Secure Web Gateway 11.2.6 Release Notes

New Features in the 11.2 Release

This release provides the following new features. For resolved issues in this release and the update releases, see further below.

NOTE: Secure Web Gateway 11.2 is provided as a main release.

For information about how to install this release, see the Upgrading to a New Version - Controlled Release. If you are installing the Secure Web Gateway appliance software for the first time, see Installing Secure Web Gateway for the First Time.

When configuring rules for your web policy, you can use these new items:

A new property to expose encrypted archive directory listings.
A new property to store the rule and rule set names or IDs that were processed at the end of the request and response filtering cycles.

Data that is collected by the GTI diagnosis script of the operating system is included in the output feedback file.

Support for rolling TCPdump collection option is now available in the UI. For more details, see Create a packet tracing file. For more details on Performing Packet Tracing in Secure Web Gateway, see Performing Packet Tracing in Secure Web Gateway SWG

When configuring an HTTP Proxy Port, you can disable the Enable FTP over HTTP option. The option is enabled by default.

The following enhancements have been added to SSL Tap configuration:

The destination port number is not overwritten by default when tapped packets are created.
The destination MAC address can be customized when tapped packets are broadcast.
SSL tapping now supports HTTP2 on Secure Web Gateway.

Excel 4 macros are now detected in media type filtering.

IP spoofing is supported for HTTP(S) when setting up proxies in Explicit Proxy or L2 Transparent mode.

For a list of issues that are currently known, see SWG 11.x.x Known Issues and Workaround

This release resolves known issues.

NOTE: Secure Web Gateway 11.2.6 is provided as a main release.

For information about how to upgrade to this release, see Upgrading to a new version – Main Release.

JIRA issue numbers are provided in the reference columns

Web filtering

Reference	Description
WP-2217	The PDF opener now also supports PDFs with versions 2.0.
WP-4536	Client IP or URL to be logged with Kerberos error messages, when authentication logs are enabled."
WP-4859	File previously not getting detected as TTF gets detected correctly as TTF now.
WP-4934	Long list names used when configuring Secure Web Gateway web policy rules are rendered completely in rule sets.
WP-4981	Block page now shows URL and category, which was missing after transitioning from coaching block page to URL blocked page
WP-4992	A new media type has been added to detect InDesign documents and templates
WP-4998	The file opener now supports tar files with pax headers.
WP-5076	The PDF opener function for detecting JavaScript has been improved.

Network communication

Reference	Description
WP-4557	No error was found when selecting rule trace even when option Restrict browser session to IP address of user is enabled
WP-4954	Passive FTP is are working as expected now in a HA Proxy setup through Haproxy.
WP-4985	An HTTP2 issue related to a wrong value for connection level flow control has been fixed.
WP-5010	TCP half-close support for TCP and SOCKS proxies to access an application works without issues.
WP-5070	A high client connection issue related to URL parsing has been fixed.
WP-5111	SaaSConnectors are syncing again.

Other

Reference	Description
WP-4491	Issue related to LinkedIn video upload with HTTP2 is now fixed.
WP-4667	Users can join a Zoom meeting via browser when the waiting room option is enabled.
WP-4724	SWG UI login issue while using Client Certificate for Authentication does not occur anymore.
WP-4944	Restore backup are working as expected now, which had happened due to duplicate ID that had been assigned to configuration file.
WP-5081	An option to configure addition of X cache headers is added to proxy control configuration
WP-5109	All the logs are rotated as per Log Manager Configuration.

Vulnerabilities Fixed

Reference

Description

WP 4999,
WP-5050, WP-5101

This Secure Web Gateway release includes updates addressing publicly disclosed CVEs, regardless of whether a CVE has been shown to impact customers.

The following medium and higher-level CVEs (CVSS 3.0 >= 4) were involved: