R-Scope PACE Getting Started Guide

Transcription

1 R-Scope PACE 632 Broadway Suite 803 New York, NY fax 1 Introduction Congratulations on your new R-Scope system. This is a short guide which covers the basics in setting up the new system. Please see the full documentation set at SW Macadam Ave. Suite 365 Portland, OR Packaged with your R-Scope system is this guide along with a sheet containing default passwords and system MAC addresses. Before storing the shipping carton, ensure that the password sheet is available. Setup includes the following steps: Physical Setup and Cabling Licensing Management Plane and Control Plane Network Configuration include IP addresses System Update Log Export 2 Placing your Sensor Placing an R-Scope sensor in an appropriate spot in your network is important. When choosing where to place R-Scope, one must first think about what network traffic is relevant for analysis, what traffic is already being analyzed by R-Scope and from which perspective will R-Scope see the traffic. For instance, if you re only interested in seeing traffic between your internal network and the Internet, monitoring traffic close to your network border is desirable. If NAT or PAT are used in your network, monitoring closer to the source of the traffic prior to the NAT may be desirable. 3 Cabling R-Scope Gen8 R-Scope

2 Gen9 R-Scope mgmt0 is a 1 gigabit Ethernet port, and it should be connected for management access to the appliance The other available Ethernet interfaces (mon0, mon1, mon2, and mon3) are 10 gigabit SFP+ ports which will auto negotiate to 1Gb/10Gb with optical or DAC interfaces. For best performance, all four should be connected to your network tap or mirror. Use mon0, when connecting only a single interface Use mon0, mon2, when connecting only two interfaces Dust covers have been installed on the ports that are not used by R-Scope Plug both power supplies into a 120V - 240V power distribution unit using an appropriate C13 power cord for the intended PDU ser0 is an optional serial port with standard x86 DB9M pinout used for network setup and out of band system maintenance VGA is an optional VGA monitor interface used for initial network setup USB is an optional keyboard interface used for initial network setup The system will automatically power on once power is applied. Power should be applied last. 4 Licensing R-Scope A license is required to access the Bro menus within the R-Scope appliance. The license process first generates a license request that is forwarded to Reservoir Support. Reservoir will then return a license key in that is used to activate the license key. 4.1 Generating a Request A license request is generated through the /system/license/generate command.

3 (prod)] base > system license generate ========================================================== ===== Copy text below, send to ===== ========================================================== # Reservoir License File licenseversion=2 swname=rscope swversion=1 hostname=rscope.reservoir.com hostid=aawp6xl2 ========================================================== ========================================================== Send the full text of the request to support@reservoir.com 4.2 Activating the License A license key will be returned in that is used for activation. The content will look like: # Reservoir License File licenseversion=2 swname=rscope swversion=1 #hostname=rscope.reservoir.com hostid=aawp6xl2 expiration=21 Feb :00: key=wte6rpz3n0x2dzdf9nc3rq== EOF The R-Scope /system/license/add command is used for license activation. Paste the full command including the EOF. Note that the license is tied to the particular host, but not to the hostname. The hostname can be change at any time with invalidating the license.

4 (prod)] base > system license add Please paste your licese below. Add EOF when done.: # Reservoir License File licenseversion=2 swname=rscope swversion=1 #hostname=rscope.reservoir.com hostid=aawp6xl2 expiration=21 Feb :00: key=wte6rpz3n0x2dzdf9nc3rq== EOF R-Scope license added and verified! Bro menu now active. At this point the Bro engine can be started, stopped and monitored using the /bro/start, /bro/stop,/bro/status commands. 5 Configuring Networking The R-Scope system will run without any networking setup right out of the factory if it is provided with a DHCP address upon boot. Within your organization, you may desire to customize the system to your particular needs. Customization will allow you to specifically set a static address, set DNS servers, enable access controls, change the NTP configuration, or change the data plane configuration. 5.1 Configuring the Management Interface Control Plane When the R-Scope appliance is plugged for the first time, the management network interface mgmt0 is configured for DHCP. Determining the initial IP address can be accomplished in three ways: 1) Note the IP address assigned from within your DHCP infrastructure. The MAC address of the R- Scope system is provided on the password sheet that came with the system. This address can be gleaned from DHCP server system logs, by inspecting the arp cache of another machine on the same network segment, or through nmap sn on the same network segment. 2) Use the serial port for serial console access using the username/password provided on the password sheet that came with the system. Once logged in, issue the following command at the R-Scope prompt: [admin@rscope (prod)] base > system network showconfig 3) Temporarily install a keyboard and monitor. Log into the system console using the username/password provided on the password sheet that came with the system. Once logged in, issue the following command at the R-Scope prompt: [admin@rscope (prod)] base > system network showconfig If needed, the management interface can be changed to a static address and/or additional DNS servers can be configured. Static or dynamic IP addresses are configured with the static or dhcp (the default) commands, respectively, under the

5 /system/network/interfaces/management context. This context can be entered by typing the above path (without the / characters). Tab-completion at the CLI prompt provides short cuts to typing the full context level name and the? character provides help. [admin@(rscope) prod] base > system network interfaces management DNS settings are available directly under the /system/network context. 5.2 Setting the Timezone and NTP To ensure that the metadata logs can be accurately correlated with other tools that may be in use, the timezone should be set to your desired localtime and NTP used to ensure an accurate clock. Under the /system/time context there are commands to set the local timezone and to configure an NTP server. Often the R-Scope appliance will be configured for UTC time. The NTP server is configured from the factory to serve time from pool.ntp.org. If you have a local NTP time source, it is recommended that you use your local source rather than relying on the default pool.ntp.org servers. 5.3 Configuring the Data Plane The data plane is fed via a tap or mirror though one to four SFP+ ports. These ports accept either SFP+ 10Gb transceivers or 10Gb copper passive/active direct attach cables. Best performance is achieved with all four interfaces active. In the case where only 1 or 2 taps/mirrors are available, the data plane network interface layout must be changed. The /system/network/interfaces/capture/layout context allows setting the data plane to one, two, or four interfaces. R-Scope is shipped in a four-port configuration, if using all four ports no additional settings are necessary. Following Section 2, Cabling R-Scope, be sure to use mon0 if only using a single SFP+ port and mon0/mon1 if only using two SFP+ ports. One Port Configuration: Use mon0 [admin@rscope-prod] base >system network interfaces capture layout oneport Two Port Configuration: Use mon0, mon2 [admin@rscope-prod] base >system network interfaces capture layout twoport Four Port Configuration (default): Use mon0, mon1, mon2, mon3 [admin@rscope-prod] base >system network interfaces capture layout fourport If the data plane port configuration is changed from the default four port configuration to two or one ports, the Bro engine must be restarted. Use the command /bro/restart to restart the Bro engine. 5.4 Validating Networking The control plane network, whether static or dynamic can be validated with the /system/network/showconfig command. Useful networking commands such as ping, traceroute, and tcpdump are available under /system/diag/network to aid in troubleshooting.

6 The data plane network can be validated with the /system/diag/network/activity command. This will show link status and network activity for the 10Gb data plane interfaces. Press ctl-c to exit. NIC link bytes_received rate(mbps) eth0 yes eth1 yes eth2 yes eth3 yes Aggregate Rate: 1109 Link status is tightly coupled to Bro engine status. When the Bro engine is stopped, the links are placed in a down state. Likewise, when the Bro engine is started, the links are placed in the up state. Ensure R-Scope is licensed and the Bro engine is running prior to troubleshooting data plane issues. 5.5 Access Controls Best practices are to limit the networks and hosts that can access the R-Scope system. The /system/network/services/ssh context allows adding specific networks or hosts that can access the R-Scope system. The R-Scope internal firewall is set to DENY by default. From the factory, there is a single rule that allows access from all networks on IPv4 and IPv6 networks. We suggest you add the networks/hosts that need to access R-Scope and remove the default all-access rule. Under the /system/network/services/ssh context this is accomplish through the add and remove commands. Be cautious when removing the default all-access rule, it is possible to lock yourself out of the system. The serial console can be used for recovery if a firewall rule is mistakenly added or removed. See section 5.1 for a description of serial console access. 6 System Updates R-Scope releases are generally on a quarterly basis with patches in between. After system installation, we recommend that you check for updates. We support three mechanisms for updates: 1) reaching out to our update server over HTTPS, 2) Installing offline updates via optical media by downloading.iso images from our support site, and 3) Installing offline updates via scp by downloading patch images from our support site and using scp from an external host to transfer the images to R-Scope. 6.1 Updates over HTTPS To update R-Scope, simply run the /system/update/https command.

7 (prod)] base > system update https Checking for updates... There is 1 system update available. Please reboot to install. Press ENTER to continue... [admin@rscope-prod] base > system reboot Are you sure you want to reboot R-Scope? (Y/N): Y 6.2 Offline Optical Media Updates For offline updates via optical media, first you must download the.iso images from the support portal at Burn that ISO to a CD or DVD and insert it into R-Scope. Run the /system/update/dvd command as follows: [admin@rscope-prod] base > system update dvd Checking for updates from DVD... Mounting... [admin@rscope-prod] base > system reboot Are you sure you want to reboot R-Scope? (Y/N): Y 6.3 Offline scp Updates There are thee steps to incorporate an offline update: 1. Download the patch image from the support portal at 2. Provide a public key to R-Scope so that the patch image can be updated. Issue the command /system/update/scp/editkeys, which will start up the vi editor to allow one or more public ssh keys to be added. 3. Use scp from an external host that has the corresponding private key to the public key used in step #2, copy the image to the update user. Reboot once the new image is completely copied. % scp update@<rscope system> <patch_image> [admin@rscope (prod)] base > system reboot Are you sure you want to reboot R-Scope? (Y/N): Y 7 Adding Users R-Scope comes with a single default user, admin, which has all privilege rights. The password is provided with the shipping materials that came with the R-Scope system. The default admin password should be changed during setup. The /system/users context allows for changing passwords, adding new local users, and removing users. All users are local to the system, but can be authenticated via RADIUS. If using RADIUS, the user must be created locally in R-Scope and have credentials in RADIUS. To authenticate users via RADIUS, the /system/authentication/radius context is used to configure a RADIUS server. Since users are local to R-Scope, authentication can happen either through RADIUS or through the local user password. It is recommended that when using RADIUS the

8 /system/authentication/local configuration be disabled. This will ensure that only RADIUS authentication takes place. Note that the admin user is always authenticated locally. This ensures that if the RADIUS server where no longer available the admin user can always still log in. 8 Exporting Data Logs are spooled to the local R-Scope filesystem during normal processing. For further processing, these logs can be exported through scp, syslog, or Splunk. The /logs/export context has three sub-contexts for export: scp, syslog, and Splunk. The scp export will export logs as they are rotated and archived within the local R-Scope filesystem. Typical log rotation intervals are on an hourly basis, which is the default setting. In heavy traffic situations 100 s of megabytes of log can accumulate in an hour. It is recommended to tune the log rotation interval through the /logs/rotation command to not export more than 100MB per rotation interval. The syslog export will export logs over the syslog protocol in near realtime. The /logs/export/syslog/receiver/rsyslog context has configuration hints for the remote syslog receiver setup. R-Scope ships with the Splunk Universal Forwarder on the system to export logs to a Splunk instance. The commands can be found under /logs/export/splunk context.