McAfee Network Security Platform

Transcription

1 NS7x00 Quick Strt Guide Revision D McAfee Network Security Pltform This quick strt guide explins how to quickly set up nd ctivte your McAfee Network Security Pltform NS7100, NS7200, nd NS7300 Sensors in in-line mode. These models hve throughput of 1.5 Gps, 3 Gps, nd 5 Gps respectively. All product documenttion referenced in this quick strt guide is found on the McAfee ServicePortl. The NS7100/NS7200/NS7300 Sensor model Figure 1 Sensor front pnel 1 Console port (1) 2 RJ-11 port (1) for fil-open control of two uilt-in SFP+ ports in slot G0. The RJ-11 port supports 1 Gps (SFP) copper or fier nd 10 Gps (SFP+) (SR nd LR). 3 SFP+ 1/10 Gigit Ethernet ports (2) The RJ-11 port controls only the SFP+ 1/10 port pir in pssive fil-open mode. 4 Two slots for I/O modules (Any comintion of the interfce modules cn e used.) SFP/SFP+ 1/10 GigE Monitoring ports (8) RJ-45 10/100/1000 Mps with internl fil-open Ethernet Monitoring ports (6) 10/1 GigE SM 8.5 micron with internl fil-open Monitoring ports (4) 10/1 GigE MM 50 micron with internl fil-open Monitoring ports (4) 10/1 GigE MM 62.5 micron with internl fil-open Monitoring ports (4) 5 RJ-45 10/100/1000 Mps Ethernet Monitoring ports (8) 1

2 The supported trnsceiver modules re SFP+ (M2M nd SM), SFP Fier (MM nd SM) nd SFP Copper. Figure 2 Sensor rer pnel 1 Auxiliry port (1) 2 USB ports (2) 3 Power supply inlet (2) The NS7x00 Sensors re shipped with one power supply unit. Second power supply (optionl) is supported to enle redundncy. 4 RJ-45 10/100/1000 Response port (R1) (1) 5 RJ-45 10/100/1000 Mngement port (Mgmt) (1) 1 Verify the contents in the ox The following ccessories re shipped in the NS7x00 Sensor crte: Sensor Power cords (McAfee provides stndrd nd interntionl power cles.) Set of rck mounting rils Printed Quick Strt Guide 2 Verify the hrdwre nd softwre requirements Mke sure to meet the following hrdwre requirements. For more informtion, see the McAfee Network Security Pltform Instlltion Guide. The following re the system requirements for Mnger server. 2

3 Operting system Minimum required Any of the following Microsoft operting systems: Windows Server 2008 R2 Stndrd or Enterprise Edition, SP1 (Full Instlltion), English operting system Windows Server 2008 R2 Stndrd or Enterprise Edition, SP1 (Full Instlltion), Jpnese operting system Windows Server 2012 Stndrd Edition (Server with GUI) English operting system Windows Server 2012 Stndrd Edition (Server with GUI) Jpnese operting system Windows Server 2012 R2 Stndrd Edition (Server with GUI) English operting system Windows Server 2012 R2 Stndrd Edition (Server with GUI) Jpnese operting system Windows Server 2012 R2 Dtcenter Edition (Server with GUI) English operting system Windows Server 2012 R2 Dtcenter Edition (Server with GUI) Jpnese operting system Only X64 rchitecture is supported. Recommended Sme s the minimum required. Memory 8 GB 8 GB or more CPU Server model processor such s Intel Xeon Sme Disk spce 100 GB 300 GB or more Network 100 Mps crd 1000 Mps crd Monitor 32-it color, 1440 x 900 disply setting 1440 x 900 (or higher) The following re the system requirements for client systems connecting to the Mnger ppliction. Operting system Minimum Windows 7 English or Jpnese Windows 8 English or Jpnese Windows 8.1 English or Jpnese The disply lnguge of the Mnger client must e sme s tht of the Mnger server operting system. Recommended RAM 2 GB 4 GB 3

4 Minimum Recommended CPU 1.5 GHz processor 1.5 GHz or fster Browser Microsoft Internet Explorer 9, 10, or 11 Mozill Firefox Google Chrome (App mode in Windows 8 is not supported.) If you re using Google Chrome, dd the Mnger certificte to the trusted certificte list. Internet Explorer 11 Mozill Firefox 20.0 or lter Google Chrome 24.0 or lter Instll the following softwre: Sensor imge Mnger imge Signture set 3 Instll the slide rils nd rck-mount the Sensor McAfee recommends rck-mounting your Sensor. For mintennce purposes, you must hve ccess to the front nd rer of the Sensor. Before you mount the Sensor on the rck, mke sure tht the power is off. Remove the power cle nd ll network interfce cles from the Sensor. Due to the weight of the pplince, McAfee recommends tht two people plce the chssis into the ril cinet. Disssemle the inner slide ril memers from the cinet sections. Pull the inner memer out until it comes to lock position. Depress the QD ltch to fully disconnect the inner memers. 4

5 Mount the inner memers to the chssis unit. Plce ech inner memer on oth sides of the chssis unit. Position the ottom mounting holes of the inner memer with mtching mounting holes on chssis unit. Use screws to secure inner memers in plce. Apply to oth sides of chssis unit. c Mount the slide cinet sections to the rck. Instll the front end of ech slide cinet section to the rck using the slide tool-less fetures. The tool-less ltch rottes when the rcket is pressed up ginst the rck rils. Align, djust, nd ttch the rer rckets to the rck ril. 5

6 d Mount the chssis unit into the mounted cinet sections. Guide the chssis unit into the pre-instlled cinet sections. Allow the pre-instlled inner memers to slide into the outer memers until they lock in plce. Depress the QD ltch on oth sides nd continue to push the chssis unit in until fully closed. e Secure the chssis unit through the rck rils. With the chssis unit in fully closed position, secure using two truss hed screws. Drive the screws through the inner memer flnge nd through the rck rils. The screws thred directly to the cinet slide memers. Tighten the screws. 4 Instll the interfce modules You cn purchse the following interfce modules nd insert them into the relevnt slots on your NS7x00 Sensor. 8-port SFP/SFP+ 1/10 Gigit interfce module 6-port RJ-45 10/100/1000 Mps with internl fil-open interfce module 4-port 10/1 GigE SM 8.5 micron with internl fil-open interfce module 6

7 5 4-port 10/1 GigE MM 50 micron with internl fil-open interfce module 4-port 10/1 GigE MM 62.5 micron with internl fil-open interfce module Remove the module from its protective pckging. Hold the module using your thum nd forefinger nd insert it into the modulr y. c Drive in the screws fixed on the sides of the module to ttch it to the Sensor. Connect the Mngement nd Console ports On the rer pnel of the NS7x00 Sensors, plug Ctegory 5e Ethernet cle in the Mngement port (leled Mgmt). Plug the other end of the cle into the network device connected to your Mnger server. 7

8 c On the front pnel of the NS7x00 Sensors, plug the DB9 Console cles into the Console port (leled Console). d Connect the other end of the Console port cle directly to COM port of the PC or terminl server you re using to configure the Sensor (for exmple, PC running correctly configured Windows Hyperterminl softwre). You must directly connect to the console for initil configurtion, you cnnot configure the Sensor remotely. Terminl servers re provided for console ccess. The required settings for Hyperterminl re: Bud rte: Stop Bits: 1 Numer of Bits: 8 Control Flow: None Prity: None e Plug one end of the power cle into the power inlet nd plug the other end into power source. The Sensor ships with stndrd US power nd interntionl cles. The NS-series Sensor does not hve power switch. You cn directly plug the power cle into power source. 8

9 6 Connect the monitoring ports This procedure descries how to connect cles to Sensor tht runs in in-line mode. Plug the cle pproprite for use with your trnsceiver module into one of the monitoring ports leled x (for exmple, 1). c Plug the cle pproprite for use with your trnsceiver module into one of the monitoring ports leled y (for exmple, 2). Connect the other end of ech cle to the network devices tht you wnt to monitor. For exmple, if you pln to monitor trffic etween switch nd router, connect the cle connected to 1 to the router nd the one connected to 2 to the switch. 7 Instll the Mnger softwre For detiled instructions, see the McAfee Network Security Pltform Instlltion Guide. You must hve dministrtor rights on the trget Windows Server to instll the Mnger softwre. A MySQL dtse is included with the Mnger nd is instlled (emedded) utomticlly on your trget Windows Server during this process. The following steps riefly explin the Mnger instlltion: c d e f Prepre the system ccording to the requirements outlined in McAfee Network Security Pltform Instlltion Guide nd the McAfee Network Security Pltform Relese Notes. Close ll open pplictions. Go to the McAfee Updte Server ( nd log on, using the grnt numer nd pssword. Go to the Mnger Softwre Updtes folder nd select the ltest Mnger softwre version ville. Downlod the.zip file to the trget Windows Server nd extrct the setup file. Doule-click Mnger _<version>_setup.exe nd follow the on-screen prompts. 8 Strt the Mnger Click Strt Progrms McAfee Network Security Mnger Network Security Mnger. 9

10 9 Add the Sensor to the Mnger The Mnger displys the Logon pge. c Log on to the Mnger using the defult user nme (dmin) nd pssword (dmin123). Click Devices. To dd Sensor in the Mnger, click Glol Add nd Remove Devices, then click New. You do not require license file to enle IPS on NS-series Sensors. The Add New Device pge is displyed. We recommend using the Add Device wizrd to dd device. d Enter the following mndtory informtion in the pproprite fields. 1) Device Nme The Sensor nme must egin with letter. The mximum length of the nme is 25 chrcters. 2) Device Type Specifies the type of device to e dded. Select IPS Sensor. 10

11 3) Shred Secret The shred secret must e minimum of 8 chrcters nd mximum of 25 chrcters in length. The key cnnot strt with n exclmtion mrk nor cn hve ny spces. The prmeters tht you cn use to define the key re: 26 lphets: Uppercse nd lowercse (A, B, C,...Z nd,,c,...z) 10 digits: symols: ~ # $ % ^ & * ( ) _ + = [ ] { } \ ; : " ',. <? / The Sensor nme nd shred secret key tht you enter in the Mnger must e identicl to the shred secret tht you will lter enter during physicl instlltion or initiliztion of the Sensor (using CLI) in Step 10 - Configure Sensor informtion. If not, the Sensor will not e le to register itself with the Mnger. 4) Updting Mode Select Online or Offline. Selecting Offline enles Offline Sensor updte. Online is the defult mode. e Click Sve. The dded Sensor is displyed on the Add nd Remove Devices pge. 10 Configure Sensor informtion Configure the Sensor with the network informtion, nme, nd the shred secret key tht the Sensor uses to estlish secure communiction with the Mnger. Use the nme nd key vlues you set in Step 9 - Add the Sensor to the Mnger. The first time you configure Sensor, you must hve physicl ccess to the Sensor. At ny time during configurtion, you cn type question mrk (?) to get help on the Sensor CLI commnds. For list of ll commnds, type commnds. Log on to the Sensor using the terminl connected to the Console port. At the prompt, log on using the defult Sensor user nme (dmin) nd pssword (dmin123). 11

12 c Optionl, ut recommended. Chnge the Sensor pssword. At the prompt, type: psswd.the Sensor prompts you to enter the new pssword nd prompts you for the old pssword. A pssword must contin etween 8 25 chrcters, is cse sensitive, nd cn consist of ny lphnumeric chrcter or symol. d Set the nme of the Sensor: You cn enter the setup commnd t the prompt. This utomticlly prompts you to provide the informtion shown in items d through g nd item j. Alterntively, you cn use the set commnd. If you use the set commnd, mnully enter the complete commnd syntx s shown in items d through g nd item j. At the prompt, type: set sensor nme <word>. Exmple: set sensor nme HR_sensor1 The Sensor nme is cse-sensitive chrcter string up to 25 chrcters. The string cn include hyphens, underscores, nd periods, nd must egin with letter. e f g If the Sensor is not on the sme network s the Mnger, set the ddress of the defult Gtewy. At the prompt, type: set sensor gtewy <A.B.C.D> Exmple: set sensor gtewy Set the IP ddress of the Mnger server. At the prompt, type: set mnger ip <A.B.C.D>. Exmple: set mnger ip Set the IP ddress nd sunet msk of the Sensor. At the prompt, type: set sensor ip <A.B.C.D> <E.F.G.H>. Exmple: set sensor ip Specify n IP ddress using four octets seprted y periods: X.X.X.X, where X is numer etween 0 nd 255, followed y sunet msk in the sme formt. h If prompted, reoot the Sensor. Type: reoot The Sensor cn tke up to five minutes to complete its reoot. i j Ping the Mnger from the Sensor to determine if your configurtion settings to this point hve successfully estlished the Sensor on the network. At the prompt, type: ping <mnger IP ddress>. If the ping is successful, continue with the following steps. If not, type show to verify your configurtion settings nd check tht the informtion is correct. Set the shred secret key vlue for the Sensor. At the prompt, type: 12

13 set sensor shredsecretkey The Sensor then prompts you to enter nd then confirm the shred secret key vlue. This vlue is used to estlish trust reltionship etween the Sensor nd the Mnger. The secret key vlue cn e etween 8 nd 25 chrcters of ny ASCII text. The shred key vlue is cse-sensitive. Mke sure tht the vlue mtches the shred secret key vlue you provided in the Mnger interfce in Step 9 - Add the Sensor to the Mnger. k l To verify the configurtion informtion, type show. Check tht ll informtion is correct. To exit the session, type exit. 11 Verify successful instlltion In the Sensor CLI, type: sttus. The sttus report is displyed. The Sensor prmeter System Initilized must e yes, nd for Mnger communiction Trust Estlished must e yes. From the Mnger Dshord, view the Mnger sttus in the System Helth monitor. 13

14 The Mnger sttus displys s Up nd Sensor sttus is Active. c From the Mnger, click Devices <Device_Nme> Setup Physicl Ports to open the Physicl Ports pge. <Device_Nme> indictes the nme of the Sensor you dded. d A policy nmed Defult Inline IPS is ctive upon Sensor ddition. To view this policy, select Intrusion Prevention Policy IPS Policies. Select Defult Inline IPS from the list nd click View / Edit. The Defult Inline IPS policy contins ttcks lredy configured with "locking" Sensor response ction. If ny ttck in the policy is triggered, the Sensor utomticlly locks the ttck. To tune this or ny other McAfee-provided policies, you cn clone the policy nd then customize it s descried in the McAfee Network Security Pltform IPS Administrtion Guide. e f Click Devices <Device_Nme> Setup Physicl Ports. Select the port on the Sensor tht you cled to view port settings. Mke sure tht your port settings mtch the cling, for exmple, if port 1 is cled for the in-line mode, then the Operting Mode in the port setting must e in-line mode. For more informtion on port settings, see Configuring the monitoring nd response ports of Sensor, McAfee Network Security Pltform IPS Administrtion Guide. 14

15 12 You're up nd running! Your Sensor is ctively monitoring connected segments nd communicting with the Mnger for dministrtion nd mngement opertions. c d For detiled usge instructions, see the McAfee Network Security Pltform IPS Administrtion Guide, or click the Detiled Help uttons in the upper-right corner of ech window in the Mnger. Strt the Anlysis Thret Anlyzer to view lert sttistics s ttcks re detected. A summry of lerts is displyed in the Uncknowledged Alert Summry re of the Mnger Dshord pge. Hving prolems? See the McAfee Network Security Pltform Trouleshooting Guide for trouleshooting informtion. Most deployment prolems stem from configurtion mismtches etween the Sensor nd the network devices to which it is connected. Check the duplex nd uto-negotition settings on oth devices to ensure tht they re synchronized. To contct technicl support, go to 15

16 Copyright 2017 McAfee, LLC McAfee nd the McAfee logo re trdemrks or registered trdemrks of McAfee, LLC or its susidiries in the US nd other countries. Other mrks nd rnds my e climed s the property of others D00