Collector Quick Start Guide

Transcription

1 September 18, 2006 Overview Introduction This guide provides connection and initial configuration instructions for your Proventia Network ADS Collectors. These instructions allow you to connect to the network with the minimum required setup. Reference: You will find information about additional configuration tasks and using ADS in the Proventia Network ADS User Guide, available on the ISS Customer Support Website at In this guide The Proventia Network ADS Collectors Quick Start Guide includes information about the following topics: Topic Page Before You Begin 2 Connecting the Appliance 4 Configuring the Appliance 6 Getting Technical Support 10 Proventia Network Anomaly Detection System Quick Start Guide, Version Internet Security Systems, Inc. All rights reserved worldwide. 1

2 Before You Begin Introduction This topic lists the package contents and the checklist for configuration settings information. Package contents Verify your package contains the following: Item Collector appliance AC power cord Recovery pack CD One crossover Ethernet cable Rack mount kit with mid mound kit procedures (two-and four-post systems) Warranty statement Table 1: Appliance package contents Record your settings Use the following worksheet to collect and document the information for your Collectors: Item Description Location of certificate package The location where you have stored the certificate package. You must upload the certificate on each appliance from the computer you will use to configure your appliances. Analyzer address The Management IP address of the Analyzer to which this Collector reports traffic data. Shared Secret The shared zone secret is a word or phrase that the system uses to encrypt traffic between the Analyzer and Collectors. Important: You must enter the same secret as you set on the Analyzer. Management IP address and Subnet Mask The unique IP address and the appropriate network mask. Table 2: Checklist and worksheet for recording configuration settings 2

3 Before You Begin Item Description NetFlow IP address and Subnet Mask (optional) If configured, the IP address to which the NetFlows are sent. Important: This IP address cannot be on the same subnet as the Management IP address. If you do not configure this, NetFlows will be sent to the Management IP address. SNMP Community String The password or phrase that allows the Collector to poll configured routers for SNMP information. Flow Sources and Types The IP addresses for the routers that will send flows to the Analyzer and the type of flows (NetFlow, NetScout, or sflow). The number of sources you can enter depends upon the Collector model. Default router (or gateway) The first router hop that sends outbound network traffic, typically the subnet switch or router. Appliance hostname The unique computer name for your appliance. This can be either a fully qualified domain name (ISSCollector1.iss.net) or just the appliance name (ISSCollector1). Administrative password The password for administrative access to the appliance. NTP Server (optional) The IP address for the server that synchronizes network time. Table 2: Checklist and worksheet for recording configuration settings (Continued) Proventia Network Anomaly Detection System Quick Start Guide, Version

4 Connecting the Appliance Introduction This topic provides instructions for connecting the Collector appliance. This topic also lists the flow source limits for different Collector models. Diagram Use the following diagram as a reference for connecting your Collector: Figure 1: Back panel of the appliance Note: Although ISS recommends using the ADS Setup Wizard to complete the initial setup of your appliances, you can use the quick installation script in the command line interface (CLI). Reference: See Chapter 2, "Using the Command Line Interface," in the Proventia Network ADS Advanced Configuration Guide for additional connection and installation information. Procedure To connect your appliance for using the Proventia Network ADS Web-based Wizard: 1. Plug one end of the provided crossover cable into the Management Interface port on the back panel of the appliance. 2. Plug the other end of the crossover cable into the Ethernet port on the computer you will use to configure the appliance. Note: Within Proventia Network ADS, the Ethernet ports are referenced by their hardware identifiers, as follows: Management/NetFlow port is equivalent to e3/4/0 Optional NetFlow port is equivalent to e3/4/1 3. Plug the AC Power connector into the back of the appliance, and then plug the other end into a standard AC receptacle. 4. Turn on the appliance, and then start your computer. 4

5 Connecting the Appliance Flow source limits The number of flow sources you can have depends upon the Collector model you have purchased, as follows: Model AD3000 AD3007 AD3014 AD3020 Description and Maximum Number of Flow Sources Packet Collector appliance (0 flow sources) Flow/Packet Collector (7 flow sources) Flow/Packet Collector (14 flow sources) Flow/Packet Collector (20+ flow sources) Table 3: Flow source limits for each Collector model Proventia Network Anomaly Detection System Quick Start Guide, Version

6 Configuring the Appliance Introduction This topic covers the following details: configuration setup options prerequisites to use the setup wizard instructions to change the network adapter TCP/IP settings directions to configure the Collector steps to connect the Collector to the network Configuration setup options You can configure your Collectors in two different ways, depending upon your deployment. Before you begin configuring settings, you should decide which setup option to use. Configuration setup options are as follows: Management and NetFlow collection on one interface (typical) Management and NetFlow collection on separate interfaces Note: You might want to use this option to manage the appliance from a different network than where the flows are received. Prerequisites Before you begin, you must change your network adapter TCP/IP settings on your computer to use the Web-based Setup Wizard with the crossover connection. Changing network adapter TCP/IP settings To change your TCP/IP settings: 1. Access your Local Area Connection properties on your PC in one of the following ways: Right-click My Network Places, and then choose Properties. Go to your control panel, and then choose Network Connections. 2. Right-click Ethernet Connections, and then choose Properties. 3. Select Internal Protocol TCP/IP. 4. Click Properties. 5. Configure your computer with the following settings: IP address: Netmask: Default gateway: Note: If your operating system is not Microsoft Windows, refer to your computer documentation for instructions on how to change your network adaptor IP address. You must reset your network adaptor IP to your original settings before you can access the Proventia Network ADS web user interface. 6

7 Configuring the Appliance Configuring the Collectors To configure the Collector appliances using the crossover connection and the Web-based Wizard: 1. Connect the cables and reset your TCP/IP settings, as instructed above. 2. Open a browser window, and then enter The Proventia Network ADS Setup Wizard Welcome screen appears. 3. Click NEXT. 4. Read the ISS Software License Agreement, select the check box to accept the license, and then click ACCEPT. 5. Read the GPL License Agreement, select the check box to accept the license, and then click ACCEPT. The Certificate Package screen appears. 6. To install the certificate package you received from ISS, click Browse, and then select the location where you stored the certificate package. 7. Click NEXT to install the certificate package. The Analyzer Address screen appears. 8. Type the IP address for the Analyzer in the Analyzer Address box. 9. Type a zone secret in the Collector Communication Shared Secret box. The Analyzer uses the zone shared secret to verify communication from its Collectors. Note: The shared secret can be any word or phrase, but you must configure the same secret on all Collectors and on the Analyzer. 10. Click NEXT. The Network Interfaces screen appears. 11. Select one of the following options: Management and NetFlow Collection on one interface Management and NetFlow Collection on separate interfaces 12. Type the Management (and NetFlow) Collection interface address in the IP address box. 13. Type the subnet mask of the Management (and NetFlow) Collection interface in the Subnet Mask box. 14. Click NEXT. The Flow Sources screen appears. 15. In the SNMP polling pane, type the SNMP community string in the Community string box if you want the Collector to poll the configured routers for SNMP information. 16. In the Configure flow sources pane, do one of the following: Select the check box for the flow sources (Netflow, Netscout, sflow) that you want the Collector to collect all data from. Type specific routers from which you want the Collector to collect information. Note: You can configure a combination of the flow source options. Example: You can configure all NetFlow sources by selecting the NetFlow check box, and then entering two specific sflow sources. 17. To specify a router, type the router's IP address in the Flow source IP box. Proventia Network Anomaly Detection System Quick Start Guide, Version

8 18. Select one of the following choices from the Type list to indicate which type of flow this router collects: NetFlow NetScout sflow 19. Select one of the following from the Interface list to specify if you want the Collector to also collect interface data from the routers: Yes No 20. Click ADD to add the flow source. When you add a flow source, it appears in the table above the Flow source boxes. Note: You can click REMOVE to delete a configured flow source from the table. 21. Repeat Steps 17 through 20 to add additional flow sources. The number of sources you can add depends upon the model you have purchased. You can continue to enter more sources, until the system displays an error message indicating you have reached the maximum number of flow sources. 22. Click NEXT when you have finished adding all flow sources. The Default Route screen appears. 23. Type the IP address for the default route (or gateway) for the Collector in the Default Route box. 24. Click NEXT. The Appliance Hostname screen appears. 25. Type the Collector name you want to appear in alert notifications and in the Analyzer Web user interface in the Hostname box. Note: Type either a fully-qualified domain name (ISSCollector1.iss.net) or just the appliance name (ISSCollector1). 26. Click NEXT. The Network Services screen appears. 27. Select the check boxes for the types of network services you want to allow. Note: You must explicitly allow a service to run. Otherwise your network access is denied. Important: ISS recommends that you enable SSH because it provides access to a command line interface (CLI) that updates appliance software and allows troubleshooting. 28. Click NEXT. The Administrator Password screen appears. 29. Type the password for the "admin" primary administrator account in the Password box. 30. Re-type the password in the Confirm Password box, and then click NEXT. The System Time screen appears. 31. Select the timezone for the Collector location from the Timezone list. 8

9 Configuring the Appliance 32. Do one of the following to set the system time: Type the IP address for the server that synchronizes network time protocol in the NTP Server box. Type the Month, Day, Year, hours (HH) and minutes (MM). 33. Click NEXT. The Review screen appears. 34. Review the settings, and then do one of the following: If you want to change settings, click PREVIOUS to return to a prior page and change the settings. If the settings are correct, do one of the following: If you want to... Do this... And then... Keep the appliance in its current location, Move the appliance to an alternate location, Click APPLY CHANGES AND REBOOT. The appliance will restart. Click APPLY CHANGES AND SHUTDOWN, and then wait one minute and turn off the appliance. See the Proventia Network ADS User Guide to start using ADS. Disconnect the Ethernet cable between your computer and the appliance, and then follow the instructions in Connecting the Collector to the network on page 9 to connect the Analyzer to the network. Connecting the Collector to the network To connect to the network to access the Web user interface, do the following: 1. Connect an Ethernet cable between the Collector Management port on the back panel and the network you will use to manage it. Note: You can also connect an Ethernet cable between the Packet Capture port and a SPAN port or network tap. If you use the Packet Capture port, you do not need to configure settings because it automatically captures any traffic it detects. 2. Turn on the appliance. 3. The Collector runs as configured and will be displayed in the ADS Status section of the Summary page in the Web user interface. Reference: See Chapter 2, "Using the Proventia Network ADS Web User Interface," in the Proventia Network ADS User Guide for instructions about accessing and using ADS. Proventia Network Anomaly Detection System Quick Start Guide, Version

10 Getting Technical Support Introduction ISS provides technical support through its Web site and by or telephone. The ISS Web site The Internet Security Systems (ISS) Resource Center Web site ( support/) provides direct access to online user documentation, current versions listings, detailed product literature, white papers, and the Technical Support Knowledgebase. Support levels ISS offers three levels of support: Standard Select Premium Each level provides you with 24x7 telephone and electronic support. Select and Premium services provide more features and benefits than the Standard service. Contact Client Services at if you do not know the level of support your organization has selected. Hours of support The following table provides hours for Technical Support at the Americas and other locations: Location Americas All other locations Hours 24 hours a day Monday through Friday, 9:00 A.M. to 6:00 P.M. during their local time, excluding ISS published holidays. Note: If your local support office is located outside the Americas, you may call or send an to the Americas office for help during off-hours. Table 4: Hours for technical support Contact information The following table provides electronic support information and telephone numbers for technical support requests: Regional Office North America Electronic Support Connect to the MYISS section of our Web site: Telephone Number Standard: (1) (888) (toll free) (1) (404) Select and Premium: Refer to your Welcome Kit or call your Primary Designated Contact for this information. Latin America support@iss.net (1) (888) (toll free) (1) (404) Table 5: Contact information for technical support 10

11 Getting Technical Support Regional Office Electronic Support Telephone Number Europe, Middle East, and Africa (44) (1753) Asia-Pacific, Australia, and the Philippines (1) (888) (toll free) (1) (404) Japan Domestic: (81) (3) Table 5: Contact information for technical support (Continued) Proventia Network Anomaly Detection System Quick Start Guide, Version

12 12