NETWORK SENTRY KNOWN ANOMALIES. Network Sentry /8.2.9 Agent Analytics Rev: G 9/26/2018

Transcription

1 RELEASE NOTES NETWORK SENTRY KNOWN ANOMALIES Network Sentry /8.2.9 Agent Analytics Rev: G 9/26/2018 For further information, please contact Bradford Networks Customer Support at or # 1, or support@bradfordnetworks.com Bradford Networks 1 of 9

2 Overview These are the Known Anomalies in Network Sentry and agent packages. There are three categories: Network Sentry: Applies to both Network Sentry and (and lower) Agent: Anomalies specific to agent version (and lower) Endpoint Compliance: AV/AS/OS support Analytics: Anomalies specific to Analytics version Network Sentry Description Case # When configured to scan for Critical or Security updates when Microsoft's update servers are inaccessible, the agents will wait for a long time before timing out Avoid the usage of characters such as '&', '<', and '>' in Portal Configuration names. On Aruba devices that are configured to use "Roles with Rules" Network Sentry uses Change of Auth (CoA) to change the role. Network Sentry does not use CoA, however, when the role is changed as a result of deleting a host. If Network Devices have device names that contain non-ascii (nonprintable) characters, they will not be shown in containers in Topology View. SSO Agent and Incoming Events integration type field does not appear on Fortinet devices when modeled for L3 polling. Registration and Remediation on the Model of a Meru controller in topology view display differently under the same conditions. However this does not impede functionality. In ESX VM environments with Network Sentry Firmware Version 5.x and lower, on VMs that use adapter types of "VMXNET-3", when you install O/S Updates that contain kernel updates, the update of the new CentOS-5 kernel can cause the VMXNET-3 adapters to be inoperable and the drivers will need to be reloaded After installing the O/S Updates, access the console of the VM and reload the drivers on VMwareTools using this command: /usr/bin/vmware-config-tools.pl -d Anonymous Authentication and Host Inventory features in the portal do not work simultaneously. Changes device name in properties view in Topo... Affects SSID port groups and SSID interfaces are removed from topo view Bradford Networks 2 of 9

3 Temporary loss of connectivity to SSO agents such as iboss can cause host / user information to not be sent after connectivity is restored. Devices deleted in MDM services may remain registered when using an NCM with host propagation enabled. Enabling proxy support for OS updates from the user interface is currently not 5238 supported. It will be added in a future release. A workaround is available Using Kaspersky 2016 on hosts in registration will lead to inconsistent and unpredictable results. The browser redirect sometimes gives an ERR_CONNECTION_RESET error. The Kaspersky Security Network (KSN) feature of Kaspersky 2016 detects the redirect as suspicious/malicious activity. Resolution: Disable Kaspersky until device is registered. At this time, Bradford Networks does not support Ubiquiti AirOS AP. Ubiquiti AirOS AP does not have the necessary capabilities to allow for full integration with Network Sentry. The limitations are as follows: No support for external MAC Authentication using RADIUS. Limited CLI and SNMP capability. No ability to dynamically modify access parameters (ie. VLANs) for active sessions. At this time, Bradford Networks does not support the Cisco 1852i Controller due to the device's limited CLI and SNMP capability. At this time, Bradford Networks is not able to support the Juniper MAG6610 VPN Gateway. This includes Pulse Connect Secure ASA Bradford Networks 3 of 9

4 (Version 8.1) Network Sentry supports inbound SNMP trap processing (i.e link traps, notification traps, cold start and warm start traps) for SNMPv only Resolution: Support added in The Administrative UI only displays and exports a portion of the events that should be displayed based on the filter. This can occur if a large number of events match the filter. Workaround: Modify the filter to return a smaller number of events. Not all models of all network devices can be configured to perform Physical MAC Address Filtering even though the Admin UI indicates that the configuration can be set. Resolution: Hosts can be disabled by implementing a Dead-end VLAN. For Portal v2 configurations, web pages that are stored in the site directory to be used for Scan Configurations will not be included when you do an Export of the Portal v2 configuration. Resolution: The files in the site directory are backed up with the Remote Backup feature, but otherwise keep a copy of these files in a safe place. Removing a device from the L2 Wired Devices or L2 Wireless Devices Group does not disable L2 (Hosts) Polling under the Polling tab in Topology. The "Set all hosts 'Risk State' to 'Safe'" button changes the status of all hosts marked At-Risk to Safe. However, the status of the individual scans for each host remain unchanged. At this time, Bradford Networks does not support wired port management for the Cisco 702W. The access point does not provide the management capabilities required. Network Sentry may list the Voice VLAN as the Default VLAN on Avaya switch ports in Topology. This can occur if the VlanIdList column in the switch lists the Voice VLAN first. Workaround: See Solution 2635 "Network Sentry Listing Voice VLAN as Default VLAN on Avaya Switch Ports" In a Layer 3 High Availability (HA) environment, configwizard must have a DHCP scope defined. Running configwizard without a DHCP scope can cause a failover. On Network Sentry appliances with CentOS 7, duplicate log messages may appear in dhcpd.log for each sub interface (eth1, eth1:1, eth1:2, etc). Alarms cannot be triggered for a certain events (for example, "Persistent Agent Scan not Performed") for a specific host Bradford Networks 4 of 9

5 Additional login requests may occur when using the Persistent Agent with a lengthy scan. At this time, Bradford Networks is not able to support the Linksys LAPN Wireless-N600 Dual Band Access Point. Bradford Networks does not support the Sophos UTM Uploading a duplicate SSL certificate when using multiple certificates in Certificate Management causes an error to be presented. Workaround: Remove duplicates from the files being uploaded. On Network Sentry Server (NCAS) with L2 High Availability (HA), scheduled reports generate an HTTP 400 error. If Contact Status = Lost (unable to ping), Network Sentry still attempts to perform a L2 poll. This generates L2 Poll Failure events. Resolution: Address the communication issue. If the device is no longer needed, delete the model from Network Sentry. The new feature "Palo Alto VPN Integration" has been determined not to be ready for customer production use managing remote user VPN connections through Palo Alto firewall. When hosts have the Persistent Agent installed and Device Profiler is running, Device Profiling Rule Missing Data events and alarms can be triggered. The agent reports on host adapters that are offline and Device Profiler tries to categorize them but there is not enough information because the adapter is offline. Resolution: There is no workaround. System > Settings > Updates > Operating System will only record and display dates of OS updates that are completed through the Administrative UI. If Operating System updates are run via command line using the "yum" tool, the update is not recorded Resolution: Execute Operating System Updates through the Administrative UI in order to maintain update history. AgentDownload in VPN defaults to legacy Windows PA When using Passive Agent Configuration Rules, the Directory attribute of "Identifier" must be mapped to samaccountname in order for Passive and Persistent Agents to authenticate correctly When a client is registered with an endpoint compliance policy with agent set to None-Bypass, the host is marked at risk when user initiates a scan Scan Host(s) option in Host View. Registration report results are organized by adapter record as opposed to host record. This may cause confusion when trying to interpret the results Bradford Networks 5 of 9

6 CLI Configurations (a.k.a. "Flex CLI") do not work with VPN access "Security Risk Host" Alarm does not Clear with "Host Safe" Event. Resolution: Use "Host Passed Security" Event to clear the alarm. Network Access Policy values are not validated against the device before applying. Consequently, Network Access Policy Application to Switches without VLAN configured may cause cause unexpected results. Network Sentry does not adjust the administrative status of a switch port based upon the receipt of SNMP link state traps. Resolution: The Synchronize Devices task via System > Scheduler can be scheduled, allowing Network Sentry to update the administrative status of interfaces on a regular basis. The Host Inventory feature of the Portal cannot be used in an NCM environment. Hosts that are deleted from the portal will not be deleted from all pods in the NCM environment. Views that contain passwords (Model Configuration Views of devices, Add and Modify RADIUS Settings views, etc) show the passwords in clear text when using "View Source" on the browser. Hosts that fail registration due to being over the physical address limit will receive the "Registration Failed" message. This occurs when the scan's order of operations is set to register first, then scan. Location-based Endpoint Compliance Policies whose scans are configured for "Scan on Connect" may not match immediately upon connecting to the network. Ports on Avaya Networks 4850GTS-PWR+ switches sometimes show "Not Connected" even though the port is active. This is due to multiple ports on the switch using the same MAC Address. This prevents NAC from correctly discerning which are "Connected" versus "Not Connected". There is no workaround. MDM registered hosts will not register successfully on Aruba configured for "Roles Only" if no roles or policies are configured. Scan Results for Windows Operating System scans can show that Automatic Updates, Critical Updates, Internet Connection Sharing, Security Updates and Trigger SCCM Evaluation have Passed even when these settings have not been checked in the Scan Configuration. If DNS servers configured in the Application Server fail the lookup test queries when configwizard is run, configwizard produces "Host Key verification failure" messages. Devices connecting via 802.1x but not using an agent may get registered using Device Profiler before the logged on user is detected. At this time, UniFi AP AC-Pro is not supported. The AP does not have the necessary capabilities to allow for full integration. Switches can consume a license if reporting a string-padded Type value (Example: "switch " instead of "switch") Bradford Networks 6 of 9

7 If there are a large number of standalone Access Points in Topology, the Access Point view may take longer than expected to load. Samsung Android devices may not display Captive notification when Captive Network Assistant is configured for the Captive Portal. Device models for Avaya 4800 switches (and potentially other related models) only support SSH. Device models for Avaya Ethernet Routing Switches only support Telnet. Contact Support if the alternate protocol is required. From a security event, the "Modify Host" view is opened when the user selects "View Host". "Host Registration Failure" events do not provide MAC or IP address information When attempting to register via the Captive Portal, a user may occasionally encounter HTTP Status 500 error indicating "Session already invalidated". Resolution: Re-enter credentials Agent Description Case # Additional login requests may occur when using the Persistent Agent with a lengthy scan. Agent versions through are not supported on Mac OS X 10.6, Snow Leopard, and 4.x versions of the Agent will only be supported on Mac OS X 10.7 and above. Resolution: Apple delivered its final update for the Mac OS X 10.6 Operating System in September 2013, but if hosts with this Operating System are still allowed on your network, use a 3.x version of the Agent or greater. With Forced Authentication and the Persistent Agent, if a host is re-authenticating after being de-authenticated, two Persistent Agent login boxes may be displayed to the user. Resolution: The second login box can be ignored. Linux hosts cannot be prevented from accessing the network via VPN based on Network Sentry group membership that is referenced in a User/Host Profile to assign a Network Access Policy Resolution: There is no workaround. Currently the Linux Persistent Agent does not have the ability to be updated via the Network Sentry Administrative UI. Currently the Agent is not supported on Windows 10S and will not run Persistent Agent binaries are unsigned on macos. The installer is signed, but not the individual binaries. When a user attempts to register a host which exceeds the user's maximum number of hosts allowed, if the user is using the Dissolvable Agent a message is displayed, 2018 Bradford Networks 7 of 9

8 "Over Registered Limit". If the user is using the Persistent Agent, however, "Registration Failed" is displayed. Hosts connecting to VPN via a local SSID do not match the VPN Cllient: Yes criteria Endpoint Compliance Description Case # Only English versions of AV/AS and their corresponding definitions are supported Anti-Virus product Iolo technologies System Mechanic Professional is currently not supported. Analytics Description Case # There is currently no method to backup the Analytics database using the Administrative UI. When trying to retrieve data from a report, the "Please Wait" message does not disappear if there is a server issue. In the Reports > Security Reports > Security Alarms view, the Action Group is listing the database ID number instead of the Group name Bradford Networks 8 of 9

9 Device data is lost when upgrading Analytics from version 3.x directly to 5.x. Workaround: Prior to upgrade, export the reports pertaining to device data. Navigate to the following locations in the Analytics Administrative UI and click the Export Reports button: Reports > PCI Compliance Report > Network Device Count Reports > Network Report > Device Graphs If the ETL Job Scheduler frequency is set to Daily, the Dashboard calculation becomes erratic. Sometimes the Dashboard is calculated, but most of the time is does not, resulting in a blank Dashboard screen Resolution: Change the frequency to either hourly or every 12 hours. On a large data set, Analytics GUI will time out and the report cannot be run. If this occurs, call support. The process name for the Analytics agent appears as "jar" when viewing the results of the jps command in the Network Sentry Server/Control Server CLI. Analytics custom date range displays dates outside of the search criteria When attempting to add a client in Analytics using a name that already exists for "Clients Network Sentry DB" name, a generic message "Error - return to dashboard" is returned. On-Premise Analytics does not support LDAP authentication. User accounts must be created along with credentials. There is no Single Sign-On for On-Premise Analytics. If accessing Analytics via the Network Sentry Administrative UI, user must enter their Analytics UI credentials. Attempting to export large amounts of data to Excel from Analytics may fail Workaround: Export to PDF Bradford Networks 9 of 9