Network Security Platform 7.1

Transcription

1 NS series Release Notes Network Security Platform 7.1 Revision B Contents About this document New features Resolved issues Known issues Installation instructions Product documentation About this document This document contains important information about the current release. We strongly recommend that you read the entire document. This release notes is to announce the availability of McAfee's Next Generation Network Security hardware namely, the NS series Sensors NS9100 and NS9200. This release was developed for use with: Network Security Manager software version: Signature Set: NS series Sensor software version: This version of 7.1 Manager software can be used to configure and manage the following hardware: I series Sensors, M series Sensors, N series Sensors, NS series Sensors, XC Cluster, and NTBA Appliances. The NS9200 and NS9100 Sensors CANNOT be managed using 7.5 Manager; it requires x Manager. Upgrade from Manager software version to is not supported. New features This release of the product includes these new features. New Network Security Sensors: NS9100, NS9200 This release of 7.1 introduces McAfee's next generation Network Security Platform hardware, NS Series Sensor models NS9100 and NS

2 The high port density NS series Sensors are designed for high bandwidth links, to provide IPS/IDS capability with an aggregate performance of up to 20 Gbps on NS9200 and 10 Gbps on NS9100 while monitoring segments in the full duplex mode (tap or inline). The NS series Sensors are flexible enough to adapt to the security needs of any enterprise environment. When deployed at key network access points, they provide real time monitoring on high traffic loads to detect malicious activity and respond to the malicious activity as configured by the administrator. The NS series Sensor is a 2RU unit equipped with the following components: Two slots for pluggable/hot swappable I/O modules McAfee NS series network modules offer a variety of network interfaces, densities, and Sensor deployment options The 2 Port QSFP+ (Quad Small Form Factor Pluggable Plus) Network Interface Module provides 40 Gigabit ethernet connectivity on each port. The 8 Port SFP+ (Small Form Factor Pluggable Plus) (SFP fiber/copper 1Gbps / SFP+ 10Gbps) Network Interface Module provides 10/1 Gigabit ethernet connectivity on each port. Pluggable Transceiver modules McAfee's IAC SFTSR FOT 10 Gbs enhanced 850nm SFP+ transceivers are designed for use in 10 Gigabit Ethernet links over multimode fiber. McAfee's IAC SFTLR FOT 10 Gbs enhanced 1310nm SFP+ transceivers are designed for use in 10 Gigabit Ethernet links up to 10 km over single mode. McAfee's IAC QSFP FOT 850nm QSFP+ transceiver modules are designed for use in 40 Gigabit per second links over multimode fiber. They are compliant with QSFP+ MSA and IEEE 802.3ba 40GBASE SR4. SFP transceiver modules are also supported on the NS series Sensors. Two fixed QSFP+ 40 Gigabit Ethernet ports Eight RJ 45 10/100/1000 Mbps Ethernet Monitoring ports One Console port Redundant Power supply (shipped only with NS9200) Up to 10Gbps Support on Management and Response ports One RJ /1000/10000 Management port One RJ /1000/10000 Response port One RJ 45 Auxiliary port External USB ports for Storage/Rescue application DB9/Serial Console Baud Rate = Failover support (port G0/1) The front and rear panel LEDs provide status information for the health of the Sensor and the activity on its ports. Diagnostics for field replacement The 10/100/1000 Mbps Fail Open Kit and the 1, 10 and 40 Gigabit Fail Open Kits are supported on the NS series Sensors. NTBA is supported on the NS series Sensors. 2

3 Features not supported Traffic Management Packet capture VLAN Bridging The NS9200 and NS9100 Sensors CANNOT be managed using 7.5 Manager; it requires x Manager. Upgrade from Manager software version to is not supported. Resolved issues These issues are resolved in this release of the product. For a list of issues fixed in earlier releases, see the Release Notes for the specific release. Resolved Sensor software issues The following table lists the high severity Sensor software issues: ID # In rare instances after a power cycle reboot, the Sensor internal uplink port could come up with incorrect speed The Sensor date is updated incorrectly when it is not connected to the Manager In rare occurrences, the Sensor process could crash and results in auto recovery modulere starting the process. This issue could occur when GTI File Reputation or SSL decryption module is enabled on the Sensor The Sensor process could crash when it sees jumbo Ethernet frames with ip options traffic GEO location based ACL rules may not work in certain conditions after a Sensor reboot. The following table lists the medium severity Sensor software issues: ID # Counters are not updated correctly for interface when the Sensor sees jumbo frames. Resolved Manager software issues The following table lists the high severity Manager software issues: ID # Evidence reports are not getting exported Proxy server option not available in Central Manager Central Manager Manager communication problem in MDR x Manager imposed a new limit on rule objects at 10. This is not feasible for NAC implementations Layer 7 data forward to Syslog is not available Automated import of Vulnerability data to Manager failed Java process reaches 100% of the CPU utilization due to issue in Sensor CLI audit log feature Error when running alert table offline update scripts after Manager upgrade Compilation error occurs when deploying signature set/uds to Sensors. 3

4 ID # Javascript errors when adding an address to a CIDR sub interface Unable to quarantine hosts Alert Data Pruning fails on the Secondary Manager Nessus report failed to import in Manager Problem with trustedsource checks when using a proxy server. The following table lists the medium severity Manager software issues: ID # Wrong error message when selecting higher number of flows to SSL decryption Bulk Edit for Multiple policies does not take effect if attacks are selected using a filter based on signature set version Unable to configure SNMP access to multiple M 8000XC Sensors Customized Policies Granularity settings changes automatically Tomcat CVE vulnerabilities Configuration update status is not written on the "iv_audit" table correctly Blocked simulated results are not sent correctly via syslog Default set whois server " rejects Port:43 access from the Manager No way to know if it is AM or PM for the displayed time in Version Control Some of the Edit Attack Detail options that are unavailable are not grayed out Alert Unavailable in Real Time Threat Analyzer if the report language is set to Chinese The custom monitor is not displaying the port name Error message when a host is successfully released from Quarantine Unable to quarantine an attacker VM via vcenter Error while saving Protection Profile settings Unable to push update configuration to the Sensor For Reconnaissance Attacks, the Custom Attack Editor does not display "Selected Attacks" and "Threshold" after saving the UDS Central Manager to Manager synchronization fails on inclusion of a Snort rule Unable to generate the Default Top 10 Application Categories by Bandwidth Usage report correctly For Reconnaissance Attacks, the signature set compilation fails when the UDS is added on to the Manager BTP value of alert detail on Real Time Threat Analyzer is incorrect Unable to change the following notification filter settings in the Syslog settings for Network Threat Behavior Analysis The Network Security Platform extension caused high utilization on the epo server during an epo Server upgrade The Real Time Threat Analyzer freezes Sensor shows update required after Manager service restart even when there is no change on the Manager XC Cluster's port status does not reflect actual port status Syslog sends to facility mailog, when configured to send to facility local Two entries of "Not applicable" countries are shown in the Source Country report. 4

5 ID # Special characters are not allowed in proxy settings Threat Analyzer Watch List not highlighting attacks for specific IP addresses Relevancy is not working even after importing data from the MVM database to the Manager via Scheduled Import Java high CPU utilization (95%+) after Manager upgrade Not able to find "GenVulReportFlat.dtd" to import the third party report Ports speed and duplex are shown incorrectly in the TAP mode The "Automated Downloading" Save button logs out user from the Manager console when using Firefox Customer is unable to add, remove, and delete scheduled reports Host name and session start are not correct for the epo host entries in the Real Time Threat Analyzer Attack Filter is not getting applied on policy for LOIC Reconnaissance attacks from Threat Analyzer In Threat Analyzer, user is unable to close the Manage Attack Filter window if the Filter Assignment window is closed first The Manager sends a wrong syslog facility to the Syslog server The Customized Community field value is overwritten by the Community String field value when they have different values The "Device re discovery failure" alert occurs when a Sensor is rebooted The Attack Destination Reputation Summary dashboard shows incorrect Source Reputation data Java process reaches 100% of the CPU utilization and was unable to connect because of applications query in firewall module The Hourly Data Mining and the Daily Data Mining fields are not displayed under the correct section on the Manager user interface Fields in Next generation report generated for bot are blank Child user can see data in reports for all Sensors Dashboard is not showing the port throughput The MDR dump also contains the APP_VIZ tables leading to a big file size The Configuration Tables backup does not exclude all the tables it should Keycertgen utility is not replacing the certification files The Destination Country filter in the Threat Analyzer does not populate any values Manager can create more ACL rules than compared to the Sensor limit Attack Encyclopedia not available for some of the attacks after Manager upgrade Backup type in Automation setting does not save the provided value Unable to read imported MVM 7.0 xml reports Host_Data.xml or Risk_Data.xml in Manager Should not display the earlier UDS attacks on importing new signature set The Show Diff on the policy settings displays incorrect information for Syslog and SNMP notification The threatanalyzer log increases in size after session time out Auto Update / Auto Deployment updates even Sensor is configured to offline updates The Disable Blocking option is not working for 5.1 Sensors after changing the signature set. 5

6 ID # NSLookup through Real Time Threat Analyzer for most IP addresses does not return results Unable to save the Archive scheduler configuration Java process reaches 100% of the CPU utilization because of issue in the Sensor CLI audit log feature Signature software image signature file combo download signature push failure after Sensor upgrade Unable to save changes in the Maintenance tab [Central Manager] Not able to save a display filter if you use the Sensor name in the display filter SMTP address field of NTBA alert notification is limited to 24 characters VLAN scanning exception for a port cluster only displays one of the port pairs Unable to select policy of child domain in Traditional report Unable to add fixed field value comparison based custom signatures SNMP trap showing wrong interface information The Port Utilization graph does not show data when zoomed back into 5 minutes' view Alerts displayed must be in the local time of the NTBA Appliance Newly added CIDR blocks are not displayed in the Manager Numerous Java Null Pointer exceptions causing Real Time Threat Analyzer performance issues Logger names (SyslogAlertForwarder, SyslogFaultForwarder etc.) are missing in the Syslog header messages [Threat Analyzer] The Sensor sometimes sends "duration" as non zero for individual alerts but on the Threat Analyzer, the source and destination port are shown as '0' The Sensor compilation fails if the Sensor has any Interface group created with a SPAN port inside it The columns in report are not aligned properly "An internal application error occurred" message is displayed when generating report Deprecated signature still appears in the Signature description The Update server Automation weekly schedule option goes back to SUNDAY Manager fails to retrieve some data in failover Performance Monitoring Alerts are not being sent to the trap receiver system The Network Access Zone and the Monitoring Port are not available after restarting the Threat Analyzer Timestamp format exception when running an archive restore Out of memory error during compilation due to bug in readfully JAVA API Incident Generator is not working. Known issues For a list of known issues in this product release, see this McAfee KnowledgeBase article: Manager software issues: KB76517 NS series Sensor software issues: KB

7 Installation instructions Review the following before you install the Manager software: The NS9100 and NS9200 ships with Sensor software version McAfee recommends that you upgrade to Sensor version to or later. The following table lists the 7.1 Manager server requirements: OS Minimum required Any of the following: Windows Server 2008 R2 Standard or Enterprise Edition, English OS, SP1 (64 bit) (Full Installation) Windows Server 2008 R2 Standard or Enterprise Edition, Japanese OS, SP1 (64 bit) (Full Installation) Only X64 architecture is supported. Recommended Same as the minimum required. Memory 4GB 8GB CPU Server model processor such as Intel Xeon Same Disk space 40GB 80GB disk with 8MB memory cache or greater Network 100Mbps card 1000Mbps card Monitor 32 bit color, 1024 x 768 display setting 1280 x 1024 The following are the system requirements for hosting Central Manager/Manager server on a VMware platform. Table 5-1 Virtual machine requirements Component Minimum OS Any of the following: Windows Server 2008 R2 Standard or Enterprise Edition with SP1 (English) (64 bit) Windows Server 2008 R2 Standard or Enterprise Edition with SP1 (Japanese) (64 bit) Recommended Same as minimum required. Only X64 architecture is supported. Memory 4 GB 8 GB Virtual CPUs 2 2 or more Disk Space 40GB 80GB Table 5-2 VMware ESX server requirements Component Minimum Virtualization software VMWare ESX Server version 4.0 update 1 and version 4.1 ESXi 5.0 ESXi 5.1 CPU Intel Xeon CPU ES 2.00GHz; Physical Processors 2; Logical Processors 8; Processor Speed 2.00GHz. 7

8 Table 5-2 VMware ESX server requirements (continued) Component Memory Internal Disks Minimum Physical Memory: 16GB 1 TB The following table lists the 7.1 Manager client requirements when using Windows 7: Minimum OS Windows 7 Recommended The display language of the Manager client must be same as that of the Manager server OS. RAM 2 GB 4 GB CPU 1.5 GHz processor 1.5 GHz or faster Browser Internet Explorer 8.0 or 9.0 Mozilla Firefox 4.0 and above The following table lists the 7.1 Manager client requirements when using Windows XP SP3: OS Minimum Windows XP SP3 RAM 1 GB 2 GB Browser Internet Explorer 7.0 or 8.0 Mozilla Firefox 4.0 and above Recommended Internet Explorer 8.0 Internet Explorer 9.0 For the Manager client, in addition to Windows 7 and Windows XP, you can also use the operating systems mentioned for the Manager server. For more information, see McAfee Network Security Platform Installation Guide. McAfee regularly releases updated versions of the signature set. Note that automatic signature set upgrade does not happen. You need to manually import the latest signature set and apply it to your Sensors. The following is the upgrade matrix supported for this release: 8

9 NSP Component Minimum Software Version Manager/Central Manager and above NS series , Upgrade from Manager software version to is not supported. For more information, see McAfee Network Security Platform Upgrade Guide. Product documentation Every McAfee product has a comprehensive set of documentation. Find product documentation 1 Go to the McAfee Technical Support ServicePortal at 2 Under Self Service, access the type of information you need: To access... User documentation Do this... 1 Click Product Documentation. 2 Select a product, then select a version. 3 Select a product document. KnowledgeBase Click Search the KnowledgeBase for answers to your product questions. Click Browse the KnowledgeBase for articles listed by product and version. The related documents available with NS series software are: NS series Quick Start Guide NS series Transceiver Modules Reference Guide NS series Sensor Product Guide 40 Gigabit Active Fail Open Kit Quick Start Guide NS series Interface Modules Reference Guide Addendum II to 7.1 Documentation Copyright 2013 McAfee, Inc. Do not copy without permission. McAfee and the McAfee logo are trademarks or registered trademarks of McAfee, Inc. or its subsidiaries in the United States and other countries. Other names and brands may be claimed as the property of others. 0B-00