Secure Web Gateway 11.0.1 Release Notes

Last updated
Save as PDF

What's new in the 11.0 release

This release introduces new features and enhances existing features.

NOTE: Skyhigh Secure Web Gateway 11.0 is provided as a controlled release.

For information about how to upgrade to this release, see Upgrade to a new version provided as a controlled release.

Download of lists maintained under MVISION Unified Cloud Edge for on-prem web policy

You can download lists of user names, user groups, and other web objects that are maintained under Skyhigh Security Service Edge for the on-prem policy that you set up on Web Gateway.

The lists are continually synchronized. When enabling the download on Web Gateway, you set the synchronization interval.

This download feature is a part of a Hybrid solution that allows you to filter web traffic using both Web Gateway and Skyhigh Security Service Edge.

For more information, see Synchronize lists for your web policy when using a Hybrid solution in the McAfee Web Gateway Product Guide.

Secure net-hop proxy for securing traffic to MVISION Unified Cloud Edge

You can set up a secure next-hop proxy on Web Gateway to ensure traffic going to Skyhigh Security Service Edge is secure.

The traffic follows the TLS protocol. A certificate is presented at the initial handshake from the server side whereas Web Gateway uses the authentication method that is enabled by Client Proxy to authenticate to Skyhigh Security Service Edge.

For more information, see Set up a secure next-hop proxy to secure traffic on a Hybrid connection in the McAfee Web Gateway Product Guide.

Use of keywords to filter lists with Azure Active Directory group names

When searching lists of user groups stored in an Azure Active Directory, you can use a keyword to filter the search result. You can create lists of keywords and use more than one in a search.

For more information, see Azure Directory settings in the McAfee Web Gateway Product Guide.

SmartMatch optimization

Performance has been optimized for SmartMatch lookups by improving the handling of partial matches in URL lists.

For more information, see the entry on the URL.SmartMatch property under Properties — U in the McAfee Web Gateway Product Guide.

Improved detection of CPIO application type

Applications of the application/x-cpio type are properly recognized through improving the methods for their detection, which had only relied on checking the file header before and caused incorrect further treatment, for example, being rated as corrupt by the file opener.

New locations for storing cloud access log data

New options available when choosing the country or region where cloud access log data are stored, including Canada, United Kingdom, United Arab Emirates, and Singapore.

For more information, see Cloud Access Log Data Residency settings in the McAfee Web Gateway Product Guide.

Recognition of intermediary HTTP2 headers

When receiving web traffic from servers that support HTTP2 on the connection to Web Gateway, headers with status code 1xx are recognized by Web Gateway as intermediary headers preceding the main headers and processed accordingly.

Improved handling of HTTP2 statistics

HTTP2 statistics, which are also shown on the Web Gateway dashboard, are provided under the Simple Network Management Protocol (SNMP) to be read by an external SNMP manage poll.

For more information about how to configure this protocol, see Event monitoring with SNMP in the McAfee Web Gateway Product Guide.

Kerberos authentication with improved logging

When the Kerberos authentication method is used, error logging has been improved, for example, by writing client IP addresses in the log.

More efficient troubleshooting methods

More efficient methods are used now to identify customers, clients, and connections relating to high load or overload issues in temp files on Web Gateway.

Known Issues and their Patches

For a list of issues that are known, but not resolved yet, see the table below.

Fix Version

Found Version

Description

SWG 11.2.5

SWG 11.2.0

Issue: After you update a central management cluster from 10.2.x to 11.2.x (specifically 11.2.4 or earlier), you see one of the following issues:

No access to UI. You might see the following error: Error while receiving data. Received 'HTTP:200'
System list updates fail with the following error: System Lists update failed, with ID 333

Workaround: Run the following commands on each cluster node via CLI:

service mwg-core stop
rm /opt/mwg/plugin/data/DLP/0/lists -rf
service mwg-core start

After the service restart, a new list is created automatically.

NOTE: This workaround includes a service restart; all connections will be disconnected and no connections will be accepted until the service is started again.

Solution: This issue is fixed in version 11.2.5; release date is November 15, 2022.

SWG 11.2.4

SWG 11.2.3

Issue: 11.2.3 uses an updated version of Tomcat.
This new version of Tomcat causes SWG to suffer an incompatibility with the authentication method "client certificate authentication."
This authentication method is only available when using the SWG UI as a Java Applet (logging in via the browser login page).
Detailed information about client certificate authentication can be found on the SWG documentation page.

NOTE: Most current browsers don't support Java Applets.
The most notable browser still supporting them is the old Internet Explorer 11, but this is now EOL.
You see the following entries, present in the log file /opt/mwg/log/mwg-errors/mwg-ui.errors.log:

[ERROR] Cannot determine if client certificate is enabled due to implementation changes in Tomcat: java.lang.NoSuchFieldException: endpoint

Issue: After you reboot, the kdump service fails to start.
The current kdump service included in SWG isn't compatible with the latest kernel upgrade provided as part of the September 20, 2022 releases.
The kdump service handles kernel failures that occur and recovery from these issues.
When this service is non-functional, kernel failures cause the appliance to become unresponsive, and a manual power cycle is needed to get the appliance back to a working state.

Workarounds: You can avoid this issue on installation and prevent the kernel package from being upgraded.

NOTE: This workaround is only applicable to the CMD method of upgrade.
Instead of running yum upgrade yum && yum upgrade, run yum upgrade yum && yum upgrade --exclude=kernel*

If already upgraded>edit the config files> allow the appliance to recover from the kernel failure> and automatically reboot after 5 secs:

Edit the sysctl.conf file from the SWG-UI.
Add the line kernel.panic=5 outside the auto generated block.
Save your changes.

SWG 11.1.14

SWG 11.1

Issue: Your Browser response page shows corrupted text. No errors are seen in the SWG logs.

Solution: This issue is fixed in version 11.1.4.

Issue: Your browser triggers a file download, which is a text file named "f.txt." No errors are seen in the SWG logs.

Solution: This issue is fixed in version 11.1.4.

Issue: Memory-leak leads to one or more of the following issues:

Appliance not reachable
SWG stops handling network traffic
No access to SWG UI

Resolution: This issue is fixed in version 11.1.4

Resolved issues in update 11.0.1

This release resolves known issues.

NOTE: Skyhigh Security Secure Web Gateway 11.0.1 is provided as a controlled release.

For information about how to upgrade to this release, see Upgrade to a new version provided as a controlled release.

JIRA issue numbers are provided in the reference column.

Web filtering

Reference	Description
WP-4158	The time consumed during a transaction can be retrieved again as a value for the Timer.TimeInTransaction property when Secure Web Gateway is running as a proxy under TCP or the SOCKS protocol.

Other

Reference	Description
WP-3247	The mcelog service will only be enabled on physical appliances now and will remain disabled on virtual appliances.