www.tufin.club

Details
Category: Version update

Situation

Tufin delivers new versions quite often. If you are working with TOS and all your requirements are fulfilled - fine. But sometimes an upgrade is recommended, e.g. if there are new features you want or support is needed. It's quite sure that Tufin Support will recommend an upgrade if you have a problem with a version which is very old.

Upgrades can't always be done inplace. Esp. when upgrading TufinOS from version 1.x to 2.x a fresh install of the OS is needed.
We do upgrades mostly running in virtualized environments. Using Snapshots it's easy to restore the older version if something went wrong.

The upgrade path

Example: Starting with TufinOS 1.1x and TSS 6.1
To upgrade from version 6.x to R16-1 these steps are recommended

  • Upgrade to version R12-6
  • Upgrade to TufinOS 1.17 (if not done before)
  • Upgrade to version R13-3 GA
  • Upgrade to version R14-1 GA
  • Upgrade to version R14-3 GA
  • Install TufinOS 2.11 and R14-3 GA. Then migrate the configuration to this version using backup/restore.
    If an upgrade of TufinOS isn't possible, upgrade to PSQL version 9.
  • Upgrade to R15-1 GA
  • Upgrade to TufinOS 1.21 - only needed if still TufinOS 1.x is used
  • Upgrade to R15-3 GA (direct upgrade to R16-1 is possible)
  • Upgrade to R15-4 GA
  • Upgrade to R16-1 GA

This procedure has been proven and should work in many situations.

 

 

Details
Category: Uncategorised

Tufin has published their new User Center and Partner Center. A new design and a new structure of content gives an excellent overview and much information. Be sure to visit https://portal.tufin.com - a new password might be required.

A new information provided is e.g. Tufin Products Life Cycle Policy.
https://portal.tufin.com/aspx/ProductsLifeCyclePolicy (Authentication required)
Extracted information:

  • TOS
    Supported Versions including New Hotfix Support and Patches:
    16-1, 15-4, 15-3, and 15-2
    All other versions are EOL and don't get any more support
  • TufinOS
    Supported Version including New Critical Security Updates Support:
    2.11 and 1.21
    All other versions are EOL and don't get any more support

Regarding Appliances: All current Appliances (T510, T1100, T1100XL) are fully supported. Older models as T80, T500, T1000, and T1000XL cannot be ordered any more. The five years of Advanced Replacement Program are guaranteed - but no extent for more years is possible.

 

 

Details
Category: TufinOS

Problem

On May 3rd, the OpenSSL project team has announced the release of OpenSSL v1.0.2h and 1.0.1t, respectively. This version addresses some vulnerabilities.
One of the most severe is the OpenSSL Memory Corruption Vulnerability (CVE-2016-2108) which  also affects TufinOS (as many other Linux).

Solution

If you run Tufin TOS under Red Hat Enterprise Linux or CentOS, please download updated packages and install them on your system.
Tufin is working on a patch for the OpenSSL Memory Corruption Vulnerability. patches for TufinOS 2.11 and TufinOS 1.22 are scheduled for the week of May 16th. So next week an update will be possible. If you don't run the latest version, an upgrade might be necessary before installing the patch.
Further information will be provided by This email address is being protected from spambots. You need JavaScript enabled to view it.upon request.

 

19.05.2016 - Update:
The patch for TufinOS 2.11 is available now: https://portal.tufin.com/Doc/Default.aspx?id=1208 (Authentication necessary)
For TufinOS 1.22 the patch will be published after Red Hat has published a patch for RHEL 5. 

 

 

Details
Category: Version update

Parallel to the Check Point CPX in Nice, Tufin has released version 16-1 GA. Until now, the first HF is available, too.
Please find some information about changes in this version below.

This version includes some improvements, e.g.:

  • New Cloud Features for AWS, e.g. automated Connectivity Modeling for AWS Applications, policy based analysis of connections, connection discovery of applications and much more
  • New Cloud Features for NSX, e.g. NSX Application Map

Changes regarding SecureTrack:

  • PaloAlto:
    Support of Palo Alto rule tags, security profiles and log profiles
  • Fortinet NAT:
    Support vo VIP, IP Pool and Destination Interface NAT as far as the Gateway is managed by FortiManager
  • Check Point:
    Full Support of Check Point R77.30 Management
  • Cisco:
    Support of ASA 9.5
  • Upgrade of HTTPD and JMS Server from TLSv1 to TLSv1.2
  • Improvements regarding the Unified Security Policy (USP). Further requirements can be added now, e.g. Logging required, no ANY as Source, Destination, Service, etc.
  • In Rule Base Optimization now a rule can be marked as "legacy". If SecureChange would recommend a change to this rule, it's ignored and a new rule will be defined. This is for optmization of "old and complex" rule bases.
  • Improvements of the REST API, esp. regarding Authorization and Compare of rule bases.

Changes regarding SecureChange:

  • The Designer has been improved, esp. when there are more than one Access Request in a ticket.
  • Visual presentation of rules in the Designer
  • The REST API now offers options for "Modify Group", exclusion of Devices and more. Please find an extended online documetation of the REST API in SecureChange now.
  • Import of Access Requests is now possible for "Comment" and "Action" also

Changes regarding SecureApp:

  • Introduction of a Connectivity Map for a graphical view of all connections affecting an application, regardless of involved devices.
  • Improved support of AWS applications
  • Improvements of the REST API, esp. for AWS

Further improvements and corrections are included.

 

The latest version of the Tufin Orchestration Suite can be found at the Tufin Portal: https://portal.tufin.com

 

Details
Category: SecureTrack

When connecting a Check Point Security Management Server to SecureTrack, there are two possibilities to gather the topology:

Check Point Security Management Server only

In this case, Secure Internal Communication is set up to have a secure connection between the SecureTrack Server and the Check Point Management.
The Topology for SecureTrack is read from the Interface information defined in the Check Point Firewall and Cluster, respectively. Anti-Spoofing information is also read to get as much information as possible about the Topology.

Check Point OS Monitoring

In this case, the Topology is read from the monitored devices directly using SNMP. Other information isn't gathered - information from the object defined in the Security Mangagement Server is ignored.

 

Lesson learned:

If Check Point OS monitoring is activated and the SecureTrack Server has no possibility to read information using SNMP (161/udp), no information about the Topology is imported and therefore this device isn't shown in the SecureTrack Topology. Allowing SNMPv3 between the SecureTrack Server and the firewall device helps to avoit this potential problem.

 

Details
Category: SecureChange

If there is a distributed installation with a SecureTrack Server and a SecureChange Server, communication is needed between these two servers.

Necessary communication: HTTPS (443/tcp) in both directions.

SecureChange Server needs information from SecureTrack, e.g. about Topology and Rule Bases of the firewalls. The SecureChange Designer needs also the opposite direction connecting from the SecureTrack Server to the SecureChange Server. If this doesn't work, the designer will result in an error.

To configure the SecureTrack Server in SecureChange, go to Menu > Settings > SecureTrack

 

To configure the name of the SecureChange Server used e.g. in E-Mails, select Menu > Settings > Miscellaneous

The name or IP address listed here represents the SecureChange Server and will also be used for the communication between SecureTrack and SecureChange. If a wrong name or IP address is configured here, SecureTrack won't be able to communicate with SecureChange since only this name/address will be contacted from SecureTrack.

For sure, the name needs to be resolvable for users too, since they will find this name in their E-Mail regarding e.g. a new task.

 

 

  • You are here:  
  • Home