www.tufin.club

Tufin has released TOS R21-3, the third and final version of the Tufin Orchestration Suite of 2021.
TOS 21-3 is available as GA and can be downloaded from the Tufin Portal (login required) in its variants for TOS Classic and TOS Aurora.

TOS 21-3 is the last version for TOS Classic. It will be supported until the end of 2022.

This version delivers improvements, e.g.

Change Automation and Orchestration

  • Enhancements for Access Decommission
    This is supported now for Check Point R80 and Panorama.
    A new tab "Manage Related Rules" has been introduced
    as well as the option to disable and not only to remove rules.

  • Enhancements for Server Decommission and Server Cloning
    Decommission of subnets as well as IP address ranges is possible now.
    Cloning allows this kind of network objects also, including a move e.g. from a subnet to a host

 Application Driven Automation

  • SecureApp supports now User Identity
  • Application Identity is shown in Connection Status

Devices and Platforms

  • Microsoft Azure
    New supported management and firewall devices in Microsoft Azure:
    • Check Point CloudGuard Multi-Domain Server, Check Point Security Management, Check Point Gateway
    • Palo Alto Panorama and PanOS
    • Fortinet FortiManager and FortiGate
  • Fortinet
    FortiManager with Central NAT policies is supported by SecureTrack now
  • Intelligent Provisioning
    for Check Point R80 and Juniper SRX
  • New versions supported:
    • Cisco ACI 5.1
    • Cisco FMC 6.7
    • VMWare NSX-V 6.4.9
    • Forcepoint SMC 6.9 with API 6.8
    • Fortinet FortiManager 6.4.6

REST API

  • SecureTrack
    • Microsoft Azure Resouces can be imported
    • Support of "get license status"
  • SecureChange
    • Auditing of some actions is possible, e.g. LDAP or RADIUS server changes as well as changes in roles
    • Output of a list of active workflows, including name, description, and type

Further improvements, as well as corrections, are included.
The latest version of the Tufin Orchestration Suite can be found at the Tufin Portal: https://portal.tufin.com

 

 

 

 

Tufin has published TufinOS 3.81. An upgrade to this version is recommended since it fixes a potential vulnerability (authentication required) in NSS during certificate verification.
When upgrading please consider the supported upgrade path as well as the minimum requirements regarding the TOS version.

 

 

 

 

After the first vulnerability in Apache Log4j has been found and is discussed on the Internet, some more have been identified. All together, until now three vulnerabilities have been found. They are described in CVE-2021-44288 (resolved in Log4j 2.15), CVE-2021-45046 (resolved in Log4j 2.16), and CVE-2021-45105 (resolved in Log4j 2.17).

Tufin has checked whether Tufin Orchestration Suite is vulnerable or not.
The latest status can be found here: https://forum.tufin.com/support/kc/latest/Content/Suite/CVE-2021-44228.htm?cshid=CVE-2021-44228.
Some official patches are available, i.e. for RTOS 19.3 and above. If you are currently using R19-2 or earlier, please upgrade to a supported version of TOS.

It is recommended to check the latest status (Tufin Portal > Security Advisories) and to subscribe to Tufin's mailing list.
Please check also the Tufin Portal also for additional information.

 

 

 

 

 

In November 2021 Tufin has released TufinOS 3.71. This version is available for download now in the Tufin Portal (authentication required).
Upgrading to this version requires an installed TufinOS on the machine. A clean installation is currently possible for TufinOS 3.5x and 3.60 only. From here a direct upgrade to TufinOS 3.71 is possible.

The most important features and updates are:

  • Apache HTTPD has been updated to version 2.4.6
  • PHP has been upgraded from PHP 5.4 to PHP 7.4

Even if there are no new CVEs fixed as it has been done with TufinOS 3.70, this update is recommended.
After having installed the upgrade, a restart of the httpd is necessary. This can be done by the command

   systemctl restart httpd


Hints:

  • Upgrading to TufinOS 3.71 requires at least one of these versions of the Tufin Orchestration Suite (so it might be necessary to upgrade TOS also):
    • R21-1 HF3.2 and above
    • R21-2 HF1.5 and above
    • R21-3 RC1 and above

  • Please keep in mind, that with an upgrade of TufinOS, the configuration of Apache, as well as SSH, might be altered back to default values. So please check your individual configuration before and after the upgrade.

 

Please be aware that only TufinOS 3.50 to 3.71 are supported by Tufin now, i.e. older versions will also get no security-related updates.
If you still use TufinOS 2.x, the only supported version is TufinOS 2.23. In this case, an upgrade is strongly recommended since TufinOS 2.x is based on CentOS 6.x (which is supported no more).


Additional information about Security Fixes included in TufinOS is available. When hardening TufinOS please regard hints given by Tufin.

 

 

 

 

As you know, TOS Aurora is public and will result in the only supported version. TOS Classic will retire end of 2022.

Before upgrading from TOS Classic to TOS Aurora, the requirements need to be considered. If you are using a Tufin Appliance, please consult Tufin about its compatibility.

If you want to install TOS Aurora on other hardware, please refer to Tufin and consider the requirements.
Not only the size of the hard disk is important, but also the speed of it. Do not try to install TOS Aurora on classic hard disks...

  • (fast) SSD array
  • 7.500 IOPS or more
  • 250 MB/s throughput or more

So besides the requirements for processors/cores, RAM, and disk size, the speed of the hard disk is very important.

 

 

 

Some messages can be delivered by SecureTrack using syslog. Looking at the WebUI, only a syslog server can be selected. At first glance, it looks as if SecureTrack supports syslog via UDP and the default port only. In the example below, the syslog server has the IP address 10.0.0.100.


Other references, e.g. in "Policy Change Notifications", "SecureTrack Administrative Alerts", and "SecureTrack Audit Trail" only have buttons to "send by syslog".

Many companies don't allow to use syslog via 514/UDP in their networks. At least TCP has to be used. To configure this, open the URL
     https://<IP_SecureTrack>/stcgitest.htm
In the menu select "Edit StConf".

If you follow the link, a short menu opens. Press the button "Fetch Current Conf".

After having done so, the SecureTrack configuration is shown in XML. Now it's necessary to find the section <syslog>

<syslog>
            <syslog_server>127.0.0.1</syslog_server>
            <port>514</port>
            <protocol>udp</protocol>
            <policy_syslog>0</policy_syslog>
            <admin_alerts_syslog>0</admin_alerts_syslog>
            <audit_trail_syslog>1</audit_trail_syslog>           
            <original_syslog_format>1</original_syslog_format>
</syslog>

Here it's possible to change the IP of the server, the protocol as well as the port. To change it, just fill in the required entries - e.g. syslog shall be sent to 10.0.0.100 using 9000/TCP
Please be aware that currently this configuration is not active for policy notifications!

<syslog>
            <syslog_server>10.0.0.100</syslog_server>
            <port>9000</port>
            <protocol>tcp</protocol>
            <policy_syslog>0</policy_syslog>
            <admin_alerts_syslog>0</admin_alerts_syslog>
            <audit_trail_syslog>1</audit_trail_syslog>           
            <original_syslog_format>1</original_syslog_format>
</syslog>

Besides this, you can also turn on the options shown in the top screenshot by changing the "0" to "1". It's not necessary to do the change here, because this can be configured via WebUI also.

To save changes, press the button "Submit New Conf". This button shows up at the bottom of the right page.