The Web Gateway has two release branches, Main and Controlled. In this article, you should get a basic understanding about each release branch, the best practices for upgrading, and how to upgrade to the Web Gateway version you want to use.
Both main and controlled release branches are fully QA tested and supported. Here are some things to expect from each branch.
At the end of the one year period, the current controlled release version becomes the main release. For more detailed information and FAQ, please go to the following KB: McAfee KnowledgeBase - Explanation of main and controlled releases in Web Gateway
Below is a visualization of the release process:
McAfee Support recommends that you stay on the Main Release Branch instead of going to the Controlled Branch unless you have a specific purpose (for example you need a new feature urgently). Most customer environments are better off with the main release branch and maintenance releases only.
Once you go to the Controlled Release, you cannot move back without a complete reimage and recreation of your rules. A backup from the Controlled Release cannot be imported to a Main Release version.
Please follow the best practices when upgrading to a different version.
Please see the release notes on the Content Security Portal or . Each release notes document has an upgrading section at the bottom with release specific instructions.
Often time’s customers need to test specific Web Gateway versions before they can be rolled out into production. If a newer release has happened while you were testing (for example, you were testing 7.5.2.1 and in the meantime 7.5.2.2 was released), you have to take special steps to get to your desired version.
On the command line execute the following commands:
The version number can be switched to any version such as 7.7.2.3
Notes:
Useful commands:
mwg-switch-repo -l
Example output: "Current Configuration: Non-sticky MWG 7.7.2.3 (release)"
mwg-switch-repo main
Note: Upgrading with this repository will always take you to the latest release in the Main Branch. Make sure you know the most current release within the Main repository before upgrading. This will help prevent an upgrade to an unexpected version.
Current main release branch: 7.7.2.x
Current controlled release branch: 7.8
yum is a real time upgrade performed by downloading files directly from McAfee's servers. If your machines do not have access to these servers, you have to perform upgrades by re-imaging to the desired version and restoring a backup.
FIPS mode does not allow you to upgrade. You need to reimage your appliance with the desired version (select FIPS again during install) and restore a backup. Note that FIPS backups cannot be restored on non-FIPS appliances.
Downgrading a Web Gateway appliance is not supported at this time. If you still have a need for it you need to reimage with the older version and restore the backup you took before the upgrade.
There seems to be a little problem if you upgrade from 7.2 to 7.3 and use the local bind daemon as a forwarding only DNS Server.
If so, you have configured 127.0.0.1 as DNS Server.
After the first boot (7.3.0.2) the named daemon is no longer supported. The server does not start
Any DNS query fails and the upgrade process is no longer able to reach the upgrade server. Your server runs in 7.3.0.2 but
you are no longer able to do any other upgrade. (Maybe yum is corrupt)
Conclusion: Be sure to enter a valid internet DNS server before upgrading to 7.3!!!
Frank - thanks for bringing up that topic!
Others,
what Frank refers to is the circumstance that we had allowed a few selected customers to install a local bind even before we had this feature to solve a critical business issues for them. This has not been picked up in the migration code from version to version as it is an edge case. On the other hand we have forgotten to notify these customers - so apologies on behalf of McAfee and please follow Frank's guidance!
thanks,
Michael
My upgrade tip for users: call support first and ask them where the upgrade docs you should pay attention to are currently located. 🙂 A reasonable person looking in the content security portal might not find them, or be pointed here. A person looking in the mysupport portal will have to wade through lots of other things to find the latest release notes, and if you leave it up to the GUI to do your appliance software update, you'll have no idea what version you're gonna get.
So, I'd recommend a support call. 🙂
Things in the upgrade process or repositories also apparently changed earlier this week when 7.3.2.2 got moved into the main release branch.
As an example the release notes for 7.3.0. might say say this ( don't do this--you'll get a package conflict on a 7.2.0.1 box)
yum install yumconf-7.3.0-mwg
yum upgrade yum yumconf\*
yum upgrade
Best Practices above say
yum install yumconf-7.3-mwg
mwg-dist-upgrade <version number>
Now that 7.3.2.2 has gone main branch as of this week, if you do the following on a 7.2.0.1 box
yum upgrade
you'll end up at 7.2.0.9. You'll need some sort of yumconf install to get where you're supposed to be, and it may happen in two steps. I'm not sure at this point.
All this is further complicated by the content security portal currently not having the 7.3.2.2 release notes linked from the software, but you can find them if you dig hard enough at https://mysupport.mcafee.com/Eservice/productdocuments.aspx?strPage=2&pl=0 It's also a bit of a drag that when coming from 7.2.0.1 at least, when you click to update appliance software in teh GUI, you will have no earthly idea what software version you'll end up at. Today at least, the answer is 7.3.2.2.
What is the right way to upgrade from 7.2.0.1 right now? Ask support, say I. Today, anyway, doing it in the GUI seems to be the easiest.
Looking forward to using all of 7.3.2.2's new features though! I managed with a lot of the fine folks at support's help...to get 3 boxes upgraded today, all in entirely different ways. Cheers!
Can we upgrade from Main release version to controlled release version or vice-versa.???
I am using Controlled release version 7.4.1.3.0 ,can I uipgrade to Main release version 7.4.2.4.0
Correct, You will be able to upgrade to the main release version.
Thanks,is the procedure to upgrade is same??
Yes the procedure is going to be the same. If you run into any issues, feel free to contact support.
Very Nice Guide
##################################################
#### Web Gateway 7.5.x / 7.6.x Memory Upgrade Needed ####
##################################################
If you have or if you are planning on upgrading to the 7.5.x release of the Web Gateway, please ensure that you meet the necessary memory requirements for this new build.
This new build of Web Gateway requires more memory due to the addition of a 64-bit Anti-Malware Engine which is available in all 7.5.x / 7.6.x builds going forward.
Web Gateway 7.5.0 Install Guide
On page (27 - 29) we have detailed information for what is needed to upgrade your physical Web Gateway systems but if needed the link detailing the needed memory modules can be found here:
##########################################################################
### The following section details commands for the CLI with SSH for tools like PuTTy, mRemote, SecureCRT, etc. ###
##########################################################################
If you need to know what model of Web Gateway you are running this can be validated with the following command:
If you are not sure what release of Web Gateway you are on, this can be checked with the following:
You can also check your memory available / free / swap with the following command:
If you are running the system with not enough memory or you have 7.5.x installed without the correct memory installed you could get errors like:
Thanks,
Andrew
Another thing you may want to keep in mind when upgrading to a controlled release is whether you use the McAfee SAAS portal in Web Hybrid mode via the MWG. When 7.5.2 was released as a Main release it was several weeks before the SAAS portal supported it. I had to disable my hybrid synch settings on the MWG's so I didn't get errors in my logs all day. That would be a nice thing to see in the release notes of any major or minor upgrade - supported or not supported by SAAS and if not supported a potential date for that support.
Claire
After we upgrade the McAfee web gateway, see a increase in the traffic coming from the port 443.
Did it somehow related to upgrade?
Hello,
you mean you see more SSL traffic from endpoints or SSL traffic from MWG to the internet. Can you please explain in some more detail?
Cheers
yum is a real time upgrade performed by downloading files directly from McAfee's servers. If your machines do not have access to these servers, you have to perform upgrades by re-imaging to the desired version and restoring a backup.
As of 7.7.1 the above statement is no longer correct. 7.7.1 and later support upgrade from ISO file that has been moved onto the appliance. The command is mwg-update -o <file name> Please see the Installation Guide of the currently installed version for details.
Corporate Headquarters
6220 America Center Drive
San Jose, CA 95002 USA