McAfee Network Security Platform

Transcription

1 1 Gigait Optical Passive Fail-open Bypass Kit Guide Revision D McAfee Network Security Platform The Gigait Optical Fail-Open Bypass Kit (the Kit) minimizes the potential risks of in-line Network Security Sensor failure on critical network links. The Gigait Ethernet (GE) Monitoring ports on Network Security Sensors (Sensors) are fail closed; thus, if the Sensor is deployed in-line, a hardware failure results in network downtime. Fail-open operation for GE ports requires the use of the optional external Bypass Switch provided in the Kit. With the Bypass Switch in place, normal Sensor operation supplies power to the switch via a control cale. While the Sensor is operating, the switch is "on" and routes all traffic directly through the Sensor. When the Sensor fails, the switch automatically shifts to a ypass state: in-line traffic continues to flow through the network link, ut is no longer routed through the Sensor. After the Sensor resumes normal operation, the switch returns to the "on" state, once again enaling in-line monitoring. The Kit contains a Bypass Switch and all the connectivity components to connect the switch to the GE Monitoring ports of any Sensor model, and to connect a control cale etween the Sensor and the switch. Additional cales may e required to connect the Bypass Switch to your other network devices (routers, switches), and you may not require all the components included in the Kit (for example, you will use only one of the two types of Control cale included in the Kit). This document descries the contents of the Kit; how to install the Kit for all M-series Sensor models with GE ports, either standard GBIC or Small Form-factor Pluggale (SFP) ports; how the Kit functions; and what to expect during normal use. You may not require all the components included in the Kit (for example, you will use only one of the two types of Control cale included in the Kit). 1 Single-Mode vs. Multimode There are two models of the Kit: one for single-mode fier networks and one for multimode fier networks. Before installing your Bypass Switch, ensure that the Kit type is compatile with your network fier type; each model functions properly only with its specific fier type. The contents and installation procedures for oth Kit models are the same. 1

2 2 Kit contents The following external hardware is shipped in oth models of the Fail-Open Kit: Qty Item 1 19-inch rack-mount panel for 3 switches Description 1RU mounting hardware to mount up to three ypass switches in a standard rack. 1 Gigait Fail-Open Cale Connects the fail-open control to one or two ypass switch(es). 2 SC-SC cale Standard cale (multimode or single-mode, depending on the Kit.) 4 4-inch cale LC-SC Converter (multimode or single-mode, depending on the Kit.) 1 3-meter RJ45 - RJ11 cale Connects the ypass switch to a uilt-in Sensor Fail-Open Control port (M-3050/M-4050 Sensors only.) 2 LC-LC cale (multimode or single-mode,depending on the Kit.) You may need to provide some of the following cales, depending on your Sensor model and network devices: RJ45 - RJ45 cale to connect the ypass switch. LC-LC cales, to connect the ypass switch to Sensor LC Monitoring ports. SC-SC cales, to connect to network devices with SC-type ports depending on the Sensor model and port type. 3 Connecting the Fail-Open Kit to a Sensor The Bypass Switch connects to any Sensor model with Gigait Ethernet (GE) ports; and the physical connection differs y Sensor model and port pair, as explained in this section. Connecting the switch to Sensors with LC-type ports Connect the switch to any of the M-series Sensor model. For example, the M-3050/M-4050 Sensors each have twelve LC-type Monitoring ports (six pairs), and each model supports up to four kits. Fail-open switch connected to ports 1A-1B This diagram shows a switch connected to one of the first four port pairs; thus the switch is controlled via the corresponding Fail-Open Control port, X1. 2

3 Item Description 1 Fail-Open Bypass Switch 2 Fail-Open Control Port X1 (RJ11 connection) 3 Control port on Bypass Switch (RJ45 connection) 4 RJ45 - RJ11 cale 5 Connection to network device (LC connection) 6 Connection to network device (LC connection) 7 PTx/SRx (inside) connection to port 1A (LC connection) 8 STx/PRx (outside) connection to port 1B (LC connection) 4 Installing the Bypass Switch on a rack You can install etween one and three Bypass Switches onto the Bypass Switch rack-mount panel. The rack-mount panel descried in this section is included in the Fail-Open Kit. This procedure is optional; if you do not wish to install the Bypass Switch on a rack, you may set the switch directly on top of the Sensor or another network device. 3

4 Install the switch in the rack-mount panel a Slide the switch into the center opening in the rack-mount panel, until the faceplate of the switch rests against the panel. Secure the switch to the rack-mount panel y inserting the screws through the holes on the switch faceplate and into the panel. Additional Bypass Switches can e installed without removing the rack-mount panel from the rack. To install up to two additional switches: 1 Remove the screws holding one of the removale lank plates from the front of the panel. 2 Follow the procedure for installing a switch in the rack-mount panel for the additional Bypass Switch(es). Install the panel and switch(es) on a rack a Place the 1U panel against the front of a standard 19-inch rack. Secure the rack-mount panel y inserting the screws (included with the rack-mount panel) through the holes on front of the panel and the sides of the rack. 5 Installing the Fail-Open Bypass Switch To accurately detect attacks, the Sensor must e aware of which traffic is outside the network and which traffic is inside. Identifying traffic direction is accomplished via proper caling of the Bypass Switch as well as proper port configuration of the Sensor Monitoring ports in the Manager. For information on how to configure Sensor ports via the Manager, see McAfee Network Security Platform IPS Administration Guide. In addition to the RJ45 Control port, the Fail-Open Module has four RJ45 connectivity ports.the two on the left have A and B laels aove the ports and a Network lael elow the port (not shown in the following diagram). These connect to your network devices. The two on the right have A and B laels aove the ports and a Monitor lael elow the port (not shown in the following diagram). These connect to the Sensor. 4

5 Field Description 1 To Sensor Fail-Open Control port 2 To Network Device (inside) 3 To Network Device (outside) 4 PTx/SRx - inside (plugs into Sensor port xa) 5 STx/PRx - outside (plugs into Sensor port xb) Connecting the Bypass Switch to a Network Device a c Plug an inside network cale connector into the Network LC receptacle laeled A (in a triangle) on the Bypass Switch. Plug the other end of this cale into the corresponding network device. Plug an outside network cale into the Network LC receptacle laeled B (in a triangle) on the Bypass Switch. If the network device requires an SC connection, use the LC-SC adaptor and SC-SC cale included in the Kit. d Plug the other end of this cale into the corresponding network device. Connecting the Bypass Switch to a Sensor with LC ports a Plug an LC-LC cale laeled PTx/SRx (inside) into the LC receptacle of port xa, where x is 1-6. Plug the other end of the LC cale into the Monitor LC receptacle laeled A (no triangle) of the Bypass Switch. 5

6 c d Plug an LC-LC cale laeled STx/PRx (outside) into the corresponding xb peer port. (For example, if you used 2A in step 1, plug the cale into port 2B). Plug the other end of this cale into the Monitor port laeled B of the Bypass Switch. With this cale configuration, Sensor Monitoring port 1A views traffic as originating inside the network, and port 1B views traffic as originating outside the network. Note that this configuration (1A = outside, 1B = inside) must match the port configuration specified for this Sensor, and that the ports must e enaled. Port configuration is accomplished via Manager, and descried in the McAfee Network Security Platform IPS Administration Guide. Connecting the switch to a Sensor with SC-type ports a c Plug the SC end of an SC-LC cale laeled STx/PRx (outside) into the SC receptacle of port xa. Plug the LC end of the cale into the Monitor LC receptacle laeled A (no triangle). Plug the SC end of an SC-LC cale laeled PTx/SRx (inside) into the corresponding xb peer port. (For example, if you used 2A in step 1, plug the cale into port 2B). Make sure that you cale inound and outound traffic correctly, matching the port configuration for these two ports on the Sensor. d Plug the other end of this cale into the Monitor port laeled B of the Bypass Switch. Configuring the Sensor Monitoring Ports You configure the Sensor's monitoring ports from the Manager interface. The port configuration must match the caling of the switch, the ports must e set to "In-line Fail-Open" and the ports must e enaled. 6

7 To view/configure the settings of your monitoring ports: a In the Manager interface, select Devices <Admin_Domain_Name> Devices <Device_Name> Setup Physical Ports Monitoring Ports. c d e f g Click a numered port (for example 10A) from Monitoring Ports pane. A pop-up displays current port settings. Indicate whether you are using a McAfee Certified module. Select the State to Enaled. In the Operation section, select Mode as In-line Fail-Open Passive. In the same section, select Placement as Inside (internal) or Outside (external). Click Save to commit your configuration. 7

8 h Click OK to confirm that you the configuration on port 10B too. i j Repeat for any other ports you need to configure. Download the changes to your Sensor y performing the steps in Deploy pending changes to a device in the McAfee Network Security Platform Manager Administration Guide. 6 Verify proper installation After the Bypass Switch has een connected to the network and the Sensor, check the switch's LED to verify that the switch is receiving power from the Sensor. Check the port status and operating mode status in the McAfee Network Security Manager (Manager) interface to ensure that the port is enaled and is in the In-Line Fail-Open mode. Status LED on the Bypass Switch The indicator is adjacent to the Control port on the Bypass Switch. Light Status ON OFF Switch is receiving power from the Sensor and traffic is passing to the Sensor. The switch is in ypass mode; it is not receiving power and is not passing network traffic to the Sensor. Port and operating mode status The port status and operating mode status for GE In-line Fail-open mode are detailed as follows: In-line Fail-Open Port Status In-line Fail-Open Port Status Port color on the virtual Sensor Green Operating Mode Status The in-line fail-open device is in in-line fail-open mode. In-line Bypass Yellow The in-line fail-open device is in in-line ypass mode. The ypass switch has een activated. The Sensor does not monitor during this time. Unknown Orange Unale to get the status of the in-line fail-open device from Sensor. Check the Operational Status. 8

9 In-line Fail-Open Port Status Port color on the virtual Sensor Operating Mode Status Switch Asent Red Fail-open control is not present, control cale is not present, or ypass switch is not present. Verify that all three components are connected properly. If everything is connected correctly, check the Operational Status. N/A Gray Not Applicale; the operating mode is not in in-line fail-open mode. If you encounter any prolems, see Common Prolems and Solutions. 7 Trouleshooting How does the Bypass Kit work? During normal Sensor in-line, fail-open operation, the Fail-Open or uilt-in Control port (depending on which controls the ypass switch) supplies power and a hearteat signal to the ypass switch. If this signal is not presented within its programmed four-second interval, the Fail-Open ypass switch removes the Sensor from the data path, and moves into ypass mode, providing continuous data flow with little network interruption. While the Sensor is in ypass mode, traffic passes directly through the switch, ypassing the Sensor. When normal Sensor operation resumes, you may or may not need to manually re-enale the monitoring ports from the Manager interface, depending on the activity leading up to the Sensor's failure. The following section descries how to return the Sensor to in-line mode. Moving from ypass mode ack to in-line mode Moving from ypass mode ack to in-line mode involves the following: Manual Sensor reoot Sensor error What happens in a Sensor failure? When a Sensor fails with the Bypass Kit in place, the following events occur in the order shown. a The Manager reports a "Sensor in ad health" or "Port pair is in ypass mode" error in the Operational Status pane. The Sensor reoots and Bypass Switch egins forwarding traffic. All traffic then ypasses the Sensor and flows across the Bypass Switch with minimal traffic disruption. A Sensor reoot reaks the link connecting the devices on either side of the Sensor and requires the renegotiation of the network link etween the two devices surrounding the Sensor. Depending on the network equipment, this disruption should range from a couple of seconds to more than a minute with certain vendors' devices. 9

10 c Upon reoot completion, the Sensor resumes its hearteat, and one of the following occurs: 1) If the reoot happened during normal activity as descried aove, the Bypass Switch resumes passing data through the Sensor and the Sensor returns to in-line mode. 2) If the reoot occurred due to an error, the Bypass Switch will continue to ypass the Sensor until the Sensor ports are re-enaled from the Manager. After the ports are re-enaled, the Bypass Switch resumes passing data through the Sensor and the Sensor returns to in-line mode. A very rief link disruption might occur while the links are renegotiated to place the Sensor ack in in-line mode. d The errors on the Manager are cleared and normal health is reported. Common Prolems and Solutions This section lists some common installation prolems and their solutions. Prolem Possile Cause Solution LED is off. The control cale has een disconnected LED is off. The Sensor is powered off. Restore Sensor power LED is off. Sensor is operational, ut is not monitoring traffic Sensor is operational, ut is not monitoring traffic. Network or link prolems. Runts or giants errors on switch and routers. The system fault "Switch asent" appears in the Manager Operational Status window. The Sensor port cale is disconnected. Network device cales have een disconnected. The Sensor ports have not een enaled in the Manager. Improper caling or port configuration. Improper caling or port configuration. The control cale has een disconnected. Check the control cale and ensure it is properly connected to oth the Sensor and the Bypass Switch. Check the Sensor cale connections. Check the cales and ensure they are properly connected to oth the network devices and the Bypass Switch. The Sensor will not monitor traffic on the ports unless the ports are enaled in the Manager. Ports are disaled in a Sensor failure; they must e re-enaled for Sensor monitoring to resume. Ensure that the transmit and receive cales are properly connected to the Bypass Switch. Ensure that the transmit and receive cales are properly connected to the Bypass Switch. Check the control cale and ensure it is properly connected to oth the Sensor and the Bypass Switch. 10

11 11

12 Copyright 2017 McAfee, LLC McAfee and the McAfee logo are trademarks or registered trademarks of McAfee, LLC or its susidiaries in the US and other countries. Other marks and rands may e claimed as the property of others D00