Cisco Tetration Release Notes, Release 3.2.1.19

Cisco Tetration Release Notes, Release 3.2.1.19

Note: This is a deploy-only release. If you are running a 3.1.1.x release, do not upgrade to this release. Use a 3.1.1.x release for any new M4-based cluster and virtual appliance deployments.

This document describes the features, caveats, and limitations for the Cisco Tetration software.

The Cisco Tetration platform is designed to address number of data center operational and security challenges comprehensively using rich traffic telemetry collected from servers, Cisco Nexus® switches and end point devices (such as laptops, desktops, and smart phones). The platform performs advanced analytics using an algorithmic approach to offer a wholistic workload protection platform. This algorithmic approach includes unsupervised machine-learning techniques and behavioral analysis. The platform provides a ready-to-use solution supporting the following use cases:

■      Provide behavior-based application insight to automate allowed-list policy generation

■      Provide application segmentation to enable efficient and secure zero-trust implementation

■      Provide consistent policy enforcement across on-premises data centers and private and public clouds

■      Identify process behavior deviations and software vulnerabilities and exposure to reduce attack surface

■      Identify application behavior changes and policy compliance deviations in near-real time

■      Support comprehensive telemetry processing in a heterogeneous environment to provide actionable insight within minutes

■      Comprehensive network performance metrics based on the telemetry collected from both switches and the servers

■      Enable long-term data retention for deep forensics, analysis, and troubleshooting

To support the analysis and various use cases within the Cisco Tetration platform, consistent telemetry is required from across the data center infrastructure. Rich Cisco Tetration telemetry is collected using sensors. There are different types of sensors available to support both existing and new data center infrastructures. This release supports the following sensor types:

■      Software sensors installed on virtual machine, baremetal, or container hosts

■      Embedded hardware sensors in Cisco Nexus 9000 cloudscale series switches

■      ERSPAN sensors that can generate Cisco Tetration telemetry from copied packets

■      Netflow sensors that can generate Cisco Tetration telemetry based Netflow v9 or IPFIX records

■      Cisco AnyConnect proxy to collect telemetry from endpoints, such as laptops, desktops, and smartphones

Software sensors also act as the policy enforcement point for the application segmentation. Using this approach, the Cisco Tetration platform provides consistent enforcement across public, private, and on-premises deployments. Sensors enforce the policy using native operating system capabilities, thereby eliminating the need for the sensor to be in the data path and providing a fail-safe option. Additional product documentation is listed in the "Related Documentation" section.

The release notes are sometimes updated with new information about restrictions and caveats. See the following website for the most recent version of this document:

https://www.cisco.com/c/en/us/support/security/tetration/products-release-notes-list.html

Table 1 shows the online change history for this document.

Table 1 Online History Change

 

 

Contents

This document includes the following sections:

■      New and Changed Information

■      Caveats

■      Compatibility Information

■      Usage Guidelines

■      Related Documentation

New and Changed Information

This section lists the new and changed features in this release and includes the following topics:

■      New Software Features

■      Changes in Behavior

New Software Features

The following new software features are available in this release:

■      Support for deploying Cisco Tetration software on new Tetration 8-RU and 39-RU clusters that are based on Cisco UCS C220 M5-based servers and Cisco Nexus 93180YC-FX or 93108TC-FX-based switches.

Changes in Behavior

This release does not include any changes in behavior.

Caveats

This section contains lists of open and resolved caveats and known behaviors.

■      Open Caveats

■      Resolved Caveats

■      Known Behaviors

Open Caveats

The following table lists the open caveats in this release. Click the bug ID to access the Bug Search Tool and see additional information about the bug.

Table 2 Open Caveats

Resolved Caveats

The following table lists the resolved caveats in this release. Click the bug ID to access the Bug Search Tool and see additional information about the bug.

Table 3 Resolved Caveats

Known Behaviors

The following list contains the known behaviors in this release:

■      Deployment and Upgrade

o    You cannot use the 3.2.1.19 release to upgrade clusters from previous releases (3.1.1.x). Instead, you must deploy new clusters with release 3.2.1.19.

o    The configuration fields for syslog (syslog server and syslog port) are deprecated in the Upgrade/Deploy GUI. Changes to these fields can only be made in the TAN GUI.

o    The configuration fields for remote CA (remote CA, remote CA URL, remote CA username, and remote CA password) are not supported on physical and ESX form factors.

■      TAN

o    User App alerts are not supported with the TAN virtual appliance.

o    Large size alerts(>64k) cannot be sent over UDP to the syslog server.

■      Data Taps/Kafka

o    On 8 rack unit deployments and ESXi cluster configurations, Cisco Tetration runs only 1 instance of the Kafka broker. Because of this, if there is a decommission or re-commission of the bare metal or VM that is hosting the instance, there will be data loss.

■      Enforcement

o    When enforcement is enabled and then disabled, agents will flush all of the rules and keep the catchall as ALLOW for both ingress and egress.

o    Agents will store the last known good policy from the backend, and will reload the policy upon service restart.

o    During a network policy update, the agent on Linux will reprogram the ipset list in a more atomic fashion by swapping the ipset's content with the new content instead of flushing and reprogramming. This reduces the chances of traffic drops.

o    During a network policy update, the agent on Windows will first set the Windows firewall inbound and outbound default policies to ALLOW, then proceed as before by removing the current rules, programming the new rules, and programming the inbound and outbound default policy as specified by the network policy configuration. This reduces the chances of traffic drops in the case of a DENY catchall policy.

o    Whenever enforcement is stopped in an enforced workspace, users should not delete objects in that workspace for approximately 15 minutes after enforcement was stopped. This ensures that pipelines have ample time to refresh the state about that workspace. User inventory filters or scopes referenced by the deleted application will not be deletable for 15 to 20 minutes after the deletion of an application.

■      Data leak

o    Data leak detection has 5-minute latency, hence data leak scores have a 5 minute delay compared to the data leak event time.

o    Data leak events are not currently shown in the Forensics Analysis page.

■      Process Hash Anomaly

o    Frequency analysis (and thus the output score) is done only at the rootscope level.

o    Analysis is run once per hour.

■      AnyConnect

o    Multiple AnyConnect proxies getting data from the same AnyConnect endpoint machine is not encouraged. If you have a use case that needs this mode, contact Cisco.

o    The same endpoint can connect to different proxies at different points in time as long as the endpoint does not flip-flop between different proxies. If a flip-flop occurs, the AnyConnect proxy will limit the scenario so that there should be at least 7 days when such a flip-flop happens. If there is a flip-flop use case in which an endpoint is alternating connections between 2 different proxies, contact Cisco.

■      Policy Publish on Kafka

o    For client applications, which utilize this feature, we do not recommend that you use the 8 rack unit deployment and ESXi cluster configuration, because this configuration has only one instance of the Kafka broker. If there is a de-/recommission of the bare metal or VM that is hosting the application, the created policy stream will not be recovered correctly and will become inoperational. Instead, use the 39 rack unit cluster configuration for higher availability of the policy stream.

■      ADM

o    An ADM run will no longer generate policies for flows that are already covered by manually created policies in the current application.

o    Clusters can no longer be used as a provided service. Existing clusters that are marked as public and referenced by an external application will be converted into inventory filters. Inventory filters become the only way to indicate a service provided by the scope or application.

o    When a cluster is promoted to an inventory filter, the cluster will be removed from the Conversations view. A new ADM run will be needed to generate an updated IP address-to-filter mapping.

o    Exclusion filters will be carried over across ADM runs. If clusters are used as part of an exclusion filter, the flows will only be removed if the application is primary.

o    A SLB upload for the Citrix load balancer configuration does not allow * as a port range. The configuration expects a single port to be specified in the configuration.

■      TIM Configuration

o    When F5s are configured in high availability mode:

§  The TIM F5 plugin fetches the configuration from only one F5 out of the configured list of hosts. All features of the F5 where this configuration differs between the primary and standby REST endpoints may experience delays after a switchover until TIM connects to the new primary.

o    Citrix configuration when Netscalers are configured in HA mode:

§  The TIM Citrix plugin fetches the configuration from only one Netscaler out of the configured list of hosts. All features of the Netscaler where this configuration differs between the primary and secondary REST endpoints may experience delays after a switchover until TIM connects to the new primary.

o    When VMware vCenter HA mode is active:

§  The TIM VMware vCenter plugin only fetches the configuration from one VMware vCenter endpoint at a time. The VMware vCenter HA mode and behaviour of the TIM VMware vCenter plugin is untested.

Compatibility Information

This release is intended for new deployments, only. You cannot upgrade to this release from any of the 3.1.1.x releases.

The software sensors in the 3.2.1.19 release supports the following operating systems (virtual machines and bare-metal servers) for legacy deep visibility and deep visibility:

■      Linux:

—     CentOS-5.x: 5.1 to 5.11

—     CentOS-6.x: 6.1 to 6.10

—     CentOS-7.x: 7.0, 7.1, 7.2, 7.3, 7.4, 7.5 and 7.6

—     Redhat Enterprise Linux-5.x: 5.1 to 5.11

—     Redhat Enterprise Linux-6.x: 6.1 to 6.10

—     Redhat Enterprise Linux-7.x: 7.0, 7.1, 7.2, 7.3, 7.4, 7.5 and 7.6

—     Oracle Linux Server-6.x: 6.0 to 6.10

—     Oracle Linux Server – 7.0, 7.1, 7.2, 7.3, 7.4, 7.5 and 7.6

—     SUSE Linux-11.x: 11.2, 11.3, and 11.4

—     SUSE Linux-12.x: 12.0, 12.1, 12.2 and 12.3

—     Ubuntu-12.04

—     Unbuntu-14.04 and 14.10

—     Ubuntu-16.04

■      Windows Server (64-bit):

—     Windows Server 2008R2 Datacenter

—     Windows Server 2008R2 Enterprise

—     Windows Server 2008R2 Essentials

—     Windows Server 2008R2 Standard

—     Windows Server 2012 Datacenter

—     Windows Server 2012 Enterprise

—     Windows Server 2012 Essentials

—     Windows Server 2012 Standard

—     Windows Server 2012R2 Datacenter

—     Windows Server 2012R2 Enterprise

—     Windows Server 2012R2 Essentials

—     Windows Server 2012R2 Standard

—     Windows Server 2016 Standard

—     Windows Server 2016 Essentials

—     Windows Server 2016 Datacenter

■      Windows VDI desktop Client:

—     Microsoft Windows 7

—     Microsoft Windows 7 Pro

—     Microsoft Windows 7 Home

—     Microsoft Windows 7 Enterprise

—     Microsoft Windows 8

—     Microsoft Windows 8 Pro

—     Microsoft Windows 8 Home

—     Microsoft Windows 8 Enterprise

—     Microsoft Windows 8.1

—     Microsoft Windows 8.1 Pro

—     Microsoft Windows 8.1 Home

—     Microsoft Windows 8.1 Enterprise

—     Microsoft Windows 10

—     Microsoft Windows 10 Pro

—     Microsoft Windows 10 Home

—     Microsoft Windows 10 Enterprise

 

The 3.2.1.19 release supports the following operating systems for the policy enforcement add-on capability:

■      Linux:

—     CentOS-6.x: 6.1 to 6.10

—     CentOS-7.x: 7.0, 7.1, 7.2, 7.3, 7.4, 7.5 and 7.6

—     Redhat Enterprise Linux-6.x: 6.1 to 6.10

—     Redhat Enterprise Linux-7.x: 7.0, 7.1, 7.2, 7.3, 7.4, 7.5 and 7.6

—     SUSE Linux-11.x: 11.2, 11.3, and 11.4

—     SUSE Linux-12.x: 12.0, 12.1, 12.2 and 12.3

—     Oracle Linux Server-6.x: 6.0 to 6.10

—     Oracle Linux Server – 7.0, 7.1, 7.2, 7.3, 7.4, 7.5 and 7.6

—     Ubuntu-14.04 and 14.10

—     Ubuntu-16.04

■      Windows Server (64-bit):

—     Windows Server 2008R2 Datacenter

—     Windows Server 2008R2 Enterprise

—     Windows Server 2008R2 Essentials

—     Windows Server 2008R2 Standard

—     Windows Server 2012 Datacenter

—     Windows Server 2012 Enterprise

—     Windows Server 2012 Essentials

—     Windows Server 2012 Standard

—     Windows Server 2012R2 Datacenter

—     Windows Server 2012R2 Enterprise

—     Windows Server 2012R2 Essentials

—     Windows Server 2012R2 Standard

—     Windows Server 2016 Standard

—     Windows Server 2016 Essentials

—     Windows Server 2016 Datacenter

■      Windows VDI desktop Client:

—     Microsoft Windows 7

—     Microsoft Windows 7 Pro

—     Microsoft Windows 7 Home

—     Microsoft Windows 7 Enterprise

—     Microsoft Windows 8

—     Microsoft Windows 8 Pro

—     Microsoft Windows 8 Home

—     Microsoft Windows 8 Enterprise

—     Microsoft Windows 8.1

—     Microsoft Windows 8.1 Pro

—     Microsoft Windows 8.1 Home

—     Microsoft Windows 8.1 Enterprise

—     Microsoft Windows 10

—     Microsoft Windows 10 Pro

—     Microsoft Windows 10 Home

—     Microsoft Windows 10 Enterprise

■      Container host OS version for policy enforcement:

—     Red Hat Enterprise Linux Release 7.1, 7.2, 7.3, 7.4

—     CentOS Release 7.1, 7.2, 7.3, 7.4

—     Ubuntu Release 16.04

 

The 3.2.1.19 release supports the following operating systems for the universal visibility sensor:

■      Linux 32-bit and 64-bit (CentOS 4.x, RHEL 4.x, CentOS 5.x, RHEL 5.x, and so on)

■      Windows Server (32-bit and 64-bit)

■      Solaris 11 on x86 (64-bit)

■      AIX 5.3, 6.1, 7.1, and 7.2

The 3.2.1.19 release supports the following Cisco Nexus 9000 series switches in NX-OS and Cisco Application Centric Infrastructure (ACI) mode:

Table 4 Supported Cisco Nexus 9000 Series Switches in NX-OS and ACI Mode

**Network performance features using hardware sensors is supported only in Cisco ACI mode with release 3.1 or later.

Usage Guidelines

This section lists usage guidelines for the Cisco Tetration software.

■      You must use the Google Chrome browser version 40.0.0 or later to access the web-based user interface.

■      After setting up your DNS, browse to the URL of your Cisco Tetration cluster: https://<cluster.domain>

Verified Scalability Limits

The following tables provide the scalability limits for Cisco Tetration (39-RU), Cisco Tetration-M (8-RU), and Cisco Tetration Cloud:

Table 5 Scalability Limits for Cisco Tetration (39-RU)

Note: Supported scale will always be based on which ever parameter reaches the limit first

Table 6 Scalability Limits for Cisco Tetration-M (8-RU)

Note: Supported scale will always be based on which ever parameter reaches the limit first

Table 7 Scalability Limits for Cisco Tetration Virtual (VMWare ESXi)

Note: Supported scale will always be based on which ever parameter reaches the limit first.

Related Documentation

The Cisco Tetration documentation can be accessed from the following websites:

Tetration Datasheets: https://www.cisco.com/c/en/us/products/security/tetration/datasheet-listing.html

General Documentation: https://www.cisco.com/c/en/us/support/security/tetration/tsd-products-support-series-home.html

The documentation includes installation information and release notes.

Table 8 Installation Documentation

 

Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)

Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.

© 2019 Cisco Systems, Inc. All rights reserved.