- Category: SecureTrack
Licensing in Tufin Orchestration Suite is done centrally in SecureTrack. Even if SecureChange / SecureApp is run on a separate server, licenses are stored in SecureTrack and published to the other machine. If a license is installed, it needs to be activated. This is quite easy using the "Generate" button. When getting the activated license, it should be installed in SecureTrack so it's bound to this system.
When switching from an Eval license to a permanent license (and vice versa) it might happen that the newly installed license isn't recognized correctly. In this case, some CLI commands regarding the database are useful.
Before you continue, create a BACKUP of your installation of SecureTrack!
It includes all configuration and also the license. Be careful when you use the commands below - without license Tufin Orchestration Suite will not work at all!
For getting further information or deleting licenses CLI access to SecureTrack is necessary.
As usual for Tufin commands, this needs to be done as root or using the sudo command.
Next steps could be:
Show the currently installed licenses
[root@TufinOS ~]# psql securetrack -Upostgres -c "select * from st_licenses"
Delete all licenses of type "full", i.e. "real" licenses
[root@TufinOS ~]# psql securetrack -Upostgres -c "delete from st_licenses where license_type='full'"
Delete all licenses of type "evaluation"
[root@TufinOS ~]# psql securetrack -Upostgres -c "delete from st_licenses where license_type='evaluation'"
Delete all licenses of both types, i.e. "full" and "evaluation"
[root@TufinOS ~]# psql securetrack -Upostgres -c "delete from st_licenses"
As written above, be careful with these commands and use them only when a current Backup is done!
- Category: TufinOS
TufinOS is based on Linux. Here a flaw called SegmentSmack has been found. Due to the handling of special TCP Packets a Denial-of-Service (DoS) can be triggered remotely. To maintain a DoS condition, continouos two-way TCP sessions to a reachable port are required.
So if your device running TufinOS isn't reachable from untrusted sources or protected by a firewall, the risk of a DoS isn't too high. But an upgrade should be installed when availalble.
Tufin points out that all versions of TufinOS are affected (TufinOS 1.8 - 1.23 as well as TufinOS 2.0 - 2.16).
Update 30.08.2018: A patch is integrated in TufinOS 2.17 which is available now for Download.
If you are still using TufinOS 1.x please upgrade since this version isn't supported any more by Tufin.
- Category: Version update
Tufin has released R18-2, the second version of the Tufin Orchestration Suite in 2018. TOS 18-2 is available as GA now, delivering some improvements, e.g.
Automatically Onboard AWS VPCs
VPCs are automatically detected now, which covers adding or removing them.
Security Policy Change Automation and Orchestration
Commit Policy Changes. Using this function, policies are pushed from the Management Server to the Firewalls using the Designer. Supported for Check Point, Palo Alto and Fortinet
- SecureTrack, SecureChange
The feature Change Windows allows to schedule time slots for committing policies from Management Server to Firewalls, including new report features
Customizable Rule Names for FortiManager allow to define a rule name directly from the SecureChange Designer when changes are implemented.
Change Automation Enhancements for Cisco Firepower allow to implement changes of the security policy automatically.
Devices and Platforms
Inline Layer Support for Check Point R80.10
Migrate or Delete Multiple Devices for some Cisco and Check Point Devices using “Device Bulk Tasks”
- Support of new devices
- VMware NSX 6.4.0
- Cisco ASA 9.8
- Fortinet FortiManager 5.6.3
- Fortinet FortiGate 5.4.7 and 5.6.3
- Forcepoint SMC 6.4
- Palo Alto Panorama 8.1
- Improvements for SecureTrack/SecureChange/SecureApp
Upgrades of REST API Stanadard (JAX_RS) from 1.1 to 2.1, compliant with Java EE8 Apache CXF (which implements JAX_RS 2.1) upgraded from 2.6.16 to 3.2.1
- Improvements for SecureTrack
- Unified Returned JSON Array Format for these APIs:
Get devices, Get device by Id, Add offline device, Update offline device, Get rules by device, Get specific rule, Rule Search APIs
- Generic Devices APIs:
Fully manage adding, deleting, or modifying generic devices to the Interactive Map via the REST APIs. New argument “update_topology”.
- Sync Topology APIs
Synchronization of Interactive Map by “Fast Topology Sync” or “Full Topology Snyc”
- Generic VPN connections API
Retrieval of a list of generic VON in the Topology Map
- Check Point Inline Layer Support
Parameter “include_subpolicy” allows support of this mode
- Additional Data Returned for Check Point Devices
API responses for “get devices”, “installed_policy” and “parent_id"
- Filtering Service Group Members
Optional parameter “show_members” with more information
- Support for Pagination in USP Exceptions
Better management of a large number of USP Exceptions
- Retrieve Domains from SecureTrack
New “Synchronize Domains” API retrieves all domains from SecureTrack, also synchronizing SecureChange Domains
- Unified Returned JSON Array Format for these APIs:
Further improvements as well as corrections are included.
The latest version of the Tufin Orchestration Suite can be found at the Tufin Portal: https://portal.tufin.com
- Category: SecureChange
Sometimes the question arises if Access Requests can consider NAT Rules also
End users opening an Access Request ticket are mostly not interested if NAT is necessary for ther request or not. In most cases they even won't know if NAT is neccessary. So in this case the question if NAT should be considered in the ticket is not that important.
An administrator knows that NAT is needed and tries to configure it in the ticket. This is possible:
Opening the object browser allows to provide IP addresses and NAT addresses
This results in a specific entry for Destination:
So everything seems ok, BUT this needs to be considered:
- Risk Analysis doesn't use NAT information
- Designer doesn't use NAT information
- Verifier doesn't use NAT information
Due to these facts, it's not really recommended to use NAT in Access Request tickets.
- Category: Admin Management
AERAsec is proud to announce that we are one of the worldwide first three Tufin Service Delivery Partners (SDP) and currently the only one in Central Europe
Tufin has announced that a new partner program is launched in June 2018. The Service Delivery Partner Program enables partner to be more service-ready.
AERAsec has a wide experience from many projects helping customers to get their values by the Tufin Orchetration Suite. The way of working closely together with Tufin Technologies will be continued in an even more intense way. So customers will have additional value not only from experience, but also from a more intense cooperation between AERAsec and Tufin. Customers purchasing Tufin products from AERAsec will have an additional advantage because of special conditions regarding these services.
- Category: TufinOS
In Red Hat Enterprise Linux (and therefore also in CentOS as well as TufinOS) a new vulnerability has been found.
An industry-wide issue has been found in the way many modern microprocessor designs have implemented speculative execution of Load & Store instructions (a commonly used performance optimization). As a result, an unprivileged attacker could use this flaw to read privileged memory by conducting targeted cache side-channel attacks.
See more details here: Speculative Store Bypass and Rogue System Register Read.
This issue will be addressed in TufinOS 2.17 and not by a patch for 2.16. The reasons are a local attack vector and a high attack complexity. The second flaw is rated with a low base score.
So in Tufin 2.17 these issues are addressed. This version is planned for August 2018.
The release of this version will be published by Tufin - and here in this Blog.
Page 2 of 11