Network Security Platform 7.1

Transcription

1 NTBA Appliance Release Notes Network Security Platform 7.1 Revision A Contents About this document New features Resolved issues Known issues Installation instructions Product documentation About this document This document contains important information about the current release. We strongly recommend that you read the entire document. This release notes is to announce the availability of a maintenance release for McAfee NTBA Appliance software version 7.1. This release is to provide fixes for some of the NTBA Appliance software issues. The software combination recommended by McAfee to use along with this release of NTBA Appliance software are as listed below: Network Security Manager software version: Signature set: NTBA Appliance software version: M-series: NS-series: This version of 7.1 Manager software can be used to configure and manage the following hardware: I-series Sensors, M-series Sensors, N series Sensors, NS series Sensors, XC Cluster, and NTBA Appliances. 1

2 New features This release is to provide fixes for some of the NTBA Appliance software issues and does not include any feature enhancements. Resolved issues Resolved NTBA Appliance software issues The following table lists the high-severity NTBA Appliance software issues: The signature set push from the Manager to the NTBA Appliance fails The tcpdump command does not prompt after capture timeout during huge netflows. The following table lists the medium-severity NTBA Appliance software issues: The NTBA CLI shows user configured speed/duplex instead of the auto-negotiated speed/ duplex NTBA is not generating New Service Detected Alert in some scenarios New Service Detected alert displays incorrect details for export and matched policy When NTBA VMs are deployed, sometimes Threat Analyzer monitors do not populate any data Disk space is utilized by temporary files which are not getting cleared Disk space is utilized by temporary files when NTBA gets very high load New service detected alerts that are triggered on client ephemeral ports Static route configuration is lost at NTBA after disabling and re-enabling monitoring port. Resolved Manager software issues The following table lists the high-severity Manager software issues: Central Manager - Manager fault synchronization fails. The following table lists the medium-severity Manager software issues: After updating to Java 7 update 25 - When viewing alert details in the Threat Analyzer, "undefined" is displayed on the labels Threat Analyzer does not goup by Source Country When customizing the alert notifcation syslog message in CEF format, the save action redirects the user to the Manager login page RFSB attacks of "malware" category are not blocked in the default Inline IPS policy SNMP V3 Trap forwarding has a performance issue. Need to optimize the processing (PDU, encryption, etc) and to de-link the events from the main queue to another queue When using Java update 21, the Internet Explorer path for attack description and Wireshark are broken. 2

3 DBAccess Error: The Manager was unable to access the alert tables Manager v7.5 cannot import alert archive created on Manager v Manual signature set import to the Manager failed The "Null" rule set has the attack, "HTTP: WebDAV Search Buffer Overflow 0x " The Manager is vulnerable against CVE The Manager accepts a value less than 10 minutes for the TCB Inactive timer Objects disappear from the Firewall policy Central Manager is unable to receive updates from one Manager The Alerts undeleted from the Historical Threat Analyzer do not appear back in the Real-Time Threat Analyzer even if the alerts are a part of the alert cache The Manager needs to support all services in Firewall policies The error message "Invalid entry!" for the TCB Inactivity timer is incorrect Sensor action should be enabled for certain bot attacks on the Manager Memory leak when GTI is configured in the Manager Special characters in the username (copy paste method) causes GUI issues Traditional reports fail to run - pdfrenderer error Confirm the accuracy of advanced search for signature The Dashboard page on the Threat Analyzer does not display anything when the "nscmadmin" logs in to the Manager or the Manager connects from the Central Manager No active signature set on the Primary Manager in an MDR setup Real-Time Threat Analyzer quick filter does not affect the CVS/PDF export NTBA: Threat Analyzer displays UDP Scan alerts with Source port Database tuning frequently produces an error at completion BTP value of alert detail on Threat Analyzer is not correct. The value displayed is different from the configured value When trying to open the alert, "Inbound UDP Packet Volume Too high" alert, an error message "Alert unavailable" is displayed. The following table lists the low-severity Manager software issues: Upgrade MySQL from to Known issues For known issues in this product release, refer to the following KnowledgeBase articles: 3

4 Manager software issues: KB76517 NTBA Appliance software issues: KB75583 Installation instructions Manager server/client system requirements The following table lists the 7.1 Manager server requirements: OS Minimum required Any of the following: Windows Server 2008 R2 Standard or Enterprise Edition, English OS, SP1 (64 bit) (Full Installation) Windows Server 2008 R2 Standard or Enterprise Edition, Japanese OS, SP1 (64 bit) (Full Installation) Only X64 architecture is supported. Same as the minimum required. Memory 4GB 8GB CPU Server model processor such as Intel Xeon Same Disk space 40GB 80GB disk with 8MB memory cache or greater Network 100Mbps card 1000Mbps card Monitor 32-bit color, 1024 x 768 display setting 1280 x 1024 The following are the system requirements for hosting Central Manager/Manager server on a VMware platform. Table 5-1 Virtual machine requirements for Central Manager/Manager Component Minimum OS Any of the following: Windows Server 2008 R2 Standard or Enterprise Edition with SP1 (English) (64 bit) Windows Server 2008 R2 Standard or Enterprise Edition with SP1 (Japanese) (64 bit) Same as minimum required. Only X64 architecture is supported. Memory 4 GB 8 GB Virtual CPUs 2 2 or more Disk Space 40GB 80GB 4

5 Table 5-2 VMware ESX server requirements for Central Manager/Manager Component Minimum Virtualization software VMWare ESX Server version 4.0 update 1 and version 4.1 ESXi 5.0 ESXi 5.1 CPU Memory Internal Disks Intel Xeon CPU ES 2.00GHz; Physical Processors 2; Logical Processors 8; Processor Speed 2.00GHz. Physical Memory: 16GB 1 TB The following table lists the 7.1 Manager client requirements when using Windows 7: Minimum OS Windows 7 The display language of the Manager client must be same as that of the Manager server OS. RAM 2 GB 4 GB CPU 1.5 GHz processor 1.5 GHz or faster Browser Internet Explorer 8.0 or 9.0 Mozilla Firefox 4.0 and above The following table lists the 7.1 Manager client requirements when using Windows XP SP3: OS Minimum Windows XP SP3 RAM 1 GB 2 GB Browser Internet Explorer 7.0 or 8.0 Mozilla Firefox 4.0 and above Internet Explorer 8.0 Internet Explorer 9.0 For the Manager client, in addition to Windows 7 and Windows XP, you can also use the operating systems mentioned for the Manager server. For more information, see McAfee Network Security Platform Installation Guide. NTBA Virtual Appliance system requirements The following table lists the 7.1 NTBA Virtual Appliance requirements: Table 5-3 VMware ESX server requirements for Virtual NTBA Appliance Component Virtualization software VMware ESX 4.1 and higher CPU 4 cores Memory 16 GB 5

6 Table 5-3 VMware ESX server requirements for Virtual NTBA Appliance (continued) Component Network ports Storage 5 (One network management port and four network ports for NTBA Virtual Appliance) 500 GB (create two partitions: 250 GB and 250 GB) The NTBA OVA image comes with pre-installed NTBA Appliance software, including the recommended configuration. Upgrade recommendations McAfee regularly releases updated versions of the signature set. Note that automatic signature set upgrade does not happen. You need to manually import the latest signature set and apply it to your Sensors. The minimum required software versions to upgrade to this release of 7.1 are listed below: Software Component Manager/Central Manager Minimum Version for Upgrade and above NTBA Appliance (T-200, T-500) , , , , , NTBA Virtual Appliance (T-VM) , , , For more information, see McAfee Network Security Platform Upgrade Guide. Product documentation Every McAfee product has a comprehensive set of documentation. Find product documentation 1 Go to the McAfee Technical Support Service Portal at 2 Under Self Service, access the type of information you need: To access... User documentation Do this... 1 Click Product Documentation. 2 Select a product, then select a version. 3 Select a product document. KnowledgeBase Click Search the KnowledgeBase for answers to your product questions. Click Browse the KnowledgeBase for articles listed by product and version. 6

7 Copyright 2013 McAfee, Inc. Do not copy without permission. McAfee and the McAfee logo are trademarks or registered trademarks of McAfee, Inc. or its subsidiaries in the United States and other countries. Other names and brands may be claimed as the property of others. 0A-00