Version update

Tufin has released TOS R21-1, the first version of the Tufin Orchestration Suite of 2021.

Please be aware that TOS 21-1 requires TufinOS 3.x, CentOS 7, or RHEL 7.

TOS 21-1 is available as GA and can be downloaded from the Tufin Portal (login required). It delivers improvements, e.g.

Change Automation and Orchestration

• SecureChange can be integrated with SecureCloud now. Automated workflows that include Azure devices can be configured. Importing Azure ASG (Application Security Groups) is possible and therefore using automation tools of SecureChange (e.g. Auto-suggest target, Provisioning) is possible. Designer and Verifier can be used for on-prem devices.
• When provisioning changes, the Designer of SecureChange used in an Access Request workflow can consider related tickets that might have an impact on the update. Related tickets can be considered when a redesign is done. 
• The Interactive Map of SecureTrack now allows to add/modify generic devices such as L2 firewalls, generic interfaces, and generic VPN by right-clicking on the mouse.
• The Interactive Map also supports IPv6 path analysis for generic devices now.
• SecureTrack Interactive Map supports using LDAP groups in Source and Destination.
• The Interactive Map allows viewing device data and calculation of paths having Amazon AWS devices included.

Devices and Platforms

• Amazon AWS
  For Amazon AWS devices the Interactive Map can be used to view device data and paths included in these devices.
• Check Point
  When using Inline Layers rules configured here, can now be viewed in Policy Browser. From here, SecureChange tickets for rule modification, rule recertification, and rule decommission can be opened.
  Check Point Cloud devices in NSX-T, ACI and AWS can be included in SecureTrack.
• Cisco
  Support for Cisco IOS-XE routers and L3 devices
• Juniper
  Juniper SRX is now supported to have IPv6 configuration in SecureTrack Topology.
• Fortinet
  For Fortinet FortiManager SecureTrack now offers visibility for user IDs and rules on the devices' security rules, the global level, and Adom level.
• Palo Alto
  Using Panorama allows the use of Shared Objects now in SecureChange. The Designer can be configured to use or create shared objects as part of the automation process.

REST API

• Error handling
  • Code for unauthorized users has been set to 403 for SecureTrack and SecureChange
  • SecureTrack returns 503 if during synchronization another graph builder is running
• Improvements for SecureTrack
  • Check Point R80 rule numbering has been improved
  • Getting IPv6 bindings is possible now
  • Mapping zones to device interfaces can be retrieved
  • Rule recertification can now be done via API
• Improvements for SecureChange
  • Get Security Zone for Access Requests
  • Modify Expiration Date and Reference Ticket ID
  • API returns an error if a device contains multiple objects or services with the same name
  • Import validations added for Rule Modification
  • Support of Panorama tags for Designer

Further improvements, as well as corrections, are included.
The latest version of the Tufin Orchestration Suite can be found at the Tufin Portal: https://portal.tufin.com

If you don't have upgraded now, you should consider not to wait too long. Reasons for upgrade are - new version with new features (ok, that's as always if a new version is released), but above all - upgrade of TufinOS to version 3.x based on CentOS 7. This is necessary because TufinOS 2.x is based on CentOS 6 which isn't supported any more since end of November 2020. Additionally, some security issues have been found in CentOS that are fixed inTufinOS 3.x, but will not be fixed for TufinOS 2.x due to EOL. So also this is a reason for upgrading soon.

All information about the upgrade can be found in the Tufin Portal.

Requirements for upgrading to TOS 20-2 and TufinOS 3.x are

• TufinOS 2.21 or higher, or RHEL/CentOS 6
• TOS R20-1 or R19-3 (any specific HF)
• Postgres 11 (and not PostgreSQL 9.0 or 9.4)
  This upgrade is mostly done when upgrading to TufinOS 2.21

Be sure that the new server you will install the latest version of TufinOS has at least 500 GB Hard Disk and 16 GB RAM (even for lab installations). Both parameters are checked during the installation of TufinOS. Installation will stop when these requirements are not fulfilled. Anyway, you shold consider the hardware requirements published by Tufin when setting up a new server.

Before beginning the upgrade you need a new machine besides the existing machine. TufinOS as well as TOS will be installed on this new machine. Your configuration as well as data need to be copied to this machine also. Later on you can turn off the old server and change the IP addresses of the new server to the addresses of the old one.
If you don't have a new machine, you need a new hard disk that is going to be mounted to the existing server. All data are saved to this mount point, so they are available afterwards.

It's recommended that you follow the "Upgrade Assistance" published by Tufin. It's recommended to download an Upgrade Planner Application that needs to be exectured on each server any component of TOS is running on. Resullt of the execution is a JSON file with all relevant information about this specific installation. Throwing this file into the field of the page mentioned before will guide you to the correct and recommended upgrade procedure.

It's also possible to get upgrade information directly without running the Planner Application or other scripts. It's important to distinguish between the different installation types, e.g. "standalone", "with Distributed Archtecture" or "with High Availability Cluster". The recommended way is to use the Upgrade Assistant since in this case all information is transferred. It's the most safe way to upgrade. If you don't like it, you can also upgrade manually.

Tufin has released TOS R20-2, the second version of the Tufin Orchestration Suite of 2020.

Please be aware that TOS 20-2 requires TufinOS 3.x, CentOS 7, or RHEL 7. This has been pointed out before. More information about this process to be published here.

So a direct upgrade isn't possible. It's necessary to upgrade/reinstall the Operating System itself. This isn't the move to TOS 2.0, the new version Tufin is talking about a lot. TOS 2.0 is currently available for SecureTrack only. Upgrade tools point customers using SecureTrack only to this new version. If you upgrade, please consider the hardware requirements Tufin has published for the "old" TOS as well as for the "new" TOS.

TOS 20-2 is available as GA, delivering some improvements, e.g.

Change Automation and Orchestration

• SecureChange offers "ticket references". So tickets can be combined and/or referenced. This might be useful if e.g. a rule is decertified and in the next step a Rule Decommissioning should start. Here, a link can be placed, showing to the first ticket.
• When in a SecureChange Access Request "Risk Analysis" is done, only USPs in SecureTrack could be considered. Now, also results of an External Risk Analysis can be considered and shown to the corresponding user.

Security, Risk, and Compliance

• The integration of Transparent Firewalls (working on layer 2 in bridge mode) needed extra tools. Now, they can be added using the WebUI of SecureTrack.
• If a path is found in SecureTrack Interactive Map, the result can now be exported in a PDF file. This file includes all relevant information about devices involved, including corresponding rules. So here is more information as it is shown via a REST API call.
• Searches in SecureTrack Interactive Map allow more than eight results now.

Devices and Platforms

• Check Point - improvement of Rule Numbering when monitoring a CMA with Global Policies.
• Cisco ACI - SecureTrack Path Analysis for simulation of paths to external IP addresses traveling via specific EPGs is possible now.
• Fortinet - Support of IPv6 Path Analysis in SecureTrack Interactive Map, FQDN Object Automation in SecureChange and possibility for Global Level configuration. The last two points require a FortiManager.
• Microsoft Azure - Support of SecureTrack Interactive Map
• Palo Alto Networks Panorama - Besides predefined applications now also custom applications can be used in SecureChange Automation. Improvements for Device Monitoring are included as well as the possibility to add Panorama tags to new rules.
• Support of additional devices and versions:
  • Check Point R80.40 (Check Point Management API v1.5 and v1.6)
  • Cisco ACI 4.2
  • Juniper SRX 19.4
  • Palo Alto PanOS 9.1
  • VMware NSX-T 2.5 and 3.0

REST API

• Error Code For Unauthorized Users Changed to 403
• Rule Numbering Enhancement for Check Point R80 Devices
• Get IPV6 Binding
• Get zone to interface mapping
• Synchronize Topology Model API Enhancement
• Rule Recertification - Update the Certification Status of SecureTrack Rules
• Network Object and Service Name Verification
• GET Security Zone for Access Requests
• Panorama supported for Designer APIs
• Expiration Date and Reference Ticket ID Can Be Modified
• Input Validations Added to Rule Modification Fields

Further improvements, as well as corrections, are included.
The latest version of the Tufin Orchestration Suite can be found at the Tufin Portal: https://portal.tufin.com

Tufin has released TOS R20-1, the first version of the Tufin Orchestration Suite in 2020. TOS 20-1 is available as GA now, delivering some improvements, e.g.

Change Automation and Orchestration

• Improvement of Rule Modification Workflow
  This type of workflow has been introduced with R19-3. This version allows to create tickets to change Source and Destionation of an existing rule. With R20-1 now also Services can be added / changed / removed from a rule.
  Supported devices are Check Point R80, Cisco ASA, Cisco FMC, Palo Alto Panorama, and Juniper SRX.
• Enhancements in SecureApp User Permissions
  More flexibility for roles and permissions in SecureApp, e.g. configuration whether users are allowed to use Server Resources in their Application Connections. Besides this, Tufin has enhanced the Security Segmentation if Interconnected Domains are configred.

Devices and Platforms

• Support of IPv6 in Topology
  SecureTrack Topology supports IPv6, i.e. it can be used in the Interactive Map for e.g. paths and traffic simulation.
  Supported are currently Cisco IOS-XR, Check Point R80, and Fortinet FortiManager in Advanced Mode.
• Fortinet IPv6 automation in non-topology mode
  If Topology isn't used in SecureChange (require e.g. manual Target selection), IPv6 objects in SecureChange Access Requests can be used in automation. So change processes can be automated working with IPv4 as well as IPv6 objects.
• Enhancements for Licensing page
  Some improvements have been implemented to deliver more clarity regarding available and bound licenses.
• Cisco FMC Zones Support - Automation
  For Cisco Firepower Management Center (FMC) devices in non-topology mode specific zone-to-zone mapping can be chosen in SecureChange Access Requests. This can also be used in automated changes.
• Cisco Firepower Rule and Object Usage
  The enhanced rule usage capabilities and features in SecureTrack can now be used for FMC devices, i.e. metadata for rules are calculated and shown in Policy Browser.
• Palo Alto Panorama Dynamic Address Group (DAG) support with Tags
  The content of Dynamic Access Groups based on Panorama Tags can be shown in SecureTrack, improving visibility and traffic analysis (also in Topology).
• Hashicorp Vault Support for Amazon AWS
  This option can be used to store Amazon AWS authentication credentials and to provide tight access control to the AWS. Instead of connecting directly to the AWS, SecureTrack can receive a token for authentication and communication with the AWS device.
• Support of additional devices and versions
  • Check Point R80.40, supporting Check Point API version 1.5
  • Cisco Firepower Management Center (FMC) 6.5
  • Forcepoint SMC 6.5.10
  • F5 BIG IP 14.1
  • Palo Alto PanOS firewall version 9.1
  • Palo Alto Panorama version 9.0.4, 9.1
  • VMware NSX-V version 6.4.6

REST API

• Management of Generic Interfaces, Generic Routes, and Generic VPN
  New API calls are available, supporting full functionality - e.g. get Generic Interface by ID, get Generic Interfaces for a device, get Generic Route by ID, get Generic Routes for a device, get Generic VPN by ID, get Generic VPNs for a device.
• Management of Device Connections for Firewalls in Transparent Mode
  Managing L2 Firewalls is now integrated and possible using REST API.
• Management of Ignored Interfaces
  It's possible to exclude selected Interfaces from SecureTrack Topology. They can now being managed using REST API.
• Device Interfaces and Domains
  When working with Domains in SecureTrack, now REST API can be used to associate an interface óf a device with a Domain ID.
• Cloud Management
  The Interactive Map uses Clouds in some situations. Now the management of Joining Clouds can be done via REST API.
• Enhancements of User Management
  Management of SecureChange and SecureApp users is enhanced when REST API is used, esp. management of Groups.
• Rule Modification Workflow
  As shown above, Service can now be changed for a rule. This can also be done with REST API.
• Ticket Search in SecureChange
  Pagination can now be used in REST API to shorten response time and to limit the amount of data returned by rule search APIs.

Further improvements as well as corrections are included.
The latest version of the Tufin Orchestration Suite can be found at the Tufin Portal: https://portal.tufin.com

Tufin has just released TOS R19-3, the third and final version of the Tufin Orchestration Suite in 2019.
TOS 19-3 is available as GA now, delivering some improvements, e.g.

Change Automation and Orchestration

• Rule Modification Workflow
  With this workflow it's possible to modify the fields Source and Destination within an existing rule. Here new as well as existing objects can be added or removed. This feature is fully integrated in SecureTrack Policy Browser and delivers full API support
  Supported devices are Check Point R80, Cisco FMC, Palo Alto Panorama, Cisco ASA, and Juniper SRX
• Group Ticket Notifications
  Teams can work better now with this feature. The requester of a ticket can now specify a group of users that will receive all E-Mail notifications
• Palo Alto Panorama FQDN Objects in Access Request
  FQDN can be used now, so it's no more necessary to convert names to IP addresses when used in an Access Request
• Check Point R80 - Support of IPv6 addresses
  Access Requests now can use IPv6 addresses in source and/or destination. This is true for new as well as existing rules. Besides this, also new IPv6 objects can be created. Manual Target Selection in SecureChange is required

Devices and Platforms

• Check Point R80 syslog
  Usually, Check Point Log/Management Servers deliver their logs to SecureTrack using LEA. If wanted, now these logs also can be sent by syslog to SecureTrack
• Cisco ACI Visibility
  The ACI policy is now shown in SecureTrack, including EPGs, VRFs, Contracts, Subjects, ... So an instant view of policy details is possible
• Cisco ACI Path Analysis
  ACI devices are included in SecureTrack Topology, so the traffic flow in and out of the ACI device is shown
• Cicso FMC Visibility
  Now FMC zones are shown in retrieved FMC rules, e.g. in Policy Prowser, View Policy etc.
• Forcepoint
  Improvements regarding speed of revision retrieval
• PAN Panorama syslog
  Panorama can be configured now to send syslog by TCP/TLS instead of UDP
• PAN Panorama Device Groups
  Panorama Device Groups (DG) can now be migrated to non-default SecureTrack domains from any level in the group hierarchy, improving management of Domains
• VMware NSX-T
  SecureTrack and Secure Change now support NSX-T. It includes Change Tracking, Clean Up, Violations, Policy Browser, Reports, Topology, etc.

REST API

• Check Point R80
  • Adding or Updating Managed Devices (CMA or SMC) via API
  • Adding new device (CMA or SMC) via API
• Palo Alto Panorama
  • Support of URL Filtering using API
• SecureChange Designer
  • Enhancements for Set Rule location via API
• Rule Modification Workflow
  • Support of many features regarding the Rule Modification Workflow via API
• SecureApp
  • Getting Application Interfaces is possible now using API

Further improvements as well as corrections are included.
The latest version of the Tufin Orchestration Suite can be found at the Tufin Portal: https://portal.tufin.com