Hardware Guide. McAfee Advanced Threat Defense 4.0.0

Transcription

1 Hardware Guide McAfee Advanced Threat Defense 4.0.0

2 COPYRIGHT 2017 McAfee LLC TRADEMARK ATTRIBUTIONS McAfee and the McAfee logo, McAfee Active Protection, epolicy Orchestrator, McAfee epo, Foundstone, McAfee LiveSafe, McAfee QuickClean, McAfee SECURE, SecureOS, McAfee Shredder, SiteAdvisor, McAfee Stinger, TrustedSource, VirusScan are trademarks of McAfee LLC or its subsidiaries in the US and other countries. Other marks and brands may be claimed as the property of others. LICENSE INFORMATION License Agreement NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND. 2 McAfee Advanced Threat Defense Hardware Guide

3 Contents 1 Introduction 5 The malware threat scenario The Advanced Threat Defense solution Hardware specifications System environmental limits Setting up the Advanced Threat Defense Appliance 13 Unpack the shipment Check your shipment Download the Product Guide Set up the hardware Usage restrictions Rack mount the appliance Turn on the Advanced Threat Defense Appliance Handling the front bezel Enable RMM Connect the management port Configure the Advanced Threat Defense Appliance network information A Appendix 25 Index 27 McAfee Advanced Threat Defense Hardware Guide 3

4 Contents 4 McAfee Advanced Threat Defense Hardware Guide

5 1 Introduction 1 McAfee Advanced Threat Defense (Advanced Threat Defense) is an on-premise appliance that facilitates detection and prevention of malware. Advanced Threat Defense provides protection from known, near-zero day, and zero-day malware without compromising on the quality of service to your network users. Advanced Threat Defense has the added advantage of being an integrated solution. In addition to its own multi-level threat detection capabilities, its ability to seamlessly integrate with other McAfee security products, protects your network against malware and other Advanced Persistent Threats (APTs). Contents The malware threat scenario The Advanced Threat Defense solution Hardware specifications System environmental limits The malware threat scenario Any software capable of being involved in hostile activities with respect to a computer, application, or network can be termed as malware. Advanced Threat Defense is designed for detecting file- and URL-based malware. Earlier, users received malware as attachments in their s. With the upsurge in Internet applications, users only need to click a link to download files. Today, there are many other options to post such files blogs, social networking sites, web sites, chat messages, web mails, message boards, and so on. The key challenges in tackling this issue are to detect malware in the shortest possible time and also contain it from spreading to other computers. There are four major aspects to an anti-malware strategy: Detection of file downloads: When a user attempts to download a file from an external resource, your security product must be able to detect it. Analysis of the file for malware: You must be able to verify if the file contains any known malware. Block future downloads of the same file: Subsequently, if the file is found to be malicious, your anti-malware protection must prevent future downloads of the same file or its variants. Identify and remediate affected hosts: Your security system must be able to identify the host which executed the malware, and also detect the hosts to which it has spread. Then, it must provide an option to quarantine the affected hosts until they are clean again. McAfee Advanced Threat Defense Hardware Guide 5

6 1 Introduction The Advanced Threat Defense solution The Advanced Threat Defense solution A security solution that relies on a single method or process might not be adequate to provide complete and reliable protection from malware attacks. You might need a multi-layered solution that involves various techniques and products. The solution can include pattern matching, global reputation, program emulation, static analysis, and dynamic analysis. All these layers must be seamlessly integrated and provide you with a single point of control for easy configuration and management. For example, pattern matching might not detect zero-day attacks. Similarly, static analysis takes less time than dynamic analysis. However, malware can avoid static analysis by code obfuscation. Malware can escape dynamic analysis too by delaying execution or take an alternate execution path if the malware detects that it is being run in a sandbox environment. This is why a reliable protection from malware requires a multi-level approach. There are other industry-leading McAfee anti-malware products for the web, network, and endpoints. However, McAfee recognizes that a robust anti-malware solution requires a multi-layered approach, the result of which is Advanced Threat Defense. Advanced Threat Defense integrates with other McAfee products to provide you a multilayered defense mechanism against malware. To quickly detect malware, Advanced Threat Defense includes a local blacklist. Integrates with McAfee Global Threat Intelligence (McAfee GTI) for cloud-lookups to detect malware that has already been identified by organizations throughout the globe. Includes the McAfee Gateway Anti-Malware Engine for emulation capabilities. 6 McAfee Advanced Threat Defense Hardware Guide

7 Introduction The Advanced Threat Defense solution 1 Includes the McAfee Anti-Malware Engine for signature-based detection. Dynamically analyzes the file by executing it in a virtual sandbox environment. Based on how the file behaves, Advanced Threat Defense determines its malicious nature. Figure 1-1 Components for malware analysis Here are some of the advantages that Advanced Threat Defense provides: McAfee Advanced Threat Defense Hardware Guide 7

8 1 Introduction Hardware specifications Advanced Threat Defense does not sniff or tap into your network traffic. It analyzes the files submitted to it for malware. This means that you can place the McAfee Advanced Threat Defense Appliance anywhere in your network as long as it is reachable to all the integrated McAfee products. It is also possible for one Advanced Threat Defense Appliance to cater to all such integrated products (assuming the number of files submitted is within the supported level). This design can make it a cost-effective and scalable anti-malware solution. For malware analysis, Advanced Threat Defense can receive files from these inline devices: IPS Sensors McAfee Web Gateway McAfee Gateway Android is currently one of the top targets for malware developers. With this integration, the Android-based handheld devices on your network are also protected. You can dynamically analyze the files downloaded by your Android devices such as smartphones and tablets. Files are concurrently analyzed by various engines. So, it is possible for known malware to be blocked in almost real time. When Advanced Threat Defense dynamically analyzes a file, it selects the analyzer virtual machine that uses the same operating system and applications as that of the target host. The dynamic analysis can be facilitated through its integration with McAfee epolicy Orchestrator (McAfee epo ) or through passive device profiling feature of McAfee Network Security Platform. Advanced Threat Defense runs the file only in the virtual environment. The dynamic analysis results help you to identify the exact impact on a targeted host if the file is run. You can also configure your environment to take the required remedial measures. When hosts download zero-day malware, the Sensor submits the file to Advanced Threat Defense. After dynamic analysis, Advanced Threat Defense determines if the file is malicious. Based on the Advanced Malware policy, the Manager adds the malware to the Sensor blacklist. If the file is also on the Advanced Threat Defense blacklist, the file's ability to re-enter your network is greatly reduced. Even the first time when a zero-day malware is downloaded, you can contain it by quarantining the affected hosts until they are cleaned and remediated. Packing can change the composition of the code or enable a malware to evade reverse engineering. So, proper unpacking is very critical to get the actual malware code for analysis. Advanced Threat Defense is capable of unpacking the code such that the original code is secured for static analysis. Hardware specifications Before you set up the Advanced Threat Defense Appliance, review the hardware specifications. Specification ATD-3100 ATD-6100 ATD-3000 ATD-6000 Packaging Dimension Chassis Chassis Dimension Length = 38", Width = 24", Height = 7" Intel R1208WTTGSR (Wildcat Pass) Length = 28", Width = 17.3", Height = 1.7" Length = 38", Width = 24", Height = 7" Intel R1208WTTGSR (Wildcat Pass) Length = 28", Width = 17.3", Height = 1.7" Length = 38", Width = 24", Height = 7" R1304GZ4GC Length = 29", Width = 17.25", Height = 1.7" Length = 36", Width = 24", Height = 7" R2304LH2HKC Length = 29", Width = 17.25", Height = 3.43" Weight 22.7 Kg (50 lbs) 22.7 Kg (50 lbs) 15 Kg (33 lbs) 22.7 Kg (50 lbs.) Form Factor 1U rack mountable; fits 19-inch rack 1U rack mountable; fits 19-inch rack 1U rack mountable; fits 19-inch rack 2U rack mountable; fits 19-inch rack Motherboard S2600WTT S2600WTT S2600GZ4 S4600LH2 8 McAfee Advanced Threat Defense Hardware Guide

9 Introduction System environmental limits 1 Specification ATD-3100 ATD-6100 ATD-3000 ATD-6000 CPU Storage Memory Remote Management 2 x E5-2609v4, 1.7GHz, 20M cache, 8 Cores Disk space HDD: 4 x 1.2TB, SAS, 12GB/s, 10K RPM, 2.5", Raid-5 SSD: 2 x Intel Enterprise grade 400GB, 2.5", Raid-0 16 x 16 GB DDR4 2400MHz ECC 2 x E5-2695v4, 2.1GHz, 45M cache, 18 Cores Disk space HDD: 6 x 1.2TB, SAS, 12GB/s, 10K RPM, 2.5", Raid-5 SSD: 2 x Intel Enterprise grade 800 GB, 2.5", Raid-0 16 x 32 GB DDR4 2400MHz ECC 2 x E5-2658, 2.10GHz, 20M Cache, 8 Cores Disk space HDD: 2 x 4TB SSD: 2 x 400 GB 192 GB 256 GB RMM4LITE2 RMM4LITE2 RMM4R RMM4 Power Supply 750 W redundant 750 W redundant 2x 750W, AC redundant, hot swappable Network Interfaces Dual Integrated 10 GB and Dual 10 GB Module Dual Integrated 10 GB and Dual 10 GB Module Dual Integrated 10 GB and Dual 10 GB Module 4 x E5-4640, 2.40GHz, 20M Cache, 8 Cores Disk space HDD: 4 x 4TB SSD: 2 x 800 GB 2x 1600W, AC redundant, hot swappable Dual Integrated 10 GB and Dual 10 GB Module System environmental limits These are the system environmental limits for the Advanced Threat Defense Appliance. Parameter State or category ATD-3100 and ATD 6100 Temperature Operating ASHRAE Class A2 Continuous Operation, 10º C to 35º C (50º F to 95º F) with the maximum rate of change not to exceed 10 C per hour ASHRAE Class A3 Includes operation up to 40º C for up to 900 hours per year ASHRAE Class A4 Includes operation up to 45º C for up to 90 hours per year ATD C to +35 C (+50 F to + 95 F) with the maximum rate of change not to exceed 10 C per hour ATD º C to +35º C (+50ºF to +95ºF) with the maximum rate of change not to exceed 10 C per hour Shipping -40º C to 70º C (-40º F to 158º F) -40 C to +70 C (-40 F to +158 F) -40 C to +70 C (-40 F to +158 F) McAfee Advanced Threat Defense Hardware Guide 9

10 1 Introduction System environmental limits Parameter State or category ATD-3100 and ATD 6100 Altitude Operating Support operation up to 3050 meters (10,000 feet) with ASHRAE class deratings Humidity Shipping 50% to 90%, non-condensing with a maximum wet bulb of 28 C (at temperatures from 25 C to 35 C) Shock Operating Half sine, 2 g peak, 11 milliseconds Unpackaged Trapezoidal, 25 g, velocity change is based on packaged weight Packaged International Safe Transit Association (ISTA) Test Procedure 3A 2008 ATD-3000 Support operation up to 3050 meters (10,000 feet) Operational 10% to 90% Non-operational 90% at 35 C Half sine, 2 g peak, 11 milliseconds Trapezoidal, 25 g, velocity change 136 inches/second ( 40 lbs to < 80 lbs) Non-palletized free fall in height 24 inches ( 40 lbs to < 80 lbs) ATD-6000 Support operation up to 3050 meters (10,000 feet) Operational 10% to 90% Non-operational 50% to 90% with a maximum wet bulb of 28 C (at temperatures from 25 C to 35 C) Half sine, 2 g peak, 11 milliseconds Trapezoidal, 25 g, velocity change is based on packaged weight Product Weight: 40 to < 80 Non-palletized Free Fall Height = 18 inches Palletized (single product) Free Fall Height = NA Vibration Unpackaged 5 Hz to 500 Hz, 2.20 g RMS random Packaged AC-DC Voltage ATD-3100 International Safe Transit Association (ISTA) Test Procedure 3A V Amps 220V Amps ATD V -6.7 Amps 220V -3.4 Amps 5 Hz to 500 Hz, 2.20 g RMS random 5 Hz to 500 Hz, 2.20 g RMS random 5 Hz to 500 Hz, 1.09 g RMS random V at 5.8 Amps V. 8.5 Amps Frequency 47 Hz to 63 Hz Hz Hz Source Interrupt Surge (Operating and non-operating) No Loss of data for power line drop-out of 12 milliseconds Unidirectional 10 McAfee Advanced Threat Defense Hardware Guide

11 Introduction System environmental limits 1 Parameter State or category ATD-3100 and ATD 6100 ATD-3000 ATD-6000 Line to earth Only AC Leads 2.0 kv I/O Leads 1.0 kv DC Leads 0.5 kv ESD Air Discharged 12.0 kv +/-12 KV except I/O port +/- 8 KV per Intel Acoustic noise Certifications Contact Discharge Power level <300 W Power level >300 W Power level >600 W Power level >1000 W Safety certification EMI certification Environmental test specification 12.0 kv 8.0 kv 8.0 kv 7.0 BA Sound power: 7.0 BA in operating conditions at typical office ambient temperature (23 +/- 2 degrees C) UL 1950, CSA-C22.2 No. 950, EN-60950, IEC 950, EN 60825, 21CFR1040 CB license and report covering all national country deviations FCC Part 15, Class A (CFR 47) (USA) ICES-003 Class A (Canada), EN55022 Class A (Europe), CISPR22 Class A (Int'l) Sound power: 7.0 BA in operating conditions at typical office ambient temperature (23 +/- 2 degrees C) UL 1950, CSA-C22.2 No. 950, EN-60950, IEC 950, EN 60825, 21CFR1040 CB license and report covering all national country deviations FCC Part 15, Class A (CFR 47) (USA) ICES-003 Class A (Canada), EN55022 Class A (Europe), CISPR22 Class A (Int'l) McAfee Advanced Threat Defense Hardware Guide 11

12 1 Introduction System environmental limits 12 McAfee Advanced Threat Defense Hardware Guide

13 2 Setting 2 up the Advanced Threat Defense Appliance Prepare the Advanced Threat Defense Appliance for installation and integration in the network. Contents Unpack the shipment Check your shipment Download the Product Guide Set up the hardware Unpack the shipment Unpack the Advanced Threat Defense Appliance from the crate. Task 1 Open the crate and remove the first accessory box. 2 Remove the Advanced Threat Defense Appliance and place it as close to the installation site as possible. 3 Make sure that the text is upright, then open the top flaps and remove the accessory box. 4 Remove the slide rail kit. 5 Pull out the packing material, then remove the Advanced Threat Defense Appliance from the anti-static bag. 6 In case you need to move or ship the Advanced Threat Defense Appliance, save the box and packing materials. Check your shipment Each product ships with all the items needed to install the appliance on a network. To verify that you received all the necessary items, verify that you have received the following: Advanced Threat Defense Appliance Accessories itemized on the Content Sheet Set of tool-less slide rails Front bezel with key McAfee Advanced Threat Defense Hardware Guide 13

14 2 Setting up the Advanced Threat Defense Appliance Check your shipment McAfee Advanced Threat Defense Appliance front and back panels Figure 2-1 ATD-3000 and ATD-6000 front panel Label Description 1 System ID button with integrated indicator light 2 NMI button (recessed, tool required for use) 3 NIC 1 activity indicator light 4 ATD-3000: NIC 3 activity indicator light ATD-6000: Not used 5 System cold reset button 6 System status indicator light 7 Power button with integrated indicator light 8 Hard drive activity indicator light 9 ATD-3000: NIC 4 activity indicator light ATD-6000: Not used 10 NIC 2 activity indicator light Figure 2-2 ATD-3000 Appliance back panel Label Description 1 Power supply module 1 2 Power supply module 2 3 Management port (NIC 1). This is the eth-0 interface. The set appliance and set mgmtport commands apply to this interface. For example, when you use the set appliance ip command, the corresponding IP address is assigned to this interface. 14 McAfee Advanced Threat Defense Hardware Guide

15 Setting up the Advanced Threat Defense Appliance Check your shipment 2 Label Description 4 NIC 2. This is the eth-1 interface. This interface is disabled by default. To enable or disable this interface, use the set intfport command. For example, set intfport 1 enable To assign the IP details to this interface use set intfport <eth 1, 2, or 3> ip <IPv4 address> <subnet mask> For example, set intfport 1 ip You cannot assign the default gateway to this port. However, you can configure a route on this interface to route the traffic to the desired gateway. To configure a route, use route add network <IPv4 subnet> netmask <netmask> gateway <IPv4 address> intfport 1 For example, route add network netmask gateway intfport 1. This command routes all traffic from the command to through NIC 2 (eth-1). 5 NIC 3. This is the eth-2 interface. The note described for NIC 2 applies to this interface as well. 6 NIC 4. This is the eth-3 interface. The note described for NIC 2 applies to this interface as well. 7 Video connector 8 RJ45 serial-a port 9 USB ports 10 RMM4 NIC port 11 I/O module ports/connectors (not used) 12 Add-in adapter slots from riser card 1 and riser card 2 Figure 2-3 ATD-6000 Appliance back panel Label Description 1 USB ports 2 USB ports 3 Management port. This is the eth-0 interface. The set appliance and set mgmtport commands apply to this interface. For example, when you use the set appliance ip command, the corresponding IP address is assigned to this interface. McAfee Advanced Threat Defense Hardware Guide 15

16 2 Setting up the Advanced Threat Defense Appliance Check your shipment Label Description 4 Additional I/O module ports/connectors. These are the eth-1, eth-2, and eth-3 interfaces respectively. These interfaces are disabled by default. To enable or disable an interface, use the set intfport command. For example, set intfport 1 enable to enable eth-1. To assign the IP details to an interface use set intfport <eth 1, 2, or 3> ip <IPv4 address> <subnet mask> For example, set intfport 1 ip You cannot assign the default gateway to this port. However, you can configure a route on this interface to route the traffic to the desired gateway. To configure a route, use route add network <IPv4 subnet> netmask <netmask> gateway <IPv4 address> intfport 1 For example, route add network netmask gateway intfport 1. This command routes all traffic from the command to through eth-1. 5 Video connector 6 NIC 1 (currently not used) 7 NIC 2 (currently not used) 8 RJ45 serial-a port 9 I/O module ports/connectors (not used) 10 Add-in adapter slots from riser card 11 RMM4 NIC port 12 Power supply module 2 13 Power supply module 1 14 Add-in adapter slots from riser card Figure 2-4 ATD-3100 and ATD-6100 front panel Table 2-1 The following table will be updated as soon as the front panel image arrives. Label A B C Description System ID button with integrated indicator light NMI button (recessed, tool required for use) NIC 1 activity indicator light 16 McAfee Advanced Threat Defense Hardware Guide

17 Setting up the Advanced Threat Defense Appliance Download the Product Guide 2 Table 2-1 The following table will be updated as soon as the front panel image arrives. (continued) Label D E F G H Description System status indicator light Power button with integrated indicator light Hard drive activity indicator light System cold reset button NIC 2 activity indicator light Figure 2-5 ATD-3100 and ATD-6100 Appliance back panel Label Interface port A Power connector A B Power connector B C Ethernet interface 3 D Ethernet interface 4 E VGA connector F Serial console interface G USB 3.0 ports H BMC port (RMM) I Ethernet interface 1 (ATD Management Interface) J Ethernet interface 2 If an item is missing or damaged, contact your supplier. Download the Product Guide To download the McAfee Advanced Threat Defense Product Guide, go to the Intel Security site. Task 1 Go to the Intel Security ServicePortal. 2 Click Knowledge Center. 3 In the Product field, enter Advanced Threat Defense. 4 From the Version drop-down list, select the version, then click Search. 5 Download the McAfee Advanced Threat Defense Product Guide. McAfee Advanced Threat Defense Hardware Guide 17

18 2 Setting up the Advanced Threat Defense Appliance Set up the hardware Set up the hardware Install and integrate the hardware in your network. Contents Usage restrictions Rack mount the appliance Turn on the Advanced Threat Defense Appliance Handling the front bezel Enable RMM Connect the management port Configure the Advanced Threat Defense Appliance network information Usage restrictions The following restrictions apply to the use and operation of Advanced Threat Defense Appliance: You should not remove the outer shell of the Advanced Threat Defense Appliance. Doing so invalidates your warranty. The Advanced Threat Defense Appliance is not a general purpose server. McAfee prohibits the use of Advanced Threat Defense Appliance for anything other than operating the Advanced Threat Defense solution. McAfee prohibits the modification or installation of any hardware or software on the Advanced Threat Defense Appliance that is not part of the normal operation of Advanced Threat Defense. Rack mount the appliance To install the Advanced Threat Defense Appliance on the four-post 19-inch rack, use the rack-mounting kit. You can use the kit with most industry-standard rack cabinets. Task 1 For each mounting rail, use the following steps. a At the front of the rack, position the right or left mounting rail on the corresponding side so that the mounting bracket aligns with the rack holes. Always load the rack from the bottom up. If you are installing multiple appliances, start with the lowest available position. Figure 2-6 Slide rail installation 18 McAfee Advanced Threat Defense Hardware Guide

19 Setting up the Advanced Threat Defense Appliance Set up the hardware 2 b At the back of the rack, pull the back mounting-bracket (extending the mounting rail) so that it aligns with the rack holes. On each side of the rack, ensure that the mounting rails are the same level. Figure 2-7 Install rail to rack c Clip the rail to the rack and secure it with the tie wraps. 2 Slide both rails so they are fully extended. Figure 2-8 Full extend slide 3 With help from another person, lift the Advanced Threat Defense Appliance and install the chassis to the rail on both the sides. Drop in the rear spool first, then the middle, then the front. Figure 2-9 Install the Appliance to rail At least two people are required to lift and attach the Advanced Threat Defense Appliance to the rack. If required, attach the lockable bezel to protect the front panel. McAfee Advanced Threat Defense Hardware Guide 19

20 2 Setting up the Advanced Threat Defense Appliance Set up the hardware 4 Lift the release tab and push the Advanced Threat Defense Appliance into the rack. Figure 2-10 Lift release tab and push Appliance into rack To remove the Advanced Threat Defense Appliance from the rack, lift the release tab next to the chassis front spool, then lift it out of the rails. Turn on the Advanced Threat Defense Appliance The Advanced Threat Defense Appliance has redundant power supplies pre-installed. The Advanced Threat Defense Appliance ships with two AC power cords specific to your country or region. Task 1 Plug one end of the AC power cord into the first power supply module in the back panel, then plug the other end into the power source. 2 Plug one end of the other AC power cord into the second power supply module in the back panel, then plug the other end into the power source. Advanced Threat Defense powers up without pressing the on/off button on the front panel. To turn off the Advanced Threat Defense Appliance AC power, you must unplug both AC power cords from the back panel or power source. The on/off button on the front panel does not turn on/off the AC power. To restart the Advanced Threat Defense Appliance, you must press the on/off power switch on the front panel while the appliance is turned on. To turn off the Advanced Threat Defense Appliance, use the shutdown CLI command, then press the on/off power switch. 20 McAfee Advanced Threat Defense Hardware Guide

21 Setting up the Advanced Threat Defense Appliance Set up the hardware 2 Handling the front bezel You can remove the front bezel if required, and then re-install it. However, before you install the bezel, you must install the rack handles. Task 1 Remove the front bezel. a Unlock the bezel if it is locked. b c Remove the left end of front bezel from rack handle. Rotate the front bezel anticlockwise to release the latches on the right end from the rack handle. 2 Install the front bezel. a Lock the right end of the front bezel to the rack handle b c Rotate the front bezel clockwise until the left end clicks into place Lock the bezel if needed. Enable RMM Enable Intel RMM on your Advanced Threat Defense Appliance. Task 1 Restart the Advanced Threat Defense Appliance. 2 During the reboot process, press F2. 3 On the BIOS Setup Utility page, select the Server Management tab. 4 Select BMC LAN Configuration. McAfee Advanced Threat Defense Hardware Guide 21

22 2 Setting up the Advanced Threat Defense Appliance Set up the hardware 5 Locate Intel (R) RMM4 LAN configuration and configure the settings. a Highlight IP Source, press Enter, then select Static. b c d Highlight IP Address, then enter the IP address. Highlight Subnet Mask, then enter the subnet mask address. Highlight Gateway IP, then enter the gateway IP address. 6 Locate User configuration and configure the settings. a Highlight User status, press Enter, then select Enabled. b c Highlight User password, press Enter, then enter the root account password. Press Enter, confirm the password, then press Enter again. 7 Press F10, then press Enter. 8 Log on to the RMM interface. Connect the management port When you connect your network device to the Advanced Threat Defense Appliance, you can configure the appliance IP address and other parameters for integration in your network. Task 1 On the back panel, plug the Category 5e or 6 Ethernet cable in the management port. 2 Plug the other end of the cable into the network device. Configure the Advanced Threat Defense Appliance network information Manage the Advanced Threat Defense Appliance from a remote computer or terminal server. Task 1 On the Advanced Threat Defense Appliance back panel, plug the console cable (RJ45 to DB9 serial) into the console port (RJ45 serial-a port). 2 Locate the computer or port of the terminal server you are using to configure the Advanced Threat Defense Appliance, then connect the other end of the cable into the COM port. 3 From your Microsoft Windows-based computer, run the HyperTerminal using the following settings. Band rate Number of Bits 8 Parity None Stop Bits 1 Control Flow None 4 To log on to the Advanced Threat Defense Appliance, use the following credentials. User name cliadmin Password atdadmin To access all the built-in command syntax instructions, enter help or?. For a list of all commands, enter list. 22 McAfee Advanced Threat Defense Hardware Guide

23 Setting up the Advanced Threat Defense Appliance Set up the hardware 2 5 Open the command prompt and configure the Advanced Threat Defense Appliance. a Enter the Advanced Threat Defense Appliance name. For example, set appliance name matd_appliance_1. Best Practice: Use an alphanumeric character string up to 25 characters. The string must begin with a letter and can include hyphens, underscores, and periods, but not spaces. b Enter the Advanced Threat Defense Appliance management port IP address and subnet mask. For example, set appliance ip Do not assign the following class C network IP addresses: / /24 c d e Restart the Advanced Threat Defense Appliance. Enter the default gateway IP address. For example, set appliance gateway Enter the management port speed and duplex settings using one of the following commands: set mgmtport auto Sets the management port in auto mode for speed and duplex. set mgmtport speed (10 100) duplex (full half) Sets the speed to 10 or 100 Mbps at full or half duplex. f To change the Advanced Threat Defense Appliance password, enter passwd. Passwords are case sensitive, must not include spaces, and must contain the following: Between 8 and 25 characters At least one uppercase letter At least one lowercase letter At least one digit At least one alphanumeric character or symbol Best Practice: Enter a password with a combination of characters that is easy for you to remember, but difficult for someone else to guess. g Verify the configuration. To view the configuration details, enter show. To check the network connectivity, enter ping <IP address>. The success message host <ip address> is alive appears. If the host is not reachable, failed to talk to <ip address> appears. McAfee Advanced Threat Defense Hardware Guide 23

24 2 Setting up the Advanced Threat Defense Appliance Set up the hardware 24 McAfee Advanced Threat Defense Hardware Guide

25 A Appendix These additional information can be used to learn more about your appliance. Grantley Platform The McAfee Advance Threat Defense appliances are built on the Grantley platform. Equipped with the CPUs from the Xenon E v3 and Xenon E v4 product families, DDR4 memory, and 10 GB Ethernet modules, your appliances are fast and efficient. For more information about the Grantley platform, visit: Boradwell-EP The CPUs from the Xenon E v3 and Xenon E v4 product families on the McAfee Advance Threat Defense appliances are manufactured in Intel's 14 Nm process technology. The ATD-3100 with two Xenon E5-2609v4 CPUs have eight cores and threads with 20 MB of Intel's Smart Cache. The ATD-6100 with two Xenon E5-2695v4 has 18 cores and 36 threads with 45 MB of Intel's Smart Cache. The ATD-3000 and ATD-6000 with two E and four E respectively has eight cores and 16 threads with 20 MB of Intel's Smart Cache. For more information about the Broadwell-EP, visit ark.intel.com. Chassis The ATD-3100 and ATD-6100 appliances are built on Intel's Wildcat Pass 1U rack system. The ATD-3000 is built on Intel's Grizzly Pass 1U and ATD-6000 is built on Intel's Lizard Head Pass 2U rack system. For more information about Wildcat Pass, Grizzly Pass, and Lizard Head Pass, visit ark.intel.com. Storage The McAfee Advance Threat Defense appliances use both HDDs and SSDs for storage. The HDDs are set in 3+1 RAID 5 configuration and the SSDs are set in 1+1 RAID 0 configuration. Remote management module (RMM) The ATD-3100 and ATD-6100 appliances are equipped with Intel's RMM4LITE2 modules. The ATD-3000 and ATD-6000 are equipped with Intel's RMM4R and RMM4 modules. The RMM4 modules have the following features which allow administrators to: Redirect KVM from RMM4 NIC or the baseboard NIC used for management traffic. Redirect media, that is, to mount a CD-ROM, Floppy disk, or a USB storage device to a server. Remotely troubleshoot system through all system level event logs, sensors reading, power statistics, and debug messages that are readily available in RMM UI console. For more information about Intel's RMM, visit: McAfee Advanced Threat Defense Hardware Guide 25

26 A Appendix 26 McAfee Advanced Threat Defense Hardware Guide

27 Index A Advanced Threat Defense Appliance setting up 13, 18 M McAfee Advanced Threat Defense solution description 6 H hardware specifications 8 O overview 5 McAfee Advanced Threat Defense Hardware Guide 27

28 0-00