www.tufin.club

Tufin has released TOS R23-1, the first version of the Tufin Orchestration Suite of 2023.
TOS R23-1 is available as GA and can be downloaded from the Tufin Portal (login required).
This version is available for TOS Aurora only. Some improvements of TOS Aurora R23-1:

Change Automation and Orchestration

• SecureChange (Azure)
  Azure Firewalls can be included in Access Request tickets in topology mode, i.e. they can be used as targets in such a ticket.
  
  
• SecureChange (Check Point)
  Support of FQDN configured in Check Point has been integrated into SecureChange automation tools.
  
  
• SecureChange (Cisco)
  Access Requests now can be provisioned to Cisco Nexus devices
  
  
• SecureChange
  A redesign by the Designer can be triggered by API.
  
  
• SecureChange
  Using API POST allows the creation of tickets with rules from multiple devices for workflows focused on rules (modification, decommission, recertification).
  
  
• SecureChange API
  The API now allows to trigger "commit now", automatic retries are possible also.
  
  
• SecureChange API
  Automation of the provisioning can be scheduled, triggered, or retried using the API

Cloud

• SecureTrack (AWS)
  Importing multiple AWS accounts and additional entries like VPCs or transit gateways is possible using the bulk API feature.

Deployment and Monitoring

• TOS Aurora deployment in AWS is now supported for large customers
• Solarwinds can be used to monitor the health of the Kubernetes cluster
• Backups can be stored externally using NAS (NFS) storage.
• Remote Collectors are now supported for Cloud Deployments (AWS, Azure, GCP)
• From now on, the Microsoft Authentication Library (MSAL) can be used for authentication, since the Active Directory Authentication Library (ADAL) will no more be supported after June 2023

Devices and Platforms

• Amazon AWS
  AWS Gateway Load Balancers can be imported from the AWS account and be integrated into SecureTrack Topology. This also means that change automation also can be used for these devices.
  
  
• Check Point / Palo Alto Networks
  Syslog is now supported not only using TCP instead of UDP but also using encryption. So for these two devices, Syslog can be transferred securely to SecureTrack.
  
  
• Check Point
  SecureTrack as well as SecureChange support Check Point FQDN objects. They are visible in security rules and change tracking, assessment, path analysis, and matching rules. In SecureChange they can be used in Target Selection, Designer, and Verifier.
  
  
• Cisco
  SecureTrack Rule Viewer, Topology, and USP now support Cisco Meraki Firewalls
  
  
• Microsoft Azure
  Azure Virtual Hubs from Azure subscriptions can be imported to SecureTrack Topology. So they can not only be used for Path Analysis, but also by SecureChange Automation Tools.
  
  
• Microsoft Azure
  The import of Azure Virtual Hubs from Azure subscriptions is possible to show in SecureTrack Topology. This can be used for Path Analysis as well as in SecureChange.
  
  
• Microsoft Azure
  Azure Shared Express Routes are now modeled in the Topology map to be used here as well as in SecureChange
  
  
• Microsoft Azure
  Azure Application Security Groups (ASGs) that are part of Network Security Group (NSG) rules can be used in SeureTrack Rule Viewer, Object Lookup, Compare Revisions, and Topology Path Analysis.
  
  
• Palo Alto Networks
  In SecureTrack Rule Viewer a search for PAN Rule UUID is possible. This information also appears in the ID of the Device column when exporting Rule Viewer information.
  
  
• API
  The Devices Bulk API has been provided with a delete function. So it's possible to remove a Management Device and all of its managed devices with an API call.
  
  
• API
  Rule-based tickets containing multiple devices or policies per ticket can be submitted by API now.

GraphQL API

• USP exceptions
  Exceptions can be defined with network objects (e.g. network groups, IP addresses) via GraphQL. This isn't possible using the WebUI

REST API

• Enhancements for SecureTrack
  • Bulk Device Deletion API allows to delete e.g. a management server and all firewalls managed by it from SecureTrack
  • Multiple AWS Accounts Management API allows using of this bulk API feature to onboard multiple AWS accounts and edit them by importing VPCs and transit gateways also.
  • Exceptions can be defined with network objects (e.g. network groups, IP addresses) via REST API and GraphQL API, respectively. This isn't possible using the WebUI
    
    
• Enhancements for SecureChange
  
  • Designer Redesign is possible now using the API. This is useful if e.g. a new revision has been retrieved between design and provisioning.
  • Selective Device Update is useful for the automation of provisioning changes.
  • Ticket Creation is possible using API POST for rules of multiple devices. This is used for Rule Modification, Rule Decommission, or Rule Recertification.
  • Trigger Commit Now for a specific device is possible. Automatic Retries can be automated.
  • Submit (Rule-Based) Tickets can be used now for multiple devices.

Security, Risk, and Compliance

• USP Exceptions contain Object IDs now, so within these exceptions, network objects can be used.

Topology Map

• Device Grouping in the Topology Map delivers more visualization. This is done by grouping network and security devices by domain or other custom requirements.

User Experience

• Accessibility for color-blind users can be improved by configurable high-contrast color schemes.
• The Look and Feel of the Tickets page is updated, delivering a more user-friendly experience.

Further improvements, as well as corrections, are included in R23-1.
The latest version of the Tufin Orchestration Suite can be found at the Tufin Portal: https://portal.tufin.com

Update July 2023: R23-1 PGA.0.0 and R23-1 PHF1.0.0 were recalled.
R23-1 PHF1.1.0 should be considered the earliest available R23-1 release.

Update August 2023: R23-1 PGA1.2.0 is available now for download.