ _x86-64.iso SHA1SUM: 8345cc70240dc3944c cc62ba2bae4670 SHA256SUM: 37a28ea8f0263b3a16bfd49309a769aa76fd176b4b0174d8b6c85e5ce8b5551f SHA512SUM: b6b49b19f3528c2ce78e785b54c90ef8 ce852d61aaff823ac80928f a 8e90eb12834f2ea4c00e98eb8339d383 abdb7f7bd732dfd37de032ce87c5eeee sg_engine_ _x86-64.zip SHA1SUM: cfc7588eab0eaaa248baf8df3c545af831bb8541 SHA256SUM: 6616a056bbf2d12ae584a9a2ef5ca60ec0e4a1b0fd7586aaf16edd152e3a8a1d SHA512SUM: ae887ab7dd d8c47771ec8 f1c65ae61ecf2583c4f65b38718ea6b3 d b15a6d fdb37a901db b1de3a54a7153e8bf55ad173d sg_engine_ _x86-64-small.iso SHA1SUM: 30706c694ce6858d2bc6521cb6f ddeaf6 SHA256SUM: f90783afc88bce1eb4a03c6d64474f3aa682ab7ab0cd06ada3b7a9c4f7e522d6 SHA512SUM: a8e8f0ad690a9ba2d0fb3d40b6448ae a651703ee315c6dc85749dfde51 feb4825dad1e7f00b512c1586a6d1867 d bb0fa20b3ef9ce7a56f356 6

7 sg_engine_ _x86-64-small.zip SHA1SUM: 0def8b5d75d4b5ea52d57a05b92b554e46b96417 SHA256SUM: af58513d88eaf637ad441e2b92bb69efe34a4bf4fb97bd313b0f0b2695dae3af SHA512SUM: 6e0b6f3f11252b5ccc9c6f9e241607e9 efea1b5fe0c356452a4325b1d2c969e9 6fbdaa43361c780afb3da74f45c60fa8 4d518c1091f25224f0b09d030bd19e7a Compatibility Stonesoft NG 6.1 is compatible with the following component versions. Stonesoft Management Center (SMC) 6.1 or later Dynamic Update 810 or later Stonesoft VPN Client for Windows or later Stonesoft VPN Client for Mac OS X or later Stonesoft VPN Client for Android or later Server Pool Monitoring Agent or later McAfee Logon Collector 2.2 and 3.0 McAfee Advanced Threat Defense 3.6 McAfee Endpoint Intelligence Agent (McAfee EIA) 2.5 New features This release of the product includes these new features. For more information and configuration instructions, see the Stonesoft Next Generation Firewall Product Guide and the Stonesoft Next Generation Firewall Installation Guide. Geo-protection and IP address categorization You can now configure geo-protection to allow or block traffic. There are predefined Country elements that represent IP addresses registered in specific countries. You can use Country elements to filter traffic in Access rules based on the source or destination country, or entire continents. They can also be used in NAT rules, Inspection rules, and File Filtering rules. You can use predefined IP address lists to control access to known good or bad IP addresses. You can either use the predefined IP address lists or create new IP address lists. You can also import IP address lists through the SMC API to the SMC. For more information, see the Stonesoft SMC API Reference Guide. 7

8 Integration of Sidewinder Proxies On Sidewinder firewalls, proxies provide high assurance protocol validation. On Stonesoft NG, Sidewinder Proxies enable some of the proxy features that are available on Sidewinder. In Stonesoft NG version 6.1, the following Sidewinder Proxies are supported: HTTP, SSH, TCP, and UDP. You can use Sidewinder Proxies on Stonesoft NG to enforce protocol validation and to restrict the allowed parameters for each protocol. Sidewinder Proxies are primarily intended for users in high assurance environments, such as government or financial institutions. In environments that limit access to external networks or access between networks with different security requirements, you can use Sidewinder Proxies for data loss protection. Changes in category-based URL filtering Category-based web filtering now uses URL categories provided by Forcepoint ThreatSeeker Intelligence Cloud. There are new types of elements for configuring URL filtering: URL Category elements are Network Application elements that represent the categories for category-based URL filtering. URL Category Group elements contain several related URL Categories. URL List elements are Network Application elements that allow you to manually define lists of URLs that you want to allow or block. The way that category-based URL filtering is applied to traffic has changed. You can now use URL Categories, URL Category Groups, and URL Lists in the Service cell of Access rules to configure URL filtering. It is no longer possible to configure URL filtering using Situation elements in the Inspection Policy. Note: These changes affect all existing users of category-based URL filtering. Legacy URL Situation elements can no longer be used in policies for Stonesoft NG version 6.1 or higher. If rules in your policy contain legacy URL Situation elements, you must replace them with URL Category elements. Browser-based wizard for configuring NG appliances As an alternative to using the command-line version of the NG Initial Configuration Wizard (sg-reconfigure) to configure an NG appliance, you can now use an initial configuration wizard in a web browser. Redirection of web traffic to TRITON AP-WEB Cloud TRITON AP-WEB Cloud is a cloud-based web security proxy service. Stonesoft NG can now redirect web traffic to the TRITON AP-WEB Cloud for inspection. Stonesoft NG redirects web traffic to the TRITON AP-WEB Cloud using a predefined policy-based VPN. The traffic is inspected in the TRITON AP-WEB Cloud and transparently forwarded to the destination. Note: To use TRITON AP-WEB Cloud to inspect web traffic, you must have a subscription to the TRITON AP-WEB Cloud service. In addition to an IPv4 or IPv6 address, you can now use a fully qualified domain name (FQDN) as a dynamic contact address of an external VPN gateway. Connecting through a VPN to a dynamic FQDN endpoint allows TRITON AP-WEB Cloud to offer addresses from the geographically closest service point. 8

9 The TRITON AP-WEB Cloud service requires the endpoint to use a MAC address as a unique identifier. You can now define VPN-specific exceptions to the IKE Phase-1 ID for endpoints on VPN Gateways. Exceptions are useful in cases where an external VPN gateway requires specific information in the IKE phase-1 value. For more information and configuration instructions, see Knowledge Base article Enhancements This release of the product includes these enhancements. Enhancements in Stonesoft NG version Enhancement Simplified service configuration and customization improvements in SSL VPN Portal Fully qualified domain names as contact addresses in external VPN gateways VPN-specific exceptions for IKE Phase-1 ID Improved throughput for antimalware inspection Improved scaling of inspection for Virtual Security Engines Improved TCP handling in the inspection module Support for Tunnel Interfaces and unnumbered interfaces for OSPF Enhanced botnet detection SSH server key fingerprints shown on engine console when the engine starts up Description You can now allow access to intranet services in the SSL VPN Portal with a freeform URL. It is no longer necessary to configure each SSL VPN Portal service separately. End users can access the services by typing the URL directly in the SSL VPN Portal. You can now also modify the look-and-feel of the SSL VPN Portal and create a custom theme with company colors and logos for the SSL VPN Portal in the Management Client. In addition to an IPv4 or IPv6 address, you can now use a fully qualified domain name (FQDN) as a dynamic contact address of an external VPN gateway. You can now define VPN-specific exceptions to the IKE Phase-1 ID for endpoints on VPN Gateways. Exceptions are useful in cases where an external VPN gateway requires specific information in the IKE phase-1 value. The throughput of anti-malware inspection has been significantly improved. Inspection now scales up better with multiple Virtual Security Engines. TCP protocol handling in the inspection module has been enhanced for performance and compatibility. Support for Tunnel Interfaces and unnumbered interfaces for OSPF has been added. Botnet detection has been enhanced. If SSH is enabled, SSH server key fingerprints are shown on the local console when the NG engine starts up. 9

10 Enhancements in Stonesoft NG version Enhancement Improved logging for File Filtering Improved evasion detection for HTTP traffic Optimized policy refresh for Virtual Security Engines Description Logging for File Filtering has been improved significantly. For example, all File Filtering Situations are now logged under File Filtering in the Facility column of the Logs view. Deep inspection is now better able to detect evasions in HTTP traffic. Refreshing a policy that includes inspection for a large number of Virtual Security Engines is now faster. Enhancements in Stonesoft NG version Enhancement Improved TLS inspection Description The performance of TLS inspection on larger NG appliances has been improved. Enhancements in Stonesoft NG version Enhancement Improved scaling of dynamic routing for Virtual Security Engines Description Dynamic routing now scales up better with a large number of Virtual Security Engines. Resolved issues These issues are resolved in this release of the product. For a list of issues fixed in earlier releases, see the Release Notes for the specific release. Description Role Issue number DHCP requests and replies might contain so much group information that the DHCP relay service cannot handle the request. In fixed versions, the number of groups added to DHCP requests is limited by the maximum size of the request. As a result, information about some groups might not be passed to DHCP. The DHCP diagnostics facility creates log entries if this issue occurs. IPv6 ICMP error messages are not handled correctly if NAT is applied to the connection. When you take traffic captures using the Management Client, transferring the traffic captures from the engine to the SMC might fail. The CPU load on the engine might also be high., IPS, L2 NG-2761 NG-3305 NG

11 Description Role Issue number The engine might become unresponsive or stop working if the appliance has a large number of CPU cores and there are a large number of new concurrent connections in the VPN. When the VPN Gateway to which VPN Clients connect is a Virtual NG Engine, VPN Client users might not be able to re-authenticate. When the NG Engine receives a large number of Users and User Groups, for example from McAfee Logon Collector, the NG Engine might process traffic more slowly. On interfaces that use the MOE10F4 (MOD-EM2-10G-SFP-4) or MO40F2 (MOD-40G-2) interface modules, link aggregation might stop working when you change the number of VLAN Interfaces on an Aggregated Link interface. When you change the interface configuration on an NG Engine that has a large number of Physical Interfaces or VLAN Interfaces, policy installation can temporarily interrupt the flow of traffic. If the engine has a large number of Physical Interfaces and VLAN Interfaces, status monitoring might periodically report the engine as unreachable. When an NG Engine in the IPS role inspects connections picked up through a Capture Interface, memory consumption might become unusually high. If the Quality of Service (QoS) mode "QoS Statistics Only" is configured for some interfaces while other interfaces use other QoS modes, the engine might stop processing traffic. The McAfee anti-malware version used by NG has been upgraded to address CVE On engines that have 300 or more Physical Interfaces or VLAN Interfaces, Aggregated Link Interfaces might not work correctly., IPS, L2 IPS, IPS, L2, IPS, L2 NG-3981 NG-4212 NG-4327 NG-4419 NG-4420 NG-4433 NG-4497 NG-4551 NG-4730 NG-4733 Installation instructions Use these high-level steps to install SMC and the Stonesoft NG engines. For detailed information, see the Stonesoft Next Generation Firewall Installation Guide. All guides are available for download at Note: The sgadmin user is reserved for SMC use on Linux, so it must not exist before SMC is installed for the first time. Steps 1) Install the Management Server, the Log Servers, and optionally the Web Portal Servers. 11

12 2) Import the licenses for all components. You can generate licenses at 3) Configure the Firewall, IPS, or Layer 2 Firewall elements with the Management Client using the Configuration view. 4) To generate initial configurations for the engines, right-click each Firewall, IPS, or Layer 2 Firewall element, then select Configuration > Save Initial Configuration. Make a note of the one-time password. 5) Make the initial connection from the engines to the Management Server, then enter the one-time password. 6) Create and upload a policy on the engines using the Management Client. Upgrade instructions Take the following into consideration before upgrading licenses, engines, and clusters. Upgrading to version 6.1 is only supported from version 5.10 or later. If you have an earlier version, first upgrade to version Stonesoft NG version 6.1 requires an updated license. The license upgrade can be requested at Install the new license using the Management Client before upgrading the software. If communication between the SMC and the license server is enabled and the maintenance contract is valid, the license is updated automatically. To upgrade the engine, use the remote upgrade feature or reboot from the installation CD and follow the instructions. For detailed instructions, see the Stonesoft Next Generation Firewall Installation Guide. Changes to category-based URL filtering in Forcepoint NG version 6.1 affect all existing users of categorybased URL filtering. Legacy URL Situation elements can no longer be used in policies for Forcepoint NG version 6.1 or later. If rules in your policy contain legacy URL Situation elements, you must replace them with URL Category elements. See the Forcepoint Next Generation Firewall Product Guide for detailed instructions. The way that routes defined in the Management Client are handled by Quagga has changed. In Forcepoint NG version 6.0 and earlier, static routes that you defined in the Management Client were considered kernel routes in Quagga. When redistributing these to dynamic routing protocols, you could use the "redistribute kernel" command. Starting from Forcepoint NG version 6.1.0, static routes that you define in the Management Client are considered static routes in Quagga. This change affects, for example, redistributing routes that you define in the Management Client to the dynamic routing protocols. Configuring static routes using vtysh in Quagga is no longer supported. Use the Management Client to configure static routing. Known issues For a list of known issues in this product release, see Knowledge Base article

13 Known limitations This release of the product includes these known limitations. Limitation Inspection in asymmetrically routed networks Inline Interface disconnect mode in the IPS role Description In asymmetrically routed networks, using the stream-modifying features (TLS Inspection, URL filtering, and file filtering) can make connections stall. The disconnect mode for Inline Interfaces is not supported on IPS virtual appliances, IPS software installations, IPS appliance models other than IPS-6xxx, or modular appliance models that have bypass interface modules. For information about feature-specific limitations, see the Stonesoft Next Generation Firewall Product Guide. Find product documentation On the Forcepoint support website, you can find information about a released product, including product documentation, technical articles, and more. You can get additional information and support for your product on the Forcepoint support website at There, you can access product documentation, Knowledge Base articles, downloads, cases, and contact information. Product documentation Every Forcepoint product has a comprehensive set of documentation. Stonesoft Next Generation Firewall Product Guide Stonesoft Next Generation Firewall online Help Note: By default, the online Help is used from the Forcepoint help server. If you want to use the online Help from a local machine (for example, an intranet server or your own computer), see Knowledge Base article Stonesoft Next Generation Firewall Installation Guide Other available documents include: Stonesoft Next Generation Firewall Hardware Guide for your model Stonesoft Next Generation Firewall Quick Start Guide Stonesoft SMC API Reference Guide Stonesoft VPN Client User Guide for Windows or Mac Stonesoft VPN Client Product Guide 13

14 2017 Forcepoint Forcepoint and the FORCEPOINT logo are trademarks of Forcepoint. Raytheon is a registered trademark of Raytheon Company. All other trademarks used in this document are the property of their respective owners.