Tufin Orchestration Suite 5.4.00

Tufin has officially released TOS 5.4.00. It's available as GA and can be downloaded from the Tufin Portal (authentication and subscription contract required).
Some improvements of TOS 5.4.00:

SecureTrack:
- Updates in TQL - GraphQL
  In Rule Viewer and GraphQL API rules can be filtered by device status - enabled or disabled - to focus on active devices. This eliminates the need to manually exclude inactive device rules from policy analysis. Additionally, device status is exposed as a field in the GraphQL API rule projection.
- The search in Rule Viewer is improved; now rules can be searched for USP violation count.
- When navigating away from rule viewer, no the last TQL query and results are automatically restored when returned to the view within the same session.
- Segmentation Intelligence analysis can now be configured directly from a dedicated settings page. Configurable items, including reporting mode, subnet volume limits, and zone, model, and device exclusions, are now accessible without requiring back-end intervention, and apply to the next analysis run.
- When managing networks with overlapping IP address spaces, now the source domain in Path Analysis can be specified. This ensures that the correct network is targeted. A new optional Source Domain field appears in the Topology Map when overlapping IP mode is enabled and the default domain view is active.
SecureApp
- It's now possible to revert changes made to a SecureApp application connection (add/edit) since the last ticket was created (via API only).
Vendor specific
- Akamai Guardicore
  - It's supported now to enforce the Unified Security Policy against tag-based assets residing inside rules. Additionally, USP security zones that include tag strings can calculate violations by matching zone tags against object tags and tagged assets in security rules.
  - SecureTrack now accurately reflects in Path Analysis the real-world enforcement, delivering reliable information about traffic being allowed or blocked. Each microsegmentation asset in the path now shows its enforcement mode (Visibility-only, Monitoring, Selective Enforcement, or Full Enforcement), the resulting allow/block decision, and the specific rule that drove it.
- Amazon Web Services (AWS)
  - For AWS Network Firewalls now unused rules are identified. So optimization recommendations can be provided by TOS. Last hit data and rule optimizer support have been extended to AWS Network Firewall, and last hit data for these rules is shown in Rule Viewer.
  - Also for AWS Network Firewalls TOS provides now policy visibility and topology support. It includes AWS Firewall Policies, their rulesets, and associated firewalls. Therefore, rules can be searched in Rule Viewer, USP violations are recognized as well as checking the packets passing the topology.
  - AWS resources are enhanced. The license usage report now counts any resource type attached to SGs beyond VMs, including NLBs, ALBs, VPC Endpoints, etc. as part of the CLOUD-VM type. Prefix lists are now supported as part of the SG rules in TOS, making license usage more transparent.
- Broadcom
  - For Broadcom VMware, migrating to VMware Cloud Foundation (VCF) with NSX 9.1 can now use TOS without losing any functionality.
  - When having Broadcom NSX, the modify group workflow now supports IPv6, improving the automation abilities.
- Check Point
  - IPv6 for Check Point is now supported by the "modify group workflow". Dual Stack network objects are supported - therefore these objects as well as IPv4 and IPv6 are supported by this workflow.
- Fortinet
  - FortiGate managed through FortiManager Cloud don't need on-prem FMG appliances. Additionally, TOS supports the cloud-based FortiCloud authentication.
  - When using FortiManager with global-only object policies, network changes can now be automated. SecureChange provisions new objects directly as global objects in FortiManager, and leverages existing global objects as part of the change process. Additionally, SecureChange provisions services and object groups as global objects, and synchronizes them from the Global ADOM to the assigned Local ADOMs.
  - When renaming a FortiManager VDOM, there is no more a need to re-import FortiManager firewalls and VDOMs after having devices renamed or moved between ADOMs.
- Illumio
  - FSecureTrack now accurately reflects in Path Analysis the real-world enforcement, delivering reliable information about traffic being allowed or blocked. Each microsegmentation asset in the path now shows its enforcement mode (Visibility-only, Monitoring, Selective Enforcement, or Full Enforcement), the resulting allow/block decision, and the specific rule that drove it.
- Palo Alto Networks
  - Strata Cloud Manager (SCM) TOS now supports dynamic and static route resolution in topology, including IPv6. This routing information is retrieved directly from the local gateway firewalls.
  - Palo Alto App ID is supported now in blocking policies within the Unified Security Policy.
  - Having Palo Alto security policies, they can be improved by the use of USP violations. To do so, the USP cell property can be configured to raise a violation when a Security Profile Group or Log Forwarding Profile is missing on NGFW rules.
  - Predefined DNS Application Recognition in Topology Map are supported and considered now.
  - For Panorama, it can be exactly seen which devices a Panorama rule targets, with accurate shadowing analysis and topology calculations that take the Target field into account. This Target field is supported in Rule Viewer as well as Compare Revision, Shadowing and Topology Path Simulation.
- Stormshield
  - SNS firewalls are supported now, with full policy visibility, USP compliance, change tracking, topology, and SecureChange automation. Native OPM integration connects directly to each SNS firewall.

Further improvements, as well as corrections, are included in TOS 5.4.00.
The latest version of the Tufin Orchestration Suite can be found and downloaded from the Tufin Portal: https://portal.tufin.com

www.tufin.club