Update 1 Release Notes

Transcription

1 Global Command Center Version 3.2 Update 1 Release Notes About this document This document describes the features of Global Command Center Release 3.2 Update 1 and its installation procedure. Contents... About this update... 2 New features... 3 Known issues... 5 Downloading and installing this update A Global Command Center Release Notes 1

2 About this update About this update This Software Update was developed primarily to support the new features of TSP firewall version Prior to this update, an apply from Global Command Center to a TSP firewall would have been unsuccessful. After installing this update, an end user will be able to configure some of these new TSP features from the Global Command Center GUI. For features for which Global Command Center does not provide configuration management support, an end user will configure them via the firewall GUI. Global Command Center will, however, preserve the firewall s setting for these features on an apply. See New features on page 3 for details. There are a few instances of configuration parameters in TSP that Global Command Center neither configures nor preserves. See Known issues on page 5 for details. This Software Update enhances Release 3.2 to provide the following benefits: Client Suite GUI Enhancements The Name Server Statistics report can now be viewed from the Global Command Center. The Classic Firewall s Audit Archive FTP Password is now being managed by Global Command Center. The VPN Certificate constraints allow symbol to be used, allowing E- mail addresses to be used as a constraint. Rules in a rule group are now ordered correctly if a user performs a Move to Top or Move to Bottom on rules in the group. Management Server The mask length is now computed correctly when converting a range endpoint to a subnet endpoint. Retrieval of an authentication rule specifying a Deny Authenticator from a TSP firewall is now handled correctly. Authenticating applications are now correctly mapped if an inline edit of a TSP authentication rule is performed. 2 Global Command Center Release Notes A

3 New features New features Global Command Center Release 3.2 Update 1 provides configuration and management of the following TSP enhancements. VPN Enhancements Configuration and management of the following VPN enhancements are supported: Multiple Diffie-Hellman groups Multiple cryptographic algorithms Multiple authentication algorithms Improved VPN IPSec SA reports can be viewed from Global Command Center. The reports now include: Number of bytes that came into and out of the firewall using the SA Number of packets that came into and out of the firewall using the SA Number of rekeys that the SA has used Number of active flows corresponding to the SA An improved VPN Statistics report can be viewed from Global Command Center. The report now includes: Number of rekeys Number of currently active flows Number of currently active engine rules Number of currently active negotiations Reporting of packets causing triggers as triggered packets. Dropped packets are further categorized under "Invalid IP options," "Resource Problem," "No Route," "Drop Rule," "Internal Error," "Reassembly," "Hardware Accelerator," and "No Rule." Merged/Preserved TSP Features Global Command Center Release 3.2 Update 1 will now preserve the configuration parameters for the new TSP features. These features can be configured only via the TSP firewall GUI. This update will, however, preserve the configuration of these features after an apply is done from Global Command Center to the firewall. VPN Enhancements Global Command Center will preserve the IPSec/VPN compatibility settings for the following: VPN Controls - includes the IKE and XAUTH exchange timers and the NAT-T Keepalive Interval IKE Parameters - includes the Enable NAT Traversal (NAT-T) option A Global Command Center Release Notes 3

4 New features Simple Network Management Protocol (SNMP) Enhancements In the TSP GUI, support was added to configure SNMP via the GUI. Global Command Center Release 3.2 Update 1 will not support configuration of SNMP via its Client Suite GUI; however, it will not overwrite the local SNMP configuration of the firewall on an apply. Scheduled Configuration Backup and Software Updates Global Command Center will preserve the firewall s setting for schedule configuration backup and schedule software updates on an apply. FTP Proxy Enhancements In TSP 6.4.1, support was added to ban upload and download of some files. Global Command Center 3.2 Update 1 will preserve the local firewall s setting for this feature on an apply. Auto-Update of Global Command Center Packages on the Firewall This update extends the upgrade procedure of the Global Command Center firewall packages to make it seamless for the end user. The Auto Update feature ensures that Global Command Center packages on the firewall are in sync with the upgraded Global Command Center Server version. If an incompatibility is detected and it is found that the Management Server is on a higher version than that of the firewall package, the firewall package is automatically upgraded. This way, the user can quickly configure and update large numbers of firewalls to work with Global Command Center with no service interruption. This process also provides a very easy way to upgrade Global Command Center and have all of the firewalls get the available updated functionality and compatibility without user intervention and without downtime to the firewalls. This feature is available only on TSP Release 6.4 and above. 4 Global Command Center Release Notes A

5 Known issues Known issues Unsupported TSP Features The following TSP configurations are neither supported (saved) nor preserved when applying from the Global Command Center 3.2 Update1 Client Suite GUI: VPN Tunnels: Do Not Initiate VPN Tunnels: Enable Anti-Replay VPN Tunnels: Send Certificate Chain The user must use the TSP firewall s native GUI in order to manage these three features after applying a TSP firewall configuration from Global Command Center A Global Command Center Release Notes 5

6 Downloading and installing this update Downloading and installing this update This Software Update should be installed only on Global Command Center Release 3.2. The update is located at Management Server Download the Software Update to an FTP server within your organization that the Global Command Center 3.2 Management Server can access. Use the following commands to FTP the Software Update to your Management Server. Description Log in to your Management Server. Enter your password. Change to the Security Officer user. Log in using your sso login name. Enter your sso password. Enable root user if not already enabled (where <password> is plain text of at least seven alphanumeric characters). Change to root user. Enter your root password. Command <login name> <password> su sso <login name> <password> /usr/sbin/cg_usermod -s /bin/sh -p <password> root su root <password> Go to root directory. cd / Make a new directory named temp. Go to the new directory. FTP to your FTP server. Log in to your FTP server. Enter your password. Request binary mode. Get the Software Update. Exit FTP. Change the permissions of the update file. Execute the script. Prompt: Install PSU psu001320s? [yes or no] mkdir temp cd temp ftp <server> <login name> <password> bin get psu001320s bye chmod 755 psu001320s./psu001320s yes 6 Global Command Center Release Notes A

7 Downloading and installing this update This will boot the Management Server to munix and install the needed files. Client Suite Remove the previous version of the Global Command Center Client Suite as follows: 1 Open Add/Remove Programs in the Control Panel. 2 Select CyberGuard - Global Command Center Client, and click Remove. 3 Go to the C:\Program\CyberGuard Corporation directory, and remove the Global Command Center folder. To install the Client Suite, refer to New Client Suite Installation on page 9 of the Global Command Center Installation Guide Version A Global Command Center Release Notes 7

8 SECURE COMPUTING CORPORATION Technical Support Information Phone or Web Product names used within are trademarks of their respective companies Secure Computing Corporation. All rights reserved. 8 Global Command Center Release Notes A