McAfee Web Gateway 7.4.0

Transcription

1 Release Notes Revision A McAfee Web Gateway Contents About this release New features and enhancements Resolved issues Installation instructions Known issues Product documentation About this release This document contains important information about the current release. We strongly recommend that you read the entire document. McAfee Web Gateway (Web Gateway), version 7.4.0, is provided as a controlled release. It is a major version that introduces new features and enhancements, and resolves issues present in previous versions. New features and enhancements This release of the product includes these new features and enhancements. Advanced Threat Defense integration Using the McAfee Advanced Threat Defense web security product, web objects can be scanned after having been received on Web Gateway from a particular web server in response to a request that was forwarded. Depending on the scanning result McAfee Advanced Threat Defense delivers to Web Gateway, the web object is forwarded to the requesting client or not. For more information, see the Web filtering chapter of the McAfee Web Gateway Product Guide. JavaScript Object Notation data JavaScript Object Notation (JSON) data can be processed on Web Gateway. The notation can be used for transmitting data of different types. 1

2 On Web Gateway, JSON data can be retrieved, for example, from external lists or from scanning reports created by McAfee Advanced Threat Defense. After retrieving the data, you can: Read JSON data Modify JSON data Create new objects containing JSON data For more information, see the Lists chapter of the McAfee Web Gateway Product Guide. Improved conditional DNS forwarding Use of DNS (Domain Name System) servers to resolve URL information into IP addresses can now be configured on Web Gateway to include also information collected in reverse DNS lookups. For more information, see the Proxies chapter of the McAfee Web Gateway Product Guide. Rule tracing enhancements Options for creating and reviewing rule traces have been modified to make them even better suited for debugging rule processing issues. A more powerful search function is also provided. For more information, see the Troubleshooting chapter of the McAfee Web Gateway Product Guide. File opening improvement File opening has been improved by enabling the composite opener to handle also those PDF files that could not be opened in earlier product versions and so were classified as corrupt. Incident handling additions Incidents have been added for handling events that are related to the WCCP protocol, including incidents for adding and removing a WCCP router. Resolved issues These issues are resolved in this release of the product. For a list of issues fixed in earlier releases, see the Release Notes for the specific release. Bugzilla reference numbers are in parentheses. Network communication When forwarding POST requests under the HTTP and HTTPS protocols, the core process failed with term signal 11. (845746, ) In a reverse proxy configuration configured for the HTTP protocol, CPU load went up due to a loop that occurred when a web server did not respond to a request that had been forwarded, but the proxy kept trying to read a response. (879980) Processing a URL under the HTTP protocol resulted in a failure to connect to the requested web server, due to misinterpreting server behavior during the connection setup. (895862) 2

3 DNS lookups When using a different IP version was configured as a fallback in a DNS configuration, DNS server lookups blocked working threads while waiting for the response of the DNS server, which led to reduced performance and dropping of data packets. (886371) Using a backup to restore an appliance as a node in a Central Management configuration failed at first attempt, but was successful when repeated. This was due to a problem with connecting to the DNS servers, which was not performed for the repeated backup. (891731) After modifying the DNS settings to replace a primary DNS server by another server, some queries to the Global Threat Intelligence system still used the old server, the appliance had to be restarted to solve the problem. (893739) Certificates When two appliances were running as nodes in a Central Management configuration, user interface settings were not shown on the node that had been configured as the scanning node, due to the use of a certificate that provided no value for a common name. (883910) When the Hardware Security Module was installed, certificate keys could not be loaded from the module after a restart of the appliance and another restart had to be performed to enable loading. (904808) Client requests were not processed on an appliance, due to a problem with handling certificate chains, and a restart had to be performed to let processing continue. (911401) Quota management In a Central Management configuration with volume quota restrictions, quota time was doubled whenever an appliance was restarted, although no time had actually been consumed by a user. (886864) After submitting valid credentials for an authorized override, a user could not proceed with the session. This was due to a failure of the quota plugin to handle very long user names, as, in this case, the user name had been extended in the process of LDAP authentication. (909810) Web filtering When the value of the URL.Categories property had been set to being an empty list, as no filtering categories had been found for a requested URL, the URL.CategoriesForURL property was set to the same value, although a different rule with a different URL had been processed. (851335) A file in XLS format was blocked by a media type filtering rule, although it was not corrupt, which was due to a file reading problem. (881412) When the SafeSearch enforcer was enabled, a URL could not be found on a Google site, due to a SafeSearch parameter that was incorrectly appended to the domain name. (887763) When a ticket was submitted in a request to the McAfee Platinum support site, the request was blocked on Web Gateway by a rule for detecting corrupted objects, although no object had been sent with the request. (895968) A download request was blocked by a rule, which applied after a failure to detect the media type of an embedded exe file, although the media type is supported on Web Gateway (900369) The List:LastMatches property was not filled with values when the URL.Host.BelongsToDomains or the String.BelongsToDomains property was used at the same time within a rule set. (909721) When a VMware installer was downloaded, an embedded vtar file was classified as corrupted by the media type detection process on Web Gateway, which was due to the failure of the process to distinguish between the tar and vtar formats..(904507) 3

4 Logging When Web Gateway was running on a virtual platform, an attempt to take a snapshot for a backup led to a VMware failure, as the VMware tried to write log files to the file system after it had already been frozen to prepare the snapshot. (891116) Log files were stored in the access log until the hard disk was filled completely on an appliance and zero-byte temporary files were created. This happened because the access log folder included no configuration file, which let the log file manager rotate files not before reaching the default size while they should have been rotated earlier, given the load that was being processed on the appliance. (897349) When the web cache status was logged, a cache hit was written into the log as a cache miss if no cache validation had been requested. (903300) User interface Using the search subfunction for showing rules in context showed a rule within its rule set, but the rule was not selected and the user had to scroll down to it. (895156) In a configuration that included more than 50,000 lists, the user interface responded very slowly when list filtering was performed within the dialog for creating rule criteria. (897110) More objects than should have been visible to a particular administrator were displayed on the user interface, but were not accessible, as had been configured. (908199) Saving configuration changes Attempting to save changes in the WCCP proxy settings caused an error when the listener thread for the WCCP manager did not join the core process as required. (880073) When an administrator saved changes for a configuration with about 50,000 lists, the saving lasted about 40 seconds, during which no activities could be performed on the user interface by this administrator, nor by any other administrators who were logged on at the same time. Logons by new administrators were also not possible. (881331) While changes were saved, no logon could be performed on the user interface and list content could not be accessed over a short period of time. (882464) REST interface When the REST interface was used to access Web Gateway, the standard user interface was not accessible for logon from a browser, nor for further REST requests, and had to be restarted, as these requests had all been sent during the initialization phase of the user interface. (880431) When the content of a list entry was retrieved using the REST interface, the link that was returned with the result incorrectly contained a second position number for the requested entry. (887671) Miscellaneous Configuring a WCCP setup on an appliance failed, as some auto-generated kernel modules were missing, which had to be loaded manually to enable the setup. (882897) When an LDAP server was queried for multiple attributes, results were not correctly represented in entries on Web Gateway, as no empty spaces were used for attributes that had no values on the LDAP server. (884115) A rule tracing file could not be opened due to a problem with performing HTML encoding for an ampersand character. (886384) In a configuration that included more than 50,000 lists, attempts at adding or deleting nodes for Central Management failed with error notifications or the configuration was not synchronized. (897321) 4

5 The list of incidents in the Web Gateway documentation included an incident that would never trigger when used by administrators, due to problems with the product environment. (899102). Bandwidth throttling worked when filtering web traffic under the HTTP protocol, but not under HTTPS, unless the SSL Scanner rule set was enabled. (900411) A list could not be deleted on the user interface, which claimed the list was in use, although no object referring to the list existed. (906991) The core process failed with term signal 11 when two proxy working threads called the same instance of the rule engine to resolve variables on the progress page within the transaction for one request. (907685) Client requests were not processed on an appliance and a restart had to be performed to let processing continue. (910431) Installation instructions The requirements for installing Web Gateway, version 7.4.0, depend on the version you are currently running on an appliance. If you have been beta-testing version 7.4.0, we recommend that you re-image the appliance, using an image of the new version. From version or any other 7.3.x version: Activate the repository for the new version. See Activate the repository. Upgrade to the new version. See Upgrade from or other 7.3.x. From a 7.2.x version or any earlier 7.x version: Create a configuration backup. Use the options provided under Troubleshooting Backup/Restore on the user interface to create the backup. Upgrade to the new version. See Upgrade from 7.2.x or earlier 7.x. The upgrade process includes a major upgrade of the operating system. It will take several steps and more time than usual. If the upgrade process fails or is interrupted, you can re-image the appliance using an image of the new version and install the configuration backup. Alternatively, you can: Create a configuration backup. Re-image the appliance using an image of the new version and install the configuration backup. From a 6.8.x or 6.9.x version, you must re-image the appliance using an image of the new version. Download an image of the new version from the download page of the McAfee Content & Cloud Security Portal at: For more information on re-imaging, see the McAfee Web Gateway Installation Guide. 5

6 Activate the repository Activate the repository for the new version before upgrading from version or any other 7.3.x version. 1 Log on to the appliance you want to upgrade on a system console, using SSH. 2 Run the following command: mwg-switch-repo You can now upgrade to the new version. Upgrade from or other 7.3.x From version or any other 7.x version, upgrade to the new version on the user interface or on a system console. s Upgrade on the user interface on page 6 To upgrade on the user interface of an appliance, select the appliance and use the upgrade option that is provided. Upgrade on a system console on page 7 To upgrade on a system console, log on to an appliance and run the upgrade commands. Upgrade on the user interface To upgrade on the user interface of an appliance, select the appliance and use the upgrade option that is provided. 1 Select Configuration Appliances. 2 On the appliances tree, select the appliance you want to upgrade. The appliance toolbar appears on the upper right of the tab. 3 Click Update Appliance Software. The upgrade to the new version is performed. 4 Click Reboot to complete the installation. 6

7 Upgrade on a system console To upgrade on a system console, log on to an appliance and run the upgrade commands. 1 Log on to the appliance you want to upgrade, using SSH. 2 Run the following two commands: yum upgrade yum yum upgrade The upgrade to the new version is performed. 3 Run the following command to complete the installation: reboot Upgrade from 7.2.x or earlier 7.x From a 7.2.x or any earlier 7.x version, upgrade to the new version on a system console. 1 Log on to the appliance you want to upgrade, using SSH. 2 Run the following two commands: yum upgrade yum yumconf\* mwg-dist-upgrade 7.4 The upgrade to the new version is performed. The appliance restarts itself after the upgrade to complete the installation. More than one restart is possible. Known issues For a list of known issues in this product release, see this McAfee KnowledgeBase article: KB

8 Product documentation Every McAfee product has a comprehensive set of documentation. For Web Gateway, this includes the following: McAfee Web Gateway Product Guide Describes the features and capabilities of Web Gateway, providing an overview of the product, as well as detailed instructions on how to configure and maintain it McAfee Web Gateway Installation Guide Describes how to set up Web Gateway, as well as several devices that can be run with the product. McAfee Web Gateway Quick Start Guide Describes high-level steps for setting up a Web Gateway version that is shipped as pre-installed appliance software on a hardware platform. This document is shipped in printed format with the pre-installed software and the hardware. Web Gateway, version 7.4.0, is not provided as pre-installed software. Find product documentation McAfee provides the information you need during each phase of product implementation, from installation to daily use and troubleshooting. After a product is released, information about the product is entered into the McAfee online KnowledgeBase. 1 Go to the McAfee Technical Support ServicePortal at 2 Under Self Service, access the type of information you need: To access... User documentation Do this... 1 Click Product Documentation. 2 Select a product, then select a version. 3 Select a product document. KnowledgeBase Click Search the KnowledgeBase for answers to your product questions. Click Browse the KnowledgeBase for articles listed by product and version. Copyright 2013 McAfee, Inc. Do not copy without permission. McAfee and the McAfee logo are trademarks or registered trademarks of McAfee, Inc. or its subsidiaries in the United States and other countries. Other names and brands may be claimed as the property of others. 0-A00