What's new

New features

This release of Network Security Platform does not include any new features.

Enhancements

This release of Network Security Platform includes the following enhancements:

Gateway Anti-Malware for an air gapped network

Previously, the Gateway Anti-Malware software initialization in the Sensors required an active connection to a public or private GTI server. Hence, the Gateway Anti-Malware engine could not be updated in an air gapped network. Starting with this release of 9.1, the Sensor software is enhanced to initialize the Gateway Anti-Malware updates in an air gapped network without an active connection to the GTI server.

You can enable Gateway Anti-Malware update in an air gapped network by executing the set gam-airgap-network enable command in the Sensor CLI and reboot the Sensor for the changes to take effect.

Note: The Gateway Anti-Malware update for an air gapped network must be enabled before pushing Gateway Anti-Malware updates from the Manager to the Sensor.

To view the status of the Gateway Anti-Malware update in an air gapped network, execute the show gam-airgap-network status command in the Sensor CLI.

You can view the Gateway Anti-Malware version in the Manager under Devices → <Admin Domain Name> → Devices → <Devices Name> → Setup → GAM Updating.

For more information about Gateway Anti-Malware for an air gapped network, see Malware engine updates in McAfee Network Security Platform 9.1.x Product Guide.

Gateway Anti-Malware version 2019

With this release of 9.1, Gateway Anti-Malware version 2019 is supported for both automatic and manual updates. Gateway Anti-Malware version 2019 version 0 is supported on Manager version 9.1.21.40 or later and Sensor version 9.1.17.120 or later.

With Manager version 9.1.21.40 and above, depending on the 9.1 Sensor software version, the Gateway Anti-Malware update server downloads the appropriate Gateway Anti-Malware version.

The following table describes the Gateway Anti-Malware versions supported:

Manager version Sensor version Gateway Anti-Malware engine version
9.1.21.40 or later 9.1.17.120 or later 2019 version 0
9.1.21.20 till 9.1.21.38 9.1.17.100 till 9.1.17.119 2017 version 3

You can view the Gateway Anti-Malware version in the Manager under Devices → <Admin Domain Name> → Devices → <Devices Name> → Setup → GAM Updating.

For more information, see Gateway Anti-Malware update in McAfee Network Security Platform 9.1.x Product Guide.

Update Server Infrastructure change

Previously, Network Security Platform used menshen1.intruvert.com as its Update Server to access the software images and signature set from the Manager. Starting with this release, nspupdate.mcafee.com is used as the Update Server in Network Security Platform for all software images and signature set updates.

Callback detector enhancements

With this release, the callback detector files are available in the McAfee Update Server. The Download Callback Detectors page displays the latest 10 versions of the callback detectors.

To view the Download Callback Detectors page, go to Manager → <Admin Domain Name> → Updating → Download Callback Detectors.

For more information on callback detectors, see Download Callback Detectors in McAfee Network Security Platform 9.1.x Product Guide.

Removal of alert processing scripts

After a Manager upgrade, all new alerts are populated in the updated schema tables. The alerts and packet logs available in the Manager prior to the upgrade are still available in the database with a ' tmp_' prefixed to them. These alerts and packet logs were not accessible and had to be manually converted to the new schema before adding it back to the Manager. This was accomplished by running the Alertproc_offline_1.sql and Alertproc_offline_2.sql scripts.

Starting with this release, the Manager installer will automatically merge the older alerts and packet logs to the updated schema. Therefore, manual conversion of the older alerts and packet logs using Alertproc_offline_1.sql and Alertproc_offline_2.sql scripts is no longer required.

Log file for database admin tool

With this release of 9.1, a new log file, dbadmin.log is added in the App folder. This log file logs information related to the database admin tool activities such as alert archival, alert restore, database backup, database restore, database tuning, database purging, and password changes.

The dbadmin.log file is available in the App folder.

For more information on log files, see System Log Files in McAfee Network Security Platform 9.1.x Product Guide.

SSH communication with the Sensor

Previously, the SSH service in the Sensor supported RSA, DSA and ECDSA keys without any enforcement of a HostKeyAlgorithm. Starting with this release, the SSH service in the Sensor will only generate ECDSA keys and enforce ecdsa-sha2-nistp256 as the HostKeyAlgorithm. McAfee requires that all remote machines be configured to support this and avoid SSH connection failures to a Sensor running this image.

McAfee modified OpenSSH v7. 8p1 is configured to support only the following:

  • Ciphers: aes256-gcm@openSSH.com, and aes128-gcm@openSSH.com
  • MACs: hmac-sha2-256 and hmac-sha2-512
  • KexAlgorithms: ecdsa-sha2-nistp256
  • HostKeyAlgorithms: ecdsa-sha2-nistp256

Terminology update in UI and CLI command

This release contains the following terminology update in both UI and CLI commands to keep up with the global standard:

Navigation Path Prior 9.1.21.40 9.1.21.40 and later
Analysis → Threat Explorer Blacklisted/Whitelisted under the Executable Classification column in the Top Executables table Blocked/Allowed under the Executable Classification column in the Top Executables table
Analysis → Malware Files Blacklist column under Individual Engine Confidence column Block column under Individual Engine Confidence column
Manage Whitelist and Blacklist Manage allow and block lists
Analysis → Network Forensics Under Suspicious Flows Panel → Suspicious activity indicators → Blacklisted executable Under Suspicious Flows Panel → Suspicious activity indicators → Blocked executable
Analysis → Endpoint Executables Manage Whitelist and Blacklist Manage allow and block lists
Blacklisted/Whitelisted under the Classification column Blocked/Allowed under the Classification column
Double-click on an alert and go to EIA Details tab. Local Classification: Blacklisted/Whitelisted. Double-click on an alert and go to EIA Details tab. Local Classification: Blocked/Allowed.
Analysis → Attack Log
Note: Only for alerts with files and domains in them.
Click Other Actions → Create Exception → Blacklist File Hash: < hash file> or double-click on an alert and go to Details tab. Select Blacklist. Click Other Actions → Create Exception → Block File Hash: < hash file> or double-click on an alert and go to Details tab. Select Block.
Click Other Actions → Create Exception → Whitelist File Hash: <hash file> or double-click on an alert and go to Details tab. Select Whitelist. Click Other Actions → Create Exception → Allow File Hash: < hash file> or double-click on an alert and go to Details tab. Select Allow.
Policy → Intrusion Prevention → Exceptions → File Hash Exceptions Whitelisted Hashes Allowed Hashes
Take Action -

  • Move selected hashes to blacklist
  • Move all hashes to blacklist

Take Action -

  • Move selected hashes to block list
  • Move all hashes to block list

Import - On selecting, Import Whitelisted Hashes dialog is displayed. Import - On selecting, Import Allowed Hashes dialog is displayed.
Export Whitelist Export Allowed
Blacklisted Hashes Blocked Hashes
Take Action -

  • Move selected hashes to whitelist
  • Move all hashes to whitelist

Take Action -

  • Move selected hashes to allow list
  • Move all hashes to allow list

Import- On selecting, Import Blacklisted Hashes is displayed. Import- On selecting, Import Blocked Hashes is displayed.
Export Blacklist Export Block List
Policy → Intrusion Prevention → Exceptions → Domain Name Exceptions Callback Detection Whitelist Callback Detection Exclusions
Import - On selecting, Import Whitelisted Domains dialog is displayed. Import - On selecting, Import Allowed Domains dialog is displayed.
IPS Inspection Whitelist IPS Inspection Exclusions
Policy → Intrusion Prevention → Policy Types → Advanced Malware Policies New or an existing policy - Blacklist and Whitelist column under the Scanning Options section. New or an existing policy - Allow and Block Lists column under the Scanning Options section.
Policy → Intrusion Prevention → Policy Types → Inspection Option Policies Domain Name Whitelist Processing under tab Inspection Options → Advanced Callback Detection Domain Name Exclusion List Processing under tab Inspection Options → Advanced Callback Detection
Blacklisted Text under tab Inspection Options → Web Server - Heuristic Analysis Blocked Text under tab Inspection Options → Web Server - Heuristic Analysis
CLI Command Prior 9.1.17.120 9.1.17.120 and later
CLI command in debug mode show wb stats show ab stats

IPS CLI enhancements

The following new Sensor CLI commands are available from this release:

Normal Mode
CLI Command Description
set gam-airgap-network This command allows configuring Gateway Anti-Malware updates initialization in the Sensor within an air gapped network. After executing this command, a Sensor reboot is required for the changes to take effect.
show gam-airgap-network status Displays availability of Gateway Anti-Malware update initialization for the Sensor in an air gapped network.
Debug Mode
CLI Command Description
reset-gam-update This command deletes the Gateway Anti-Malware engine related data in the Sensors.

For more information, see CLI commands in McAfee Network Security Platform 9.1.x Product Guide.

Features, enhancements, and resolved issues from non-FIPS releases

This version supports all the features, enhancements, and resolved issues that are supported in the following non-FIPS versions. Above and beyond that, it is FIPS complaint. If you wish to learn about features released in non-FIPS versions of Network Security Platform 9.1.x in general, please refer to the following release notes:

NSP 9.1.7.83-9.1.5.102-NS-series Release Notes

NSP 9.1.7.80-9.1.5.80-NS-series Release Notes

NSP 9.1.7.77-9.1.5.63-NS-series Release Notes

NSP 9.1.7.75-9.1.5.56-NS-series Release Notes

Updated platform, environment, or operating system support

This release extends support to the following additional platforms, environments, or operating systems.

MariaDB database upgrade

Starting with this release of 9.1, the Network Security Manager uses MariaDB version 10.3.27 and J-connector version 2.6.1 with a set of vulnerability fixes and bug fixes.

Azul Zulu java upgrade

Starting with this release of 9.1, the Network Security Manager uses Azul Zulu java version 1.8.0_275. The Azul Zulu java version 1.8.0_275 consists of fixes for previously known issues and security fixes.

Apache Tomcat server upgrade

Starting with this release of 9.1, Tomcat server used in the Network Security Manager is upgraded. This server update provides a set of security fixes.