STRM Installation Guide

Transcription

1 Security Thret Response Mnger Relese Juniper Networks, Inc North Mthild Avenue Sunnyvle, CA USA Published:

2 Copyright Notice Copyright 2014 Juniper Networks, Inc. All rights reserved. Juniper Networks, Junos, Steel-Belted Rdius, NetScreen, nd ScreenOS re registered trdemrks of Juniper Networks, Inc. in the United Sttes nd other countries. The Juniper Networks Logo, the Junos logo, nd JunosE re trdemrks of Juniper Networks, Inc. The following terms re trdemrks or registered trdemrks of other compnies: Jv TM nd ll Jv-bsed trdemrks nd logos re trdemrks or registered trdemrks of Orcle nd/or its ffilites. All other trdemrks, service mrks, registered trdemrks, or registered service mrks re the property of their respective owners. All specifictions re subject to chnge without notice. Juniper Networks ssumes no responsibility for ny inccurcies in this document or for ny obligtion to updte informtion in this document. Juniper Networks reserves the right to chnge, modify, trnsfer, or otherwise revise this publiction without notice. FCC Sttement The following informtion is for FCC complince of Clss A devices: This equipment hs been tested nd found to comply with the limits for Clss A digitl device, pursunt to prt 15 of the FCC rules. These limits re designed to provide resonble protection ginst hrmful interference when the equipment is operted in commercil environment. The equipment genertes, uses, nd cn rdite rdio-frequency energy nd, if not instlled nd used in ccordnce with the instruction mnul, my cuse hrmful interference to rdio communictions. Opertion of this equipment in residentil re is likely to cuse hrmful interference, in which cse users will be required to correct the interference t their own expense. The following informtion is for FCC complince of Clss B devices: The equipment described in this mnul genertes nd my rdite rdio-frequency energy. If it is not instlled in ccordnce with Juniper Networks instlltion instructions, it my cuse interference with rdio nd television reception. This equipment hs been tested nd found to comply with the limits for Clss B digitl device in ccordnce with the specifictions in prt 15 of the FCC rules. These specifictions re designed to provide resonble protection ginst such interference in residentil instlltion. However, there is no gurntee tht interference will not occur in prticulr instlltion. If this equipment does cuse hrmful interference to rdio or television reception, which cn be determined by turning the equipment off nd on, the user is encourged to try to correct the interference by one or more of the following mesures: Reorient or relocte the receiving ntenn. Increse the seprtion between the equipment nd receiver. Consult the deler or n experienced rdio/tv technicin for help. Connect the equipment to n outlet on circuit different from tht to which the receiver is connected. Cution: Chnges or modifictions to this product could void the user's wrrnty nd uthority to operte this device. Disclimer THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT, SUBJECT TO THE MODIFICTAIONS SET FORTH BELOW ON THIS PAGE, ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR JUNIPER NETWORKS REPRESENTATIVE FOR A COPY. Relese Copyright 2014, Juniper Networks, Inc. All rights reserved. Printed in USA. Revision History September 2014 The informtion in this document is current s of the dte listed in the revision history. END USER LICENSE AGREEMENT The Juniper Networks product tht is the subject of this technicl documenttion consists of (or is intended for use with) Juniper Networks softwre. Use of such softwre is subject to the terms nd conditions of the End User License Agreement ( EULA ) posted t s modified by the following text, which shll be treted under the EULA s n Entitlement Document tking precedence over ny conflicting provisions of such EULA s regrds such softwre: As regrds softwre ccompnying the STRM products (the Progrm ), such softwre contins softwre licensed by Q1 Lbs nd is further ccompnied by third-prty softwre tht is described in the pplicble documenttion or mterils provided by Juniper Networks. 2

3 For the convenience of Licensee, the Progrm my be ccompnied by third prty operting system. The operting system is not prt of the Progrm, nd is licensed directly by the operting system provider (e.g., Red Ht Inc., Novell Inc., etc.) to Licensee. Neither Juniper Networks nor Q1 Lbs is prty to the license between Licensee nd the third prty operting system provider, nd the Progrm includes the third prty operting system AS IS, without representtion or wrrnty, express or implied, including ny implied wrrnty of merchntbility, fitness for prticulr purpose or non-infringement. For n instlled Red Ht operting system, see the license file: /usr/shre/doc/redht-relese-server-6server/eula. By downloding, instlling or using such softwre, you gree to the terms nd conditions of tht EULA s so modified. 3

4 4

5 CONTENTS ABOUT THIS GUIDE Audience Documenttion Conventions Technicl Documenttion Requesting Technicl Support PREPARATION FOR YOUR INSTALLATION STRM Deployment Overview STRM Components Additionl Hrdwre Requirements Additionl Softwre Requirements Supported Browsers Required Network Settings STRM CONSOLE AND MANAGED HOST INSTALLATION Prepring Your STRM Applince for Instlltion Instlling STRM Console or Mnged Host Accessing the STRM User Interfce INSTALLING THE RED HAT ENTERPRISE LINUX OPERATING SYSTEM 4 RE-INSTALLATION FROM THE RECOVERY PARTITION Recovery Prtition Overview Prepring for Re-instlltion Using Fctory Defult Setting Re-Instlling STRM Applince Accessing the STRM User Interfce VIRTUAL APPLIANCE INSTALLATION STRM Virtul Applinces Virtul Applince Requirements Virtul Applince Instlltion Procedures Accessing the STRM User Interfce

6 6 NETWORK SETTINGS MANAGEMENT Chnging the Network Settings in n All-in-One Console Chnging the Network Settings of Console in Multi-System Deployment Chnging the Network Settings of Mnged Host in Multi-System Deployment.44 Updting Network Settings fter NIC Replcement INDEX

7 ABOUT THIS GUIDE The provides you with STRM instlltion procedures. STRM pplinces re pre-instlled with softwre nd Red Ht Enterprise Linux version 6.3 operting system. This guide does not cover instlltion nd recovery of High Avilbility (HA) systems. If you wnt to instll or recover n HA system, see the STRM High Avilbility Guide. Audience This guide is intended for network dministrtors responsible for instlltion nd configurtion of STRM systems in your network. This guide ssumes working knowledge of networking nd Linux systems. Documenttion Conventions Tble 1 lists conventions tht re used throughout this guide. Tble 1 Icons Icon Type Description Informtion note Informtion tht describes importnt fetures or instructions. Cution Wrning Informtion tht lerts you to potentil loss of dt or potentil dmge to n ppliction, system, device, or network. Informtion tht lerts you to potentil personl injury. Technicl Documenttion You cn ccess technicl documenttion, technicl notes, nd relese notes directly from the Juniper customer support website t Once you ccess the Juniper customer support

8 8 ABOUT THIS GUIDE website, locte the product nd softwre relese for which you require documenttion. Your comments re importnt to us. Plese send your e-mil comments bout this guide or ny of the Juniper Networks documenttion to: Include the following informtion with your comments: Document title Pge number Requesting Technicl Support Technicl product support is vilble through the Juniper Networks Technicl Assistnce Center (JTAC). If you re customer with n ctive J-Cre or JNASC support contrct, or re covered under wrrnty, nd need postsles technicl support, you cn ccess our tools nd resources online or open cse with JTAC. JTAC policies For complete understnding of our JTAC procedures nd policies, review the JTAC User Guide locted t Product wrrnties For product wrrnty informtion, visit JTAC Hours of Opertion The JTAC centers hve resources vilble 24 hours dy, 7 dys week, 365 dys yer. Self-Help Online Tools nd Resources For quick nd esy problem resolution, Juniper Networks hs designed n online self-service portl clled the Customer Support Center (CSC) tht provides you with the following fetures: Find CSC offerings: Serch for known bugs: Find product documenttion: Find solutions nd nswer questions using our Knowledge Bse: Downlod the ltest versions of softwre nd review relese notes: Serch technicl bulletins for relevnt hrdwre nd softwre notifictions: Join nd prticipte in the Juniper Networks Community Forum: Open cse online in the CSC Cse Mngement tool:

9 Requesting Technicl Support 9 To verify service entitlement by product seril number, use our Seril Number Entitlement (SNE) Tool: Opening Cse with JTAC You cn open cse with JTAC on the Web or by telephone. Use the Cse Mngement tool in the CSC t Cll JTAC ( toll-free in the USA, Cnd, nd Mexico). For interntionl or direct-dil options in countries without toll-free numbers, visit us t

10 10 ABOUT THIS GUIDE

11 1 PREPARATION FOR YOUR INSTALLATION To ensure successful STRM deployment, dhere to the preprtion requirements nd recommendtions included in this topic. STRM Deployment Overview STRM deployment rchitecture llows you to instll components on single server for smll enterprises or distributed cross multiple servers for mximum performnce nd sclbility in lrge enterprise environments. STRM lso provides High Avilbility (HA) functionlity, which requires you to instll redundnt pplinces for ech system tht requires HA protection. If you wnt to instll or recover n HA system, see the STRM High Avilbility Guide. STRM Components STRM deployments cn include the following components: Flow Processor - Pssively collects trffic flows from your network through spn ports or network tps. The Flow Processor lso supports the collection of externl flow-bsed dt sources, such s NetFlow. Console - Provides the STRM user interfce, which provides rel time event nd flow views, reports, offenses, sset informtion, nd dministrtive functionlity. Using the Console, you cn lso mnge hosts tht include other components in distributed STRM deployment. Event Collector - Gthers events from locl nd remote log sources. The Event Collector normlizes rw log source events. During this process, the Mgistrte component exmines the event from the log source nd mps the event to STRM Identifier (QID). Then the Event Collector bundles identicl events to conserve system usge nd sends the informtion to the Event Processor. Event Processor - Processes events collected from one or more Event Collector. The Event Processor correltes the informtion from STRM nd distributes the informtion to the pproprite re, depending on the type of event. The Event Processor lso includes informtion gthered by STRM to indicte behviorl chnges or policy violtions for the event. When complete, the Event Processor sends the events to the Mgistrte component. Mgistrte - Provides the core processing components. You cn dd one Mgistrte component for ech deployment. The Mgistrte provides views,

12 12 PREPARATION FOR YOUR INSTALLATION reports, lerts, nd nlysis of network trffic nd security events. The Mgistrte processes events ginst the custom rules. If n event mtches rule, the mgistrte genertes the response configured in the custom rule. For exmple, the custom rule my indicte tht when n event mtches the rule, n offense is creted. If there is no mtch to custom rule, the Mgistrte uses defult rules to process the event. An offense is n lert tht hs been processed using multiple inputs, individul events, nd events combined with nlyzed behvior nd vulnerbilities. The mgistrte prioritizes the offenses nd ssigns mgnitude vlue bsed on severl fctors, including number of events, severity, relevnce, nd credibility. For more informtion on ech STRM component, see the STRM Administrtion Guide. Additionl Hrdwre Requirements Before you instll STRM systems, mke sure you hve ccess to the following hrdwre components: Monitor nd keybord, or seril console Uninterrupted Power Supply (UPS) for ll systems tht store dt, such s Consoles, Event Processors, or Flow Processors Null modem cble if you wnt to connect the system to seril console Additionl Softwre Requirements Before you instll STRM, mke sure you hve the following pplictions instlled on ny desktop system tht you use to ccess the STRM user interfce: Jv TM Runtime Environment (JRE) Adobe Flsh 10.x You cn downlod Jv 1.6.0_u24 t the following website: Mke sure tht you instll JRE on your desktop system, not on the STRM system. Supported Browsers You cn ccess the Console from stndrd web browser. When you ccess the system, prompt sks for user nme nd pssword, which must be configured in dvnce by the STRM dministrtor. Tble 3-1 Supported Web Browsers Web browser Supported versions Mozill Firefox 10.0 Due to Mozill s short relese cycle, we cnnot commit to test the ltest versions of the Mozill Firefox browser. However, we re fully committed to investigte ny issues tht re reported.

13 Required Network Settings 13 Tble 3-1 Supported Web Browsers (continued) Web browser Microsoft Internet Explorer, with Comptibility View Enbled Supported versions For instructions on how to enble Comptibility View, see Enbling Comptibility View for Microsoft Internet Explorer. Enbling Comptibility View for Microsoft Internet Explorer Step 1 Step 2 To use the Microsoft Internet Explorer web browser, you must enble Comptibility View. Procedure Press F12 to open the Developer Tools window. Configure the following comptibility settings: Tble 3-2 Microsoft Internet Explorer Comptibility Settings Browser Version Option Description Microsoft Internet Browser Mode From the Browser Mode list box, select Internet Explorer 8.0. Explorer 8.0 Document Mode From the Document Mode list box, select Internet Explorer 7.0 Stndrds. Microsoft Internet Explorer 9.0 Browser Mode From the Browser Mode list box, select Internet Explorer 9.0. Document Mode From the Document Mode list box, select Internet Explorer 7.0 Stndrds. Required Network Settings Before you instll STRM, you must identify the following informtion for ech system tht you wnt to instll: Hostnme IP ddress Network msk ddress Subnet msk Defult gtewy ddress Primry Domin Nme System (DNS) server ddress Secondry DNS server ddress (optionl) Public IP ddress for networks using Network Address Trnsltion (NAT) Emil server nme Network Time Protocol (NTP) server (Console only) or time server nme

14 14 PREPARATION FOR YOUR INSTALLATION

15 2 STRM CONSOLE AND MANAGED HOST INSTALLATION Use the procedures in this topic to instll STRM Consoles nd mnged host pplinces (non-consoles). STRM pplinces include STRM softwre nd Red Ht Enterprise Linux operting system. For more informtion bout pplinces, see the STRM Hrdwre Instlltion Guide. Prepring Your STRM Applince for Instlltion Before you cn use the instlltion wizrd to instll STRM pplince, you must physiclly instll nd prepre the pplince. About this tsk If you use lptop to connect to the system, you must use terminl progrm, such s HyperTerminl, to connect to the system. Mke sure you set Connect Using to the pproprite COM port of the seril connector nd Bits per second to You must lso set Stop Bits (1), Dt bits (8), nd Prity (None). For more informtion on your STRM pplince, see the STRM Hrdwre Instlltion Guide. CAUTION When deploying n STRM/JSA pplince with imge r , you must reimge the pplince to the common imge r For more informtion, see Instlling JSA Using Bootble USB Flsh-Drive Technicl Note. Step 1 Step 2 Step 3 Procedure Instll ll necessry hrdwre. Connect lptop to the seril port on the front pnel of the pplince. Power on the system nd log in: Usernme: root NOTE The usernme is cse sensitive.

16 16 STRM CONSOLE AND MANAGED HOST INSTALLATION Step 4 Press Enter. Wht to do next Instlling STRM Console or Mnged Host Instlling STRM Console or Mnged Host Use this procedure to instll STRM Console or mnged host. Before you begin Before you begin, ensure tht the following requirements re met: Your pplince is prepred for instlltion. If your pplince is not prepred for instlltion, see Prepring Your STRM Applince for Instlltion. About this tsk The Internet Protocol Version window displys up to mximum of four interfces. Ech interfce with physicl link is denoted with plus (+) symbol. When you configure the network settings, you cn configure public IP ddress for the server. This is secondry IP ddress tht is used to ccess the server, usully from different network or the Internet, nd is mnged by your network dministrtor. The Public IP ddress is often configured using Network Address Trnsltion (NAT) services on your network or firewll settings on your network. NAT trnsltes n IP ddress in one network to different IP ddress in nother network. When you crete the root pssword, the pssword must meet the following criteri: Must contin t lest five chrcters No spces Cn include the following specil nd *. Procedure Step 1 If you re instlling non-console pplince, go to Step 4. Step 2 Step 3 Select the Enterprise tuning templte. Select Next nd press Enter. Configure your time settings: b c Choose one of the following options: - Mnul - Select this option to mnully input the time nd dte. Select Next nd press Enter. The Current Dte nd Time window is displyed. Go to b. - Server - Select this option to specify your time server. Select Next nd press Enter. The Enter Time Server window is displyed. Go to c. To mnully enter the time nd dte, type the current time nd dte. Select Next nd press Enter. Go to Step 4. To specify time server, in the Time server field, type the time server nme or IP ddress. Select Next nd press Enter. Go to Step 6.

17 Instlling STRM Console or Mnged Host 17 Step 4 Step 5 Step 6 Step 7 Step 8 Step 9 Step 10 Step 11 Step 12 Step 13 On the Time Zone Continent window, select your time zone continent or re. Select Next nd press Enter. On the Time Zone Region window, select your time zone region. Select Next nd press Enter. Select n internet protocol version. Select Next nd press Enter. Select the interfce tht you wnt to use s the mngement interfce. Select Next nd press Enter. Choose one of the following options: If you use IPv4 s your Internet protocol, go to Step 11. If you use IPv6 s your Internet protocol, go to Step 9. Choose one of the following options: To utomticlly configure for IPv6, select Yes nd press Enter. The utomtic configurtion cn tke n extended period of time. Go to Step 11. b To mnully configure for IPv6, select No nd press Enter. Go to Step 10. Enter network informtion to use for IPv6: b c In the Hostnme field, type fully qulified domin nme s the system hostnme. In the IP Address field, type the IP ddress of the system. In the Emil server field, type the emil server. If you do not hve n emil server, type loclhost in this field. d Select Next nd press Enter. Go to Step 12 Configure the STRM network settings: b Enter vlues for the following prmeters: - Hostnme - Type fully qulified domin nme s the system hostnme. - IP Address - Type the IP ddress of the system. - Network Msk - Type the network msk ddress for the system. - Gtewy - Type the defult gtewy of the system. - Primry DNS - Type the primry DNS server ddress. - Secondry DNS - Optionl. Type the secondry DNS server ddress. - Public IP - Optionl. Type the Public IP ddress of the server. - Emil Server - Type the emil server. If you do not hve n emil server, type loclhost in this field. Select Next nd press Enter. Configure the STRM root pssword: b Type your pssword. Select Next nd press Enter. Retype your new pssword to confirm. Select Finish nd press Enter. Press Enter to select OK.

18 18 STRM CONSOLE AND MANAGED HOST INSTALLATION Result After you configure the instlltion prmeters, series of messges re displyed s STRM continues with the instlltion. This process typiclly tkes severl minutes. Wht to do next See Accessing the STRM User Interfce. Accessing the STRM User Interfce After the instlltion is complete, you cn ccess the STRM user interfce. About this tsk When you ccess the STRM for the first time, note the following requirements: If you use Mozill Firefox, you must dd n exception to Mozill Firefox. For more informtion, see your Mozill documenttion. If you use Internet Explorer, website security certificte messge is displyed. You must select the Continue to this website option to log in to STRM. For your STRM Console, defult license key provides you ccess to STRM for five weeks. For more informtion on the license key, see the STRM Administrtion Guide. Step 1 Step 2 Step 3 Procedure Open your web browser. Log in to STRM: Address> Where <IP Address> is the IP ddress of the STRM system. The defult vlues re: Usernme: dmin Pssword: <root pssword> Click Login To STRM.

19 Accessing the STRM User Interfce 19

20

21 3 INSTALLING THE RED HAT ENTERPRISE LINUX OPERATING SYSTEM Use this tsk to instll the Red Ht Enterprise Linux 6.3 operting system on STRM. Before you begin Before you instll the Red Ht Enterprise Linux 6.3 operting system, note the following: STRM supports the 64-bit versions of the Red Ht Enterprise Linux 6.3 operting system. STRM does not support KickStrt disks. These disks my cuse the ppliction to instll incorrectly. If you wnt to use NTP s your time server, mke sure you instll the NTP pckge. For more informtion, see your Red Ht documenttion. For Console systems, must hve t lest 8 GB of RAM nd t lest 256 GB of free disk spce. Note: For optiml performnce, ensure tht n extr 2-3 times of the minimum disk spce is vilble. If you pln to enble pylod indexing we strongly recommend tht your Console hs t lest 24 GB of RAM. We require tht you upgrde your system memory before you instll STRM on your system. For Flow Processors, mke sure the primry drive is t lest 70 GB of free spce. The firewll configurtion must llow WWW (http, https) nd SSH trffic. Before you configure the firewll, disble the SELinux option. The STRM instlltion includes defult firewll templte, which you cn updte in the System Setup window.

22 22 INSTALLING THE RED HAT ENTERPRISE LINUX OPERATING SYSTEM Tble 1-1 Prtition Guide About this tsk If you wnt to delete nd recrete prtitions rther thn edit the defult prtitions, use the following tble s guide: File system type Prtition Description Mount point Size Forced to be primry /boot System boot files /boot EXT4 101 MB Yes SDA swp No SDA Are to be used s memory when RAM is full. / Instll re for STRM, the operting system, nd ssocited files. /store/tmp Storge re for STRM temporry files /vr/log Storge re for STRM nd system log files /store Storge re for ll STRM dt nd configurtion files empty swp For systems with 4 to 8 GB of RAM, the size of the swp prtition must mtch the mount of RAM, For systems with 8 to 24 GB of RAM, configure the swp prtition size to be 75% of RAM, with minimum vlue of 8 GB nd mximum vlue of 24 GB. SDA or SDB / EXT MB No SDA /store/tmp EXT MB No SDA /vr/log EXT MB No SDA /store EXT4 Select the Fill to mximum llowble size check box No SDA NOTE If n error is displyed when the softwre RAID prtitions re creted, contct Juniper Customer Support. CAUTION Future softwre upgrdes will fil if you reformt ny of the following prtitions or their sub-prtitions: /store, /store/tmp, /store/riel, /store/persistent dt. For multi-disk deployments only, configure the following prtitions for the Console: /store s RAID5 - Stores STRM dt. Choose EXT4 s the file system type. FLOWLOGS nd DB re locted in the Store prtition. In system with five drives, suggested configurtion includes:

23 23 - disk 1 - boot, swp, OS, STRM temporry files, nd log files - remining disks - RAID 5, mounted s /store NOTE Other STRM components do not require the storge prtitions mentioned bove. After instlltion, if you notice tht your onbord network interfces re nmed nything other thn eth0, eth1, eth2, nd eth3, you must renme the network interfces. Step 1 Step 2 Step 3 Step 4 Procedure Instll the Red Ht Enterprise Linux 6.3 operting system: Obtin the Red Ht Enterprise Linux 6.3 operting system DVD ISO nd copy the ISO to one of the following portble storge devices: - Digitl Verstile Disk (DVD) - Bootble USB flsh-drive For instructions on how to crete bootble USB flsh-drive, see the Instlling STRM Using Bootble USB Flsh-Drive Technicl Note. b c d e f Insert the portble storge device into your pplince. Restrt your pplince. Lod the boot menu. Choose one of the following options: - Select the USB drive or DVD drive s the boot option. - To instll the Red Ht Enterprise Linux operting system on system tht supports Extensible Firmwre Interfce (EFI), you must strt the system in legcy mode. Select boot from legcy dvd or boot from legcy usb. When the login prompt is displyed, log in to the system s the root user. To prevent n issue with ethernet interfce ddress nming, perform the following steps on the Welcome pge: Press Tb. b c d Locte the following line: Vmlinuz initrd=initrd.imge At the end of the Vmlinuz initrd=initrd.imge line, dd the following text: biosdevnme=0 To return to the instlltion wizrd, press Enter. Click Next to dvnce to the next pge. Select the lnguge tht you wnt to use for the instlltion process nd s the system defult. Click Next.

24 24 INSTALLING THE RED HAT ENTERPRISE LINUX OPERATING SYSTEM Step 5 Step 6 Step 7 Step 8 Step 9 Step 10 Step 11 Step 12 Step 13 Step 14 Step 15 Step 16 Step 17 Step 18 Step 19 Select the type of keybord lyout tht you wnt to use. Click Next. Select the Bsic Storge Devices option. Click Next In the Hostnme field, type unique nme of your server. The host nme cn include letters, numbers, nd hyphens. Click Configure Network. The Network Connections window is displyed. Select System eth0. Click Edit. Configure the prmeters: b c d e f g Select the Connect utomticlly check box. Click the IPv4 Settings tb. From the Method list box, select Mnul. In the Addresses pne, click Add, nd then dd the IP, Netmsk, nd Gtewy ddresses for your server. In the DNS servers field, type comm-seprted list of DSN servers. Click Apply. Click Close. Click Next to dvnce to the next pge. From the list box, select time zone. Click Next. Configure your root pssword for your system: b c In the Root Pssword field, type root pssword. In the Confirm field, type the root pssword gin. Click Next to dvnce to the next pge. Select the Crete Custom Lyout option. Click Next. Configure disk prtitioning: b c Configure the mount points for ech disk prtition. For ll other prtitions, such s /, /boot, nd /vr/log, configure the file system type to be EXT4. Reformt the swp prtition with file system type of swp. For importnt informtion on prtition requirements, see About this tsk. Click Next. No chnges re required on this pge. Click Next. Select the Bsic Server option. Click Next. When the instlltion is complete, click Reboot. Wht to do next Instlling STRM Console or Mnged Host

25 4 RE-INSTALLATION FROM THE RECOVERY PARTITION If required, you cn re-instll STRM softwre from the recovery prtition. This section pplies to new STRM instlltions or upgrdes from STRM instlltions on STRM pplinces. Recovery Prtition Overview When you instll STRM, the instller (ISO) is copied into the recovery prtition. From this prtition, you cn re-instll STRM, which restores STRM to fctory defults. Your system is restored bck to fctory defult configurtion. Your current configurtion nd dt files re overwritten. When you reboot your STRM pplince, you re presented with the option to re-instll the softwre. If you do not respond to the prompt fter 5 seconds, the system reboots s norml, thus your configurtion nd dt files re mintined. If you choose the re-instll STRM option, wrning messge is displyed nd you must confirm tht you wnt to re-instll STRM. After confirmtion, the instller runs nd you cn follow the prompts through the instlltion process. NOTE After hrd disk filure, you re unble to re-instll from the recovery prtition, becuse it is longer be vilble. If you experience hrd disk filure, contct Juniper Customer Support for ssistnce. Any softwre upgrdes you perform fter you instll STRM replces the ISO file with the newer version. This section includes the following topics: Prepring for Re-instlltion Using Fctory Defult Setting Re-Instlling STRM Applince Prepring for Re-instlltion Using Fctory Defult Setting This topic provides the procedure to prepre for re-instlltion using fctory defult setting.

26 26 RE-INSTALLATION FROM THE RECOVERY PARTITION Step 1 Step 2 Step 3 Step 4 Step 5 Procedure Reboot your STRM pplince. Select Fctory re-instll. Type fltten to continue. Type SETUP. Log in to STRM s the root user nd press Enter. If you re setting up STRM pplince, such s STRM 2500, the Tuning Templte window is displyed. Go to Re-Instlling STRM Applince Re-Instlling STRM Applince Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 Step 8 To re-instll STRM Applince: Select the Enterprise tuning templte. Select Next nd press Enter. Configure your time settings: b c Choose one of the following options: - Mnul - Select this option to mnully input the time nd dte. Select Next nd press Enter. The Current Dte nd Time window is displyed. Go to b. - Server - Select this option to specify your time server. Select Next nd press Enter. The Enter Time Server window is displyed. Go to c. To mnully enter the time nd dte, type the current time nd dte. Select Next nd press Enter. Go to Step 3. To specify time server, in the Time server field, type the time server nme or IP ddress. Select Next nd press Enter. Go to Step 5. On the Time Zone Continent window, select your time zone continent or re. Select Next nd press Enter. On the Time Zone Region window, select your time zone region. Select Next nd press Enter. Select n internet protocol version. Select Next nd press Enter. Select the interfce tht you wnt to use s the mngement interfce. Select Next nd press Enter. Choose one of the following options: If you use IPv4 s your Internet protocol, go to Step 10. If you use IPv6 s your Internet protocol, go to Step 8. Choose one of the following options: To utomticlly configure for IPv6, select Yes nd press Enter. The utomtic configurtion cn tke n extended period of time. Go to Step 10. b To mnully configure for IPv6, select No nd press Enter. Go to Step 9.

27 Re-Instlling STRM Applince 27 Step 9 Step 10 Step 11 Step 12 Enter network informtion to use for IPv6: b c In the Hostnme field, type fully qulified domin nme s the system hostnme. In the IP Address field, type the IP ddress of the system. In the Emil server field, type the emil server. If you do not hve n emil server, type loclhost in this field. d Select Next nd press Enter. Go to Step 11. Configure the STRM network settings: b Enter vlues for the following prmeters: - Hostnme - Type fully qulified domin nme s the system hostnme. - IP Address - Type the IP ddress of the system. - Network Msk - Type the network msk ddress for the system. - Gtewy - Type the defult gtewy of the system. - Primry DNS - Type the primry DNS server ddress. - Secondry DNS - Optionl. Type the secondry DNS server ddress. - Public IP - Optionl. Type the Public IP ddress of the server. - Emil Server - Type the emil server. If you do not hve n emil server, type loclhost in this field. Select Next nd press Enter. Configure the STRM root pssword: b Type your pssword. Select Next nd press Enter The pssword must meet the following criteri: - Must contin t lest five chrcters - No spces - Cn include the following specil nd *. The Confirm New Root Pssword window is displyed. Retype your new pssword to confirm. Select Finish nd press Enter. Press Enter to select OK. Result After you configure the instlltion prmeters, series of messges re displyed s STRM continues with the re-instlltion. This process typiclly tkes severl minutes. Wht to do next See Accessing the STRM User Interfce

28 28 RE-INSTALLATION FROM THE RECOVERY PARTITION Accessing the STRM User Interfce After the instlltion is complete, you cn ccess the STRM user interfce. About this tsk When you ccess the STRM for the first time, note the following requirements: If you use Mozill Firefox, you must dd n exception to Mozill Firefox. For more informtion, see your Mozill documenttion. If you use Internet Explorer, website security certificte messge is displyed. You must select the Continue to this website option to log in to STRM. For your STRM Console, defult license key provides you ccess to STRM for five weeks. For more informtion on the license key, see the STRM Administrtion Guide. Step 1 Step 2 Step 3 Procedure Open your web browser. Log in to STRM: Address> Where <IP Address> is the IP ddress of the STRM system. The defult vlues re: Usernme: dmin Pssword: <root pssword> Click Login To STRM.

29 5 VIRTUAL APPLIANCE INSTALLATION A virtul pplince is STRM system tht consists of STRM softwre instlled on VMWre ESX 5.0 virtul mchine. Use the procedures in this topic to instll your virtul pplince. A virtul pplince enbles the sme visibility nd functionlity in your virtul network infrstructure tht STRM pplinces offer in your physicl environment. After you instll your virtul pplinces, you cn ccess the deployment editor nd dd your virtul pplinces to your deployment. For more informtion on how to connect pplinces, see the STRM Administrtion Guide. STRM Virtul Applinces The following virtul pplinces re vilble: STRMV All-In-One Deployment STRMV All-In-One Thret Mnger (AIO-TM) The STRMV AIO-TM virtul pplince includes n on-bord Event Processor, Flow Processor, nd Correltion Engine for utomticlly identifying nd prioritizing incidents. It hs support for custom dshbords nd flexible reporting engine tht supports scheduling of reports.the STRMV AIO-TM virtul pplince supports: - Up to 1,000 network objects - 50,000 flows per intervl, depending on your license - 1,000 events per second (eps), depending on your license event feeds (dditionl devices cn be dded to your licensing) - Externl flow dt sources for NetFlow, sflow, J-Flow, Pcketeer, nd Flowlog files - Flow Processor nd Lyer 7 network ctivity monitoring STRMV All-In-One Log Mnger (AIO-LM) The STRMV AIO-LM virtul pplince includes n on-bord Event Processor. It hs support for custom dshbords nd flexible reporting engine tht supports scheduling of reports. The STRMV AIO-LM virtul pplince supports: - Up to 1,000 network objects

30 30 VIRTUAL APPLIANCE INSTALLATION - 1,000 events per second (eps), depending on your license event feeds (dditionl devices cn be dded to your licensing) STRMV Distributed Deployment STRMV Console You cn lso expnd the cpcity beyond wht one STRM AIO cn support by implementing STRMV in distributed deployment. This requires one STRMV Console nd one or more STRMV Event or Flow Processors. A STRM Console cn support up to 100 distributed virtul or physicl processors nd is vilble in the following types: - STRMV LM Console: Supports only distributed Event Processors nd does not include correltion support. - STRMV TM Console: Supports both distributed Event nd Flow Processors nd 2 TB or lrger dedicted flow storge, which includes correltion of both event nd flow dt. STRMV Distributed TM Event Processor (Only supported together with STRMV TM Console) Provides event collection nd correltion. The STRMV Distributed TM Event Processor supports: - Up to 1,000 network objects - 1,000 events per second (eps), depending on your license event feeds (dditionl devices cn be dded to your licensing) STRMV Distributed LM Event Processor (Only supported together with STRMV LM Console) Provides event collection only (no event correltion). The STRMV Distributed LM Event Processor supports: - Up to 1,000 network objects - 1,000 events per second (eps), depending on your license event feeds (dditionl devices cn be dded to your licensing) STRMV Distributed Flow Processor (Only supported together with STRMV TM Console) Provides flow collection nd correltion. The STRMV Distributed Flow Processor supports: - 50,000 flows per intervl, depending on your license - Externl flow dt sources for NetFlow, sflow, J-Flow, Pcketeer, nd Flowlog files Flow Processor nd Lyer 7 network ctivity monitoring Virtul Applince Requirements Before you instll your virtul pplince, ensure the following requirements re met: Virtul pplinces require VMwre ESXi 5.0. You must hve VMwre client instlled on your desktop. VMwre server pplictions re bundled with client softwre. For exmple, ESXi 5.0 is bundled with VMwre vsphere client 5.0. If

31 Virtul Applince Instlltion Procedures 31 your server/client configurtion differs, we recommend you upgrde your VMwre server nd client. For more informtion, see 4 GB of free memory is required by the VMwre host for STRMV Distributed Event or Flow Processors. 12 GB is optiml. 8 GB of free memory is required by the VMwre host for STRMV All-in-One or STRMV Console deployment. 12 GB is optiml. 256 GB of free disk spce is required on ll virtul pplince types except Flow Processors. Note: For optiml performnce, ensure tht n extr 2-3 times of the minimum disk spce is vilble. Flow Processors require t lest 70 GB of free disk spce. Virtul Applince Instlltion Procedures Creting your Virtul Mchine The process to instll virtul pplince includes the following tsks, which must be performed in sequence. 1 Creting your Virtul Mchine 2 Instlling the STRM ISO on the Virtul Mchine 3 Instlling STRM Softwre on your Virtul Mchine 4 Adding your Virtul Applince to your Deployment To instll virtul pplince, you must first crete virtul mchine using VMwre vsphere client 5.0. About this tsk When you configure the prmeters on the CPU pge, you must configure minimum of two processors. The combintion of number of virtul sockets nd number of cores per virtul socket determines how mny processors re configured on your system. NOTE You cn configure up to mximum of eight processors. Where number of processors is equl to (number of virtul sockets) * (number of cores per virtul socket). The following tble provides exmples of CPU pge settings you cn use: Tble 1-2 Smple CPU Pge Settings Number of Processors Smple CPU Pge Settings 2 Number of virtul sockets = 1 Number of cores per virtul socket = 2

32 32 VIRTUAL APPLIANCE INSTALLATION Tble 1-2 Smple CPU Pge Settings (continued) Number of Processors Smple CPU Pge Settings 2 Number of virtul sockets = 2 Number of cores per virtul socket = 1 4 Number of virtul sockets = 4 Number of cores per virtul socket = 1 4 Number of virtul sockets = 2 Number of cores per virtul socket = 2 Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 Step 8 Step 9 Step 10 Procedure Access your vsphere Client. Select File > New > Virtul Mchine. In the Configurtion pne of the Crete New Virtul Mchine window, select the Custom option nd click Next. In the Nme field, type unique nme for the virtul mchine nd click Next. In the right pne, select the dtstore where you wnt to store the virtul mchine nd click Next. In the Virtul Mchine Version pne, select the Virtul Mchine Version: 8 option nd click Next. Select the Operting System (OS) for the STRM virtul pplince: In the Guest Operting System pne, select the Linux option. b From the Version list box, select Red Ht Enterprise Linux 6 (64-bit) nd click Next. On the CPUs pge, configure the number of virtul processors tht you wnt for the virtul mchine: From the Number of virtul sockets list box, select the number of sockets tht you wnt for the virtul mchine nd click Next. b From the Number of cores per virtul socket list box, select the number of sockets tht you wnt for the virtul mchine nd click Next. In the Memory Configurtion pne, provide minimum of 8 GB for memory: b In the Memory Size field, type or select 8 or higher. In the list box, select GB. Configure your network connections: b c From the How mny NICs do you wnt to connect list box, select the number of Network Interfce Controllers (NICs) tht you wnt to dd. You must dd t lest one NIC. For ll NICs, select VMXNET3 from the Adpter list box. Click Next.

33 Virtul Applince Instlltion Procedures 33 Step 11 Step 12 Step 13 Step 14 Step 15 In the SCSI controller pne, select VMwre Prvirtul nd click Next. In the Disk pne, select Crete new virtul disk. Configure the virtul disk size nd specify provisioning policy: In the Cpcity pne, type or select 256 or higher nd select GB from the list box. Note: For optiml performnce, ensure tht n extr 2-3 times of the minimum disk spce is vilble. b In the Disk Provisioning pne, select the Thin provision check box. c Click Next. The Advnced Options pge is displyed. Do not configure the options on this pge. Click Next. On the Redy to Complete pge, review the settings nd click Finish. Wht to do next Instlling the STRM ISO on the Virtul Mchine Instlling the STRM ISO on the Virtul Mchine After you crete your virtul mchine, you must instll the STRM ISO on the virtul mchine. Before you begin Before you begin, ensure tht you creted virtul mchine. See Creting your Virtul Mchine. Procedure Step 1 Obtin the STRM softwre from the Juniper Customer Support website Step 2 Step 3 Step 4 In the left pne of your VMwre vsphere Client, select your virtul mchine from the menu tree. In the right pne, click the Summry tb. In the Commnds pne, click Edit Settings. Step 5 In the left pne of the Virtul Mchine Properties window, click CD/DVD Drive 1. Step 6 Step 7 Step 8 Step 9 In the Device Sttus pne, select the Connect t power on check box. In the Device Type pne, select Dtstore ISO File nd click Browse. is displyed. On the Browse Dtstores window, locte nd select the ISO file nd click Open. Click OK. Wht to do next Instlling STRM Softwre on your Virtul Mchine.

34 34 VIRTUAL APPLIANCE INSTALLATION Instlling STRM Softwre on your Virtul Mchine After your virtul mchine is configured nd STRM ISO is instlled, power on nd continue the STRM softwre instlltion. Before you begin Before you begin, you must hve creted virtul mchine nd instlled the STRM ISO on the mchine. See the following topics: Creting your Virtul Mchine Instlling the STRM ISO on the Virtul Mchine About this tsk The Internet Protocol Version window displys up to mximum of four interfces. Ech interfce with physicl link is denoted with plus (+) symbol. When you configure the network settings, you cn configure public IP ddress for the server. This is secondry IP ddress tht is used to ccess the server, usully from different network or the Internet, nd is mnged by your network dministrtor. The Public IP ddress is often configured using Network Address Trnsltion (NAT) services on your network or firewll settings on your network. NAT trnsltes n IP ddress in one network to different IP ddress in nother network. When you crete the root pssword, the pssword must meet the following criteri: Must contin t lest five chrcters No spces Cn include the following specil nd *. Step 1 Step 2 Step 3 Procedure Access your vsphere Client. In the menu tree, right-click your virtul mchine nd select Power > Power On. Log in to the virtul mchine: Usernme: root NOTE The usernme is cse sensitive. Step 4 Press Enter. Step 5 Select norml for your type of setup. Select Next nd press Enter. Step 6 Specify if you wnt to instll Console or non-console system. Yes - Select this option if this system is Console. No - Select this option if this system is not Console. Step 7 Select Next nd press Enter. Step 8 If you re instlling non-console pplince, go to Step 11.

35 Virtul Applince Instlltion Procedures 35 Step 9 Step 10 Step 11 Step 12 Step 13 Step 14 Step 15 Step 16 Step 17 Step 18 Select the Enterprise tuning templte. Select Next nd press Enter. Configure your time settings: b c Choose one of the following options: - Mnul - Select this option to mnully input the time nd dte. Select Next nd press Enter. The Current Dte nd Time window is displyed. Go to b. - Server - Select this option to specify your time server. Select Next nd press Enter. The Enter Time Server window is displyed. Go to c. To mnully enter the time nd dte, type the current time nd dte. Select Next nd press Enter. Go to Step 11. To specify time server, in the Time server field, type the time server nme or IP ddress. Select Next nd press Enter. Go to Step 11. On the Time Zone Continent window, select your time zone continent or re. Select Next nd press Enter. On the Time Zone Region window, select your time zone region. Select Next nd press Enter. Select n internet protocol version. Select Next nd press Enter. Select the interfce tht you wnt to use s the mngement interfce. Select Next nd press Enter. Choose one of the following options: If you use IPv4 s your Internet protocol, go to Step 18. If you use IPv6 s your Internet protocol, go to Step 16. Choose one of the following options: To utomticlly configure for IPv6, select Yes nd press Enter. The utomtic configurtion cn tke n extended period of time. Go to Step 18. b To mnully configure for IPv6, select No nd press Enter. Go to Step 17. Enter network informtion to use for IPv6, type the vlues for the Hostnme nd Emil server. Select Next nd press Enter. Configure the STRM network settings: Enter vlues for the following prmeters: Hostnme - Type fully qulified domin nme s the system hostnme. IP Address - Type the IP ddress of the system. Network Msk - Type the network msk ddress for the system. Gtewy - Type the defult gtewy of the system. Primry DNS - Type the primry DNS server ddress. Secondry DNS - Optionl. Type the secondry DNS server ddress. Public IP - Optionl. Type the Public IP ddress of the server. Emil Server - Type the emil server. If you do not hve n emil server, type loclhost in this field.

36 36 VIRTUAL APPLIANCE INSTALLATION Step 19 b Select Next nd press Enter. Configure the STRM root pssword: Type your pssword. Select Next nd press Enter. b Retype your new pssword to confirm. Select Finish nd press Enter. c Press Enter to select OK. Result After you configure the instlltion prmeters, series of messges re displyed s STRM continues with the instlltion. This process typiclly tkes severl minutes. Wht to do next Adding your Virtul Applince to your Deployment Adding your Virtul Applince to your Deployment After your virtul pplince is instlled, you must dd the virtul pplince to your deployment using the deployment editor. Before you begin Before you begin, you must hve creted virtul mchine, instlled the STRM ISO on the mchine, nd instlled STRM. See the following topics: Creting your Virtul Mchine Instlling the STRM ISO on the Virtul Mchine Instlling STRM Softwre on your Virtul Mchine About this tsk The nme you ssign to the virtul pplince cn be up to 20 chrcters in length nd cn include underscores or hyphens. Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Procedure Log in to the STRM Console. On the Admin tb, click Deployment Editor. In the Event Components pne on the Event View pge, select the virtul pplince component tht you wnt to dd. On the first pge of the Adding New Component wizrd, type unique nme for the virtul pplince. Click Next. From the Select host to ssign to list box, select the mnged host tht you wnt to ssign the virtul pplince to. Click Next. Click Finish.

37 Accessing the STRM User Interfce 37 Step 7 Step 8 From the deployment editor menu, select File > Sve to stging. On the Admin tb menu, click Deploy Chnges. Accessing the STRM User Interfce After the instlltion is complete, you cn ccess the STRM user interfce. About this tsk When you ccess the STRM user interfce for the first time, note the following requirements: If you use Mozill Firefox, you must dd n exception to Mozill Firefox. For more informtion, see your Mozill documenttion. If you use Internet Explorer, website security certificte messge is displyed. You must select the Continue to this website option to log in to STRM. For your STRM Console, defult license key provides you ccess to STRM for five weeks. For more informtion on the license key, see the STRM Administrtion Guide. Step 1 Step 2 Step 3 Procedure Open your web browser. Log in to STRM: Address> Where <IP Address> is the IP ddress of the STRM system. The defult vlues re: Usernme: dmin Pssword: <root pssword> Click Login To STRM.

38

39 6 NETWORK SETTINGS MANAGEMENT Use the qchnge_netsetup script to chnge the network settings of your STRM system. Configurble network settings include hostnme, IP ddress, network msk, gtewy, DNS ddresses, public IP ddress, nd emil server. Chnging the Network Settings in n All-in-One Console You cn chnge the network settings in your ll-in-one system. An ll-in-one system hs ll STRM components, including the Admin tb, instlled on one system. Before you begin You must hve locl connection to your Console before you strt this procedure. About this tsk The Internet Protocol Version window displys up to mximum of four interfces. Ech interfce with physicl link is denoted with plus (+) symbol. When you configure the network settings, you cn configure public IP ddress for the server. This is secondry IP ddress tht is used to ccess the server, usully from different network or the Internet, nd is mnged by your network dministrtor. The Public IP ddress is often configured using Network Address Trnsltion (NAT) services on your network or firewll settings on your network. NAT trnsltes n IP ddress in one network to different IP ddress in nother network. Step 1 Step 2 Step 3 Step 4 Procedure Log in to STRM s the root user: Usernme: root Pssword: <pssword> Type the following commnd: qchnge_netsetup Select n internet protocol version. Select Next nd press Enter. Select the interfce tht you wnt to use s the mngement interfce. Select Next nd press Enter.