Cascade Profiler, Express, Sensor and Gateway Appliance Installation Guide. Version 10.6 March 2014

Transcription

1 Cascade Profiler, Express, Sensor and Gateway Appliance Installation Guide Version 10.6 March 2014

2 2014 Riverbed Technology. All rights reserved. Accelerate, AirPcap, AppResponse Xpert, BlockStream, Cascade, Cloud Steelhead, Granite, Interceptor, RiOS, Riverbed, Shark, SkipWare, Steelhead, TrafficScript, TurboCap, Virtual Steelhead, Whitewater, WinPcap, Wireshark, and Stingray are trademarks or registered trademarks of Riverbed Technology, Inc. in the United States and other countries. Riverbed and any Riverbed product or service name or logo used herein are trademarks of Riverbed Technology. All other trademarks used herein belong to their respective owners. The trademarks and logos displayed herein cannot be used without the prior written consent of Riverbed Technology or their respective owners. F5, the F5 logo, icontrol, irules and BIG-IP are registered trademarks or trademarks of F5 Networks, Inc. in the U.S. and certain other countries. Linux is a trademark of Linus Torvalds in the United States and in other countries. VMware, ESX, ESXi are trademarks or registered trademarks of VMware, Incorporated in the United States and in other countries. Portions of Cascade products contain copyrighted information of third parties. Title thereto is retained, and all rights therein are reserved, by the respective copyright owner. PostgreSQL is (1) Copyright The PostgreSQL Development Group, and (2) Copyright the Regents of the University of California; PHP is Copyright The PHP Group; gnuplot is Copyright , 1998, 2004 Thomas Williams, Colin Kelley; ChartDirector is Copyright 2007 Advanced Software Engineering; Net-SNMP is (1) Copyright 1989, 1991, 1992 Carnegie Mellon University, Derivative Work 1996, Copyright 1996, The Regents of The University of California, (2) Copyright Network Associates Technology, Inc., (3) Copyright Cambridge Broadband Ltd., (4) Copyright 2003 Sun Microsystems, Inc., (5) Copyright Sparta, Inc. and (6) Copyright 2004 Cisco, Inc. and Information Network Center of Beijing University of Posts and Telecommunications, (7) Copyright Fabasoft R&D Software; Apache is Copyright by The Apache Software Foundation; Tom Sawyer Layout is Copyright Tom Sawyer Software; Click is (1) Copyright Massachusetts Institute of Technology, (2) Copyright Riverbed Technology, Inc., (3) Copyright International Computer Science Institute, and (4) Copyright Regents of the University of California; OpenSSL is (1) Copyright The OpenSSL Project and (2) Copyright Eric Young (eay@cryptsoft.com); Netdisco is (1) Copyright 2003, 2004 Max Baker and (2) Copyright 2002, 2003 The Regents of The University of California; SNMP::Info is (1) Copyright Max Baker and (2) Copyright 2002, 2003 The Regents of The University of California; mm is (1) Copyright Ralf S. Engelschall and (2) Copyright The OSSP Project; ares is Copyright 1998 Massachusetts Institute of Technology; libpq++ is (1) Copyright The PostgreSQL Global Development Group, and (2) Copyright 1994 the Regents of the University of California; Yahoo is Copyright 2006 Yahoo! Inc.; pd4ml is Copyright zefer.org; Rapid7 is Copyright Rapid7 LLC; CmdTool2 is Copyright 2008 Intel Corporation; QLogic is Copyright QLogic Corporation; Tarari is Copyright 2008 LSI Corporation; Crypt_CHAP is Copyright , Michael Bretterklieber; Auth_SASL is Copyright Richard Heyes; Net_SMTP is Copyright The PHP Group; XML_RPC is (1) Copyright Edd Dumbill, (2) Copyright The PHP Group; Crypt_HMAC is Copyright The PHP Group; Net_Socket is Copyright The PHP Group; PEAR::Mail is Copyright The PHP Group; libradius is Copyright 1998 Juniper Networks. This software is based in part on the work of the Independent JPEG Group the work of the FreeType team. This documentation is furnished "AS IS" and is subject to change without notice and should not be construed as a commitment by Riverbed Technology. This documentation may not be copied, modified or distributed without the express authorization of Riverbed Technology and may be used only in connection with Riverbed products and services. Use, duplication, reproduction, release, modification, disclosure or transfer of this documentation is restricted in accordance with the Federal Acquisition Regulations as applied to civilian agencies and the Defense Federal Acquisition Regulation Supplement as applied to military agencies. This documentation qualifies as "commercial computer software documentation" and any use by the government shall be governed solely by these terms. All other use is prohibited. Riverbed Technology assumes no responsibility or liability for any errors or inaccuracies that may appear in this documentation. Individual license agreements can be viewed at the following location: This manual is for informational purposes only. Addresses shown in screen captures were generated by simulation software and are for illustrative purposes only. They are not intended to represent any real traffic or any registered IP or MAC addresses. Riverbed Technology 199 Fremont Street San Francisco, CA Phone: Fax: Web: Part Number

3 Contents Chapter 1 - Introduction...1 Additional Resources...1 Safety Guidelines...2 Contacting Riverbed...2 Chapter 2 - Installing the Standard Profiler...3 Overview...3 Inventory and inspection...4 Preparations for installation...4 Mounting location...4 Data sources...5 Cable connections...5 Access to the network...5 Configuration information...6 Licensing strategy...8 Downloading and adding license keys...8 Automatically adding license keys...9 Manually adding license keys...9 Mounting and powering...9 Safety information...9 Rack mounting the chassis...9 Cabling to the network...10 Configuring the Standard Profiler...10 License activation...11 Generating the license keys...12 Manually adding the license keys...13 Additional configuration...13 Installation verification...14 Hardware specifications...15 Profiler, Express, Sensor and Gateway Installation Guide iii

4 Contents Rack space...15 Power...15 Cooling...15 Console port pin-out...16 Chapter 3 - Installing the Enterprise Profiler...17 Overview...17 Inventory and inspection...18 Preparations for installation...18 Mounting location...18 Data sources...19 Cable connections...19 Access to the network...20 Configuration information...21 Licensing strategy...22 Downloading and adding license keys...22 Automatically adding license keys...23 Manually adding license keys...23 Mounting and powering...23 Safety information...23 Rack mounting the chassis...24 Cabling to the network...24 Configuring the Enterprise Profiler...25 License activation...26 Generating the license keys...27 Manually adding the license keys...27 Additional configuration...28 Installation verification...28 Hardware specifications...29 Rack space...29 Power...30 Cooling...30 Console port pin-out...31 Chapter 4 - Installing the Express and Express Overview...33 Inventory and inspection...34 Preparations for installation...34 Mounting location...34 Data sources...35 Cable connections...35 Access to the network...36 Configuration information...37 iv Profiler, Express, Sensor and Gateway Installation Guide

5 Contents Licensing strategy...39 Downloading and adding license keys...39 Automatically adding license keys...40 Manually adding license keys...40 Mounting and powering...40 Safety information...40 Rack mounting the chassis...40 Cabling to the network...41 Configuring the Express...41 License activation...42 Generating the license keys...43 Manually adding the license keys...44 Additional configuration...44 Configuring the Aux interface...44 Specifying static routes...45 Specifying ports on which the Express is to receive flow data...45 Specifying traffic profile periods...45 Installation verification...46 Hardware specifications...47 Rack space...47 Power...47 Cooling...47 Console port pin-out...48 Chapter 5 - Installing the Gateway...49 Overview...49 Inventory and inspection...50 Preparations for installation...50 Mounting location...50 Data sources...51 Cable connections...51 Access to the network...52 Configuration information...52 Licensing strategy...54 Downloading and adding license keys...54 Automatically adding license keys...55 Manually adding license keys...55 Mounting and powering...55 Safety information...55 Rack mounting the chassis...56 Cabling to the network...56 Configuring the Gateway...56 License activation...58 Profiler, Express, Sensor and Gateway Installation Guide v

6 Contents Generating the license keys...58 Manually adding the license keys...59 Additional configuration...60 Configuring the Aux interface...60 Specifying static routes...60 Specifying ports on which the Gateway is to receive flow data...60 Specifying destinations for traffic information...61 Specifying forwarding destinations for flow data received by the Gateway...61 Installation verification...62 Hardware specifications...63 Rack space...63 Power...64 Cooling...64 Console port pin-out...64 Chapter 6 - Installing the Sensor...65 Overview...65 Inventory and inspection...66 Preparations for installation...66 Mounting location...66 Data sources...67 Cable connections...67 Access to the network...68 Configuration information...68 Licensing strategy...69 Downloading and adding license keys...70 Automatically adding license keys...70 Manually adding license keys...71 Mounting and powering...71 Safety information...71 Rack mounting the chassis...71 Cabling to the network...71 Configuring the Sensor...72 License activation...73 Generating the license keys...74 Manually adding the license keys...75 Additional configuration...75 Installation verification...76 Hardware specifications...76 Rack space...76 Power...77 Cooling...77 Console port pin-out...77 vi Profiler, Express, Sensor and Gateway Installation Guide

7 CHAPTER 1 Introduction This guide describes installing the Riverbed Cascade Profiler, Express, Gateway and Sensor appliances. Installation instructions for the Virtual Editions of the Profiler, Express 460 and Gateway are in separate installation guides. Installation includes mounting and cabling the product, connecting it to your network, activating the licenses, and verifying that the appliance is receiving and processing traffic data. When these tasks are completed, the Cascade appliance is ready to configure operationally. Operational configuration is described in the online help system of each product. The instructions in this guide refer to the rack mounting guide that is shipped in hard copy with the appliance. Refer to the rack mounting guide as necessary for mounting the rails and chassis in racks. This guide includes a complete, self-contained chapter for each Cascade appliance except for the Cascade Shark. Refer to the Cascade Shark Quick Start Guide for installing the Shark appliance. This guide includes: Chapter 2, Installing the Standard Profiler Chapter 3, Installing the Enterprise Profiler Chapter 4, Installing the Express and Express 460 Chapter 5, Installing the Gateway Chapter 6, Installing the Sensor Additional Resources The primary source of product information is the online help system. Additional information is available from the Riverbed Support site at This includes: Release Notes - posted in the software section of the page for your product. Users Guides - posted in the documentation section of the page for your product. Tech Notes - posted in the documentation section of the page for your product where applicable. Knowledge Base - a database of known issues and how-to documents. You can browse titles or search for key words and strings. Choose Search the Knowledge Base from the Knowledge Base menu. Profiler, Express, Sensor and Gateway Installation Guide 1

8 Introduction Safety Guidelines Safety Guidelines Follow the safety precautions outlined in the Safety and Compliance Guide when installing and setting up your equipment. Important: Failure to follow these safety guidelines can result in injury or damage to the equipment. Mishandling of the equipment voids all warranties. Please read and follow safety guidelines and installation instructions carefully. Many countries require the safety information to be presented in their national languages. If this requirement applies to your country, consult the Safety and Compliance Guide. Before you install, operate, or service the Riverbed product, you must be familiar with the safety information. Refer to the Safety and Compliance Guide if you do not clearly understand the safety information provided in this guide. Contacting Riverbed Options for contacting Riverbed include: Internet - Find out about Riverbed products at Support - If you have problems installing, using, or replacing Riverbed products, contact Riverbed Technical Support or your channel partner who provides support. To contact Riverbed Technical Support, please open a trouble ticket at or call RVBD-TAC ( ) in the United States and Canada or outside the United States. Professional Services - Riverbed has a staff of engineers who can help you with installation, provisioning, network redesign, project management, custom designs, consolidation project design, and custom-coded solutions. To contact Riverbed Professional Services, go to or proserve@riverbed.com. Documentation - Riverbed continually strives to improve the quality and usability of its documentation. We appreciate any suggestions you may have about our online documentation or printed materials. Send documentation comments to techpubs@riverbed.com. 2 Profiler, Express, Sensor and Gateway Installation Guide

9 CHAPTER 2 Installing the Standard Profiler Overview If you are familiar with installing Cascade appliances and your network environment has the necessary ports open between Cascade appliances, then mount the appliance in the rack and skip to Licensing strategy on page 8. If you are unfamiliar with installing Cascade appliances, then start here. The installation process involves the following steps: 1. Unpack, inspect and inventory the shipment. See Inventory and inspection on page Ensure that the mounting location and network environment will accommodate the appliance. See Preparations for installation on page Collect the configuration information you will need. See Configuration information on page Determine how the licenses are to be activated. See Licensing strategy on page 8 5. Mount the appliance in the rack and connect rack power. See Mounting and powering on page Connect the cables to the console port and the primary network port. See Cabling to the network on page Run the setup wizard on the console port to make the appliance reachable on the network. See Configuring the Standard Profiler on page Ensure that the licenses for the appliance are activated. See License activation on page Perform additional configuration, as necessary. See Additional configuration on page Verify that the appliance has been successfully installed. See Installation verification on page 14. Refer to the Hardware specifications on page 15 for dimensions, weight and power requirements. Profiler, Express, Sensor and Gateway Installation Guide 3

10 Installing the Standard Profiler Inventory and inspection Inventory and inspection 1. Check the shipping documentation to ensure that all cartons have arrived. 2. If you have not already done so, visually inspect each carton for indications of damage. 3. If any cartons are damaged or missing, contact Riverbed Support before continuing. Phone United States and Canada: Phone outside U.S. and Canada: support@riverbed.com Web: 4. Unpack the contents of the shipping cartons and inventory the contents against the shipping documentation. 5. If any components of the order are damaged or missing, contact Riverbed Support. Preparations for installation Before installing the chassis, ensure that the following considerations have been addressed: Mounting location Data sources Cable connections Access to the network Mounting location Cascade Standard Profiler appliance requires a 2U rack space in a 4-post, 19-inch rack or cabinet. It should be mounted in a rack that is appropriately sized for the chassis using the rails provided. Additional rails can be purchased from Riverbed using part number RMK-CAP-001. The rack should be properly secured to a level solid surface to prevent tipping or excess shock while the unit is operating. (Operating shock limits are half sine, 2 g peak, 11 msec.) Appliances should never be installed in an unsecured location such as on a table or shelf. They should never be stacked on top of one another. Manufacturing data for the units indicates that premature disk drive failure can result from vibration transmitted between units that are in direct contact with one another. The appliances should be installed so that the ventilation openings on the front and rear of the units are not blocked and so air flows from the front to the rear of the unit to facilitate proper cooling. Each fan within the appliance is capable of supporting multiple speeds. If the internal ambient temperature of the appliance exceeds the value programmed into the thermal sensor data record (SDR), the BMC firmware increases the speed for all the fans within fan module. Improper cooling can result in the appliance overheating, which could cause premature failure of sensitive components, such as the CPUs. In addition, overheating can result in the fans running at a higher speed for extended periods, which increases the amount of vibration in the appliance. Excess vibration can result in premature disk drive failure. 4 Profiler, Express, Sensor and Gateway Installation Guide

11 Preparations for installation Installing the Standard Profiler Refer to Hardware specifications on page 15 to ensure that the mounting location accommodates the dimensions, weight, power and cooling requirements of the appliance. Data sources The Profiler obtains traffic information from Riverbed Sensor, Gateway, Shark, AppResponse Xpert appliances. The Profiler must be receiving traffic information from at least one source in order for you to verify successful installation and configuration. There are two approaches to setting up data sources: Set up the available data sources and point them to the IP address of the Profiler before you install it. Install the Profiler up to the point of verification, then go install or configure the data sources, and then return to the Cascade appliance to complete the installation verification. It is preferable to configure all the data sources that are available at the time you install the Cascade appliance. However, Cascade operation can be confirmed with just one data source. Cable connections Power The Cascade appliance has two power supplies. Plug these into two different circuits, if they are available. Console port The initial setup of the Cascade appliance is performed using a console port. Ensure that you have a terminal server or a system running a terminal emulation program such as HyperTerminal or Tera Term Pro. Connect this to the Cascade appliance console port using a null modem cable with a 9-pin D-subminiature connector. Any standard serial device connection will work. Primary port The Profiler is equipped with a 100/1000baseTX primary management port that must connect to a hub or switch on the management network. The primary port is set by default for auto-negotiation. Ensure that: A straight-through cable to a hub or switch port on the management network is available at the rack location. The management network switch port is set to establish a connection at 100 or 1000 Mb/s and full duplex. A terminal device (laptop, KVM, etc.) is available on the management network for logging in to the Profiler user interface. Access to the network The Profiler uses the management network to communicate with other Cascade appliances and to access network services. Communication between Cascade appliances If you lock down your network on a port-by-port basis, ensure that the following ports are open between Cascade appliances: Profiler, Express, Sensor and Gateway Installation Guide 5

12 Installing the Standard Profiler Configuration information TCP/22 (ssh) This is needed for the Profiler to transfer upgrade packages to other Cascade devices that are connected to it. TCP/443 (https) Secure web-based management interfaces. TCP/8443 Exchange of encryption certificates between Cascade appliances. TCP/41017 Encrypted communication between Profiler and Sensor, Gateway, Shark, and AppResponse Xpert appliances. UDP/123 (ntp) Synchronization of time between a Sensor or Gateway and Profiler. Cascade versions before version 9.5 required TCP ports 8080, and to be open for communication among Cascade Pilot, Shark, and Profiler appliances. These port are no longer used by version 9.5 and above Cascade products, so they can be closed now. Access to and from network access services TCP/22 (ssh) This is needed for secure shell access to Cascade software components and for the appliance to obtain information from servers via scripts. UDP/161 (snmp) The Profiler uses SNMP to obtain interface information from switches. Also, management systems use this port to read the Cascade appliance MIB. TCP/443 (https) Secure web-based management interfaces. TCP/5432 (odbc) If you will be allowing other applications to access the Profiler internal database via ODBC, then you must allow traffic on this port If you will be using the Profiler user identification feature with a Microsoft Active Directory domain controller, then you must allow traffic on port Vulnerability scanner ports If you will be using the Profiler vulnerability scan feature, then you must allow traffic on the port that the Cascade appliance is to use for accessing the vulnerability scanner server. Obtain vulnerability scanner server addresses and port numbers from the administrator of those systems. The default ports are as follows: Nessus: 1241 ncircle: 443 Rapid7: 3780 Qualys: Requires external https access to qualysapi.qualys.com (Note: This is separate from qualysguard.qualys.com.) Foundstone: 3800 Configuration information When you configure the Profiler, you will be asked to provide configuration information. Information that is required to complete the installation is listed in the table that follows with an asterisk (*). Items not marked with an asterisk are optional during installation and can be specified afterwards on the Profiler Configuration > General Settings page if necessary. 6 Profiler, Express, Sensor and Gateway Installation Guide

13 Configuration information Installing the Standard Profiler It may be useful to write the configuration values in the blank column of the checklist below so that you can refer to them during the configuration step or afterward. Profiler host name:* Profiler IP address:* Netmask:* Default gateway:* DNS name resolution for hosts (enable or disable): Primary DNS server IP address: Secondary DNS server IP address: DNS search domain: Primary port settings: (10/100/1000 Mb/s, half- or full-duplex, or auto-negotiate) Switch port settings: The settings of the switch port or hub that the Profiler primary port connects to. (Auto-negotiate is recommended.) NTP server IP addresses:* Applies only if Profiler is being synchronized to an external NTP server. Enter one or more addresses as a commaseparated list. Time Zone: Flow encryption certificate (default or new certificate): For faster installation, use the default encryption certificate shipped with the Profiler and then generate a new certificate later. SNMP information: Profiler is set by default to use SNMP Version 1 and to allow MIB browsing. If you are configuring SNMP at this time, obtain the necessary V1 or V3 information. Outgoing mail server name, port number, and From address. Applies only if you will be specifying a server that Profiler is to use for sending reports or alert notifications. Inside addresses: IP addresses or address ranges of hosts that the Profiler is to track individually. The default values are 10/8,172.16/ 12, /16 Security Profile settings:* You can use either three traffic collection profiles (weekdays, weeknights, and weekends) or four (weekdays, weeknights, Saturdays, and Sundays). After installation, you can define others. You can also specify the times when weekdays begin and end (default times are 9:00 am to 5:00 pm). Password to use for your initial Profiler login:* The default password admin. Profiler, Express, Sensor and Gateway Installation Guide 7

14 Installing the Standard Profiler Licensing strategy New password to enter when prompted to change the initial Profiler password:* Applies only to systems not previously configured. Service Management Leave this set to ByLocation unless you are required to choose another group type for service locations. Licensing strategy Capacity and feature licenses must be activated on the Riverbed licensing web site. Cascade appliances that have been configured and have access to Internet automatically download the license keys that have been assigned to their serial numbers on the licensing web site. If the appliance does not have Internet access, then you must add its license keys manually. The licensing web site provides the flexibility to assign different feature and capacity licenses to different appliances. You can ship appliances to remote locations without concern for which appliance is to have which license. When you have the serial numbers and know where the appliances are deployed in the network, you can make the license assignments on the Riverbed licensing web site. When all the appliances are to be licensed for the same features and capacities, the licensing web site handles this automatically. The appliances can automatically download their licenses without your needing to visit the licensing web site. Downloading and adding license keys If the Profiler is configured and has Internet connectivity, it can download its license keys automatically. Otherwise, someone must the keys from the Riverbed licensing web site and then copy them from the , or copy them directly from the Riverbed licensing web site, and someone must add them to the Profiler manually. Determine which strategy you are using. Will you activate the licenses on the Riverbed licensing web site yourself? Or will someone else do that? If the Profiler you are installing does not have Internet access, how will you ensure that it gets its assigned license keys? Will you them to yourself from the Riverbed licensing site? Will you copy them from the Riverbed licensing site? Or will someone else provide the license keys for you to add to the Profiler manually? Typically, the installer: 1. Mounts, cables and configures this appliance and the other Cascade appliances that were ordered with it. 2. Records the product serial number from the chassis of each appliance. 3. Sends the serial number for each appliance, along with the appliance location on the network, to the network manager. Then the network manager: 1. Logs in to the Riverbed licensing web site. 2. Enters the product serial number of the first Cascade appliance to gain access to the licensing page. The Riverbed licensing page lists the licenses for the appliance. 3. For each serial number, activate the licenses that apply to that serial number. 8 Profiler, Express, Sensor and Gateway Installation Guide

15 Mounting and powering Installing the Standard Profiler Using the Riverbed licensing web site is described after the configuration step. See License activation on page 11. After the licenses have been activated on the Riverbed licensing web site, the license keys can be added to the Profiler either automatically or manually. Automatically adding license keys Cascade appliances that have access to Internet automatically download the license keys that have been assigned to their serial numbers on the licensing web site. If the appliance has been configured to be accessible on the network and if it has access to the Internet, then it automatically downloads its license keys when you click Configure Now on the initial Setup page. If you select the Enable automatic license download from Riverbed option on the Configuration > Licenses page, the appliance checks for any additional licenses once per day. Manually adding license keys If the Profiler does not have access to the Internet, then it is necessary to add the license keys manually. This involves copying and pasting the keys into the Profiler licensing page. You can have the license keys ed to yourself from the licensing web site and copy them from the , or you can copy them directly from the web site. Alternatively, the person who generates the keys on the web site can provide them to you. Once you have the keys, you paste them into the Configuration > Licenses page. Mounting and powering Safety information Follow the safety precautions outlined in the Riverbed Safety and Compliance Guide when installing and setting up your system. The guide contains the safety information in multiple languages. Before you install, operate, or service your system, you must be familiar with the safety information. Note: Failure to follow these safety guidelines can result in injury or damage to the equipment. Mishandling of the equipment voids all warranties. Please read and follow the safety guidelines and installation instructions carefully. CAUTION: Slide/rail mounted equipment is not to be used as a shelf or a work space. Rack mounting the chassis 1. Locate the rails in the shipping carton. 2. Locate the Rack Installation Guide in the documentation kit. 3. Mount the rails in the rack and install the chassis on the rails, as described in the instructions. CAUTION: Observe the safety cautions in the mounting instructions. 4. Connect the power cable to the chassis and to rack power. The system starts up automatically when power is connected. However, you can use the power button to power off the system if necessary. Profiler, Express, Sensor and Gateway Installation Guide 9

16 Installing the Standard Profiler Cabling to the network Cabling to the network 1. Connect a system running a terminal emulation program such as HyperTerminal or Tera Term Pro to the 9-pin D- subminiature Console port connector of the Profiler. 2. Connect the cable from the management network to the Primary connector on the Profiler. Primary Port Connector Console Port Connector Configuring the Standard Profiler 1. On the system connected to the Console port connector, set the terminal emulator for 9600 Baud, 8 data bits, 1 stop bit, no parity bit, and no flow control. 2. Use your terminal emulator to log in through the console port. The default login credentials are: User name: admin Password: admin 3. When the configuration wizard starts, enter the required information at the prompts. 4. When the wizard completes and exits, the system reboots. Wait until the system finishes rebooting before continuing with the next step. 5. On the management network, point your web browser to the IP address you specified in the configuration wizard using the console port Log in to the Profiler user interface. The default credentials are: User name: admin Password: admin The first time you log in to the Profiler user interface, it displays the Setup page. 7. On the Setup page, ensure that all the required fields (marked with an asterisk) are filled in. 10 Profiler, Express, Sensor and Gateway Installation Guide

17 License activation Installing the Standard Profiler 8. At the bottom of the Setup page, click Configure Now. When you click Configure Now, the Profiler automatically fetches the license keys that are assigned to it on the Riverbed licensing web site, if the Profiler has Internet access. If the Profiler does not have access to the Internet, it is necessary to activate the license manually. License activation If the licenses have been activated on the Riverbed licensing web site and the Profiler has downloaded its licensing keys, skip to the next step: Additional configuration on page 13. To confirm that the Profiler has downloaded its license keys from the Riverbed licensing web site, 1. Log in to the Profiler using the admin account user name and the password that you specified in the preceding step. 2. Navigate to the Configuration > Licenses page. If the list of licenses shows more than just the Included license, then skip to Additional configuration on page 13. If the list shows only the Included license, then the Profiler has not downloaded its license keys. Profiler, Express, Sensor and Gateway Installation Guide 11

18 Installing the Standard Profiler License activation 3. Click Fetch Updates Now. If the Profiler has Internet access and the licenses have been activated on the Riverbed licensing web site, then the license keys will be listed within a few minutes. If the Profiler does not have Internet access, or if its licenses have not been activated on the Riverbed licensing site, then it will not be able to fetch its license keys. If you have been given the license keys, enter them manually as described below. If you are responsible for generating the license keys, 1. Go to the Riverbed licensing web site and generate the keys. (See Generating the license keys, next.) 2. Copy the license keys or else them to a machine that has access to the Profiler. 3. Manually add the license keys to the Profiler Configuration > Licenses page. Generating the license keys To generate a license key on the Riverbed licensing site: 1. Ensure that you have product serial number for each appliance. This is located on the rear of the chassis. The number identified as SN is the product serial number. 2. Point your browser to the Riverbed licensing portal: 3. Enter the product serial number. This displays a table listing the serial numbers of all the Cascade products purchased on the same purchase order as the appliance whose serial numbers you entered. 4. If you purchased only one appliance, then the licenses you purchased are already assigned to that appliance. If you purchased more than one appliance, use the drop-down list boxes in the Software column for each serial number to assign the correct licenses to each appliance. Select or multi-select the licenses you want to activate for each appliance. 5. Follow the instructions of the licensing wizard to continue the process and generate the license keys. 6. If the Profiler has Internet access, it automatically downloads the licenses that have been assigned to its serial number. If the Profiler does not have access to Internet and cannot fetch license keys from the Riverbed licensing site, then it is necessary to enter the license keys manually on the Profiler Configuration > Licenses page. To get the keys for entering manually, continue with the next step on the licensing web site. 7. Either choose the option to the license keys to yourself, or else copy the activated license keys from the table. 8. Place the keys in a file that is accessible to the machine you are using for configuring the Profiler. 12 Profiler, Express, Sensor and Gateway Installation Guide

19 Additional configuration Installing the Standard Profiler Manually adding the license keys 1. On the Profiler, navigate to the Configuration > Licenses page and click Add License(s). 2. Paste or type the license keys into the Licenses page. When entering more than one license key, use a commaseparated list. 3. Confirm that the licenses are listed on the Configuration > Licenses page and that the status of each is green. When the license keys have been added, the Profiler is fully functional and ready for additional configuration or for installation verification. Additional configuration Additional configuration tasks, such as specifying configurations that are not available on the Setup page, can be performed by logging in to the Profiler after the licenses have been activated. For example, you may want to set up security profile periods as early as possible. The initial Setup page offers the choice of collecting separate traffic profiles for: Weekdays, weeknights, and weekends, or Weekdays, weekends, Saturdays, and Sundays. If you want to add more profiles or use a different profile scheme, 1. Log in to the Profiler. 2. Go to the Behavior Analysis > Policies page Security tab and click Security Profiles. This opens the Security Profiles page. 3. Click Reconfigure Weekly Scheme to open the profile scheme composer. 4. Specify the days and times of the traffic collection profiles you want to use. When you specify a new security profile scheme, Profiler discards any current baseline information and begins collecting new data. For descriptions of making other configuration changes, refer to the Profiler online help system. Profiler, Express, Sensor and Gateway Installation Guide 13

20 Installing the Standard Profiler Installation verification Installation verification Installation verification requires the Profiler to be receiving traffic data from at least one source. To determine if the Profiler is receiving data, log in and navigate to the System > Devices/Interfaces page. Check the status of the Sensors, Gateways, Sharks or other data source devices on the Devices tab. When a data source comes on line, the Profiler begins collecting data. If no data sources are listed on the System > Devices/Interfaces page Devices tab, then Profiler installation and configuration cannot be verified. Set up at least one data source device (preferably all data source devices) and then perform the installation verification as follows. 1. Go to the Dashboard page and verify that the graphs display data. 2. Go to the System > Information page and assure that all status indications (System and Component, DNS Server) are displaying OK. 14 Profiler, Express, Sensor and Gateway Installation Guide

21 Hardware specifications Installing the Standard Profiler 3. Go to the System > Devices/Interfaces page and assure that each data source that is expected to be available is listed and that no status indicators are red. 4. Go to the Reports > Traffic page. Near the bottom of the Report Criteria section, click Run now. Verify that a traffic report is displayed. (It will take a short time for the report to display.) This completes the installation process. The Profiler can now be turned over to those who are responsible for setting up user accounts and operational parameters. Refer to the online help system for further configuration procedures. Hardware specifications Rack space The Profiler requires a 2U rack space and is best mounted in a 4-post, 19-inch rack or cabinet. It can also be mounted in a 2-post, 19-inch rack, but this requires a deep shelf. Product model: CAP (Regulatory compliance code 2UACA) Dimensions without bezels or mounting flanges: Height: 87.1 mm, 3.4 in. Width mm, 17.2 in. Depth: mm, 25.4 in. Dimensions with all protrusions: Height: 88.9 mm, 3 1/2 in. Width: mm, 19 3/16 in. Depth: mm, 27 in. Weight: 27.2 kg, 60 lbs. Power The Profiler requires: 100V-127V, 50/60 Hz, 5.5A, or 200V-240V, 50/60 Hz, 2.8A Cooling The Profiler requires up to approximately1433 BTU/hour of cooling, depending on the model. Ambient air should be: Operating Air temperature: 10 to 40 C (50 to 95 F) Humidity: 20% to 80% non-condensing Profiler, Express, Sensor and Gateway Installation Guide 15

22 Installing the Standard Profiler Hardware specifications Storage Air temperature: 40 to 65 C ( 40 to 149 F) Humidity: 5% to 95% non-condensing The maximum rate of temperature change should not to exceed 10 C per hour. Console port pin-out The console port uses a DB-9 subminiature connector with standard wiring as follows. Pin Function 1 Data Carrier Detect 2 Receive Data 3 Transmit Data 4 Data Terminal Ready 5 Signal Ground 6 Data Set Ready 7 Request to Send 8 Clear to Send 16 Profiler, Express, Sensor and Gateway Installation Guide

23 CHAPTER 3 Installing the Enterprise Profiler Overview If you are familiar with installing Cascade appliances and your network environment has the necessary ports open between Cascade appliances, then mount the appliance in the rack and skip to Licensing strategy on page 22. If you are unfamiliar with installing Cascade appliances, then start here. The installation process involves the following steps: 1. Unpack, inspect and inventory the shipment. See Inventory and inspection on page Ensure that the mounting location and network environment will accommodate the appliance. See Preparations for installation on page Collect the configuration information you will need. See Configuration information on page Determine how the licenses are to be activated. See Licensing strategy on page Mount the modules (each chassis is a module) in the rack and connect rack power. See Mounting and powering on page Connect the cables to the console port and the primary network port of each module. See Cabling to the network on page With all modules powered on for at least two minutes, run the setup wizard on the console port of each module to make it reachable on the network. The modules must be set up in the following order: Database module User Interface module Analysis module Expansion modules and Dispatcher module (if present) See Configuring the Enterprise Profiler on page Ensure that the licenses for the appliance are activated. See License activation on page Perform additional configuration, as necessary. See Additional configuration on page 28. Profiler, Express, Sensor and Gateway Installation Guide 17

24 Installing the Enterprise Profiler Inventory and inspection 10. Verify that the appliance has been successfully installed. See Installation verification on page 28. Refer to the Hardware specifications on page 29 for dimensions, weight and power requirements. Inventory and inspection 1. Check the shipping documentation to ensure that all cartons have arrived. 2. If you have not already done so, visually inspect each carton for indications of damage. 3. If any cartons are damaged or missing, contact Riverbed Support before continuing. Phone United States and Canada: Phone outside U.S. and Canada: support@riverbed.com Web: 4. Unpack the contents of the shipping cartons and inventory the contents against the shipping documentation. 5. If any components of the order are damaged or missing, contact Riverbed Support. Preparations for installation Before installing the chassis, ensure that the following considerations have been addressed: Mounting location Data sources Cable connections Access to the network Mounting location Cascade Enterprise Profiler appliance modules require 1U and 2U rack spaces in a 4-post, 19-inch rack or cabinet. The User Interface (UI) module, Database (DB) module and Dispatcher (DP) module each require one rack unit (1U). The Analysis and Expansion modules each require two rack units (2U). They should be mounted in a rack that is appropriately sized for the chassis using the rails provided. Additional rails can be purchased from Riverbed using part number RMK-CAP-001. The rack should be properly secured to a level solid surface to prevent tipping or excess shock while the unit is operating. (Operating shock limits are half sine, 2 g peak, 11 msec.) Appliances should never be installed in an unsecured location such as on a table or shelf. They should never be stacked on top of one another. Manufacturing data for the units indicates that premature disk drive failure can result from vibration transmitted between units that are in direct contact with one another. The appliances should be installed so that the ventilation openings on the front and rear of the units are not blocked and so air flows from the front to the rear of the unit to facilitate proper cooling. 18 Profiler, Express, Sensor and Gateway Installation Guide

25 Preparations for installation Installing the Enterprise Profiler Each fan within the appliance is capable of supporting multiple speeds. If the internal ambient temperature of the appliance exceeds the value programmed into the thermal sensor data record (SDR), the BMC firmware increases the speed for all the fans within fan module. Improper cooling can result in the appliance overheating, which could cause premature failure of sensitive components, such as the CPUs. In addition, overheating can result in the fans running at a higher speed for extended periods, which increases the amount of vibration in the appliance. Excess vibration can result in premature disk drive failure. Refer to Hardware specifications on page 29 to ensure that the mounting location accommodates the dimensions, weight, power and cooling requirements of the appliance. Data sources The Profiler obtains traffic information from Riverbed Sensor, Gateway, Shark or AppResponse Xpert appliances. The Profiler must be receiving traffic information from at least one source in order for you to verify successful installation and configuration. There are two approaches to setting up data sources: Set up the available data sources and point them to the IP address of the Profiler before you install it. Install the Profiler up to the point of verification, then go install or configure the data sources, and then return to the Cascade appliance to complete the installation verification. It is preferable to configure all the data sources that are available at the time you install the Cascade appliance. However, Cascade operation can be confirmed with just one data source. Cable connections Power Each Enterprise Profiler module has two power supplies. Plug these into two different circuits, if they are available. Console port The initial setup of each module (chassis) is performed using a console port. Ensure that you have a terminal server or a system running a terminal emulation program such as HyperTerminal or Tera Term Pro. Connect this to the console port of each module using a null modem cable with a 9-pin D-subminiature connector. A cable with a USB connector on the other end is shipped with each module. You can use these with a laptop computer if you are not connecting the console port to a cable in the rack. Any standard serial device connection will work. Primary ports Modules in the Enterprise Profiler communicate with one another by means of a customer-supplied switch. Each module is equipped with a 100/1000baseTX primary management port that must connect to a hub or switch on the management network. The primary port is set by default for auto-negotiation. Ensure that: The management network has a switch port for each Enterprise Profiler module. Straight-through cables are available at the rack locations for connecting the Profiler modules to the switch. (One cable per chassis.) The management network switch port is set to establish a connection at 1000 Mb/s and full duplex. Profiler, Express, Sensor and Gateway Installation Guide 19

26 Installing the Enterprise Profiler Preparations for installation A terminal device (laptop, KVM, etc.) is available on the management network for logging in to the Profiler user interface. Access to the network The Enterprise Profiler uses the management network: For communication between its modules. To access network services. To provide access to its user interface. Communication between Cascade appliances If you lock down your network on a port-by-port basis, ensure that the following ports are open between Cascade appliances: TCP/22 (ssh) This is needed for the Profiler to transfer upgrade packages to other Cascade devices that are connected to it. TCP/8080 Cascade Pilot communicates with the web interface of the Cascade Shark over this port. TCP/8443 Exchange of encryption certificates between Cascade appliances. TCP/41017 Encrypted communication between Profiler and Sensor, Gateway, Shark, and AppResponse Xpert appliances. UDP/123 (ntp) Synchronization of time between a Sensor or Gateway and Profiler. Cascade versions before version 9.5 required TCP ports 8080, and to be open for communication among Cascade Pilot, Shark, and Profiler appliances. These ports are no longer used by version 9.5 and above Cascade products, so they can be closed now. Access to and from network access services TCP/22 (ssh) This is needed for secure shell access to Cascade software components and for the appliance to obtain information from servers via scripts. UDP/161 (snmp) The Profiler uses SNMP to obtain interface information from switches. Also, management systems use this port to read the Cascade appliance MIB. TCP/443 (https) Secure web-based management interfaces. TCP/5432 (odbc) If you will be allowing other applications to access the Profiler internal database via ODBC, then you must allow traffic on this port If you will be using the Profiler user identification feature with a Microsoft Active Directory domain controller, then you must allow traffic on port Vulnerability scanner ports If you will be using the Profiler vulnerability scan feature, then you must allow traffic on the port that the Cascade appliance is to use for accessing the vulnerability scanner server. Obtain vulnerability scanner server addresses and port numbers from the administrator of those systems. The default ports are as follows: Nessus: 1241 ncircle: 443 Rapid7: Profiler, Express, Sensor and Gateway Installation Guide

27 Configuration information Installing the Enterprise Profiler Qualys: Requires external https access to qualysapi.qualys.com (Note: This is separate from qualysguard.qualys.com.) Foundstone: 3800 Configuration information When you configure the Profiler, you will be asked to provide configuration information. Information that is required to complete the installation is listed in the table that follows with an asterisk (*). Items not marked with an asterisk are optional during installation and can be specified afterwards on the Profiler Configuration > General Settings page if necessary. It may be useful to write the configuration values in the blank column of the checklist below so that you can refer to them during the configuration step or afterward. Profiler host name:* Profiler IP address:* Netmask:* Default gateway:* DNS name resolution for hosts (enable or disable): Primary DNS server IP address: Secondary DNS server IP address: DNS search domain: NTP server IP addresses:* Applies only if Profiler is being synchronized to an external NTP server. Enter one or more addresses as a commaseparated list. Time Zone: Flow encryption certificate (default or new certificate): For faster installation, use the default encryption certificate shipped with the Profiler and then generate a new certificate later. Profiler UI Module IP address: * This setting was previously called the Management address. Profiler DB Module IP address: * (The Database module.) Profiler AN Module IP address:* (The first Analysis module.) Profiler EX Module IP address (if present):* (The first Expansion module.) SNMP information: Profiler is set by default to use SNMP Version 1 and to allow MIB browsing. If you are configuring SNMP at this time, obtain the necessary V1 or V3 information. Profiler, Express, Sensor and Gateway Installation Guide 21

28 Installing the Enterprise Profiler Licensing strategy Outgoing mail server name, port number, and From address. Applies only if you will be specifying a server that Profiler is to use for sending reports or alert notifications. Inside addresses: IP addresses or address ranges of hosts that the Profiler is to track individually. The default values are 10/8,172.16/ 12, /16 Security Profile settings:* You can use either three traffic collection profiles (weekdays, weeknights, and weekends) or four (weekdays, weeknights, Saturdays, and Sundays). After installation, you can define others. You can also specify the times when weekdays begin and end (default times are 9:00 am to 5:00 pm). Password to use for your initial Profiler login:* The default password admin. New password to enter when prompted to change the initial Profiler password:* Applies only to systems not previously configured. Service Management Leave this set to ByLocation unless you are required to choose another group type for service locations. Licensing strategy Capacity and feature licenses must be activated on the Riverbed licensing web site. Cascade appliances that have been configured and have access to Internet automatically download the license keys that have been assigned to their serial numbers on the licensing web site. If the appliance does not have Internet access, then you must add its license keys manually. The licensing web site provides the flexibility to assign different feature and capacity licenses to different appliances. You can ship appliances to remote locations without concern for which appliance is to have which license. When you have the serial numbers and know where the appliances are deployed in the network, you can make the license assignments on the Riverbed licensing web site. When all the appliances are to be licensed for the same features and capacities, the licensing web site handles this automatically. The appliances can automatically download their licenses without your needing to visit the licensing web site. Downloading and adding license keys If the Profiler is configured and has Internet connectivity, it can download its license keys automatically. Otherwise, someone must the keys from the Riverbed licensing web site and then copy them from the , or copy them directly from the Riverbed licensing web site, and someone must add them to the Profiler manually. Determine which strategy you are using. Will you activate the licenses on the Riverbed licensing web site yourself? Or will someone else do that? If the Profiler you are installing does not have Internet access, how will you ensure that it gets its assigned license keys? Will you them to yourself from the Riverbed licensing site? Will you copy them from the Riverbed licensing site? Or will someone else provide the license keys for you to add to the Profiler manually? Typically, the installer: 22 Profiler, Express, Sensor and Gateway Installation Guide

29 Mounting and powering Installing the Enterprise Profiler 1. Mounts, cables and configures this appliance and the other Cascade appliances that were ordered with it. 2. Records the product serial number from the chassis of each appliance. The number identified as SN is the product serial number. 3. Sends the serial number for each appliance, along with the appliance location on the network, to the network manager. Then the network manager: 1. Logs in to the Riverbed licensing web site. 2. Enters the product serial number of the first Cascade appliance to gain access to the licensing page. The Riverbed licensing page lists the serial numbers of all Cascade appliances that were included in the same purchase order. 3. For each serial number, activate the licenses that apply to that serial number. Using the Riverbed licensing web site is described after the configuration step. See License activation on page 26. After the licenses have been activated on the Riverbed licensing web site, the license keys can be added to the Profiler either automatically or manually. Automatically adding license keys Cascade appliances that have access to Internet automatically download the license keys that have been assigned to their serial numbers on the licensing web site. If the appliance has been configured to be accessible on the network and if it has access to the Internet, then it automatically downloads its license keys when you click Configure Now on the initial Setup page. If you select the Enable automatic license download from Riverbed option on the Configuration > Licenses page, the appliance checks for any additional licenses once per day. Manually adding license keys If the Profiler does not have access to the Internet, then it is necessary to add the license keys manually. This involves copying and pasting the keys into the Profiler licensing page. You can have the license keys ed to yourself from the licensing web site and copy them from the , or you can copy them directly from the web site. Alternatively, the person who generates the keys on the web site can provide them to you. Once you have the keys, you paste them into the Configuration > Licenses page. Mounting and powering Safety information Follow the safety precautions outlined in the Riverbed Safety and Compliance Guide when installing and setting up your system. The guide contains the safety information in multiple languages. Before you install, operate, or service your system, you must be familiar with the safety information. Note: Failure to follow these safety guidelines can result in injury or damage to the equipment. Mishandling of the equipment voids all warranties. Please read and follow the safety guidelines and installation instructions carefully. Profiler, Express, Sensor and Gateway Installation Guide 23

30 Installing the Enterprise Profiler Cabling to the network CAUTION: Slide/rail mounted equipment is not to be used as a shelf or a work space. Rack mounting the chassis For each module of the Enterprise Profiler: 1. Locate the rails in the shipping carton. 2. Locate the Rack Installation Guide in the documentation kit. 3. Mount the rails in the rack and install the chassis on the rails, as described in the instructions. CAUTION: Observe the safety cautions in the mounting instructions. 4. Connect the power cable to the chassis and to rack power. The system starts up automatically when power is connected. However, you can use the power button to power off the system if necessary. Cabling to the network 1. Connect a system running a terminal emulation program such as HyperTerminal or Tera Term Pro to the 9-pin D- subminiature Console port connector of the Profiler DB module. 2. Connect the cable from the management network to the Primary connector on the Profiler. Each module of the Enterprise Profiler is assigned its network address using its console port. If there are to be permanent connections to the console ports, make those connections now. If you will temporarily connect to each console port in succession, begin with the DB module. The UI module must be set up next, the AN module after that, and any EX or DP modules last. 24 Profiler, Express, Sensor and Gateway Installation Guide

31 Configuring the Enterprise Profiler Installing the Enterprise Profiler Configuring the Enterprise Profiler 1. On the system connected to the Console port connector of the DB module, set the terminal emulator for 9600 Baud, 8 data bits, 1 stop bit, no parity bit, and no flow control. 2. Use your terminal emulator to log in through the console port. The default login credentials are: User name: admin Password: admin 3. When the configuration wizard starts, enter the required information at the prompts. 4. When the wizard completes and exits, the system reboots. Wait until the system finishes rebooting before continuing with the next step. 5. Perform Steps 2 through 4 with the UI module and then with the AN module. If your Enterprise Profiler has additional modules (Expansion modules and a Dispatcher module), assign the network addresses to those modules after completing Steps 2 through 4 on the DB, UI and AN modules. 6. On the management network, point your web browser to the IP address of the UI module, which you specified in the configuration wizard using the console port Log in to the Profiler user interface. The default credentials are: User name: admin Password: admin The first time you log in to the Profiler user interface, it displays the Setup page. Profiler, Express, Sensor and Gateway Installation Guide 25

32 Installing the Enterprise Profiler License activation 8. On the Setup page, ensure that all the required fields (marked with an asterisk) are filled in. 9. At the bottom of the Setup page, click Configure Now. When you click Configure Now, the Profiler automatically fetches the license keys that are assigned to it on the Riverbed licensing web site, if the Profiler has Internet access. If the Profiler does not have access to the Internet, it is necessary to activate the license manually. License activation If the licenses have been activated on the Riverbed licensing web site and the Profiler has downloaded its licensing keys, skip to the next step: Additional configuration on page 28. To confirm that the Profiler has downloaded its license keys from the Riverbed licensing web site, 1. Log in to the Profiler using the admin account user name and the password that you specified in the preceding step. 2. Navigate to the Configuration > Licenses page. If the list of licenses shows more than just the Included license, then skip to Additional configuration on page 28. If the list shows only the Included license, then the Profiler has not downloaded its license keys. 3. Click Fetch Updates Now. If the Profiler has Internet access and the licenses have been activated on the Riverbed licensing web site, then the license keys will be listed within a few minutes. If the Profiler does not have Internet access, or if its licenses have not been activated on the Riverbed licensing site, then it will not be able to fetch its license keys. If you have been given the license keys, enter them manually as described below. If you are responsible for generating the license keys, 1. Go to the Riverbed licensing web site and generate the keys. (See Generating the license keys, next.) 2. Copy the license keys or else them to a machine that has access to the Profiler. 3. Manually add the license keys to the Profiler Configuration > Licenses page. 26 Profiler, Express, Sensor and Gateway Installation Guide

33 License activation Installing the Enterprise Profiler Generating the license keys To generate a license key on the Riverbed licensing site: 1. Ensure that you have product serial number for each appliance. This is located on the rear of the chassis. The number identified as SN is the product serial number. 2. Point your browser to the Riverbed licensing portal: 3. Enter the product serial number. This displays a table listing the serial numbers of all the Cascade products purchased on the same purchase order as the appliance whose serial numbers you entered. 4. Use the drop-down list boxes in the Software column for each serial number to assign the correct licenses to each appliance. Select or multi-select the licenses you want to activate for each Enterprise Profiler module or other Cascade appliance. 5. Follow the instructions of the licensing wizard to continue the process and generate the license keys. 6. If the Profiler has Internet access, it automatically downloads the licenses that have been assigned to its serial number. If the Profiler does not have access to Internet and cannot fetch license keys from the Riverbed licensing site, then it is necessary to enter the license keys manually on the Profiler Configuration > Licenses page. To get the keys for entering manually, continue with the next step on the licensing web site. 7. Either choose the option to the license keys to yourself, or else copy the keys from the Activated License Key column of the table. 8. Place the keys in a file that is accessible to the machine you are using for configuring the Profiler. Manually adding the license keys 1. On the Profiler, navigate to the Configuration > Licenses page and click Add License(s). 2. Paste or type the license keys into the Licenses page. When entering more than one license key, use a commaseparated list. 3. Confirm that the licenses are listed on the Configuration > Licenses page and that the status of each is green. Profiler, Express, Sensor and Gateway Installation Guide 27

34 Installing the Enterprise Profiler Additional configuration When the license keys have been added, the Profiler is fully functional and ready for additional configuration or for installation verification. Additional configuration Additional configuration tasks, such as specifying configurations that are not available on the Setup page, can be performed by logging in to the Profiler after the licenses have been activated. For example, you may want to set up security profile periods as early as possible. The initial Setup page offers the choice of collecting separate traffic profiles for: Weekdays, weeknights, and weekends, or Weekdays, weekends, Saturdays, and Sundays. If you want to add more profiles or use a different profile scheme, 1. Log in to the Profiler. 2. Go to the Behavior Analysis > Policies page Security tab and click Security Profiles. This opens the Security Profiles page. 3. Click Reconfigure Weekly Scheme to open the profile scheme composer. 4. Specify the days and times of the traffic collection profiles you want to use. When you specify a new security profile scheme, Profiler discards any current baseline information and begins collecting new data. For descriptions of making other configuration changes, refer to the Profiler online help system. Installation verification Installation verification requires the Profiler to be receiving traffic data from at least one source. To determine if the Profiler is receiving data, log in and navigate to the System > Devices/Interfaces page. Check the status of the Sensors, Gateways, Sharks or other data source devices on the Devices tab. When a data source comes on line, the Profiler begins collecting data. 28 Profiler, Express, Sensor and Gateway Installation Guide

35 Hardware specifications Installing the Enterprise Profiler If no data sources are listed on the System > Devices/Interfaces page Devices tab, then Profiler installation and configuration cannot be verified. Set up at least one data source device (preferably all data source devices) and then perform the installation verification as follows. 1. Go to the Dashboard page and verify that the graphs display data. 2. Go to the System > Information page and assure that all status indications (System and Component, DNS Server) are displaying OK. 3. Go to the System > Devices/Interfaces page and assure that each data source that is expected to be available is listed and that no status indicators are red. 4. Go to the Reports > Traffic page. Near the bottom of the Report Criteria section, click Run now. Verify that a traffic report is displayed. (It will take a short time for the report to display.) This completes the installation process. The Profiler can now be turned over to those who are responsible for setting up user accounts and operational parameters. Refer to the online help system for further configuration procedures. Hardware specifications Rack space The User Interface (UI) module, Database (DB) module and Dispatcher (DP) module each require one rack unit (1U). The Analysis (AN) and Expansion (EX) modules each require two rack units (2U). 1U Chassis (Regulatory compliance code 1UACA) Product models: CAP UI User Interface module CAP DB Database module CAP DP Dispatcher module Dimensions without bezels or mounting flanges: Height: 43.4 mm, 1.7 in. Width mm, 17.2 in. Depth: mm, 25.4 in. Dimensions with all protrusions: Height: 44.5 mm, 1 3/4 in. Width: mm, 18 7/8 in. Depth: mm, 27 in. Weight: 16.3 kg, 36 lbs. Profiler, Express, Sensor and Gateway Installation Guide 29

36 Installing the Enterprise Profiler Hardware specifications 2U Chassis (Regulatory compliance code 2UACA) Product models: CAP AN Analysis module CAP EX Expansion module Dimensions without bezels or mounting flanges: Height: 87.1 mm, 3.4 in. Width mm, 17.2 in. Depth: mm, 25.4 in. Dimensions with all protrusions: Height: 88.9 mm, 3 1/2 in. Width: mm, 19 3/16 in. Depth: mm, 27 in. Weight: 27.2 kg, 60 lbs. Power The User Interface (UI) module, Database (DB) module and Dispatcher (DP) module each require: 100V-127V, 50/60 Hz, 4.1A, or 200V-240V, 50/60 Hz, 2.1A The Analysis (AN) module and Expansion (EX) module each require: 100V-127V, 50/60 Hz, 5.5A, or 200V-240V, 50/60 Hz, 2.8A Cooling The User Interface (UI) module, Database (DB) module and Dispatcher (DP) module each require approximately819 Btu/hr of cooling. The Analysis (AN) module and Expansion (EX) module each require approximately1433 Btu/hr of cooling. 30 Profiler, Express, Sensor and Gateway Installation Guide

37 Hardware specifications Installing the Enterprise Profiler Ambient air should be: Operating Air temperature: 10 to 40 C (50 to 95 F) Humidity: 20% to 80% non-condensing Storage Air temperature: 40 to 65 C ( 40 to 149 F) Humidity: 5% to 95% non-condensing Console port pin-out The console port uses a DB-9 subminiature connector with standard wiring as follows. Pin Function 1 Data Carrier Detect 2 Receive Data 3 Transmit Data 4 Data Terminal Ready 5 Signal Ground 6 Data Set Ready 7 Request to Send 8 Clear to Send Profiler, Express, Sensor and Gateway Installation Guide 31

38 Installing the Enterprise Profiler Hardware specifications 32 Profiler, Express, Sensor and Gateway Installation Guide

39 CHAPTER 4 Installing the Express and Express 460 Overview If you are familiar with installing Cascade appliances and your network environment has the necessary ports open between Cascade appliances, then mount the appliance in the rack and skip to Licensing strategy on page 39. If you are unfamiliar with installing Cascade appliances, then start here. The installation process involves the following steps: 1. Unpack, inspect and inventory the shipment. See Inventory and inspection on page Ensure that the mounting location and network environment will accommodate the appliance. See Preparations for installation on page Collect the configuration information you will need. See Configuration information on page Determine how the licenses are to be activated. See Licensing strategy on page Mount the appliance in the rack and connect rack power. See Mounting and powering on page Connect the cables to the console port and the primary network port. See Cabling to the network on page Run the setup wizard on the console port to make the appliance reachable on the network. See Configuring the Express on page Ensure that the licenses for the appliance are activated. See License activation on page Perform additional configuration, as necessary. See Additional configuration on page Verify that the appliance has been successfully installed. See Installation verification on page 46. Refer to the Hardware specifications on page 47 for dimensions, weight and power requirements. Profiler, Express, Sensor and Gateway Installation Guide 33

40 Installing the Express and Express 460 Inventory and inspection Inventory and inspection 1. Check the shipping documentation to ensure that all cartons have arrived. 2. If you have not already done so, visually inspect each carton for indications of damage. 3. If any cartons are damaged or missing, contact Riverbed Support before continuing. Phone United States and Canada: Phone outside U.S. and Canada: support@riverbed.com Web: 4. Unpack the contents of the shipping cartons and inventory the contents against the shipping documentation. 5. If any components of the order are damaged or missing, contact Riverbed Support. Preparations for installation Before installing the chassis, ensure that the following considerations have been addressed: Mounting location Data sources Cable connections Access to the network Mounting location Cascade Express appliance requires a 1U rack space in a 4-post, 19-inch rack or cabinet. It should be mounted in a rack that is appropriately sized for the chassis using the rails provided. Additional rails can be purchased from Riverbed using part number RMK-CAP-001. The rack should be properly secured to a level solid surface to prevent tipping or excess shock while the unit is operating. (Operating shock limits are half sine, 2 g peak, 11 msec.) Appliances should never be installed in an unsecured location such as on a table or shelf. They should never be stacked on top of one another. Manufacturing data for the units indicates that premature disk drive failure can result from vibration transmitted between units that are in direct contact with one another. The appliances should be installed so that the ventilation openings on the front and rear of the units are not blocked and so air flows from the front to the rear of the unit to facilitate proper cooling. Each fan within the appliance is capable of supporting multiple speeds. If the internal ambient temperature of the appliance exceeds the value programmed into the thermal sensor data record (SDR), the BMC firmware increases the speed for all the fans within fan module. Improper cooling can result in the appliance overheating, which could cause premature failure of sensitive components, such as the CPUs. In addition, overheating can result in the fans running at a higher speed for extended periods, which increases the amount of vibration in the appliance. Excess vibration can result in premature disk drive failure. 34 Profiler, Express, Sensor and Gateway Installation Guide

41 Preparations for installation Installing the Express and Express 460 Refer to Hardware specifications on page 47 to ensure that the mounting location accommodates the dimensions, weight, power and cooling requirements of the appliance. Data sources The Riverbed Cascade Express obtains traffic information from taps or mirror ports on the monitored network. It can also obtain flow data from NetFlow, IPFIX, Packeteer FDR or sflow sources, or by CascadeFlow from a CascadeFlow compatible Steelhead. Additionally, it can obtain traffic information from Riverbed Sensor, Gateway, Shark or AppResponse Xpert appliances. If the Express is to receive flow data from NetFlow-enabled devices, enable the SNMP ifindex persistence feature of the NetFlow source to ensure consistency of interface reporting. There are two approaches to setting up data sources: Set up the available data sources and point them to the IP address of the Express before you install it. Install the Express up to the point of verification, then go install or configure the data sources, and then return to the Cascade appliance to complete the installation verification. It is preferable to configure all the data sources that are available at the time you install the Cascade appliance. However, Cascade operation can be confirmed with just one data source. Cable connections Power The Cascade appliance has two power supplies. Plug these into two different circuits, if they are available. Console port The initial setup of the Cascade appliance is performed using a console port. Ensure that you have a terminal server or a system running a terminal emulation program such as HyperTerminal or Tera Term Pro. Connect this to the Cascade appliance console port using a null modem cable with a 9-pin D-subminiature connector. Any standard serial device connection will work. Primary port The Express is equipped with a 100/1000baseTX primary management port that must connect to a hub or switch on the management network. The primary port is set by default for auto-negotiation. Ensure that: A straight-through cable to a hub or switch port on the management network is available at the rack location. The management network switch port is set to establish a connection at 100 or 1000 Mb/s and full duplex. A terminal device (laptop, KVM, etc.) is available on the management network for logging in to the Express user interface. Auxiliary Port Optionally, the Aux port can be configured. This is useful if you what to keep network data and network control traffic on separate networks. Ensure that: A straight-through cable to a hub or switch port on the network is available at the rack location. Profiler, Express, Sensor and Gateway Installation Guide 35

42 Installing the Express and Express 460 Preparations for installation The network switch port is set to establish a connection at 100 or 1000 Mb/s and full duplex. Traffic monitoring ports All Cascade Express appliances have four electrical ports with 10/100/1000baseTX (RJ45) connectors. These connect via straight-through cables to taps or mirror ports on the monitored network. Some models also have two 10 Gb/s optical ports that support both LR and SR SFP modules with LC connectors. These connect via single mode (LR) or multimode (SR) optical fiber cables to taps or mirror ports on the monitored network. Ensure that the necessary taps or mirror ports are set up and that the correct electrical or optical cables are available in the rack where the Express is to be installed. Access to the network The Express uses the management network to communicate with other Cascade appliances and to access network services. Communication between Cascade appliances If you lock down your network on a port-by-port basis, ensure that the following ports are open between Cascade appliances: TCP/22 (ssh) This is needed for the Express to transfer upgrade packages to other Cascade devices that are connected to it. TCP/8080 Cascade Pilot communicates with the web interface of the Cascade Shark over this port. TCP/8443 Exchange of encryption certificates between Cascade appliances. TCP/41017 Encrypted communication between Express and Sensor, Gateway, Shark, and AppResponse Xpert appliances. UDP/123 (ntp) Synchronization of time between a Sensor or Gateway and Express. Cascade versions before version 9.5 required TCP ports 8080, and to be open for communication among Cascade Pilot, Shark, and Profiler appliances. These port are no longer used by version 9.5 and above Cascade products, so they can be closed now. Access to and from network access services TCP/22 (ssh) This is needed for secure shell access to Cascade software components and for the appliance to obtain information from servers via scripts. UDP/161 (snmp) The Express uses SNMP to obtain interface information from switches. Also, management systems use this port to read the Cascade appliance MIB. TCP/443 (https) Secure web-based management interfaces. TCP/5432 (odbc) If you will be allowing other applications to access the Express internal database via ODBC, then you must allow traffic on this port If you will be using the Express user identification feature with a Microsoft Active Directory domain controller, then you must allow traffic on port Profiler, Express, Sensor and Gateway Installation Guide

43 Configuration information Installing the Express and Express 460 Vulnerability scanner ports If you will be using the Express vulnerability scan feature, then you must allow traffic on the port that the Cascade appliance is to use for accessing the vulnerability scanner server. Obtain vulnerability scanner server addresses and port numbers from the administrator of those systems. The default ports are as follows: Nessus: 1241 ncircle: 443 Rapid7: 3780 Qualys: Requires external https access to qualysapi.qualys.com (Note: This is separate from qualysguard.qualys.com.) Foundstone: 3800 Configuration information When you configure the Express, you will be asked to provide configuration information. Information that is required to complete the installation is listed in the table that follows with an asterisk (*). Items not marked with an asterisk are optional during installation and can be specified afterwards on the Express Configuration > General Settings page if necessary. It may be useful to write the configuration values in the blank column of the checklist below so that you can refer to them during the configuration step or afterward. Express host name:* Express IP address:* Netmask:* Default gateway:* DNS name resolution for hosts (enable or disable): Primary DNS server IP address: Secondary DNS server IP address: DNS search domain: Primary port settings: (10/100/1000 Mb/s, half- or full-duplex, or auto-negotiate) Switch port settings: The settings of the switch port or hub that the Express primary port connects to. (Auto-negotiate is recommended.) Aux interface IP address Aux interface netmask Aux interface switch port settings Monitored network port settings - mon0_0 10/100/1000 Mb/s, half- or full-duplex, or auto-negotiate Monitored network port settings - mon0_1 10/100/1000 Mb/s, half- or full-duplex, or auto-negotiate Profiler, Express, Sensor and Gateway Installation Guide 37

44 Installing the Express and Express 460 Configuration information Monitored network port settings - mon0_2 10/100/1000 Mb/s, half- or full-duplex, or auto-negotiate Monitored network port settings - mon0_3 10/100/1000 Mb/s, half- or full-duplex, or auto-negotiate Packet Deduplication Enable packet deduplication if your network configuration might cause the Cascade appliance to see duplicated packets. NTP server IP addresses:* Applies only if Express is being synchronized to an external NTP server. Enter one or more addresses as a commaseparated list. Time Zone: Flow encryption certificate (default or new certificate): For faster installation, use the default encryption certificate shipped with the Express and then generate a new certificate later. NetFlow port: Applies only if Express is receiving NetFlow data (versions 1, 5, 7 or 9), IPFIX data, or CascadeFlow data. Do not send more than one type of flow data to the same port. sflow port: Applies only if Express is receiving sflow data (versions 2, 4 or 5). Do not send more than one type of flow data to the same port. Packeteer port: Applies only if Express is receiving Packeteer Flow Detail Records (versions 1 or 2). Do not send more than one type of flow data to the same port. SNMP information: Express is set by default to use SNMP Version 1 and to allow MIB browsing. If you are configuring SNMP at this time, obtain the necessary V1 or V3 information. Outgoing mail server name, port number, and From address. Applies only if you will be specifying a server that Express is to use for sending reports or alert notifications. Inside addresses: IP addresses or address ranges of hosts that the Express is to track individually. The default values are 10/8,172.16/ 12, /16 Security Profile settings:* You can use either three traffic collection profiles (weekdays, weeknights, and weekends) or four (weekdays, weeknights, Saturdays, and Sundays). After installation, you can define others. You can also specify the times when weekdays begin and end (default times are 9:00 am to 5:00 pm). Password to use for your initial Express login:* The default password admin. 38 Profiler, Express, Sensor and Gateway Installation Guide

45 Licensing strategy Installing the Express and Express 460 New password to enter when prompted to change the initial Express password:* Applies only to systems not previously configured. Service Management Leave this set to ByLocation unless you are required to choose another group type for service locations. Licensing strategy Capacity and feature licenses must be activated on the Riverbed licensing web site. Cascade appliances that have been configured and have access to Internet automatically download the license keys that have been assigned to their serial numbers on the licensing web site. If the appliance does not have Internet access, then you must add its license keys manually. The licensing web site provides the flexibility to assign different feature and capacity licenses to different appliances. You can ship appliances to remote locations without concern for which appliance is to have which license. When you have the serial numbers and know where the appliances are deployed in the network, you can make the license assignments on the Riverbed licensing web site. When all the appliances are to be licensed for the same features and capacities, the licensing web site handles this automatically. The appliances can automatically download their licenses without your needing to visit the licensing web site. Downloading and adding license keys If the Express is configured and has Internet connectivity, it can download its license keys automatically. Otherwise, someone must the keys from the Riverbed licensing web site and then copy them from the , or copy them directly from the Riverbed licensing web site, and someone must add them to the Express manually. Determine which strategy you are using. Will you activate the licenses on the Riverbed licensing web site yourself? Or will someone else do that? If the Express you are installing does not have Internet access, how will you ensure that it gets its assigned license keys? Will you them to yourself from the Riverbed licensing site? Will you copy them from the Riverbed licensing site? Or will someone else provide the license keys for you to add to the Express manually? Typically, the installer: 1. Mounts, cables and configures this appliance and the other Cascade appliances that were ordered with it. 2. Records the product serial number from the chassis of each appliance. The number identified as SN is the product serial number. 3. Sends the serial number for each appliance, along with the appliance location on the network, to the network manager. Then the network manager: 1. Logs in to the Riverbed licensing web site. 2. Enters the product serial number of the first Cascade appliance to gain access to the licensing page. The Riverbed licensing page lists the serial numbers of all Cascade appliances that were included in the same purchase order. Profiler, Express, Sensor and Gateway Installation Guide 39

46 Installing the Express and Express 460 Mounting and powering 3. For each serial number, activate the licenses that apply to that serial number. Using the Riverbed licensing web site is described after the configuration step. See License activation on page 42. After the licenses have been activated on the Riverbed licensing web site, the license keys can be added to the Express either automatically or manually. Automatically adding license keys Cascade appliances that have access to Internet automatically download the license keys that have been assigned to their serial numbers on the licensing web site. If the appliance has been configured to be accessible on the network and if it has access to the Internet, then it automatically downloads its license keys when you click Configure Now on the initial Setup page. If you select the Enable automatic license download from Riverbed option on the Configuration > Licenses page, the appliance checks for any additional licenses once per day. Manually adding license keys If the Express does not have access to the Internet, then it is necessary to add the license keys manually. This involves copying and pasting the keys into the Express licensing page. You can have the license keys ed to yourself from the licensing web site and copy them from the , or you can copy them directly from the web site. Alternatively, the person who generates the keys on the web site can provide them to you. Once you have the keys, you paste them into the Configuration > Licenses page. Mounting and powering Safety information Follow the safety precautions outlined in the Riverbed Safety and Compliance Guide when installing and setting up your system. The guide contains the safety information in multiple languages. Before you install, operate, or service your system, you must be familiar with the safety information. Note: Failure to follow these safety guidelines can result in injury or damage to the equipment. Mishandling of the equipment voids all warranties. Please read and follow the safety guidelines and installation instructions carefully. CAUTION: Slide/rail mounted equipment is not to be used as a shelf or a work space. Rack mounting the chassis 1. Locate the rails in the shipping carton. 2. Locate the Rack Installation Guide in the documentation kit. 3. Mount the rails in the rack and install the chassis on the rails, as described in the instructions. CAUTION: Observe the safety cautions in the mounting instructions. 40 Profiler, Express, Sensor and Gateway Installation Guide

47 Cabling to the network Installing the Express and Express Connect the power cable to the chassis and to rack power. The system starts up automatically when power is connected. However, you can use the power button to power off the system if necessary. Cabling to the network 1. Connect a system running a terminal emulation program such as HyperTerminal or Tera Term Pro to the 9-pin D- subminiature Console port connector of the Express. 2. Connect the cable from the management network to the Primary connector on the Express. 3. Connect the electrical Ethernet cables from the taps or mirror ports to the monitoring port connectors mon0_0 through mon0_3. 4. If the Express has 10 Gbs fiber ports, connect the optical cables from the taps or mirror ports to the monitoring port connectors mon1_0 and mon1_2. 5. If your appliance has additional monitoring ports, refer to the sticker on the top cover of the chassis for the connector positions. Make additional cable connections as necessary. Configuring the Express 1. On the system connected to the Console port connector, set the terminal emulator for 9600 Baud, 8 data bits, 1 stop bit, no parity bit, and no flow control. 2. Use your terminal emulator to log in through the console port. The default login credentials are: User name: admin Password: admin 3. When the configuration wizard starts, enter the required information at the prompts. 4. When the wizard completes and exits, the system reboots. Wait until the system finishes rebooting before continuing with the next step. 5. On the management network, point your web browser to the IP address you specified in the configuration wizard using the console port Log in to the Express user interface. The default credentials are: Profiler, Express, Sensor and Gateway Installation Guide 41

48 Installing the Express and Express 460 License activation User name: admin Password: admin The first time you log in to the Express user interface, it displays the Setup page.on the Setup page, ensure that all the required fields (marked with an asterisk) are filled in. 7. At the bottom of the Setup page, click Configure Now. When you click Configure Now, the Express automatically fetches the license keys that are assigned to it on the Riverbed licensing web site, if the Express has Internet access. If the Express does not have access to the Internet, it is necessary to activate the license manually. License activation If the licenses have been activated on the Riverbed licensing web site and the Express has downloaded its licensing keys, skip to the next step: Additional configuration on page 44. To confirm that the Express has downloaded its license keys from the Riverbed licensing web site, 1. Log in to the Express using the admin account user name and the password that you specified in the preceding step. 2. Navigate to the Configuration > Licenses page. If the list of licenses shows more than just the Included license, then skip to Additional configuration on page 44. If the list shows only the Included license, then the Express has not downloaded its license keys. 3. Click Fetch Updates Now. If the Express has Internet access and the licenses have been activated on the Riverbed licensing web site, then the license keys will be listed within a few minutes. If the Express does not have Internet access, or if its licenses have not been activated on the Riverbed licensing site, then it will not be able to fetch its license keys. 42 Profiler, Express, Sensor and Gateway Installation Guide

49 License activation Installing the Express and Express 460 If you have been given the license keys, enter them manually as described below. If you are responsible for generating the license keys, 1. Go to the Riverbed licensing web site and generate the keys. (See Generating the license keys, next.) 2. Copy the license keys or else them to a machine that has access to the Express. 3. Manually add the license keys to the Express Configuration > Licenses page. Generating the license keys To generate a license key on the Riverbed licensing site: 1. Ensure that you have product serial number for each appliance. This is located on the rear of the chassis. The number identified as SN is the product serial number. 2. Point your browser to the Riverbed licensing portal: 3. Enter the product serial number. This displays a table listing the serial numbers of all the Cascade products purchased on the same purchase order as the appliance whose serial numbers you entered. 4. If you purchased only one appliance, then the licenses you purchased are already assigned to that appliance. If you purchased more than one appliance, use the drop-down list boxes in the Software column for each serial number to assign the correct licenses to each appliance. Select or multi-select the licenses you want to activate for each appliance. 5. Follow the instructions of the licensing wizard to continue the process and generate the license keys. Profiler, Express, Sensor and Gateway Installation Guide 43

50 Installing the Express and Express 460 Additional configuration 6. If the Express has Internet access, it automatically downloads the licenses that have been assigned to its serial number. If the Express does not have access to Internet and cannot fetch license keys from the Riverbed licensing site, then it is necessary to enter the license keys manually on the Express Configuration > Licenses page. To get the keys for entering manually, continue with the next step on the licensing web site. 7. Either choose the option to the license keys to yourself, or else copy the activated license keys from the table. 8. Place the keys in a file that is accessible to the machine you are using for configuring the Express. Manually adding the license keys 1. On the Express, navigate to the Configuration > Licenses page and click Add License(s). 2. Paste or type the license keys into the Licenses page. When entering more than one license key, use a commaseparated list. 3. Confirm that the licenses are listed on the Configuration > Licenses page and that the status of each is green. When the license keys have been added, the Express is fully functional and ready for additional configuration or for installation verification. Additional configuration The Express appliance can be configured to receive flow data from flow data collectors. It can be configured to receive flow data on the Management interface, the Aux interface, or both. If necessary, you can specify static routes. Additionally, it can use data profile periods other than the default settings on the initial Setup page. Configuring the Aux interface To enable the Aux interface, 1. Go to the Configuration > General Settings page and scroll to the Aux Interface Configuration section. 2. Enter the IP address, netmask and connection settings for the Aux interface. 3. Select the Configure AUX Interface option. 44 Profiler, Express, Sensor and Gateway Installation Guide

51 Additional configuration Installing the Express and Express 460 Specifying static routes If there are multiple subnets on the Aux interface network, or if you need to use a gateway router other than the default gateway, it may be necessary to define static routes. Use the Static Routes section of the Configuration > General Settings page to specify static routes as necessary. Specifying ports on which the Express is to receive flow data In addition to monitoring traffic on taps and mirror ports, the Express appliance can also receive flow data from flow data collectors. For it to do this, you must specify the types of flow data and the ports on which they are to be received. 1. Go to the Configuration > General Settings page and scroll to the Data Sources section. 2. Select the data type and enter the port number or numbers on which the Express is to receive it. The Express does not require flow data to use particular ports. However, you must identify the port that the sending device is configured to send to. Each port can receive only one type of flow data. 3. If you are using the Aux interface, select which interface(s) are to receive flow data. 4. Click Configure Now at the bottom of the page to apply the settings. The number of sources that you can configure to send flow data to the Express depends on the amount of data each is sending. The total from all sources combined must not exceed the capacity of the Express. Refer to your license agreement for the flow capacity of your Express appliance. Specifying traffic profile periods The initial Setup page offers the choice of collecting separate traffic profiles for: Weekdays, weeknights, and weekends, or Weekdays, weekends, Saturdays, and Sundays. If you want to add more profiles or use a different profile scheme, 1. Log in to the Express. 2. Go to the Behavior Analysis > Policies page Security tab and click Security Profiles. This opens the Security Profiles page. 3. Click Reconfigure Weekly Scheme to open the profile scheme composer. Profiler, Express, Sensor and Gateway Installation Guide 45

52 Installing the Express and Express 460 Installation verification 4. Specify the days and times of the traffic collection profiles you want to use. When you specify a new security profile scheme, Express discards any current baseline information and begins collecting new data. For descriptions of making other configuration changes, refer to the Express online help system. Installation verification Installation verification requires the Express to be receiving traffic data from at least one source. To determine if the Express is receiving data, log in and navigate to the System > Devices/Interfaces page. Check the status of the Sensors, Gateways, Sharks or other data source devices on the Devices tab. When a data source comes on line, the Express begins collecting data. If no data sources are listed on the System > Devices/Interfaces page Devices tab, then Express installation and configuration cannot be verified. Set up at least one data source device (preferably all data source devices) and then perform the installation verification as follows. 1. Go to the Dashboard page and verify that the graphs display data. 2. Go to the System > Information page and assure that all status indications (System and Component, DNS Server) are displaying OK. 3. Go to the System > Devices/Interfaces page and assure that each data source that is expected to be available is listed and that no status indicators are red. 4. Go to the Reports > Traffic page. Near the bottom of the Report Criteria section, click Run now. Verify that a traffic report is displayed. (It will take a short time for the report to display.) This completes the installation process. The Express can now be turned over to those who are responsible for setting up user accounts and operational parameters. Refer to the online help system for further configuration procedures. 46 Profiler, Express, Sensor and Gateway Installation Guide

53 Hardware specifications Installing the Express and Express 460 Hardware specifications Rack space The Express requires a 1U rack space and is best mounted in a 4-post, 19-inch rack or cabinet. It can also be mounted in a 2-post, 19-inch rack, but this requires a deep shelf. Product models: CAX and CAX (Regulatory compliance code 1UACA) Dimensions without bezels or mounting flanges: Height: 87.1 mm, 3.4 in. Width mm, 17.2 in. Depth: mm, 25.4 in. Dimensions with all protrusions: Height: 88.9 mm, 3 1/2 in. Width: mm, 19 3/16 in. Depth: mm, 27 in. Weight: 27.2 kg, 60 lbs. Power The Express requires: 100V-127V, 50/60 Hz, 4.1A, or 200V-240V, 50/60 Hz, 2.1A Cooling The Express requires up to approximately1024 Btu/hour of cooling, depending on the model. Ambient air should be: Operating Air temperature: 10 to 40 C (50 to 95 F) Humidity: 20% to 80% non-condensing Storage Air temperature: 40 to 65 C ( 40 to 149 F) Humidity: 5% to 95% non-condensing Profiler, Express, Sensor and Gateway Installation Guide 47

54 Installing the Express and Express 460 Hardware specifications Console port pin-out The console port uses a DB-9 subminiature connector with standard wiring as follows. Pin Function 1 Data Carrier Detect 2 Receive Data 3 Transmit Data 4 Data Terminal Ready 5 Signal Ground 6 Data Set Ready 7 Request to Send 8 Clear to Send 48 Profiler, Express, Sensor and Gateway Installation Guide

55 CHAPTER 5 Installing the Gateway Overview If you are familiar with installing Cascade appliances and your network environment has the necessary ports open between Cascade appliances, then mount the appliance in the rack and skip to Licensing strategy on page 54. If you are unfamiliar with installing Cascade appliances, then start here. The installation process involves the following steps: 1. Unpack, inspect and inventory the shipment. See Inventory and inspection on page Ensure that the mounting location and network environment will accommodate the appliance. See Preparations for installation on page Collect the configuration information you will need. See Configuration information on page Determine how the licenses are to be activated. See Licensing strategy on page Mount the appliance in the rack and connect rack power. See Mounting and powering on page Connect the cables to the console port and the primary network port. See Cabling to the network on page Run the setup wizard on the console port to make the appliance reachable on the network. See Configuring the Gateway on page Ensure that the licenses for the appliance are activated. See License activation on page Perform additional configuration, as necessary. See Additional configuration on page Verify that the appliance has been successfully installed. See Installation verification on page 62. Refer to the Hardware specifications on page 63 for dimensions, weight and power requirements. Profiler, Express, Sensor and Gateway Installation Guide 49

56 Installing the Gateway Inventory and inspection Inventory and inspection 1. Check the shipping documentation to ensure that all cartons have arrived. 2. If you have not already done so, visually inspect each carton for indications of damage. 3. If any cartons are damaged or missing, contact Riverbed Support before continuing. Phone United States and Canada: Phone outside U.S. and Canada: support@riverbed.com Web: 4. Unpack the contents of the shipping cartons and inventory the contents against the shipping documentation. 5. If any components of the order are damaged or missing, contact Riverbed Support. Preparations for installation Before installing the chassis, ensure that the following considerations have been addressed: Mounting location Data sources Cable connections Access to the network Mounting location Cascade Gateway appliance requires a 1U rack space in a 4-post, 19-inch rack or cabinet. It should be mounted in a rack that is appropriately sized for the chassis using the rails provided. Additional rails can be purchased from Riverbed using part number RMK-CAP-001. The rack should be properly secured to a level solid surface to prevent tipping or excess shock while the unit is operating. (Operating shock limits are half sine, 2 g peak, 11 ms) Appliances should never be installed in an unsecured location such as on a table or shelf. They should never be stacked on top of one another. Manufacturing data for the units indicates that premature disk drive failure can result from vibration transmitted between units that are in direct contact with one another. The appliances should be installed so that the ventilation openings on the front and rear of the units are not blocked and so air flows from the front to the rear of the unit to facilitate proper cooling. Each fan within the appliance is capable of supporting multiple speeds. If the internal ambient temperature of the appliance exceeds the value programmed into the thermal sensor data record (SDR), the BMC firmware increases the speed for all the fans within fan module. Improper cooling can result in the appliance overheating, which could cause premature failure of sensitive components, such as the CPUs. In addition, overheating can result in the fans running at a higher speed for extended periods, which increases the amount of vibration in the appliance. Excess vibration can result in premature disk drive failure. 50 Profiler, Express, Sensor and Gateway Installation Guide

57 Preparations for installation Installing the Gateway Refer to Hardware specifications on page 63 to ensure that the mounting location accommodates the dimensions, weight, power and cooling requirements of the appliance. Data sources The Riverbed Cascade Gateway obtains traffic information from NetFlow, IPFIX, Packeteer FDR or sflow sources, or by CascadeFlow from a CascadeFlow compatible Steelhead. Enable the SNMP ifindex persistence feature of the NetFlow source devices to ensure consistency of interface reporting. There are two approaches to setting up data sources: Set up the available data sources and point them to the IP address of the Gateway before you install it. Install the Gateway up to the point of verification, then go install or configure the data sources, and then return to the Cascade appliance to complete the installation verification. It is preferable to configure all the data sources that are available at the time you install the Cascade appliance. However, Cascade operation can be confirmed with just one data source. Cable connections Power The Cascade appliance has two power supplies. Plug these into two different circuits, if they are available. Console port The initial setup of the Cascade appliance is performed using a console port. Ensure that you have a terminal server or a system running a terminal emulation program such as HyperTerminal or Tera Term Pro. Connect this to the Cascade appliance console port using a null modem cable with a 9-pin D-subminiature connector. Any standard serial device connection will work. Primary port The Gateway is equipped with a 100/1000baseTX primary management port that must connect to a hub or switch on the management network. The primary port is set by default for auto-negotiation. Ensure that: A straight-through cable to a hub or switch port on the management network is available at the rack location. The management network switch port is set to establish a connection at 100 or 1000 Mb/s and full duplex. A terminal device (laptop, KVM, etc.) is available on the management network for logging in to the Gateway user interface. Auxiliary Port Optionally, the Aux port can be configured. This is useful if you what to keep network data and network control traffic on separate networks. Ensure that: A straight-through cable to a hub or switch port on the network is available at the rack location. The network switch port is set to establish a connection at 100 or 1000 Mb/s and full duplex. Profiler, Express, Sensor and Gateway Installation Guide 51

58 Installing the Gateway Configuration information Access to the network The Gateway uses the management network to communicate with other Cascade appliances and to access network services. Communication between Cascade appliances If you lock down your network on a port-by-port basis, ensure that the following ports are open between Cascade appliances: TCP/22 (ssh) This is needed for the Gateway to receive upgrade packages from a Profiler. TCP/8443 Exchange of encryption certificates between the Gateway and a Profiler. TCP/41017 Encrypted communication between the Gateway and a Profiler. UDP/123 (ntp) Synchronization of time between the Gateway and a Profiler. Access to and from network access services TCP/22 (ssh) This is needed for secure shell access to Cascade software components. TCP/443 (https) Secure web-based management interface. Configuration information When you configure the Gateway, you will be asked to provide configuration information. Information that is required to complete the installation is listed in the table that follows with an asterisk (*). Items not marked with an asterisk are optional during installation and can be specified afterwards on the Gateway Configuration > General Settings page if necessary. It may be useful to write the configuration values in the blank column of the checklist below so that you can refer to them during the configuration step or afterward. Gateway host name:* Gateway IP address:* Netmask:* Default gateway:* DNS name resolution for hosts (enable or disable): Primary DNS server IP address: Secondary DNS server IP address: DNS search domain: Primary port settings: (10/100/1000 Mb/s, half- or full-duplex, or auto-negotiate) Switch port settings: The settings of the switch port or hub that the Gateway primary port connects to. (Auto-negotiate is recommended.) Aux interface IP address Aux interface netmask 52 Profiler, Express, Sensor and Gateway Installation Guide

59 Configuration information Installing the Gateway Aux interface switch port settings Time Zone: Flow encryption certificate (default or new certificate): For faster installation, use the default encryption certificate shipped with the Gateway and then generate a new certificate later. SNMP information: Gateway is set by default to use SNMP Version 1 and to allow MIB browsing. If you are configuring SNMP at this time, obtain the necessary V1 or V3 information. Data Sources - Use NetFlow Specify the port number on which the Gateway will receive the data. Applies only if the Gateway is receiving NetFlow data (versions 1, 5, 7 or 9), IPFIX, CascadeFlow, or cflow data. Do not send more than one type of flow data to the same port. Data Sources - Use sflow Specify the port number on which the Gateway will receive the data. Applies only if the Gateway is receiving sflow data (versions 2, 4 or 5). Do not send more than one type of flow data to the same port. Data Sources - Use Packeteer Specify the port number on which the Gateway will receive the data. Applies only if the Gateway is receiving Packeteer Flow Detail Records (versions 1 or 2). Do not send more than one type of flow data to the same port. SNMP information: Profiler is set by default to use SNMP Version 1 and to allow MIB browsing. If you are configuring SNMP at this time, obtain the necessary V1 or V3 information. First Profiler data input address. The address of the Profiler to which the Gateway will send traffic data. This is the IP address of the management interface (Primary port) of an Express or Standard Profiler or the address of the first Analysis Module of an Enterprise Profiler. If data sent to this Profiler is to be limited to only data received from certain flow sources, then specify those sources. Second Profiler data input address. If the Gateway will be sending traffic data to more than one Profiler, this is the IP address of the second Profiler. It is the management interface (Primary port) of an Express or Standard Profiler or the address of the Analysis Module of an Enterprise Profiler. If flow forwarding to this Profiler is to be limited to only data received from certain flow sources, then specify those sources Profiler IP Address: Flow sources: Profiler IP Address: Flow sources: Profiler, Express, Sensor and Gateway Installation Guide 53

60 Installing the Gateway Licensing strategy Data Forward - Destination 1 IP address and port number of the first destination to which the Gateway is to forward flow data, the type of data (e.g., NetFlow) to be forwarded, and whether or not the source address of the forwarded packets should be overwritten with the source address from which they were received. If flow forwarding to this destination is to be limited to data received from only certain flow sources, then specify those sources. Data Forward - Destination 2 IP address and port number of the second destination to which the Gateway is to forward flow data, the type of data (e.g., NetFlow) to be forwarded, and whether or not the source address of the forwarded packets should be overwritten with the source address from which they were received. If flow forwarding to this destination is to be limited to data received from only certain flow sources, then specify those sources. IP address: Port: Type: Source: Overwrite source address? Yes/No: IP address: Port: Type: Source: Overwrite source address? Yes/No: Password to use for your initial Gateway login:* The default password admin. New password to enter when prompted to change the initial Gateway password:* Applies only to systems not previously configured. Licensing strategy Capacity and feature licenses must be activated on the Riverbed licensing web site. Cascade appliances that have been configured and have access to Internet automatically download the license keys that have been assigned to their serial numbers on the licensing web site. If the appliance does not have Internet access, then you must add its license keys manually. The licensing web site provides the flexibility to assign different feature and capacity licenses to different appliances. You can ship appliances to remote locations without concern for which appliance is to have which license. When you have the serial numbers and know where the appliances are deployed in the network, you can make the license assignments on the Riverbed licensing web site. When all the appliances are to be licensed for the same features and capacities, the licensing web site handles this automatically. The appliances can automatically download their licenses without your needing to visit the licensing web site. Downloading and adding license keys If the Gateway is configured and has Internet connectivity, it can download its license keys automatically. Otherwise, someone must the keys from the Riverbed licensing web site and then copy them from the , or copy them directly from the Riverbed licensing web site, and someone must add them to the Gateway manually. Determine which strategy you are using. Will you activate the licenses on the Riverbed licensing web site yourself? Or will someone else do that? If the Gateway you are installing does not have Internet access, how will you ensure that it gets its assigned license keys? Will you them to yourself from the Riverbed licensing site? Will you copy them from the Riverbed licensing site? Or will someone else provide the license keys for you to add to the Gateway manually? 54 Profiler, Express, Sensor and Gateway Installation Guide

61 Mounting and powering Installing the Gateway Typically, the installer: 1. Mounts, cables and configures this appliance and the other Cascade appliances that were ordered with it. 2. Records the product serial number from the chassis of each appliance. The number identified as SN is the product serial number. 3. Sends the serial number for each appliance, along with the appliance location on the network, to the network manager. Then the network manager: 1. Logs in to the Riverbed licensing web site. 2. Enters the product serial number of the first Cascade appliance to gain access to the licensing page. The Riverbed licensing page lists the serial numbers of all Cascade appliances that were included in the same purchase order. 3. For each serial number, activate the licenses that apply to that serial number. Using the Riverbed licensing web site is described after the configuration step. See License activation on page 58. After the licenses have been activated on the Riverbed licensing web site, the license keys can be added to the Gateway either automatically or manually. Automatically adding license keys Cascade appliances that have access to Internet automatically download the license keys that have been assigned to their serial numbers on the licensing web site. If the appliance has been configured to be accessible on the network and if it has access to the Internet, then it automatically downloads its license keys when you click Configure Now on the initial Setup page. If you select the Enable automatic license download from Riverbed option on the Configuration > Licenses page, the appliance checks for any additional licenses once per day. Manually adding license keys If the Gateway does not have access to the Internet, then it is necessary to add the license keys manually. This involves copying and pasting the keys into the Gateway licensing page. You can have the license keys ed to yourself from the licensing web site and copy them from the , or you can copy them directly from the web site. Alternatively, the person who generates the keys on the web site can provide them to you. Once you have the keys, you paste them into the Configuration > Licenses page. Mounting and powering Safety information Follow the safety precautions outlined in the Riverbed Safety and Compliance Guide when installing and setting up your system. The guide contains the safety information in multiple languages. Before you install, operate, or service your system, you must be familiar with the safety information. Profiler, Express, Sensor and Gateway Installation Guide 55

62 Installing the Gateway Cabling to the network Note: Failure to follow these safety guidelines can result in injury or damage to the equipment. Mishandling of the equipment voids all warranties. Please read and follow the safety guidelines and installation instructions carefully. CAUTION: Slide/rail mounted equipment is not to be used as a shelf or a work space. Rack mounting the chassis 1. Locate the rails in the shipping carton. 2. Locate the Rack Installation Guide in the documentation kit. 3. Mount the rails in the rack and install the chassis on the rails, as described in the instructions. CAUTION: Observe the safety cautions in the mounting instructions. 4. Connect the power cable to the chassis and to rack power. The system starts up automatically when power is connected. However, you can use the power button to power off the system if necessary. Cabling to the network 1. Connect a system running a terminal emulation program such as HyperTerminal or Tera Term Pro to the 9-pin D- subminiature Console port connector of the Gateway. 2. Connect the cable from the management network to the Primary connector on the Gateway. Configuring the Gateway 1. On the system connected to the Console port connector, set the terminal emulator for 9600 Baud, 8 data bits, 1 stop bit, no parity bit, and no flow control. 2. Use your terminal emulator to log in through the console port. The default login credentials are: User name: admin 56 Profiler, Express, Sensor and Gateway Installation Guide

63 Configuring the Gateway Installing the Gateway Password: admin 3. When the configuration wizard starts, enter the required information at the prompts. 4. When the wizard completes and exits, the system reboots. Wait until the system finishes rebooting before continuing with the next step. 5. On the management network, point your web browser to the IP address you specified in the configuration wizard using the console port Log in to the Gateway user interface. The default credentials are: User name: admin Password: admin The first time you log in to the Gateway user interface, it displays the Setup page. 7. On the Setup page, ensure that all the required fields (marked with an asterisk) are filled in. 8. At the bottom of the Setup page, click Configure Now. When you click Configure Now, the Gateway automatically fetches the license keys that are assigned to it on the Riverbed licensing web site, if the Gateway has Internet access. If the Gateway does not have access to the Internet, it is necessary to activate the license manually. Profiler, Express, Sensor and Gateway Installation Guide 57

64 Installing the Gateway License activation License activation If the licenses have been activated on the Riverbed licensing web site and the Gateway has downloaded its licensing keys, skip to the next step: Additional configuration on page 60. To confirm that the Gateway has downloaded its license keys from the Riverbed licensing web site, 1. Log in to the Gateway using the admin account user name and the password that you specified in the preceding step. 2. Navigate to the Configuration > Licenses page. If the list of licenses shows more than just the Included license, then skip to Additional configuration on page 60. If the list shows only the Included license, then the Gateway has not downloaded its license keys. 3. Click Fetch Updates Now. If the Gateway has Internet access and the licenses have been activated on the Riverbed licensing web site, then the license keys will be listed within a few minutes. If the Gateway does not have Internet access, or if its licenses have not been activated on the Riverbed licensing site, then it will not be able to fetch its license keys. If you have been given the license keys, enter them manually as described below. If you are responsible for generating the license keys, 1. Go to the Riverbed licensing web site and generate the keys. (See Generating the license keys, next.) 2. Copy the license keys or else them to a machine that has access to the Gateway. 3. Manually add the license keys to the Gateway Configuration > Licenses page. Generating the license keys To generate a license key on the Riverbed licensing site: 1. Ensure that you have product serial number for each appliance. This is located on the rear of the chassis. The number identified as SN is the product serial number. 2. Point your browser to the Riverbed licensing portal: 3. Enter the product serial number. This displays a table listing the serial numbers of all the Cascade products purchased on the same purchase order as the appliance whose serial numbers you entered. 58 Profiler, Express, Sensor and Gateway Installation Guide

65 License activation Installing the Gateway 4. If you purchased only one appliance, then the licenses you purchased are already assigned to that appliance. If you purchased more than one appliance, use the drop-down list boxes in the Software column for each serial number to assign the correct licenses to each appliance. Select or multi-select the licenses you want to activate for each appliance. 5. Follow the instructions of the licensing wizard to continue the process and generate the license keys. 6. If the Gateway has Internet access, it automatically downloads the licenses that have been assigned to its serial number. If the Gateway does not have access to Internet and cannot fetch license keys from the Riverbed licensing site, then it is necessary to enter the license keys manually on the Gateway Configuration > Licenses page. To get the keys for entering manually, continue with the next step on the licensing web site. 7. Either choose the option to the license keys to yourself, or else copy the activated license keys from the table. 8. Place the keys in a file that is accessible to the machine you are using for configuring the Gateway. Manually adding the license keys 1. On the Gateway, navigate to the Configuration > Licenses page and click Add License(s). 2. Paste or type the license keys into the Licenses page. When entering more than one license key, use a commaseparated list. 3. Confirm that the licenses are listed on the Configuration > Licenses page and that the status of each is green. When the license keys have been added, the Gateway is fully functional and ready for additional configuration or for installation verification. Profiler, Express, Sensor and Gateway Installation Guide 59

66 Installing the Gateway Additional configuration Additional configuration The Gateway appliance must be configured to receive flow data from flow data collectors and to send its processed traffic information to a Profiler or Express appliance. It can be configured to receive flow data on the Management interface, the Aux interface, or both. If necessary, you can specify static routes. The Gateway appliance can also be configured to forward flow data to two other destinations in the format in which it is received. For descriptions of making other configuration changes, refer to the Gateway online help system. Configuring the Aux interface To enable the Aux interface, 1. Go to the Configuration > General Settings page and scroll to the Aux Interface Configuration section. 2. Enter the IP address, netmask and connection settings for the Aux interface. 3. Select the Configure AUX Interface option. Specifying static routes If there are multiple subnets on the Aux interface network, or if you need to use a gateway router other than the default gateway, it may be necessary to define static routes. Use the Static Routes section of the Configuration > General Settings page to specify static routes as necessary. Specifying ports on which the Gateway is to receive flow data 1. Go to the Configuration > General Settings page and scroll to the Data Sources section. 2. Select the data type and enter the port number or numbers on which the Gateway is to receive it. The Gateway does not require flow data to use particular ports. However, you must identify the port that the sending device is configured to send to. Each port can receive only one type of flow data. 60 Profiler, Express, Sensor and Gateway Installation Guide

67 Additional configuration Installing the Gateway 3. If you have configured the Aux interface, select which interfaces are to receive flow data. 4. Click Configure Now at the bottom of the page to apply the settings. The number of sources that you can configure to send flow data to the Gateway depends on the amount of data each is sending. The total from all sources combined must not exceed the capacity of the Gateway. Refer to your license agreement for the flow capacity of your Gateway appliance. Specifying destinations for traffic information To specify Profiler or Express appliances that are to receive traffic flow data from the Gateway: 1. Go to the Configuration > Profiler Export page. 2. Click Add New Entry to open a blank entry for specifying a destination Profiler or Express appliance. 3. In the Profiler IP Address box, enter the IP address of the management interface for an Express or Standard Profiler. For an Enterprise Profiler, enter the IP address of the Dispatcher Module, if one is present. If there is no Dispatcher Module, then enter the IP address of the Analysis Module. 4. In the Flow Sources box, either: Leave the box blank to forward all flow data to the specified Profiler, or Enter a comma-separated list of the IP addresses of flow source devices whose traffic is to be sent to the Profiler. You can enter IP addresses by clicking Browse and searching for the flow source device by name, address, or subnet. To send data to a second Profiler, perform Steps 2 through 4 for that Profiler. 5. Click Configure Now at the bottom of the page to apply the settings. Specifying forwarding destinations for flow data received by the Gateway The Cascade Gateway can forward flow data to two destinations. Flow data is forwarded in the format in which it is received. You can make the forwarded flow data appear to be coming from the Gateway. Use the Overwrite Source option to use the Gateway address as the source address in the forwarded data packets. This may be necessary to prevent packets from appearing to be spoofed. Profiler, Express, Sensor and Gateway Installation Guide 61

68 Installing the Gateway Installation verification To specify forwarding destinations, 1. Go to the Configuration > Flow Forwarding page. 2. Click Add New Entry to open a blank entry for specifying a destination. 3. Enter the destination IP address, port number, and data type for each destination. (For IPFIX data, select NetFlow.) 4. If you need to have the data identified as coming from the Gateway, select Overwrite Source to use the Gateway address as the source address in the forwarded data packets. 5. In the Flow Sources box, either: Leave the box blank to forward all flow data to the specified device, or Enter a comma-separated list of the IP addresses of flow source devices whose traffic is to be sent to the specified destination device. You can enter IP addresses by clicking Browse and searching for the flow source device by name, address, or subnet. 6. Click Configure Now at the bottom of the page to apply the settings. The Gateway begins forwarding flow data to the destination devices within 5 minutes after you click Configure Now. Installation verification Verify that the Gateway has been successfully installed and configured by logging in and checking the Overview page. The Overview page identifies all traffic information sources that are currently sending data to the Gateway. Also, it identifies destinations to which the Gateway forwards traffic information. If flow sources are currently configured to send data to the Gateway, they should be displayed on the Overview page. If Profilers are receiving data from the Gateway, they should also be displayed on the Overview page. 62 Profiler, Express, Sensor and Gateway Installation Guide

69 Hardware specifications Installing the Gateway Hardware specifications Rack space The Gateway requires a 1U rack space and is best mounted in a 4-post, 19-inch rack or cabinet. It can also be mounted in a 2-post, 19-inch rack, but this requires a deep shelf. Product model: CAG (Regulatory compliance code 1UACA) Dimensions without bezels or mounting flanges: Height: 87.1 mm, 3.4 in. Width mm, 17.2 in. Depth: mm, 25.4 in. Dimensions with all protrusions: Height: 88.9 mm, 3 1/2 in. Width: mm, 19 3/16 in. Depth: mm, 27 in. Weight: 27.2 kg, 60 lbs. Profiler, Express, Sensor and Gateway Installation Guide 63

70 Installing the Gateway Hardware specifications Power The Gateway requires: 100V-127V, 50/60 Hz, 4.1A, or 200V-240V, 50/60 Hz, 2.1A Cooling The Gateway requires up to approximately 819 Btu/hr of cooling, depending on the model. Ambient air should be: Operating Air temperature: 10 to 40 C (50 to 95 F) Humidity: 20% to 80% non-condensing Storage Air temperature: 40 to 65 C ( 40 to 149 F) Humidity: 5% to 95% non-condensing Console port pin-out The console port uses a DB-9 subminiature connector with standard wiring as follows. Pin Function 1 Data Carrier Detect 2 Receive Data 3 Transmit Data 4 Data Terminal Ready 5 Signal Ground 6 Data Set Ready 7 Request to Send 8 Clear to Send 64 Profiler, Express, Sensor and Gateway Installation Guide

71 CHAPTER 6 Installing the Sensor Overview If you are familiar with installing Cascade appliances and your network environment has the necessary ports open between Cascade appliances, then mount the appliance in the rack and skip to Licensing strategy on page 69. If you are unfamiliar with installing Cascade appliances, then start here. The installation process involves the following steps: 1. Unpack, inspect and inventory the shipment. See Inventory and inspection on page Ensure that the mounting location and network environment will accommodate the appliance. See Preparations for installation on page Collect the configuration information you will need. See Configuration information on page Determine how the licenses are to be activated. See Licensing strategy on page Mount the appliance in the rack and connect rack power. See Mounting and powering on page Connect the cables to the console port and the primary network port. See Cabling to the network on page Run the setup wizard on the console port to make the appliance reachable on the network. See Configuring the Sensor on page Ensure that the licenses for the appliance are activated. See License activation on page Perform additional configuration, as necessary. See Additional configuration on page Verify that the appliance has been successfully installed. See Installation verification on page 76. Refer to the Hardware specifications on page 76 for dimensions, weight and power requirements. Profiler, Express, Sensor and Gateway Installation Guide 65

72 Installing the Sensor Inventory and inspection Inventory and inspection 1. Check the shipping documentation to ensure that all cartons have arrived. 2. If you have not already done so, visually inspect each carton for indications of damage. 3. If any cartons are damaged or missing, contact Riverbed Support before continuing. Phone United States and Canada: Phone outside U.S. and Canada: support@riverbed.com Web: 4. Unpack the contents of the shipping cartons and inventory the contents against the shipping documentation. 5. If any components of the order are damaged or missing, contact Riverbed Support. Preparations for installation Before installing the chassis, ensure that the following considerations have been addressed: Mounting location Data sources Cable connections Access to the network Mounting location Cascade Sensor appliance requires a 1U rack space in a 4-post, 19-inch rack or cabinet. It should be mounted in a rack that is appropriately sized for the chassis using the rails provided. Additional rails can be purchased from Riverbed using part number RMK-CAP-001. The rack should be properly secured to a level solid surface to prevent tipping or excess shock while the unit is operating. (Operating shock limits are half sine, 2 g peak, 11 ms.) Appliances should never be installed in an unsecured location such as on a table or shelf. They should never be stacked on top of one another. Manufacturing data for the units indicates that premature disk drive failure can result from vibration transmitted between units that are in direct contact with one another. The appliances should be installed so that the ventilation openings on the front and rear of the units are not blocked and so air flows from the front to the rear of the unit to facilitate proper cooling. Each fan within the appliance is capable of supporting multiple speeds. If the internal ambient temperature of the appliance exceeds the value programmed into the thermal sensor data record (SDR), the BMC firmware increases the speed for all the fans within fan module. Improper cooling can result in the appliance overheating, which could cause premature failure of sensitive components, such as the CPUs. In addition, overheating can result in the fans running at a higher speed for extended periods, which increases the amount of vibration in the appliance. Excess vibration can result in premature disk drive failure. 66 Profiler, Express, Sensor and Gateway Installation Guide

73 Preparations for installation Installing the Sensor Refer to Hardware specifications on page 76 to ensure that the mounting location accommodates the dimensions, weight, power and cooling requirements of the appliance. Data sources The Riverbed Cascade Sensor obtains traffic information from taps or mirror ports on the monitored network. There are two approaches to setting up data sources: Set up the available data sources before you install the Sensor. Install the Sensor up to the point of verification, then go install or configure the data sources, and then return to the Sensor to complete the installation verification. It is preferable to configure all the data sources that are available at the time you install the Sensor. However, Sensor installation can be verified with just one data source. Cable connections Power The Cascade appliance has two power supplies. Plug these into two different circuits, if they are available. Console port The initial setup of the Cascade appliance is performed using a console port. Ensure that you have a terminal server or a system running a terminal emulation program such as HyperTerminal or Tera Term Pro. Connect this to the Cascade appliance console port using a null modem cable with a 9-pin D-subminiature connector. Any standard serial device connection will work. Primary port The Sensor is equipped with a 100/1000baseTX primary management port that must connect to a hub or switch on the management network. The primary port is set by default for auto-negotiation. Ensure that: A straight-through cable to a hub or switch port on the management network is available at the rack location. The management network switch port is set to establish a connection at 100 or 1000 Mb/s and full duplex. A terminal device (laptop, KVM, etc.) is available on the management network for logging in to the Sensor user interface. Traffic monitoring ports All Cascade Sensor appliances have four electrical ports with 10/100/1000baseTX (RJ45) connectors. These connect via straight-through cables to taps or mirror ports on the monitored network. Some models also have two 10 Gb/s optical ports that support both LR and SR SFP modules with LC connectors. These connect via single mode (LR) or multimode (SR) optical fiber cables to taps or mirror ports on the monitored network. Ensure that the necessary taps or mirror ports are set up and that the correct electrical or optical cables are available in the rack where the Sensor is to be installed. Profiler, Express, Sensor and Gateway Installation Guide 67

74 Installing the Sensor Configuration information Access to the network The Sensor uses the management network to communicate with other Cascade appliances and to access network services. Communication between Cascade appliances If you lock down your network on a port-by-port basis, ensure that the following ports are open between Cascade appliances: TCP/22 (ssh) This is needed for the Sensor to receive upgrade packages from the Profiler it connects to. TCP/8443 Exchange of encryption certificates between Sensor and Profiler. TCP/41017 Encrypted communication between Sensor and Profiler. UDP/123 (ntp) Synchronization of time between a Sensor and a Profiler. Access to and from network access services TCP/22 (ssh) This is needed for secure shell access to Cascade software components. TCP/443 (https) Secure web-based management interfaces. Configuration information When you configure the Sensor, you will be asked to provide configuration information. Information that is required to complete the installation is listed in the table that follows with an asterisk (*). Items not marked with an asterisk are optional during installation and can be specified afterwards on the Sensor Configuration > General Settings page if necessary. It may be useful to write the configuration values in the blank column of the checklist below so that you can refer to them during the configuration step or afterward. Sensor host name:* Sensor IP address:* Netmask:* Default gateway:* DNS name resolution for hosts (enable or disable): Primary DNS server IP address: Secondary DNS server IP address: DNS search domain: Primary port settings: (10/100/1000 Mb/s, half- or full-duplex, or auto-negotiate) Switch port settings: The settings of the switch port or hub that the Sensor primary port connects to. (Auto-negotiate is recommended.) Monitored network port settings - mon0_0 10/100/1000 Mb/s, half- or full-duplex, or auto-negotiate 68 Profiler, Express, Sensor and Gateway Installation Guide

75 Licensing strategy Installing the Sensor Monitored network port settings - mon0_1 10/100/1000 Mb/s, half- or full-duplex, or auto-negotiate Monitored network port settings - mon0_2 10/100/1000 Mb/s, half- or full-duplex, or auto-negotiate Monitored network port settings - mon0_3 10/100/1000 Mb/s, half- or full-duplex, or auto-negotiate Packet Deduplication Enable packet deduplication if your network configuration might cause the Cascade appliance to see duplicated packets. NTP server IP addresses:* Applies only if Sensor is being synchronized to an external NTP server. Enter one or more addresses as a commaseparated list. Time Zone: Flow encryption certificate (default or new certificate): For faster installation, use the default encryption certificate shipped with the Sensor and then generate a new certificate later. SNMP information: Sensor is set by default to use SNMP Version 1 and to allow MIB browsing. If you are configuring SNMP at this time, obtain the necessary V1 or V3 information. First Profiler data input address:* The address of the Profiler to which the Sensor will send traffic data. This is the IP address of the management interface (Primary port) of an Express or Standard Profiler or the address of the Analysis Module for an Enterprise Profiler. Second Profiler data input address:* If the Sensor will be sending traffic data to more than one Profiler, this the address of the second Profiler. This is the IP address of the management interface (Primary port) of an Express or Standard Profiler or the address of the Analysis Module for an Enterprise Profiler. Password to use for your initial Sensor login:* The default password admin. New password to enter when prompted to change the initial Sensor password:* Applies only to systems not previously configured. Licensing strategy Capacity and feature licenses must be activated on the Riverbed licensing web site. Cascade appliances that have been configured and have access to Internet automatically download the license keys that have been assigned to their serial numbers on the licensing web site. If the appliance does not have Internet access, then you must add its license keys manually. The licensing web site provides the flexibility to assign different feature and capacity licenses to different appliances. You can ship appliances to remote locations without concern for which appliance is to have which license. When you have the serial numbers and know where the appliances are deployed in the network, you can make the license assignments on the Riverbed licensing web site. Profiler, Express, Sensor and Gateway Installation Guide 69

76 Installing the Sensor Licensing strategy When all the appliances are to be licensed for the same features and capacities, the licensing web site handles this automatically. The appliances can automatically download their licenses without your needing to visit the licensing web site. Downloading and adding license keys If the Sensor is configured and has Internet connectivity, it can download its license keys automatically. Otherwise, someone must the keys from the Riverbed licensing web site and then copy them from the , or copy them directly from the Riverbed licensing web site, and someone must add them to the Sensor manually. Determine which strategy you are using. Will you activate the licenses on the Riverbed licensing web site yourself? Or will someone else do that? If the Sensor you are installing does not have Internet access, how will you ensure that it gets its assigned license keys? Will you them to yourself from the Riverbed licensing site? Will you copy them from the Riverbed licensing site? Or will someone else provide the license keys for you to add to the Sensor manually? Typically, the installer: 1. Mounts, cables and configures this appliance and the other Cascade appliances that were ordered with it. 2. Records the product serial number from the chassis of each appliance. The number identified as SN is the product serial number. 3. Sends the serial number for each appliance, along with the appliance location on the network, to the network manager. Then the network manager: 1. Logs in to the Riverbed licensing web site. 2. Enters the product serial number of the first Cascade appliance to gain access to the licensing page. The Riverbed licensing page lists the serial numbers of all Cascade appliances that were included in the same purchase order. 3. For each serial number, activate the licenses that apply to that serial number. Using the Riverbed licensing web site is described after the configuration step. See License activation on page 73. After the licenses have been activated on the Riverbed licensing web site, the license keys can be added to the Sensor either automatically or manually. Automatically adding license keys Cascade appliances that have access to Internet automatically download the license keys that have been assigned to their serial numbers on the licensing web site. If the appliance has been configured to be accessible on the network and if it has access to the Internet, then it automatically downloads its license keys when you click Configure Now on the initial Setup page. If you select the Enable automatic license download from Riverbed option on the Configuration > Licenses page, the appliance checks for any additional licenses once per day. 70 Profiler, Express, Sensor and Gateway Installation Guide

77 Mounting and powering Installing the Sensor Manually adding license keys If the Sensor does not have access to the Internet, then it is necessary to add the license keys manually. This involves copying and pasting the keys into the Sensor licensing page. You can have the license keys ed to yourself from the licensing web site and copy them from the , or you can copy them directly from the web site. Alternatively, the person who generates the keys on the web site can provide them to you. Once you have the keys, you paste them into the Configuration > Licenses page. Mounting and powering Safety information Follow the safety precautions outlined in the Riverbed Safety and Compliance Guide when installing and setting up your system. The guide contains the safety information in multiple languages. Before you install, operate, or service your system, you must be familiar with the safety information. Note: Failure to follow these safety guidelines can result in injury or damage to the equipment. Mishandling of the equipment voids all warranties. Please read and follow the safety guidelines and installation instructions carefully. CAUTION: Slide/rail mounted equipment is not to be used as a shelf or a work space. Rack mounting the chassis 1. Locate the rails in the shipping carton. 2. Locate the Rack Installation Guide in the documentation kit. 3. Mount the rails in the rack and install the chassis on the rails, as described in the instructions. CAUTION: Observe the safety cautions in the mounting instructions. 4. Connect the power cable to the chassis and to rack power. The system starts up automatically when power is connected. However, you can use the power button to power off the system if necessary. Cabling to the network 1. Connect a system running a terminal emulation program such as HyperTerminal or Tera Term Pro to the 9-pin D- subminiature Console port connector of the Sensor. 2. Connect the cable from the management network to the Primary connector on the Sensor. Profiler, Express, Sensor and Gateway Installation Guide 71

78 Installing the Sensor Configuring the Sensor 3. Connect the electrical Ethernet cables from the taps or mirror ports to the monitoring port connectors mon0_0 through mon0_4. 4. If the Sensor has 10 Gb/s fiber ports, connect the optical cables from the taps or mirror ports to the monitoring port connectors mon1_0 and mon1_2. Configuring the Sensor 1. On the system connected to the Console port connector, set the terminal emulator for 9600 Baud, 8 data bits, 1 stop bit, no parity bit, and no flow control. 2. Use your terminal emulator to log in through the console port. The default login credentials are: User name: admin Password: admin 3. When the configuration wizard starts, enter the required information at the prompts. 4. When the wizard completes and exits, the system reboots. Wait until the system finishes rebooting before continuing with the next step. 5. On the management network, point your web browser to the IP address you specified in the configuration wizard using the console port Log in to the Sensor user interface. The default credentials are: User name: admin Password: admin The first time you log in to the Sensor user interface, it displays the Setup page. 7. On the Setup page, ensure that all the required fields (marked with an asterisk) are filled in. 8. At the bottom of the Setup page, click Configure Now. 72 Profiler, Express, Sensor and Gateway Installation Guide

79 License activation Installing the Sensor When you click Configure Now, the Sensor automatically fetches the license keys that are assigned to it on the Riverbed licensing web site, if the Sensor has Internet access. If the Sensor does not have access to the Internet, it is necessary to activate the license manually. License activation If the licenses have been activated on the Riverbed licensing web site and the Sensor has downloaded its licensing keys, skip to the next step: Additional configuration on page 75. To confirm that the Sensor has downloaded its license keys from the Riverbed licensing web site, 1. Log in to the Sensor using the admin account user name and the password that you specified in the preceding step. 2. Navigate to the Configuration > Licenses page. If the list of licenses shows more than just the Included license, then skip to Additional configuration on page 75. If the list shows only the Included license, then the Sensor has not downloaded its license keys. 3. Click Fetch Updates Now. If the Sensor has Internet access and the licenses have been activated on the Riverbed licensing web site, then the license keys will be listed within a few minutes. Profiler, Express, Sensor and Gateway Installation Guide 73