IMPORTANT
SNS 3.x versions have reached End of Maintenance since July 1st, 2024.
We recommend that you update your SNS firewalls to a version with maintenance to guarantee the protection of your infrastructure.
New features in SNS 3.0.0
Unified web interface
The unified web interface now covers the administration, monitoring and reporting of Stormshield Network firewalls.
A new monitoring window offers graphs (in real time and with history statistics) on system resources used (memory and CPU), throughput per interface and connected users as well as detailed information on machines (ongoing connections, applications used, vulnerabilities detected, etc).
Many interactive features facilitate the search for incidents and the administration of Stormshield Network firewalls.
Wireless networks
Wireless networks compatible with 802.11 a/b/g/n standards are now supported on the new SN160W and SN210W models.
Every firewall offers all the features needed for securing Wi-Fi connections.
Temporary user management
In order to provide easy Internet access to persons outside the organization or in public places, Stormshield Network products offer advanced features for managing temporary users.
In addition to guest mode, which was already available, version 3 includes "sponsorship" mode and a new portal to create temporary accounts.
The current "guest" portal may be enriched with new fields (first name, last name, e-mail address, etc) that the user will need to enter before accepting the Internet access charter.
Temporary accounts can be created easily thanks to a simplified screen that can only be accessed by persons authorized to create such accounts.
"Sponsorship" mode makes it possible to delegate - to an authorized person - the privilege of accepting or rejecting an Internet access request from a person outside the organization.
Many enhancements allow customizing users' various access portals.
Integration into a multi-domain environment
Users can now be authenticated on several Active Directory domains. It is therefore possible to authenticate users originating from various domains and applying distinct security policies to them.
Multiple directories also offer the possibility of registering firewall administrators in an internal directory and managing unprivileged users in an external directory.
IP geolocation - Country-based filtering
Thanks to the geolocation feature, administrators gain visibility over the source or destination of their network traffic. Security policies can therefore be adapted to filter traffic according to new geographical criteria represented by "Country" or "Continent" objects.
All log files and reports have been enriched with a new item corresponding to the country.
IP Reputation – External host reputation
This feature, which can be combined with geolocation, makes it possible to lower an organization's attack risk.
Public IP addresses with a bad reputation (e.g.: Tor exit nodes) will fall under one of seven categories: Spam, Phishing, Anonymizer, Botnet, Malware, Tor or Scanner. These categories are regularly updated through the Active Update mechanism.
Through his security policy, the administrator can therefore block external machines with bad reputations from attempting to access the organization's network, and prohibit connections from internal workstations to reputedly risky hosts.
Dynamic Host Reputation – Internal host reputation
Security policies can now be assigned based on the reputation of internal hosts.
Reputations, represented by a score, can be calculated dynamically thanks to ratings provided by the inspection engines built into Stormshield firewalls. Whenever our sandboxing solution detects a virus, raises a major alarm or identifies malware, the host's score will automatically be raised.
Administrators can view the history of a host's reputation score in the new "monitoring" module. Other indicators such as the average score of a network and the maximum score, provide addition information to help them define their security policies and act on hosts that require intervention.
This feature requires the use of a SD card if there is no hard disk on the firewall.
"DNS names (FQDN)" objects
In order to refine a security policy, it is now possible to use network objects defined only by their FQDN (IP address(es) automatically retrieved by DNS resolutions) such as "google.com" or "office365.com".
Safe transmission of Syslog traffic through the TLS protocol
The transmission of logs to one or several Syslog servers (maximum 4) via TCP can now be secured through the TLS protocol with client and server certificate authentication.
This secure transmission of Syslog traffic is compatible with the Stormshield Visibility Center solution.
Stormshield Network firewalls support several standardized formats of Syslog messages (RFC3164, RFC5424, RFC5425 and RFC6587).
Possibility of configuring the hash algorithm in the internal PKI and the SSL proxy
The Certificates and PKI module offers the possibility of selecting the hash algorithm (in particular SHA256) used for the certificates of the SSL proxy and the firewall's internal PKI.
IPFIX/Netflow support
Compatibility with Netflow/IPfix collectors allows administrators to easily identify potential network issues.
Customized signatures on the intrusion prevention (IPS) engine
Administrators can now create their own context-based signatures in order to detect applications inside the organization.
SNi40 - Hardware bypass
In order to ensure service continuity in an industrial setting, the SNi40 firewall is equipped with a hardware bypass function, which when enabled, allows network traffic to pass through in the event of a power outage or appliance breakdown.
Importing and exporting the contents of the network objects database
Exporting the objects database in CSV format makes it possible to save the database and reimport it directly into the Stormshield Management Center centralized administration solution.
The structure of the rows that make up the objects database in CSV format is available in the section Structure of an objects database in CSV format of the Stormshield Network Configuration and Administration Manual.
Official support for KVM and Hyper-V virtualization platforms
Stormshield Network virtual firewalls are available for Microsoft Hyper-V (VHD format) and KVM platforms (Kernel-based Virtual Machine - QCOW2 format). The supported versions of hypervisors are listed in the Compatibility section of this document.
Intrusion prevention scans on HTTP traffic with on-the-fly decompression
The intrusion prevention engine is now capable of decompressing HTTP data on the fly in order to perform IPS scans on this protocol. The firewall therefore no longer needs to modify the headers of HTTP packets sent by the client in order to mask compression support (accept-encoding). As a result, this mechanism reduces latency and the amount of data needed for transferring HTTP packets, but demands a greater amount of the firewall's resources.
This feature is enabled by default and can be suspended in the HTTP configuration module.
Possibility of adding a constraint on the Domain name of the certificate presented by an IPsec peer.
When a certificate authority (CA) is specified in the list of trusted authorities for the establishment of IPsec tunnels, a constraint can be added on the Domain Name (DN) of the certificate presented by the peer in order to strengthen security.
CRL verification and support for BindAddr in the firewall's LDAP requests
In the firewall's LDAP configuration, the BindAddr parameter followed by the firewall's private IP address forces the firewall to present this IP address during LDAP requests to an external directory: LDAP traffic can therefore be encapsulated in an IPsec tunnel in order to encrypt requests to the directory.
This parameter can only be modified in command line (setconf ConfigFiles/ldap LDAP_Name BindAddr FW_Private_IP).
IPS scans of the Ethernet/IP industrial protocol
The intrusion prevention engine now allows filtering (Analyze / Block) public command sets for this protocol. A customized list of Ethernet/IP commands that need to be allowed can also be specified.
Intrusion prevention scans for SNMP
SNMP (Simple Network Management Protocol) is a network equipment monitoring protocol. The IPS scan for this protocol has been particularly enriched. It therefore now possible to allow or block SNMP packets according to the version of the protocol (SNMPv1, v2c or v3), create community whitelists/blacklists (SNMPv1 and v2c), identifiers (SNMPv3) or OIDs (Object Identifier).
NAT support for Dynamic DNS
The module that sends the public IP address to the dynamic DNS registration service provider now distinguishes the real public IP address presented by a NAT router from the local address. This feature can be enabled by selecting Support address translation (NAT) in the advanced properties of the Dynamic DNS module.
SSL proxy - Support for new encryption algorithms
The SSL proxy supports new encryption algorithms based on elliptic curves (ECDSA algorithm: Elliptic Curve Digital Signature Algorithm).
Systematic verification of unused objects
The Network objects module displays the list of objects found in the firewall's database; objects are classified by category (hosts, networks, DNS domain names [FQDN], etc).
A colored symbol appears before each object, dynamically indicating whether the object is being used in the firewall's configuration (green chip) or not (gray chip). Clicking on the "eye" icon located to the right of a green chip will list all the modules using the object in question.
Rule names in IPS logs and active connection logs
The Filter and NAT module makes it possible to assign a name to each rule created. Do note that the "Name" column is hidden by default.
This rule name (rulename) is referenced in IPS logs and connection logs. It has the advantage of not changing according to rule criteria (via, interface, etc) or the position of a rule in a filter policy, unlike rule identifiers (ruleid). As such, filter or NAT rules can be easily handled according to their names.
Exporting monitoring data and audit logs
In the same way as report data, the information displayed in audit logs and the data presented in the tables of the monitoring module can also be exported to a file in CSV format.
Sandboxing – Form to report false positives
The interactions offered on audit logs allow warning Stormshield of any wrong categorization following a sandboxing operation. This feature therefore makes it possible to unblock attachments that have been wrongly considered malicious.
Authentication
The maximum length of an identifier has been raised to 255 characters. Moreover, users can now be included in 250 groups (this limit used to be 50 in older versions).
SSL VPN
The SSL VPN Client configuration file now includes register-dns and block-outside-dns options indicating, respectively, for the client to write the DNS server(s) specified by the Stormshield Network firewall to its configuration, and to not use third-party DNS servers. This feature shortens the time needed for receiving responses to the client's DNS requests, especially for machines running in Microsoft Windows 10.
Child connections (active FTP) through virtual IPsec interfaces
Traffic that creates child connections (e.g.: active FTP) is now compatible with the use of virtual IPsec interfaces (VTI).
TCP-based DNS requests
Stormshield Network firewalls automatically switch their DNS requests over to TCP whenever they receive a response exceeding 512 bytes (response with many entries such as dynamic objects and DNS name objects [FQDN]).
Addition of logs in stateful pseudo-connections
Stateful pseudo-connections (GRE, ESP, etc) now generate registrations in connection log files (l_connection) and filter statistics files (l_filterstat).
Support for generic 3G/4G modems
For generic 3G/4G modems whose characteristics are not automatically recognized, up to two profiles grouping configuration information (model, vendor ID, etc) can be defined, such information having to be manually entered. The various fields to configure are explained in the section Creating a modem in the Stormshield Network Configuration and Administration Manual.
Strengthening the IPS scan on TCP
The TCP IPS scan has been strengthened in order to detect data in RESET packets and setting off the specific alarm "TCP RST with data". It can now also handle a larger amount of unacknowledged data without setting off alarm no. 84 "TCP data queue overflow".
Other features
- Improvement of the intrusion prevention scan on the SSL protocol with regard to fragmented headers
- Support for Unicode international characters in certificates
- Inclusion of source and destination object names in alarm e-mails
- Addition of the firewall's system name in Shell command prompts