This release of the product includes these new features that have been added since NGFW 5.5.

Transcription

1 Release Notes Revision B McAfee Next Generation Firewall Contents About this release New features Enhancements Known limitations Resolved issues System requirements Installation instructions Upgrade instructions Additional information Build version Compatibility Known issues Find product documentation About this release This document contains important information about the current release. We strongly recommend that you read the entire document. The Security Engine product name has changed in this release. The Security Engine is now known as the McAfee Next Generation Firewall or NGFW. NGFW engines are still represented by Security Engine elements in the Management Client. New features This release of the product includes these new features that have been added since NGFW 5.5. New features introduced in NGFW 5.7 Botnet detection McAfee NGFW now supports botnet detection using the following new Command and Control (C&C) communication detection methods: - Decryption-based detection: Detect known characteristics of the botnet C&C, port number, carrier, encryption protocol, and key material. - Message length sequence analysis detection: Extract message length for sequence analysis for botnet C&C detection. 1

2 New features introduced in NGFW 5.6 Virtual Security Engines in IPS and Layer 2 Firewall roles McAfee NGFW now supports Virtual Security Engines in the Virtual IPS and Layer 2 Firewall roles. Support for the Virtual Firewall/VPN role was added in version 5.5. Virtual Security Engines are logically separate engines that run as virtual engine instances on a physical engine device. You can now use a physical NGFW device as a Master Engine to provide resources for Virtual Security Engines. This means that the same Master Engine can simultaneously have different security policies, separate routing tables, and overlapping IP addresses for different interfaces (reserved by different Virtual Security Engines). You can configure up to 250 Virtual Firewalls, Virtual IPS engines, or Virtual Layer 2 Firewalls per Master Engine. The Master Engine can be clustered. The Virtual Security Engines are load-balanced between the Master Engine nodes. One Master Engine handles all the traffic of one Virtual Security Engine at any given time. All Virtual Engines hosted by one Master Engine or Master Engine cluster must be in the same role. Virtual Security Engines do not require individual licenses. Instead, the license for the Master Engine defines how many Virtual Resources can be created. The number of Virtual Resources limits the number of Virtual Security Engines. In this major version, Virtual Security Engines can be used in the Firewall/VPN, IPS, and Layer 2 Firewall roles with some limitations in normal engine features. Virtualization works across several administrative Domains. For example, the Master Engine can be in the Shared Domain and the Virtual Security Engines can be in one or several other Domains. Enhancements This release of the product includes these enhancements added since NGFW 5.5. Enhancements introduced in NGFW 5.7 Application detection coverage has been improved The McAfee AppPrism Application signature library is now used for application detection with McAfee NGFW. Anti-virus engine changed The anti-virus engine used in McAfee NGFW engines is now based on the McAfee Anti-Virus Scanning Engine. Out of window TCP resets dropped in Normal Connection Tracking Mode without inspection Protection against spoofed TCP reset packets has been improved in Normal Connection Tracking Mode. In the new TCP reset protection feature, RFC 5961 blind reset attack protection is implemented in the engine on behalf of the connection endpoints. The feature is configured through the TCP Reset Sensitivity setting in the DoS Protection Settings in the engine properties. Rule tag logging Connection closed log entries now also contain the rule tag associated with the connection. Related connection log entries now also contain the rule tag of the parent connection. TLS 1.2 support in TLS inspection TLS protocol version 1.2 is now supported in TLS inspection for client protection and server protection. Decompression in inspection By default, the engine now also decompresses Zip archives that have been compressed using the Deflate method when inspecting traffic. 2

3 Enhancements introduced in NGFW 5.6 Scan detection You can configure Security Engines and Master Engines to detect if network ports are scanned. When you enable Scan Detection on a Firewall, IPS engine, Layer 2 Firewall, Master Engine, or Virtual Security Engine, a log is generated if scan probes are detected. Security Engines and Master Engines support IPv4 and IPv6 protocols and detect TCP, UDP, and ICMP scan types. Scan detection has been redesigned in version 5.6. Scan detection performance has been optimized for multi-core platforms and the feature activation has been simplified. You can now define a general Scan Detection setting in the engine properties. You can override the general Scan Detection settings in Access rules. SYN flood protection You can configure Security Engines to detect SYN flood attacks. When you enable SYN flood protection on a Firewall, IPS engine, Layer 2 Firewall, or Virtual Security Engine, a log is generated if a SYN flood is detected. The engine uses the SYN cookie method to prevent SYN packets sent from spoofed IP addresses from reaching the target host. When a SYN flood attack ends, a new log event is generated. The SYN flood protection feature has been redesigned in version 5.6. The performance of SYN flood protection has been optimized for multi-core platforms and the feature activation has been simplified. You can define SYN flood protection settings as part of general DoS Protection settings in the engine properties. You can override the general DoS Protection settings in Access rules. Protection against slow HTTP requests You can configure the Security Engines to detect very slow HTTP GET or POST requests that may indicate an attack against web applications and may cause a DoS situation. The engine uses a faster timeout for HTTP connections if the HTTP GET and POST requests are very slow. You can define protection against slow HTTP requests as part of general DoS Protection settings in the engine properties. You can override the general DoS Protection settings in Access rules. VLAN Interface support for IPS engines and Layer 2 Firewalls You can now use VLAN Interfaces and re-tag network traffic on IPS engines and Layer 2 Firewalls. The settings are configured in the engine properties. Ethernet MTU can be defined for IPS engine and Layer 2 Firewall interfaces The Ethernet Maximum Transmission Unit (MTU) can now be defined for IPS engine and Layer 2 Firewall interfaces in the engine properties. Improved connection tracking configuration for IPS engines and Layer 2 Firewalls You can now choose between three connection tracking modes (Strict, Normal, and Loose) in the engine properties. You can override the engine-specific setting in Access rules. Interface link aggregation improved for Firewalls Interface link aggregation stability and performance have been improved in this major version. 3

4 Known limitations High-Security Inspection Policy and Strict TCP mode are not supported in asymmetrically routed networks in IPS and Layer 2 Firewall roles The High-Security Inspection Policy and Strict TCP mode are not supported in asymmetrically routed networks or in environments where an NGFW in the IPS or Layer 2 Firewall role is directly connected to a load-balancing or High Availability network device. It is recommended to base policies on the Medium-Security Inspection Policy in such cases. In Strict TCP mode and in the High-Security Inspection Policy, the engine controls the progress of a TCP connection and checks that the TCP handshake proceeds according to the TCP protocol. The same engine node must be able to see all the packets in the connection. In Strict TCP mode, the engine also enforces the packet direction (for example, SYN and SYN-ACK packets are not allowed from the same interface). The TLS inspection and URL filtering features use Strict TCP mode and are not supported in asymmetrically routed networks in the IPS and Layer 2 Firewall roles. SSL/TLS inspection and web filtering are not supported in capture (IDS) mode The TLS inspection and URL filtering features are not supported in capture (IDS) mode. Inline Interface Disconnect Mode in IPS role The Inline Interface Disconnect Mode is not supported on IPS Virtual Appliances, IPS software installations, or appliance models other than IPS-6xxx or modular appliance models on bypass NIC modules. Resolved issues These issues have been resolved since version NGFW For a list of issues that have been fixed in earlier releases, see the Release Notes for the specific release. Issue Role Description OpenSSL library update (#108656) FW L2FW IPS The OpenSSL library has been updated to versions 0.9.8za and 1.0.1h to address the issue listed in CVE The issue does not affect the following: - TLS management connections. The SMC does not use OpenSSL. - TLS inspection. TLS inspection only uses the low-level cryptographic functions of OpenSSL. TLS inspection does not use the TLS layer of OpenSSL. - Browser-Based User Authentication with HTTPS. Browser- Based User Authentication does not use OpenSSL. The following connections are vulnerable: - Connections between engines and the User Agent. - Cluster communication between the cluster nodes. 4

5 System requirements McAfee NGFW appliances Appliance model FW-315 MIL-320 FW-1030 FW-1060 FW-5000 IPS-1030 IPS-1060 IPS-1205 Supported roles Firewall/VPN Firewall/VPN Firewall/VPN Firewall/VPN Firewall/VPN IPS and Layer 2 Firewall IPS and Layer 2 Firewall IPS and Layer 2 Firewall 1035 Firewall/VPN, IPS, and Layer 2 Firewall 1065 Firewall/VPN, IPS, and Layer 2 Firewall 1301 Firewall/VPN, IPS, and Layer 2 Firewall 1302 Firewall/VPN, IPS, and Layer 2 Firewall 1402 Firewall/VPN, IPS, and Layer 2 Firewall 3201 Firewall/VPN, IPS, and Layer 2 Firewall 3202 Firewall/VPN, IPS, and Layer 2 Firewall 3205 Firewall/VPN, IPS, and Layer 2 Firewall 3206 Firewall/VPN, IPS, and Layer 2 Firewall 5201 Firewall/VPN, IPS, and Layer 2 Firewall 5205 Firewall/VPN, IPS, and Layer 2 Firewall 5206 Firewall/VPN, IPS, and Layer 2 Firewall Some features in this release are not available for all appliance models. See and for up-to-date appliance-specific software compatibility information. McAfee appliances support only the software architecture version (32-bit or 64-bit) that they are shipped with. Certified Intel platforms McAfee has certified specific Intel-based platforms for the Next Generation Firewall. Tested platforms can be found from McAfee Support Knowledge Center ( under the Next Generation Firewall product. We strongly recommend using certified hardware or a pre-installed McAfee appliance as the hardware solution for new McAfee NGFW installations. If it is not possible to use a certified platform, the NGFW can also run on standard Intel-based hardware that fulfills the hardware requirements. 5

6 Basic NGFW hardware requirements Intel Core 2 / Intel Xeon based hardware IDE hard disk (IDE RAID controllers are not supported) and CD-ROM drive Memory: 2 GB RAM minimum for 32-bit (i386) installation 8 GB RAM minimum for 64-bit (x86-64) installation VGA-compatible display and keyboard One or more certified network interfaces for the Firewall/VPN role 2 or more certified network interfaces for IPS with IDS configuration 3 or more certified network interfaces for Inline IPS or Layer 2 Firewall For more information on certified network interfaces, see Requirements for Master Engines Each Master Engine must run on a separate physical NGFW device. For more details, please read the hardware requirements document at All the Virtual Security Engines hosted by a Master Engine or Master Engine cluster must have the same role and the same Failure Mode ( fail-open or fail-close ). Master Engines can allocate VLANs or interfaces to Virtual Security Engines. If the Failure Mode of the Virtual IPS engines or Virtual Layer 2 Firewalls is Normal (fail-close) and you want to allocate VLANs to several engines, you must use the Master Engine cluster in standby mode. Cabling requirements for Master Engine clusters that host Virtual IPS engines or Layer 2 Firewalls: Failure Mode Bypass (fail-open) requires IPS serial cluster cabling. Failure Mode Normal (fail-close) requires Layer 2 Firewall cluster cabling. For more information on cabling, see the McAfee NGFW Reference Guide for IPS and Layer 2 Firewall Roles. Requirements for Virtual Appliance Nodes VMware ESXi versions 5.1 and GB virtual disk 1 GB RAM minimum, 2 GB recommended if inspection is used A minimum of one virtual network interface for the Firewall/VPN role, three for IPS or Layer 2 Firewall roles The following limitations apply when a McAfee NGFW is run as a virtual appliance node in the Firewall/VPN role: Only Packet Dispatching CVI mode is supported. Only Standby clustering mode is supported. Heartbeat requires a dedicated non-vlan-tagged interface. The following limitations apply when a McAfee NGFW is run as a virtual appliance node in the IPS or Layer 2 Firewall role: Clustering is not supported. 6

7 Installation instructions Note The sgadmin user is reserved for McAfee use on Linux, so it must not exist before the McAfee Security Management Center is installed for the first time. The main installation steps for the McAfee Security Management Center (SMC) and the NGFW engines are as follows: 1. Install the Management Server, the Log Server(s), and optionally the Web Portal Server(s) and the Authentication Server(s). 2. Import the licenses for all components (you can generate licenses at 3. Configure the Firewall, IPS, or Layer 2 Firewall elements with the Management Client using the Security Engine Configuration view. 4. Generate initial configurations for the engines by right-clicking each Firewall, IPS, or Layer 2 Firewall element and selecting Save Initial Configuration. 5. Make the initial connection from the engines to the Management Server and enter the one-time password provided during Step Create and upload a policy on the engines using the Management Client. The detailed installation instructions can be found in the product-specific installation guides. For a more thorough explanation of using the McAfee Security Management Center, refer to the Management Client Online Help or the McAfee SMC Administrator s Guide. For background information on how the system works, consult the McAfee SMC Reference Guide. All guides are available for download at Upgrade instructions McAfee NGFW version requires an updated license if upgrading from version 5.6.x or lower. The license upgrade can be requested at Install the new license using the Management Client before upgrading the software. The license is updated automatically by the SMC if communication with McAfee servers is enabled and the maintenance contract is valid. Note The anti-virus engine changes from ClamAV to McAfee when upgrading from a version lower than to version or higher. To upgrade and maintain anti-virus scanning capability, these steps must be taken: 1. Upgrade the SMC to version 5.7 or higher and the engine to version or a higher 5.5 version. 2. Before upgrading the engine, issue this command for each engine from the Monitoring view in the Management Client: Commands Update Anti-Virus Database 3. Wait until the Appliance Status monitoring confirms that the new anti-virus signature database has been downloaded. 4. Upgrade the engine using the remote upgrade feature normally. If the engine does not have the new anti-virus database available before the upgrade, the upgrade can be done but it takes some time before anti-virus is operational again after the upgrade. 7

8 To upgrade the engine, use the remote upgrade feature or reboot from the installation CD and follow the instructions. Detailed instructions can be found in the McAfee NGFW Installation Guide for Firewall/VPN Role and the McAfee NGFW Installation Guide for IPS and Layer 2 Firewall Roles. Note McAfee NGFW appliances support only the software architecture version that they are pre-installed with. 32-bit versions (i386) can only be upgraded to another 32-bit version and 64-bit versions (x86-64) can only be upgraded to another 64-bit version. Clusters can only have online nodes using the same software architecture version. State synchronization between 32-bit and 64-bit versions is not supported. Changing architecture for third-party server machines using software licenses requires full re-installation using a CD. Upgrading to any 5.7.x version is only supported from a 5.5.x, 5.6.x, or 5.7.x version. If you are running a lower version, upgrade first to the highest 5.5.x version following the instructions in the release notes for that version. Note If you have not changed the root password since engine version 4.x, change the root password before upgrading using the sg-reconfigure tool or the Management Client. If the upgrade is done without changing the root password, root login to the engine does not work after upgrading to or a higher version until the password has been reset in the Management Client. It is recommended to change root password in any case, as the salted hash of the root password is stored using a stronger hash (SHA-512) in version and higher. Additional information In this major version New brand Stonesoft Management Center is now called McAfee Security Management Center. At the same time, we have changed the main application icons, the OS level icons, the look and feel of the SMC installer, the login page, the Getting Started page, the Web Start page, the Web Portal, the browser-based user authentication pages, the Online Help, and the SMC API documentation pages. We have also updated the Windows Service names and the default installation folder paths. The Security Engine product name has also changed in this release. The Security Engine is now known as the McAfee Next Generation Firewall or NGFW. NGFW engines are still represented by Security Engine elements in the Management Client. 8

9 Build version McAfee Next Generation Firewall version build version is Product Binary Checksums sg_engine_ _i386.iso SHA1SUM 14553a71fbae85f39833bde326d25c19a4757e7a SHA512SUM 286db37336d29a9ff e8ef3fa5877b29d9b0e f f8fe94f727fcb5fff01daf61a cad28b34a8f250af30be6d66d36b732c sg_engine_ _i386.zip SHA1SUM f5ae4e3742ccc264a8681b329cf7ef2ed04dc77b SHA512SUM 3826fd351ece0ce259a3e6da51c184811a6b0f0ec5680fadc851280acf3025a0f65ffea87dc7e11c5015ee5eb ae5712bf391be58ac4e878f e20332a4 sg_engine_ _x86-64.iso SHA1SUM 46a68fca41399ba9ee5dee7b5042cf4b7bfcb56b SHA512SUM 2adcfeff2778c8d666ac2387ccc3d656470abacc791ee55464a7edebb52a53b9843e3607b4e367fc60fc0753 a523a9b01772cddc4a996b0d c9a0a7ee sg_engine_ _x86-64.zip SHA1SUM 08d1272c2cc97a24db3cd025b709e68b86a27285 SHA512SUM a70c943aa3a48e4a3ddd03e34579e15b81c779a62f22ceb7b8b5b3bed85544a39fe63a3f3cef7bbd5495b72 f38828c3d2ea608c2309ed6da3c79daec05dab1b9 Compatibility Minimum McAfee NGFW version is compatible with the following component versions: McAfee Security Management Center or higher Dynamic Update 545 or higher Stonesoft IPsec VPN Client or higher Server Pool Monitoring Agent or higher User Agent or higher 9

10 Known issues The current important known issues of McAfee NGFW version are described in the table below. Issue Role Description Packet fragmentation in route-based VPN does not work (#105431) FW Packet fragmentation in route-based VPN does not work properly. Find product documentation McAfee provides the information you need during each phase of product implementation, from installation to daily use and troubleshooting. After a product is released, information about the product is entered into the online Knowledge Base. Information about McAfee NGFW and McAfee Security Management Center can still be found at To access... User documentation Knowledge Base Do this... Go to Go to the Stonesoft Knowledge Base: The known issues database and the release notes can be found on the website. Go to the McAfee Knowledge Center: New material will be published under the Next Generation Firewall product. Copyright 2014 McAfee, Inc. Do not copy without permission. McAfee and the McAfee logo are trademarks or registered trademarks of McAfee, Inc. or its subsidiaries in the United States and other countries. Other names and brands may be claimed as the property of others. 00-B 10