IBM Security Network Protection

Transcription

1 IBM Security Network Protection XGS firmware release Features and Enhancements IBM SECURITY SUPPORT OPEN MIC Reminder: You must dial-in to the phone conference to listen to the panelists. The web cast does not include audio. USA toll-free: USA toll: Participant passcode: Slides and additional dial in numbers: August 25, 2016 NOTICE: BY PARTICIPATING IN THIS CALL, YOU GIVE YOUR IRREVOCABLE CONSENT TO IBM TO RECORD ANY STATEMENTS THAT YOU MAY MAKE DURING THE CALL, AS WELL AS TO IBM S USE OF SUCH RECORDING IN ANY AND ALL MEDIA, INCLUDING FOR VIDEO POSTINGS ON YOUTUBE. IF YOU OBJECT, PLEASE DO NOT CONNECT TO THIS CALL.

2 Panelists Bill Klauke Presenter L2 Support Product Lead Moazzam Khan L3 Software Engineer Eric York Product Manager Maxime Turlot L2 Support Product Lead Jack Cam Moderator L2 Support Manager 2 IBM Security

3 What are the new features and enhancements in the XGS firmware release? 3 IBM Security

4 Agenda Inbound/Outbound SSL inspection enhancements XGS/GX parity features Additional Administrator Settings Local Management Interface and Command Line Interface enhancements Support for Remote Syslog over TLS More serviceability features BMC Update 4 IBM Security

5 SSL Inspection Enhancements

6 SSL Inspection Enhancements Inbound and Outbound support for the Extended Master Secret TLS Extension Microsoft added support for EMS in IIS v10. Login.live.com uses EMS extensions. Microsoft started adding support for EMS in Openssl will add support in version slated for August Outbound support for Channel ID TLS extension and ChaCha20-Poly1305 Cipher Suites (When using Chrome browser to access Google web sites) ChaCha was developed for use on mobile devices which don t have AES capable hardware. ChaCha20-Poly1305 is only available on Chrome at this time. Apple and Firefox may add it soon. Channel ID is used by the Chrome browser to access Google sites. 6 IBM Security

7 SSL Inspection Enhancements Added ability to force unrecognized resumed sessions to renegotiate on inbound SSL connections Support for session resumption was first added in firmware Missed cache hits would trigger an FNXSI system event To enable the new feature, add the following tuning parameter: alpsd.ssl.intercept.cache_miss=true (default=false) 7 IBM Security

8 SSL Inspection Enhancements Handling unsupported TLS extensions on Outbound SSL connections As new TLS extensions are developed regularly, you will run into situations where the XGS will not be able to handle the new extension. You can add the following tuning parameter to force Outbound SSL to strip away unsupported extensions: alpsd.ssl.intercept.domains= google.com, gmail.com Prior to 5.3.3, this tuning parameter had a default list of mostly Google sites. 8 IBM Security

9 XGS/GX Parity Features

10 XGS/GX parity features Response object content customization Add a new Content tab when creating response object Allow to customize Subject and Body To add new fields(s) Select one or multiple parameters and click [>] button to add to the message Double click Drag-and-drop Edit text directly to remove parameters 10 IBM Security

11 XGS/GX parity features IPS events generated on the XGS will now add the following 4 data fields when it sends events to a SiteProtector System 1. event-type OpenSignature/Status/Audit/Attack 2. Issue ID (same as algorithm-id) 3. target-ip-addr-start 4. target-ip-addr-end These 4 fields are present on the GX appliance-generated IPS events. 11 IBM Security

12 Enhancement for Administrator Settings

13 Enhancement for Administrator Settings Administrator must acknowledge press OK the login banner prompt before entering password to login CLI and LMI 13 IBM Security

14 Enhancement for Administrator Settings Added a configurable policy control for minimum length of new password 14 IBM Security

15 Local Management Interface and Command Line Interface Enhancements

16 LMI and CLI Enhancements Added system summary information, such as model, serial number, and NIM information in LMI dashboard and CLI CLI > sysinfo> show 16 IBM Security

17 LMI and CLI Enhancements Added the capability to configure the unique rule label for the Access events of the Network Access Policy rules Use comment field for placing alias : as default delimiter. Using acl.rule.label.delimiter to change Rule label shows up as new column in SiteProtector event details, Tag name will still be Access In NAP rule In event report detail 17 IBM Security

18 LMI and CLI Enhancements Clear Network Access and IPS events Configure via LMI > Monitor > Logs Before In IBM Security

19 LMI and CLI Enhancements Download update package before installation Configure via LMI > Manage > Available Updates Before In If you have a slow connection to the internet, this will avoid long download times for the firmware updates and keep you in your maintenance window. 19 IBM Security

20 LMI and CLI Enhancements Added Speed/Duplex settings to the Management Interfaces page Configure via LMI > Manage > Management Interfaces Before In Note: Supported BMC version needed for XGS 3100 and XGS IBM Security

21 LMI and CLI Enhancements Added a warning message to the pending policy deployment page in LMI for potential link flapping due to policy change example warning before pushing protection interface policy 21 IBM Security

22 LMI and CLI Enhancements Support for grep function for log viewer CLI > logs > grep example grep for system events without parameters 22 IBM Security

23 Support for Remote Syslog over TLS

24 Support for Remote Syslog over TLS Remote Syslog support for TLS first appeared in firmware Was configured via the comment field Rsyslog objects configured in will not be migrated, but will still work Instructions can be found on appliance help (LMI banner > click Help ) 24 IBM Security

25 Serviceability Enhancements

26 Serviceability Enhancements More system events for critical events Capability to log the enter and exit software bypass in system events as critical events. (FNXDP, FNXPM) Capability to report unanalyzed and dropped frames. (FNXUD) FNXDP7001I FNXDP7002I FNXPM1011I FNXPM1012I FNXUD0001I FNXUD0002I Packet driver entered software bypass state Packet driver left software bypass state. Packet processing engine is entering bypass mode. Packet processing engine is leaving bypass mode. There are {frame} packets unanalyzed within last {period} minute(s) at interface {interface}. There are {frame} packets dropped within last {period} minute(s) at interface {interface}. FNXUD system alert: Disabled by default. Change via LMI > Manage > System Alerts. Reporting interval is 10 minutes if enabled. Use alpsd.statistics.interval=<min> to change 26 IBM Security

27 Serviceability Enhancement System event details list download for all languages through LMI Help page LMI> Help > Troubleshooting > System event details 27 IBM Security

28 Serviceability Enhancement Added more details to Outbound SSL Inspection failures in system events and improved existing Inbound SSL Inspection logging Added a failure event for outbound SSL inspection The event includes the destination domain / IP where the user is connecting to (e.g. mail.google.com) as well as the reason why outbound SSL inspection fails Usage: To identify the cause of OSSL failure To create outbound ignore rule based on event description FNXSI1003E Outbound SSL inspection failed for rule: {rule},src_addr:{src_addr}, dest_addr:{dest_addr},src_port:{src_port}, dest_port:{dest_port}, domain: {domain}, throttled:{throttled}, error:{error} 28 IBM Security

29 BMC Update

30 BMC Update There are new machine code updates for the 3100/4100/5100/7100 appliance models 3100/4100/5100 get improved temp sensors with corrected thresholds 3100/4100 get ability to hard-code management port speed/duplex 7100 gets improved PSU failure detection as well as diagnostic info for AC DC power supplies Start update by selecting boot option Hardware Updater in GRUB menu after installed IBM Security

31 BMC Update Press enter or wait 60 seconds for update or turn off to skip. When upgrade is in progress, power off or reboot is NOT allowed because it may cause damage resulting in RMA. Estimated time of upgrade depends on appliances. System will reboot automatically when upgrade is completed successfully. GRUB menu will point to default ISNP boot option. Model XGS3100 XGS4100 XGS5100 XGS7100 Estimated Time of Upgrade 40 Minutes 10 Minutes 20 Minutes 31 IBM Security

32 pre-event forum questions 1 For the Speed/duplex settings to work, what is the supported BMC version? How do you check and update the BMC if needed? 32 IBM Security

33 Questions for the panel Now is your opportunity to ask questions of our panelists. To ask a question now: Press *1 to ask a question over the phone or Type your question into the IBM Connections Cloud Meeting chat To ask a question after this presentation: You are encouraged to participate in our Forum on this topic - topic-wh/ 33 IBM Security

34 Where do you get more information? Questions on this or other topics can be directed to the dw Answers forum: More articles you can review: Technote : IBM Security Network Protection firmware update release notes Technote : IBM Security Network Protection XGS Appliance Machine Code Updates for the firmware update Technote : IBM Security Network Protection /XGS Knowledgebase Index IBM Security Network Intrusion Prevention System Virtual Appliance product information: IBM Knowledge Center: 34 IBM Security

35 IBM Security Support Information Useful links: Get started with IBM Security Support IBM Support Portal Sign up for My Notifications Follow us: 35 IBM Security

36 THANK YOU FOLLOW US ON: securityintelligence.com xforce.ibmcloud.com Copyright IBM Corporation All rights reserved. The information contained in these materials is provided for informational purposes only, and is provided AS IS without warranty of any kind, express or implied. Any statement of direction represents IBM's current intent, is subject to change or withdrawal, and represent only goals and objectives. IBM, the IBM logo, and other IBM products and services are trademarks of the International Business Machines Corporation, in the United States, other countries or both. Other company, product, or service names may be trademarks or service marks of others. Statement of Good Security Practices: IT system security involves protecting systems and information through prevention, detection and response to improper access from within and outside your enterprise. Improper access can result in information being altered, destroyed, misappropriated or misused or can result in damage to or misuse of your systems, including for use in attacks on others. No IT system or product should be considered completely secure and no single product, service or security measure can be completely effective in preventing improper use or access. IBM systems, products and services are designed to be part of a lawful, comprehensive security approach, which will necessarily involve additional operational procedures, and may require other systems, products or services to be most effective. IBM does not warrant that any systems, products or services are immune from, or will make your enterprise immune from, the malicious or illegal conduct of any party.