Juniper Secure Analytics

Transcription

1 Juniper Secure Analytics Installation Guide Release Modified:

2 Juniper Networks, Inc Innovation Way Sunnyvale, California USA All rights reserved. Juniper Networks, Junos, Steel-Belted Radius, NetScreen, and ScreenOS are registered trademarks of Juniper Networks, Inc. in the United States and other countries. The Juniper Networks Logo, the Junos logo, and JunosE are trademarks of Juniper Networks, Inc. All other trademarks, service marks, registered trademarks, or registered service marks are the property of their respective owners. Juniper Networks assumes no responsibility for any inaccuracies in this document. Juniper Networks reserves the right to change, modify, transfer, or otherwise revise this publication without notice. Juniper Secure Analytics Installation Guide All rights reserved. The information in this document is current as of the date on the title page. YEAR 2000 NOTICE Juniper Networks hardware and software products are Year 2000 compliant. Junos OS has no known time-related limitations through the year However, the NTP application is known to have some difficulty in the year END USER LICENSE AGREEMENT The Juniper Networks product that is the subject of this technical documentation consists of (or is intended for use with) Juniper Networks software. Use of such software is subject to the terms and conditions of the End User License Agreement ( EULA ) posted at By downloading, installing or using such software, you agree to the terms and conditions of that EULA. ii

3 Table of Contents About the Documentation v Documentation and Release Notes v Documentation Conventions v Documentation Feedback vii Requesting Technical Support viii Self-Help Online Tools and Resources viii Opening a Case with JTAC viii Part 1 Juniper Secure Analytics Installation Chapter 1 Juniper Secure Analytics Deployment Overview Understanding JSA Deployment Licence Keys Integrated Management Module JSA Components Prerequisite Hardware Accessories and Desktop Software for JSA Installations Supported Web Browsers Enabling Document Mode and Browser Mode in Internet Explorer Chapter 2 USB Flash Drive Installations USB Flash Drive Installations Overview Supported versions Installation overview Creating a Bootable USB Flash Drive with a JSA Appliance Creating a Bootable USB Flash Drive with Microsoft Windows Creating a Bootable USB Flash Drive with Red Hat Linux Obtaining the create-usb-install-key.py Script Obtaining the create-usb-install-key.py Script from the Software Download Page Obtaining the create-usb-install-key.py Script from the Software ISO Configuring a USB Flash Drive for Serial-only Appliances Installing JSA with a USB Flash Drive Chapter 3 Virtual Appliance Installations for JSA and Log Manager Juniper Secure Analytics and Log Manager Installation Overview Overview of Supported Virtual Appliances JSA Virtual All-in-One JSA Virtual Distributed Event Processors iii

4 Juniper Secure Analytics Installation Guide JSA Virtual Distributed Flow Processors System Requirements for Virtual Appliances Creating Your Virtual Machine Installing the JSA Software on a Virtual Machine Adding Your Virtual Appliance to Your Deployment Chapter 4 Installations from the Recovery Partition Installing from the Recovery Partition Using Factory Default Setting Re-Installing a JSA Appliance Chapter 5 Network Settings Management Changing the Network Settings in an All-In-One System Changing the Network Settings of a JSA Console in a Multisystem Deployment Updating Network Settings After a NIC Replacement Part 2 Appendix Appendix A Troubleshooting Problems Troubleshooting Resources JSA Log Files Ports Used by JSA Ports and Iptables SSH Communication on Port JSA Ports Searching for Ports in Use by Juniper Secure Analytics Viewing IMQ Port Associations iv

5 About the Documentation Documentation and Release Notes Documentation and Release Notes on page v Documentation Conventions on page v Documentation Feedback on page vii Requesting Technical Support on page viii Documentation Conventions To obtain the most current version of all Juniper Networks technical documentation, see the product documentation page on the Juniper Networks website at If the information in the latest release notes differs from the information in the documentation, follow the product Release Notes. Juniper Networks Books publishes books by Juniper Networks engineers and subject matter experts. These books go beyond the technical documentation to explore the nuances of network architecture, deployment, and administration. The current list can be viewed at Table 1 on page vi defines notice icons used in this guide. v

6 Juniper Secure Analytics Installation Guide Table 1: Notice Icons Icon Meaning Description Informational note Indicates important features or instructions. Caution Indicates a situation that might result in loss of data or hardware damage. Warning Alerts you to the risk of personal injury or death. Laser warning Alerts you to the risk of personal injury from a laser. Tip Indicates helpful information. Best practice Alerts you to a recommended use or implementation. Table 2: Text and Syntax Conventions Table 2 on page vi defines the text and syntax conventions used in this guide. Convention Description Examples Bold text like this Represents text that you type. To enter configuration mode, type the configure command: user@host> configure Fixed-width text like this Represents output that appears on the terminal screen. user@host> show chassis alarms No alarms currently active Italic text like this Introduces or emphasizes important new terms. Identifies guide names. Identifies RFC and Internet draft titles. A policy term is a named structure that defines match conditions and actions. Junos OS CLI User Guide RFC 1997, BGP Communities Attribute Italic text like this Represents variables (options for which you substitute a value) in commands or configuration statements. Configure the machine s domain name: [edit] root@# set system domain-name domain-name vi

7 About the Documentation Table 2: Text and Syntax Conventions (continued) Convention Description Examples Text like this Represents names of configuration statements, commands, files, and directories; configuration hierarchy levels; or labels on routing platform components. To configure a stub area, include the stub statement at the [edit protocols ospf area area-id] hierarchy level. The console port is labeled CONSOLE. < > (angle brackets) Encloses optional keywords or variables. stub <default-metric metric>; (pipe symbol) Indicates a choice between the mutually exclusive keywords or variables on either side of the symbol. The set of choices is often enclosed in parentheses for clarity. broadcast multicast (string1 string2 string3) # (pound sign) Indicates a comment specified on the same line as the configuration statement to which it applies. rsvp { # Required for dynamic MPLS only [ ] (square brackets) Encloses a variable for which you can substitute one or more values. community name members [ community-ids ] Indention and braces ( { } ) ; (semicolon) Identifies a level in the configuration hierarchy. Identifies a leaf statement at a configuration hierarchy level. [edit] routing-options { static { route default { nexthop address; retain; } } } GUI Conventions Bold text like this Represents graphical user interface (GUI) items you click or select. In the Logical Interfaces box, select All Interfaces. To cancel the configuration, click Cancel. > (bold right angle bracket) Separates levels in a hierarchy of menu selections. In the configuration editor hierarchy, select Protocols>Ospf. Documentation Feedback We encourage you to provide feedback, comments, and suggestions so that we can improve the documentation. You can provide feedback by using either of the following methods: Online feedback rating system On any page of the Juniper Networks TechLibrary site at simply click the stars to rate the content, and use the pop-up form to provide us with information about your experience. Alternately, you can use the online feedback form at vii

8 Juniper Secure Analytics Installation Guide Send your comments to Include the document or topic name, URL or page number, and software version (if applicable). Requesting Technical Support Technical product support is available through the Juniper Networks Technical Assistance Center (JTAC). If you are a customer with an active J-Care or Partner Support Service support contract, or are covered under warranty, and need post-sales technical support, you can access our tools and resources online or open a case with JTAC. JTAC policies For a complete understanding of our JTAC procedures and policies, review the JTAC User Guide located at Product warranties For product warranty information, visit JTAC hours of operation The JTAC centers have resources available 24 hours a day, 7 days a week, 365 days a year. Self-Help Online Tools and Resources For quick and easy problem resolution, Juniper Networks has designed an online self-service portal called the Customer Support Center (CSC) that provides you with the following features: Find CSC offerings: Find product documentation: Find solutions and answer questions using our Knowledge Base: Download the latest versions of software and review release notes: Search technical bulletins for relevant hardware and software notifications: Join and participate in the Juniper Networks Community Forum: Open a case online in the CSC Case Management tool: To verify service entitlement by product serial number, use our Serial Number Entitlement (SNE) Tool: Opening a Case with JTAC You can open a case with JTAC on the Web or by telephone. Use the Case Management tool in the CSC at Call JTAC ( toll-free in the USA, Canada, and Mexico). viii

9 About the Documentation For international or direct-dial options in countries without toll-free numbers, see ix

10 Juniper Secure Analytics Installation Guide x

11 PART 1 Juniper Secure Analytics Installation Juniper Secure Analytics Deployment Overview on page 3 USB Flash Drive Installations on page 9 Virtual Appliance Installations for JSA and Log Manager on page 21 Installations from the Recovery Partition on page 35 Network Settings Management on page 41 1

12 Juniper Secure Analytics Installation Guide 2

13 CHAPTER 1 Juniper Secure Analytics Deployment Overview Understanding JSA Deployment This chapter describes about the following sections: Understanding JSA Deployment on page 3 Licence Keys on page 3 Integrated Management Module on page 5 JSA Components on page 5 Prerequisite Hardware Accessories and Desktop Software for JSA Installations on page 7 Supported Web Browsers on page 7 You can install Juniper Secure Analytics (JSA) components on a single server for small enterprises, or across multiple servers for large enterprise environments. For maximum performance and scalability, you must install redundant appliances for each system that requires High Availability protection. For more information about installing or recovering an High Availability system, see the High Availability Guide. Related Documentation Licence Keys on page 3 Integrated Management Module on page 5 Supported Web Browsers on page 7 Licence Keys After the installation is complete and before the default license expires, you must access the Juniper Secure Analytics (JSA) user interface to apply your license key. Your system includes a default license key that provides you with access to JSA software for five weeks. After you install the software and before the default license key expires, you must add your purchased licenses. 3

14 Juniper Secure Analytics Installation Guide Table 3 on page 4 and Table 4 on page 4 describes the restrictions for the default license key. Table 3: Restrictions for the Default License Key for JSA Installation Usage Limit Active log source limit No Limit Events per second threshold JSA JSA JSA JSA k JSA k JSA k Virtual JSA-1000 Flows per interval JSA k JSA k JSA k JSA k JSA k JSA ,200k Virtual JSA-50k User limit 10 Network object limit 300 Table 4: Restrictions for the Default License Key for Log Manager Installations Usage Limit Active log source limit No Limit Events per second threshold 5000 User limit 10 Network object limit 300 When you purchase a JSA product, an that contains your permanent license key is sent from Juniper. These license keys extend the capabilities of your appliance type 4

15 Chapter 1: Juniper Secure Analytics Deployment Overview and define your system operating parameters. You must apply your license keys before your default license expires. Related Documentation Understanding JSA Deployment on page 3 Integrated Management Module on page 5 Supported Web Browsers on page 7 Integrated Management Module Use Integrated Management Module, which is on the back panel of each appliance type, to manage the serial and Ethernet connectors. You can configure the Integrated Management Module to share an Ethernet port with the Juniper Secure Analytics (JSA) product management interface. However, to reduce the risk of losing the connection when the appliance is restarted, configure Integrated Management Module in dedicated mode. To configure Integrated Management Module, you must access the system BIOS settings by pressing F1 when the splash screen is displayed. For more information about configuring the Integrated Management Module, see the Integrated Management Module User's Guide on the CD that is shipped with your appliance. Related Documentation Understanding JSA Deployment on page 3 Licence Keys on page 3 Supported Web Browsers on page 7 JSA Components Juniper Secure Analytics (JSA) consolidates event data from log sources that are used by devices and applications in your network. NOTE: Software versions for all JSA appliances in a deployment must be same version and fix level. Deployments that use different versions of software are not supported. JSA deployments can include the following components: JSA Flow Processor Passively collects traffic flows from your network through span ports or network taps. The JSA Flow Processor also supports the collection of external flow-based data sources, such as NetFlow. 5

16 Juniper Secure Analytics Installation Guide NOTE: The component is available only for JSA deployments. JSA Console Provides the JSA product user interface. The interface delivers real-time event and flow views, reports, offenses, asset information, and administrative functions. In distributed JSA deployments, use the JSA console to manage hosts that include other components. Magistrate A service running on the JSA console, the Magistrate provides the core processing components. You can add one Magistrate component for each deployment. The Magistrate provides views, reports, alerts, and analysis of network traffic and security events. The Magistrate component processes events against the custom rules. If an event matches a rule, the Magistrate component generates the response that is configured in the custom rule. For example, the custom rule might indicate that when an event matches the rule, an offense is created. If there is no match to a custom rule, the Magistrate component uses default rules to process the event. An offense is an alert that is processed by using multiple inputs, individual events, and events that are combined with analyzed behavior and vulnerabilities. The Magistrate component prioritizes the offenses and assigns a magnitude value that is based on several factors, including number of events, severity, relevance, and credibility. JSA Event Collector Gathers events from local and remote log sources. Normalizes raw log source events. During this process, the Magistrate component examines the event from the log source and maps the event to a JSA Identifier (QID). Then, the Event Collector bundles identical events to conserve system usage and sends the information to the Event Processor. JSA Event Processor Processes events that are collected from one or more Event Collector components. The Event Processor correlates the information from JSA products and distributes the information to the appropriate area, depending on the type of event. The Event Processor also includes information that is gathered by JSA products to indicate behavioral changes or policy violations for the event. When complete, the Event Processor sends the events to the Magistrate component. Related Documentation Prerequisite Hardware Accessories and Desktop Software for JSA Installations on page 7 Understanding JSA Deployment on page 3 6

17 Chapter 1: Juniper Secure Analytics Deployment Overview Supported Web Browsers on page 7 Prerequisite Hardware Accessories and Desktop Software for JSA Installations Before you install Juniper Secure Analytics (JSA) products, ensure that you have access to the required hardware accessories and desktop software. Hardware accessories Ensure that you have access to the following hardware components: Monitor and keyboard, or a serial console Uninterrupted Power Supply (UPS) for all systems that store data, such as JSA console, Event Processor components, or JSA Flow Processor components Null modem cable if you want to connect the system to a serial console NOTE: JSA products support hardware-based Redundant Array of Independent Disks (RAID) implementations, but do not support software-based RAID installations. Desktop software requirements Ensure that following applications are installed on all desktop systems that you use to access the JSA product user interface: Java Runtime Environment (JRE) version 1.7 or 64-bit Runtime Environment for Java V7.0 Adobe Flash version 10.x Install JSA console or a managed host on the JSA appliance. Related Documentation Supported Web Browsers on page 7 Troubleshooting Problems on page 49 Integrated Management Module on page 5 Supported Web Browsers For the features in Juniper Secure Analytics (JSA) products to work properly, you must use a supported web browser. When you access the JSA system, you are prompted for a user name and a password. The user name and password must be configured in advance by the administrator. Table 5 on page 8 lists the supported versions of web browsers. 7

18 Juniper Secure Analytics Installation Guide Table 5: Supported Web Browsers for JSA Products Web Browser Supported Version Mozilla Firefox 17.0 Extended Support Release 24.0 Extended Support Release 32-bit Microsoft Internet Explorer, with document mode and browser mode enabled Google Chrome The current version as of the release date of JSA products Enabling Document Mode and Browser Mode in Internet Explorer If you use Microsoft Internet Explorer to access Juniper Secure Analytics (JSA) products, you must enable browser mode and document mode. 1. In your Internet Explorer web browser, press F12 to open the Developer Tools window. 2. Click Browser Mode and select the version of your web browser. 3. Click Document Mode and select Internet Explorer 7.0 Standards. For Internet Explorer V9.0, select Internet Explorer 9 standards. For Internet Explorer V10.0, select Internet Explorer 10 standards. Related Documentation Understanding JSA Deployment on page 3 Licence Keys on page 3 Integrated Management Module on page 5 8

19 CHAPTER 2 USB Flash Drive Installations This chapter describes about the following section: USB Flash Drive Installations Overview on page 9 Creating a Bootable USB Flash Drive with a JSA Appliance on page 10 Creating a Bootable USB Flash Drive with Microsoft Windows on page 12 Creating a Bootable USB Flash Drive with Red Hat Linux on page 14 Obtaining the create-usb-install-key.py Script on page 16 Configuring a USB Flash Drive for Serial-only Appliances on page 17 Installing JSA with a USB Flash Drive on page 18 USB Flash Drive Installations Overview You can install Juniper Secure Analytics (JSA) software with a USB flash drive. USB flash drive installations are full product installations. You cannot use a USB flash drive to upgrade or apply product patches. For information about applying patches, see Patch Release Notes. Supported versions The following appliances or operating systems can be used to create a bootable USB flash drive: A JSA appliance or later A Linux system that is installed with Red Hat Enterprise Linux 6.4 Microsoft Windows Vista Microsoft Windows 7 Microsoft Windows 2008 Microsoft Windows 2008R2 Installation overview Follow this procedure to install JSA software from a USB flash drive: 1. Create the bootable USB flash drive. 9

20 Juniper Secure Analytics Installation Guide 2. Install the software for your JSA appliance. 3. Install any product maintenance releases or pathces. See Patch Release Notes for installation instructions for patches. Related Documentation Creating a Bootable USB Flash Drive with Microsoft Windows on page 12 Creating a Bootable USB Flash Drive with Red Hat Linux on page 14 Installing JSA with a USB Flash Drive on page 18 Creating a Bootable USB Flash Drive with a JSA Appliance You can use a Juniper Secure Analytics (JSA) or later appliance to create a bootable USB flash drive that can be used to install JSA software. Before you begin Before you can create a bootable USB flash drive from a JSA appliance, you must have access to the following items: A 2 GB USB flash drive A JSA or later ISO image file A physical JSA appliance If your JSA appliance does not have Internet connectivity, you can download the JSA ISO image file to a desktop computer or another JSA appliance with Internet access. You can then copy the ISO file to the JSA appliance where you install the software. When you create a bootable USB flash drive, the contents of the flash drive are deleted. Procedure To create a bootable USB flash drive with a JSA appliance: 1. Obtain the create-usb-install-key.py script. See Obtaining the create-usb-install-key.py Script on page Using SSH, log in to your JSA system as the root user. Username: root Password: <password> 3. Insert the USB flash drive in the USB port on your JSA system. It might take up to 30 seconds for the system to recognize the USB flash drive. 10

21 Chapter 2: USB Flash Drive Installations 4. Type the following command to start the USB creation script (if script is placed in /tmp): /tmp/create-usb-install-key.py 5. Press Enter. 6. Press 1, then press Enter to type the path to the ISO file. For example, To obtain the JSA ISO: Access website to download a JSA ISO file: a. Select JSA Series under By Series. b. Click on any of the JSA Series. c. Click Software tab. d. Under Version, select e. Locate the ISO on the page and download the ISO. f. Copy the ISO image to a directory on your JSA system. For example, /tmp. 7. Press 2, then press Enter to select the drive containing your USB flash drive. 8. Press 3, then press Enter to create your USB key. 9. Type create and press Enter to start the USB creation process. The process of writing the ISO image to your USB flash drive takes several minutes to complete. When the ISO is loaded onto the USB flash drive, a confirmation message is displayed. 10. Press q to quit the USB key script. 11. Remove the USB flash drive from your JSA system. You are now ready to use your USB flash drive to install JSA on an appliance. What to do next Installing JSA with a USB Flash Drive on page 18. Related Documentation Creating a Bootable USB Flash Drive with Microsoft Windows on page 12 Creating a Bootable USB Flash Drive with Red Hat Linux on page 14 Configuring a USB Flash Drive for Serial-only Appliances on page

22 Juniper Secure Analytics Installation Guide Creating a Bootable USB Flash Drive with Microsoft Windows You can use a Microsoft Windows desktop or notebook system to create a bootable USB flash drive that can be used to install Juniper Secure Analytics (JSA) software. Before you begin Before you can create a bootable USB flash drive with a Microsoft Windows system, you must have access to the following items: A 2 GB USB flash drive A desktop or notebook system with one the following operating systems: Windows 7 Windows Vista Windows 2008 Windows 2008R2 You must download the following files from the Juniper Support website ( JSA or later Red Hat 64-bit ISO image file Create-USB-Install-Key (CUIK) tool You must download the following files from the Internet. PeaZip Portable SYSLINUX 4.06 TIP: Search the web for Peazip Portal v4.8.1 and Syslinux to find the download files. When you create a bootable USB flash drive, the contents of the flash drive are deleted. Procedure To create a bootable USB flash drive with Microsoft Windows: 1. Download the JSA ISO file: a. Access the Juniper Customer Support website b. Locate the JSA ISO file on the Juniper Customer Support website. c. Save the ISO file to your Windows system. 2. Download the Create-USB-Install-Key (CUIK) tool from the Juniper Customer Support website. 12

23 Chapter 2: USB Flash Drive Installations cuik.<version>.zip. 3. Extract the Create-USB-Install-Key (CUIK) tool to a directory. For example, C:\cuik 4. From the Internet, download the following required files to the CUIK/deps folder: PeaZip Portable For example, c:\cuik\deps\peazip_portable windows.zip Syslinux 4.06 For example, c:\cuik\deps\syslinux-4.06.zip You are not required to extract the zip files. The files only need to be available in the cuik/deps directory. 5. Insert a blank USB flash drive into the USB port on your computer. 6. Verify that the USB flash drive is be listed by drive letter and accessible in Windows. 7. Right-click cuik.exe and select Run as administrator. 8. Press Enter to continue. 9. Press 1 to select your JSA ISO file. 10. Select your ISO image and click Open. 11. Press 2 to select your USB drive letter. 12. Select the number that corresponds to your USB flash drive letter. 13. Press 3 to create your USB flash drive. 14. Press Enter to confirm you are aware that the contents of the USB flash drive are deleted. 15. Type create to create a bootable USB flash drive from the ISO image. This process takes several minutes to complete and the software tool informs you if the process was successful. 13

24 Juniper Secure Analytics Installation Guide 16. Press Enter, then type q to exit the Create-USB-Install-Key tool. 17. Safely eject the USB flash drive from the your desktop system. The USB stick is configured to install JSA software. Related Documentation Creating a Bootable USB Flash Drive with a JSA Appliance on page 10 Creating a Bootable USB Flash Drive with Red Hat Linux on page 14 Configuring a USB Flash Drive for Serial-only Appliances on page 17. Creating a Bootable USB Flash Drive with Red Hat Linux You can use a Linux desktop or notebook system with Red Hat v6.3 to create a bootable USB flash drive that can be used to install Juniper Secure Analytics (JSA) software. Before you begin Before you can create a bootable USB flash drive with a Linux system, you must have access to the following items: A 2 GB USB flash drive A JSA or later ISO image file A Linux system that has the following software installed: Red Hat 6.4 Python 6.2 or later When you create a bootable USB flash drive, the contents of the flash drive are deleted. Procedure 1. Obtain the create-usb-install-key.py script. See Obtaining the create-usb-install-key.py Script on page 16. Username: root Password: <password> 2. Update your Linux- based system to include these packages. syslinux mtools dosfstools parted For information about the specific package manager for your Linux system, see the vendor documentation. 14

25 Chapter 2: USB Flash Drive Installations 3. Log in to your JSA system as the root user. 4. Insert your USB flash drive in the front USB port on your system. It might take up to 30 seconds for the system to recognize the USB flash drive. 5. Type the following command to start the USB creation script (if script is placed in /tmp): /tmp/create-usb-install-key.py 6. Press Enter. 7. Press 1, then press Enter to type the path to the ISO file. For example, /tmp/jsa iso To obtain the JSA ISO: Access website to download a JSA ISO file: a. Select JSA Series under By Series. b. Click on any of the JSA Series. c. Click Software tab. d. Under Version, select e. Locate the ISO on the page and download the ISO. f. Copy the ISO image to a directory on your JSA system. For example, /tmp. 8. Press 2, then press Enter to select the drive containing your USB flash drive. 9. Press 3, then press Enter to create your USB key 10. Type create and press Enter to start the USB creation process. The process of writing the ISO image to your USB flash drive takes several minutes to complete. When the ISO is loaded onto the USB flash drive, a confirmation message is displayed. 11. Press q to quit the USB key script. 12. Remove the USB flash drive from your system. You are now ready to use your USB flash drive to install JSA on your appliance. What to do next Installing JSA with a USB Flash Drive on page 18 15

26 Juniper Secure Analytics Installation Guide Related Documentation Configuring a USB Flash Drive for Serial-only Appliances on page 17. Creating a Bootable USB Flash Drive with Microsoft Windows on page 12 Creating a Bootable USB Flash Drive with a JSA Appliance on page 10 Obtaining the create-usb-install-key.py Script Obtain the create-usb-install-key from the software ISO or from the software download page, using the following sections: Obtaining the create-usb-install-key.py Script from the Software Download Page on page 16 Obtaining the create-usb-install-key.py Script from the Software ISO on page 16 Obtaining the create-usb-install-key.py Script from the Software Download Page You can obtain the create-usb-install-key from the software download page. Procedure To obtain the create-usb-install-key script from the software download page: 1. Access the website to download create-usb-install-key script files: a. Select JSA Series under By Series. b. Click on any of the JSA Series. c. Click Software tab. d. Under Version, select e. Locate the create-usb-install-key.py script you want to download and click create-usb-install-key.py. 2. Save the file. 3. Copy the file to /tmp of JSA. What to do next Creating a Bootable USB Flash Drive with a JSA Appliance on page 10 Creating a Bootable USB Flash Drive with Red Hat Linux on page 14 Obtaining the create-usb-install-key.py Script from the Software ISO To obtain the create-usb-install-key.py script from the software ISO: 16

27 Chapter 2: USB Flash Drive Installations Procedure 1. Access the website to download create-usb-install-key script files: a. Select JSA Series under By Series. b. Click on any of the JSA Series. c. Click Software tab. d. Under Version, select e. Locate the ISO on the page and download the ISO.. f. Copy the ISO image to a directory on your JSA system. For example, /tmp. 2. Using SSH, log in to your JSA system as the root user. Username: root Password: <password> 3. Run the following command to mount the ISO image: mount -o loop /tmp/<name of the iso image>.iso /media/cdrom/ 4. Use cd /media/cdrom/post/ to go to post directory. create-usb-install-key.py script is present in the post directory. 5. Copy create-usb-install-key.py script to /tmp. cp /media/cdrom/post/create-usb-install-key.py /tmp What to do next Creating a Bootable USB Flash Drive with a JSA Appliance on page 10 Creating a Bootable USB Flash Drive with Red Hat Linux on page 14 Related Documentation USB Flash Drive Installations Overview on page 9 Creating a Bootable USB Flash Drive with Microsoft Windows on page 12 Configuring a USB Flash Drive for Serial-only Appliances on page 17 Configuring a USB Flash Drive for Serial-only Appliances You must complete an extra configuration step before you can use the bootable USB flash drive to install Juniper Secure Analytics (JSA) software on serial-only appliances. 17

28 Juniper Secure Analytics Installation Guide About this task This procedure is not required if you have a keyboard and mouse that is connected to your appliance. Procedure To configure a USB flash drive for serial-only appliances: 1. Insert the bootable USB flash drive into the USB port of your appliance. 2. On your USB flash drive, locate the syslinux.cfg file. 3. Edit the syslinux configuration file to change the default installation from default Linux to default serial. 4. Save the changes to the syslinux configuration file. What to do next You are now ready to install JSA with the USB flash drive. Related Documentation USB Flash Drive Installations Overview on page 9 Creating a Bootable USB Flash Drive with Microsoft Windows on page 12 Installing JSA with a USB Flash Drive on page 18 Installing JSA with a USB Flash Drive Follow this procedure to install Juniper Secure Analytics (JSA) from a bootable USB flash drive. Before you begin You must create the bootable USB flash drive before you can use it to install JSA software. About this task This procedure provides general guidance on how to use a bootable USB flash drive to install JSA software. The complete installation process is documented in the product Installation Guide. Procedure To install JSA with a USB flash drive: 1. Install all necessary hardware. 2. Choose one of the following options: 18

29 Chapter 2: USB Flash Drive Installations Connect a notebook to the serial port at the back of the appliance. Connect a keyboard and monitor to their respective ports. 3. Insert the bootable USB flash drive into the USB port of your appliance. 4. Restart the appliance. Most appliances can boot from a USB flash drive by default. If you are installing JSA software on your own hardware, you might have to set the device boot order to prioritize USB. After the appliance starts, the USB flash drive prepares the appliance for installation. This process can take up to an hour to complete. 5. When the Red Hat Enterprise Linux menu is displayed, select one of the following options: If you connected a keyboard and monitor, select Install or upgrade using VGA console. If you connected a notebook with a serial connection, select Install or upgrade using Serial console. 6. Type SETUP to begin the installation. 7. When the login prompt is displayed, type root to log in to the system as the root user. The user name is case-sensitive. 8. Press Enter and follow the prompts to install JSA. The complete installation process is documented in the product Installation Guide. Related Documentation Configuring a USB Flash Drive for Serial-only Appliances on page 17 Creating a Bootable USB Flash Drive with a JSA Appliance on page 10 Creating a Bootable USB Flash Drive with Red Hat Linux on page 14 19

30 Juniper Secure Analytics Installation Guide 20

31 CHAPTER 3 Virtual Appliance Installations for JSA and Log Manager This chapter describes about the following section: Juniper Secure Analytics and Log Manager Installation Overview on page 21 Overview of Supported Virtual Appliances on page 21 System Requirements for Virtual Appliances on page 23 Creating Your Virtual Machine on page 27 Installing the JSA Software on a Virtual Machine on page 29 Adding Your Virtual Appliance to Your Deployment on page 32 Juniper Secure Analytics and Log Manager Installation Overview You can install Juniper Secure Analytics (JSA) and Log Manager on a virtual appliance. Ensure that you use a supported virtual appliance that meets the minimum system requirements. To install a virtual appliance, complete the following tasks in sequence: Create a virtual machine. Install JSA software on the virtual machine. Add your virtual appliance to the deployment. Related Documentation System Requirements for Virtual Appliances on page 23 Creating Your Virtual Machine on page 27 Adding Your Virtual Appliance to Your Deployment on page 32 Overview of Supported Virtual Appliances A virtual appliance is a Juniper Secure Analytics (JSA) system that consists of JSA software that is installed on a VMWare ESX virtual machine. Use the procedures in this topic to install your virtual appliance. 21

32 Juniper Secure Analytics Installation Guide A virtual appliance provides the same visibility and functionality in your virtual network infrastructure that JSA appliances provide in your physical environment. After you install your virtual appliances, use the deployment editor to add your virtual appliances to your deployment. For more information on how to connect appliances, see the Juniper Secure Analytics Administration Guide. JSA Virtual All-in-One This virtual appliance is a Juniper Secure Analytics (JSA) system that can profile network behavior and identify network security threats. The JSA Virtual All-in-One or JSA Virtual console deployment virtual appliance includes an on-board Event Collector and internal storage for events. The JSA Virtual All-in-One or JSA Virtual console deployment virtual appliance supports the following items: 600k flows per minute max depending on the configuration of the VM 750 event feeds (additional devices can be added to your licensing) External flow data sources for NetFlow, sflow, J-Flow, Packeteer, and Flowlog files Flow Processor and Layer 7 network activity monitoring To expand the capacity of the JSA Virtual All-in-One or JSA Virtual console deployment beyond the license-based upgrade options, you can add one or more of the JSA Virtual Distributed Event or Flow processors or JSA Virtual Distributed Event or Flow processors virtual appliances. JSA Virtual Distributed Event Processors This virtual appliance is a dedicated Event Processor that allows you to scale your Juniper Secure Analytics (JSA) deployment to manage higher EPS rates. The JSA Virtual Distributed Event or Flow processors includes an on-board Event Collector, Event Processor, and internal storage for events. The JSA Virtual Distributed Event or Flow processors appliance supports the following items: Up to 20k events per second, depending on the amount of CPU and RAM allocated 2 TB or larger dedicated event storage The JSA Virtual Distributed Event or Flow processors virtual appliance is a distributed Event Processor appliance and requires a connection to any series appliance. JSA Virtual Distributed Flow Processors This virtual appliance is deployed with any series appliance. The virtual appliance is used to increase storage and includes an on-board Event Processor, and internal storage. JSA Virtual Distributed Event or Flow processors appliance supports the following items: 600k flows per minute max depending on the amount of CPU and RAM allocated 22

33 Chapter 3: Virtual Appliance Installations for JSA and Log Manager 2 TB or larger dedicated flow storage Flow Processor and Layer 7 network activity monitoring You can add JSA Virtual Distributed Event or Flow processors appliances to any series appliance to increase the storage and performance of your deployment. Related Documentation Juniper Secure Analytics and Log Manager Installation Overview on page 21 Creating Your Virtual Machine on page 27 Adding Your Virtual Appliance to Your Deployment on page 32 System Requirements for Virtual Appliances To ensure that Juniper Secure Analytics (JSA) works correctly, ensure that virtual appliance that you use meets the minimum software and hardware requirements. To install a virtual appliance, you must first use VMware vsphere Client to create a virtual machine. For more information, see Creating Your Virtual Machine on page 27. Table 6 on page 23 describes the minimum requirements for virtual appliances. Table 6: Requirements for Virtual Appliances Requirement Description VMware client VMware ESXi Version 5.0 VMware ESXi Version 5.1 VMware ESXi Version 5.5 For more information about VMWare clients, see the VMware website at Virtual disk size on all appliance except Flow Processor appliances Minimum: 256 GB NOTE: For optimal performance, ensure that an extra 2-3 times of the minimum disk space is available. NOTE: After successful installation, extra disk space cannot be added. Virtual disk size for Flow Processor appliances Minimum: 70 GB Table 7 on page 24 describes the minimum memory requirements for virtual appliances. 23

34 Juniper Secure Analytics Installation Guide Table 7: Minimum and Optional Memory Requirements for JSA Virtual Appliances Appliance Minimum memory requirement Suggested memory requirement JSA Virtual Distributed Event processors 12 GB 24 GB JSA Virtual Distributed Flow processors 12 GB 24 GB JSA Virtual All-in-One or JSA Virtual console deployment 12 GB 24 GB Log Manager Virtual 12 GB 24 GB Table 8 on page 24 describes the Log Manager all-in-one requirements. Table 8: Log Manager All-in-One Requirements Events Per Second CPUs RAM (GB) Table 9 on page 24 describes the Log Manager event processor requirements. Table 9: Log Manager Event Processor Requirements Events Per Second CPUs RAM (GB)

35 Chapter 3: Virtual Appliance Installations for JSA and Log Manager Table 9: Log Manager Event Processor Requirements (continued) Events Per Second CPUs RAM (GB) Table 10 on page 25 describes the Log Manager dedicated console requirements. Table 10: Log Manager Dedicated Console Requirements Console CPUs RAM (GB) Virtual machine as console 4 12 NOTE: Console resource requirements can vary widely with usage. Table 11 on page 25 describes the Threat Manager all-in-one requirements. Table 11: Threat Manager All-in-One Requirements Flows Per Minute Events Per Second CPUs

36 Juniper Secure Analytics Installation Guide Table 12 on page 26 describes the Threat Manager event processor requirements. Table 12: Threat Manager Event Processor Requirements Events Per Second CPUs RAM (GB) Table 13 on page 26 describes the Threat Manager flow processor requirements. Table 13: Threat Manager Flow Processor Requirements Flows Per Minute CPUs RAM (GB) Table 14 on page 26 describes the Threat Manager dedicated console requirements. Table 14: Threat Manager Dedicated Console Requirements Console CPUs RAM (GB) Virtual machine as console 4 12 NOTE: Console resource requirements can vary widely with usage. 26

37 Chapter 3: Virtual Appliance Installations for JSA and Log Manager Table 16 on page 27 describes the disk space allocation (Events per second) requirements. Table 15: Disk Space Allocation (Events Per Second) Requirements Events Per Second Retention Period Disk Required days 1 TB days 2 TB days 6.5 TB Table 16 on page 27 describes the disk space allocation (Flows per second) requirements. Table 16: Disk Space Allocation (Flows Per Second) Requirements Flows Per Minute Retention Period Disk Required 50, days 500 MB 50, days 1 TB 50, days 3 TB Related Documentation Juniper Secure Analytics and Log Manager Installation Overview on page 21 Overview of Supported Virtual Appliances on page 21 Adding Your Virtual Appliance to Your Deployment on page 32 Creating Your Virtual Machine To install a virtual appliance, you must first use VMware vsphere Client to create a virtual machine. 1. Select the host and choose File > New > Virtual Machine, and then click Next. 2. Select Custom In the Configuration pane of the Create New Virtual Machine window, and then click Next. 3. Enter a name for the virtual machine in the Name and Location pane, and then click Next. 4. Select the datastore in which you want to store the virtual machine files, and then click Next. 5. Select Virtual Machine Version: 7 in the Virtual Machine Version pane, and then click Next. 27

38 Juniper Secure Analytics Installation Guide 6. Select Linux under Guest operating System and then select Linux Red Hat Enterprise Linux 6 (64-bit) under Version, and then click Next. 7. Configure the number of virtual processors that you want for the virtual machine on the CPUs page, and then click Next. When you configure the parameters on the CPU page, you must configure a minimum of two processors. The combination of number of virtual sockets and number of cores per virtual socket determines how many processors are configured on your system. Table 17 on page 28 provides examples of CPU page settings you can use. Table 17: Descriptions for Network Configuration Parameters Number of Processors Sample CPU Page Settings 2 Number of virtual sockets = 1 Number of cores per virtual socket = 2 2 Number of virtual sockets = 2 Number of cores per virtual socket = 1 4 Number of virtual sockets = 4 Number of cores per virtual socket = 1 4 Number of virtual sockets = 2 Number of cores per virtual socket = 2 8. In the Memory Size field, type or select 24 GB and then click Next. Table 7 on page 24 describes the minimum memory requirements for virtual appliances. 9. To configure your network connections, perform the following steps: a. Add at least one Network Interface Controller (NIC) for How many NICs do you want to connect. b. Select VMXNET3 for Adapter. c. Select Connect at Power On. d. Click Next. 10. Select VMware Paravirtual in the SCSI Controller pane, and then click Next. 28

39 Chapter 3: Virtual Appliance Installations for JSA and Log Manager 11. Select Create a new virtual disk in the Select a Disk pane, and then click Next. 12. To configure the virtual disk parameters in the Create a Disk pane, perform the following steps: a. Select 256 or higher (GB) in Capacity. NOTE: After successful installation, extra disk space cannot be added. b. Select Thin provisioning in Disk Provisioning. c. Select Store with the virtual machine in Location. d. Click Next. 13. In the Advanced Options page, do not configure anything. 14. On the Ready to Complete page, review the settings and click Finish. Related Documentation Overview of Supported Virtual Appliances on page 21 System Requirements for Virtual Appliances on page 23 Adding Your Virtual Appliance to Your Deployment on page 32 Installing the JSA Software on a Virtual Machine After you create your virtual machine, you must install the Juniper Secure Analytics (JSA) software on the virtual machine. 1. In the left navigation pane of your VMware vsphere Client, select your virtual machine. 2. In the right pane, click the Summary tab. 3. Click Power On in the Commands pane to power on your machine. 4. Click Edit Settings in the Commands pane. 5. Click CD/DVD Drive 1 in the left pane of the Virtual Machine Properties window. 6. Select Datastore ISO File under Device Type, and then click Browse. 29

40 Juniper Secure Analytics Installation Guide 7. Locate and select the JSA ISO file in the Browse Datastores window and click Open and then click OK. 8. Select the Connect at power on check box under Device Status. 9. Click OK. 10. After the JSA product ISO image is installed, right-click your virtual machine and click Power > Reset to reboot. 11. In the left navigation pane of your VMware vsphere Client, select your virtual machine. 12. In the right pane, click the Console tab. 13. Log in to the virtual machine and type linux. 14. Ensure that the End User License Agreement (EULA) is displayed. TIP: Press the Spacebar key to advance through the document. 15. Select Skip using Tab and press Enter to skip the media test and proceed with the installation process. 16. If you choose hardware type 7, select OK using Tab and press Enter in the Unsupported Hardware Detected screen. 17. Type flatten. The installer partitions and reformats the hard disk, installs the OS, and then reinstalls the JSA product. You must wait for the flatten process to complete. This process can take up to several minutes. When the process is complete, a confirmation is displayed. 18. Type SETUP to begin the installation. 19. Select the appliance ID and select Next and press Enter. 20. For the type of setup, select normal. Select Next and press Enter. 21. For JSA console installations, select the Enterprise tuning template. Select Next and press Enter. 22. Choose one of the following options for time server: 30