June 8, 2022

To:         Symantec Secure Web Gateway Customers

From:     SGOS and Advanced Secure Gateway Product Teams

Subject:     General Availability Announcement for SGOS and Advanced Secure Gateway 7.3.8.2 Patch Release

On behalf of Broadcom, we appreciate your business and the opportunity to provide you with high-quality, innovative software and services.  As part of our ongoing commitment to customer success, we regularly release updated versions of our products. Today, we are pleased to announce that SGOS and Advanced Secure Gateway version 7.3.8.2 are now available, including a number of fixes and the following changes:

IMPORTANT: This patch release (PR) includes a critical fix and replaces SGOS 7.3.8.1 released on May 11, 2022. If you are running version 7.3.8.1, upgrade to version 7.3.8.2 to apply the fix. See the version 7.3.8.2 release notes for information. The following features were introduced in version 7.3.8.1, which is no longer available for download.

SSL/TLS Version Controls for SSL Forward Proxy 

•  Set Client Min Max SSL Version
•  Set Server Min Max SSL Version 

• client.connection.min_ssl_version()
• client.connection.max_ssl_version()
• server.connection.min_ssl_version()
• server.connection.max_ssl_version()

• ProxySG Admin Console
• Command Line Interface Reference
• Web Visual Policy Manager Reference
• Content Policy Language Reference
• Security Best Practices

X.509v3 Enhancements for Self-Signed Certificates and Certificate Signing Requests

• Subject Alternative Name 
• Basic Constraints
• Key Usage 
• Extended Key Usage

• ProxySG Admin Console
• Command Line Interface Reference

Separate Event Logging Configuration for Email and Syslog

• ProxySG Admin Console
• Command Line Interface Reference

Recognition of Specific CAB Data Types in HTTP Responses

• MSCAB: MS Cab archive 
• ISCAB: InstallShield archive

• Content Policy Language Reference
• SGOS 7.3.x Upgrade/Downgrade 

Threat Detection Notification VPM Objects

• Request Threat Detected: (Static object) Specifies whether threat scanning detected a threat in the request.
  CPL condition: request.icap.threat_detected=
• Response Threat Detected: (Static object) Specifies whether threat scanning detected a threat in the response.
  CPL condition: response.icap.threat_detected=
• Request Threat Info: Specifies whether threat scanning detected a specific type of threat in the request. 
  CPL conditions: request.icap.threat_id=, request.icap.threat_id.exists=, request.icap.threat_details=, request.icap.threat_details.exists=, request.icap.threat_source=, and request.icap.threat_source.exists=
• Response Threat Info: Specifies whether threat scanning detected a specific type of threat in the response.
  CPL conditions:  response.icap.threat_id=, response.icap.threat_id.exists=, response.icap.threat_details=, response.icap.threat_details.exists=, response.icap.threat_source=, and response.icap.threat_source.exists=

• Web Visual Policy Manager Reference

ProxySG Admin Console 1.2.4.1

• Configure Certificate Revocation Lists (CRLs) to check certificates against CA-provided lists of invalid and expired certificates (Configuration > SSL > CRLs).
• You can create self-signed certificates and certificate signing requests (CSRs) with the extensions described in the "X.509v3 Enhancements for Self-Signed Certificates and Certificate Signing Requests" feature above. When viewing the certificate, the extensions are displayed in an Extensions section (Configuration > SSL > CA Certificates).
• Import external certificates, for which Symantec does not have the private key, to the appliance and manage external certificate lists (Configuration > SSL > External Certificates).
• Specify a range of SSL/TLS versions to use for all intercepted SSL connections (Configuration > Services > SSL Proxy Settings). See the "SSL/TLS Version Controls for SSL Forward Proxy" feature above. To support this feature, when configuring the SSL client, device profile, reverse proxy listener service, and HTTPS management service, you must specify a contiguous range of SSL/TLS versions (for example, TLSv1.1,
  v1.2, and v1.3). If you specify only TLSv1.3 and v1.1, for example, you receive an error "SSL versions must be contiguous" and cannot save the configuration.
• Keep the central policy file up to date by automatically downloading a new file when it is updated, and receiving email notifications in the event of a policy file change. You can view and update policy files on the appliance and view the policy source (Configuration > Policy > Policy Options).
• Enable SNMP functionality on the appliance and configure SNMPv1, SNMPv2c, or SNMPv3 to monitor network devices for health or status conditions (Administration > SNMP > SNMP).
• View and edit settings for system, licensing, status, and subscription metrics (Administration > Health Checks and Monitoring > Health Monitoring). 
• Configure global event logging settings such as maximum event log file size, SMTP server, and Syslog loghosts. You can also select different event logging levels for Syslog and email and specify overrides as described in the "Separate Event Logging Configuration for Email and Syslog" feature above (Administration > Logging > Event Logging). 
• Perform routine and troubleshooting tasks such as restart, shutdown, clearing caches, and resetting the system (Administration > General > Tasks).

• The list of system images now shows the index number for each system.
• The Signed column has been removed from the list (all system images are signed).

• ProxySG Admin Console

Deploy ProxySG Virtual Appliance on VMWare Tools

• ZTP Deployment

Microsoft Outlook Email Protocol (MAPI) Improvements

• REQMOD and RESPMOD statistics are now reported separately under MAPI over HTTP proxy statistics (available at advanced URL /mapihttp/statistics).
• Email attachment upload in Outlook 2021 is significantly improved. Previously, sometimes uploaded email attachments were truncated, jumbled, or both. Email attachment upload is now fully supported in Outlook 2021.
• Email attachment upload performance is improved.

Specify an Interface for Reflect Client IP

When initiating upstream connections, use the specified interface for the outbound source IP address.

reflect_ip(interface.<label>)

More information:

• Content Policy Language Reference

Removed Hardware Registration Commands

The following CLI commands have been removed:

#licensing register-hardware
#licensing mark-registered

These commands are no longer required for licensing an appliance.

If you have any questions or require assistance, please contact Broadcom Customer Care online at https://www.broadcom.com/support/software/contact where you can submit an online request using the Customer Care web form: https://ca-broadcom.wolkenservicedesk.com/web-form?_ga=2.205828371.1432263889.1590607313-713014253.1588711301.  You can also call Broadcom Customer Care at +1-800-225-5224 in North America or see https://www.broadcom.com/support/software/contact for the local number in your country. 

Should you need any assistance, our Broadcom Services experts can help.  For more information on Broadcom Services and how you can leverage our experience, please visit https://www.broadcom.com/support/ca/services-support/ca-services.

Your success is very important to us, and we look forward to continuing our successful partnership with you.

To review Broadcom Support lifecycle policies, please review the Broadcom Support Policy and Terms located at: https://support.broadcom.com/.  

Thank you again for your business.