Revision A. McAfee Data Loss Prevention Prevent 11.1.x Hardware Guide

Transcription

1 Revision A McAfee Data Loss Prevention Prevent 11.1.x Hardware Guide

2 COPYRIGHT Copyright 2018 McAfee, LLC TRADEMARK ATTRIBUTIONS McAfee and the McAfee logo, McAfee Active Protection, epolicy Orchestrator, McAfee epo, McAfee EMM, Foundstone, McAfee LiveSafe, McAfee QuickClean, Safe Eyes, McAfee SECURE, SecureOS, McAfee Shredder, SiteAdvisor, McAfee Stinger, True Key, TrustedSource, VirusScan are trademarks or registered trademarks of McAfee, LLC or its subsidiaries in the US and other countries. Other marks and brands may be claimed as the property of others. LICENSE INFORMATION License Agreement NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND. 2 McAfee Data Loss Prevention Prevent 11.1.x Hardware Guide

3 Contents Safety considerations 5 FCC compliance Safety compliance guidelines Rack-mounting considerations McAfee DLP Prevent hardware appliances 7 Supported appliance models and features DLP 6600 appliance model DLP 5500 appliance model Check your shipment Technical specifications Power redundancy Set up the hardware Install and remove rack handles Install the appliance in a rack Turn on the appliance Turn off and restart the appliance Managing hardware appliances with the RMM Connect your appliance Serial console settings Replace hardware components Replace the hard drive Replace the power supply McAfee DLP Capture Storage Array 25 Details about McAfee DLP Capture Storage Array McAfee DLP Capture Storage Array back panel Front control panel Power supply indicator lights Check your shipment Technical specifications McAfee DLP Capture Storage Array Power Redundancy Set up the hardware McAfee Data Loss Prevention Prevent 11.1.x Hardware Guide 3

4 Contents 4 McAfee Data Loss Prevention Prevent 11.1.x Hardware Guide

5 Safety considerations Contents FCC compliance Safety compliance guidelines Rack-mounting considerations FCC compliance McAfee DLP Prevent and McAfee DLP Capture Storage Array hardware have been tested and found to comply with the limits for a Class A digital device, pursuant to Part 16 of the Federal Communications Commission rules. Any modifications to McAfee DLP Prevent and McAfee DLP Capture Storage Array equipment, unless expressly approved by the party responsible for compliance, might void authority to operate the equipment. Operation of the McAfee DLP Prevent appliance and McAfee DLP Capture Storage Array is subject to these conditions: The devices might cause harmful interference. The devices must accept any interference received, including interference that might cause unwanted operation. These limits provide reasonable protection against harmful interference when the equipment is operated in a commercial environment. McAfee DLP Prevent equipment generates, uses, and can radiate radio frequency energy. If not installed and used in accordance with the instruction manual, it might cause harmful interference to radio communications. If operation of this equipment in a residential area causes harmful interference, it must be corrected at owner's expense. If McAfee DLP Capture Storage Array is not installed and used in accordance with the safety instructions mentioned in the manufacturer's documentation, it might cause harmful interference to radio communications. If operation of this equipment in a residential area causes harmful interference, it must be corrected at owner's expense. Safety compliance guidelines The McAfee DLP Prevent appliance and McAfee DLP Capture Storage Array must be operated in compliance with strict safety guidelines. The hardware units must be installed only in restricted access locations, such as dedicated equipment rooms or electrical closets. Disconnect all power supply cords before servicing. There is a risk of explosion if a backup unit (super capacitor) is replaced by an incorrect type. Dispose the used backup units according to industry standards. McAfee Data Loss Prevention Prevent 11.1.x Hardware Guide 5

6 Safety considerations Rack-mounting considerations Rack-mounting considerations McAfee DLP Prevent and McAfee DLP Capture Array hardware must be rack mounted properly to ensure safe configuration. Consider these points when installing McAfee DLP Prevent and McAfee DLP Capture Array hardware in a rack. Operating ambient temperature If installed in a closed or multi-unit rack assembly, the operating ambient temperature of the rack environment might be greater than room ambient. Consider installing the equipment in an environment compatible with the maximum ambient temperature (MAT) specified by the manufacturer. Air flow When installing the equipment in a rack, do not restrict the supply of cool air to the appliance. Mechanical loading When mounting the equipment, make sure no hazardous conditions are created due to uneven mechanical loading. Circuit loading When connecting the equipment to the supply circuit, consider the effect that circuit overloading might have on overcurrent protection and supply wiring. Use appropriate consideration of equipment nameplate ratings when addressing this concern. Grounding Maintain reliable grounding of the rack-mounted equipment. Give particular attention to supply connections that are not directly connected to the branch circuit, such as power strips. For more information about DLP 6600 and DLP 5500 appliance model rack-mounting considerations, see the Intel documentation. 6 McAfee Data Loss Prevention Prevent 11.1.x Hardware Guide

7 1 McAfee 1 DLP Prevent hardware appliances Prepare the McAfee Data Loss Prevention Prevent (McAfee DLP Prevent) hardware appliance for deployment, installation, and integration in the network. Contents Supported appliance models and features Check your shipment Technical specifications Power redundancy Set up the hardware Replace hardware components Supported appliance models and features Depending on the model, the McAfee DLP Prevent appliance is a 1-U or 2-U rack mount chassis. You must be using a supported appliance model according to how you want to use the product. McAfee DLP Prevent appliance runs on version 10.x and later of the software and is supported on DLP 6600 and DLP 5500 appliance models. You can set it up as a standalone appliance or as a member of a cluster. Deploying the appliance in a cluster enables you to balance the load for monitoring and web traffic and ensuring high availability if there is a failure. For information about deploying and installing McAfee DLP Prevent appliances in your environment, see the McAfee Data Loss Prevention Prevent Installation Guide. Table 1-1 Model specifications Model DLP 6600 appliance model DLP 5500 appliance model Processors RAM (GB)* Capture disk capacity (TB) OS+RW HDD (TB) Number of hard drives Remote Management Module (RMM) N/A Yes 1U Yes 2U Rack height * McAfee does not support adding more memory to McAfee DLP Prevent appliances. For performance optimization, make sure that all appliances in a cluster are of the same model, and all virtual appliances have the same specifications. To run the DLP Capture feature on a DLP 6600 appliance, connect the DLP 6600 appliance to an external storage device, known as the McAfee DLP Capture Storage Array. McAfee Data Loss Prevention Prevent 11.1.x Hardware Guide 7

8 1 McAfee DLP Prevent hardware appliances Supported appliance models and features See also Details about McAfee DLP Capture Storage Array on page 25 DLP 6600 appliance model The DLP 6600 appliance model ships on Intel Server System R1208WTTGS. McAfee DLP 9.x is not supported on a DLP 6600 appliance model. For more information about Intel Server System R1208WTTGS, see the Intel documentation. Intel Server System R1000WT Product Family Technical Product Specification R1000WT_TPS_R1_06.pdf Complete information about Intel Server Board S2600WT Family Intel Server Board S2600WT Technical Product Specification Intel_Server_Board_S2600WT_TPS.pdf Intel Server Board S2600WT Family Configuration Guide S2600WT_Config_Guide_2_13.pdf Back panel and port assignments Familiarize yourself with the hardware components on the back panel and network port assignments before setting up the DLP 6600 appliance. Figure 1-1 DLP 6600 back panel Table 1-2 Port assignments Usage 6600 Common ports Serial Use these connection settings: callout 6 Baud rate Data bits 8 Parity None Flow control None Stop bits 1 8 McAfee Data Loss Prevention Prevent 11.1.x Hardware Guide

9 McAfee DLP Prevent hardware appliances Supported appliance models and features 1 Table 1-2 Port assignments (continued) Usage 6600 VGA callout 5 USB Use one of the USB ports to connect to the McAfee DLP Capture Storage Array console port using the provided USB-to-serial port adapter. callout 7 Remote Management Module (RMM) callout 8 Power supplies callout 1 RAID port (available only when the RAID controller is installed) Connects the RAID controller to McAfee DLP Capture Storage Array through the provided mini-sas cable. Network port assignments OOB port Out-of-band management traffic such as McAfee epolicy Orchestrator (McAfee epo ) management. LAN 1 port (10 GBase-T) Data traffic for scanning (Optional) Management traffic callout 9 callout 4 callout 2 Callouts that are not referenced in the table are unused. Front control panel The control panel is on the front of the chassis. Figure front control panel 1 System ID button 5 Hard drive activity 2 NMI button (recessed) 6 Power button 3 NIC 2 activity 7 NIC 1 activity 4 System cold reset button 8 System status McAfee Data Loss Prevention Prevent 11.1.x Hardware Guide 9

10 1 McAfee DLP Prevent hardware appliances Supported appliance models and features Table system status indicator light states Color State Status Green Solid System booted and ready Blink System degraded: Non-critical threshold crossed Temperature Voltage Power supply input or output Fan redundancy lost, sufficient system cooling maintained Power supply redundancy lost Unable to use all of the installed memory one or more DIMMS failed or disabled, but functional memory remains available Battery failure Power unit sensor offset error asserted HDD HSC offline or degraded BMC executing uboot BMC Watchdog has reset the BMC Amber Solid Fatal alarm System has failed or shut down: CPU CATERR signal asserted CPU 1 missing CPU Thermal Trip CPU ERR2 signal asserted MSID mismatch detected DIMM failure when only one DIMM is present Runtime memory uncorrectable error in non-redundant mode DIMM Thermal Trip or equivalent SSB Thermal Trip or equivalent BMC/Video memory test failed Both uboot BMC FW images are bad 240 VA fault Power fault Fatal error in processor initialization Processor families not identical Processor models not identical Processor core/thread counts not identical Processor cache sizes not identical Unable to synchronize processor frequency Unable to synchronize QPI link frequency 10 McAfee Data Loss Prevention Prevent 11.1.x Hardware Guide

11 McAfee DLP Prevent hardware appliances Supported appliance models and features 1 Table system status indicator light states (continued) Color State Status Blink Non-fatal alarm System is likely to fail: Critical threshold crossed Temperature Voltage Power supply input or output Voltage regulator device (VRD) hot asserted Minimum number of fans to cool the system not present or failed Hard drive fault Insufficient power supplies present Correctable memory error threshold crossed for a failing DDR3 DIMM when the system operates in a non-redundant mode Off Off System turned off Power supply indicator lights Each installed power supply module has a single indicator light to show the power supply status. Table power supply indicator light states Color State Status Green Solid Output ON and OK Amber Solid 1 Hz Blink AC present / Only 12 VSB on (power supply off) or power supply in cold redundant state 2 Hz Blink Power supply FW updating AC cord unplugged or AC power lost when a second parallel power supply still has AC input power Power supply critical event causing a shutdown: Failure Over Current Protection Over Voltage Protection Fan failed Blink Power supply warning events where the power supply continues to operate: High temperature High power High current Slow fan Off Off No AC power to all power supplies McAfee Data Loss Prevention Prevent 11.1.x Hardware Guide 11

12 1 McAfee DLP Prevent hardware appliances Supported appliance models and features DLP 5500 appliance model The DLP 5500 appliance model ships on an Intel Server System R2312GZ. For more information about Intel Server System R2312GZ, see the Intel documentation. Intel Server System R2000GZ/GL Product Family Technical Product Specification r2000gzgl_tps_r2_2.pdf Intel Server System R2000GZ/GL Family Service Guide r2000gzgl_serviceguide.pdf Intel Server System R2000GZ/GL Product Family Quick Installation User's Guide R2000GZ_GL_QIG.pdf Back panel and port assignments Familiarize yourself with the hardware components on the back panel and network port assignments before setting up the DLP 5500 appliance. Figure 1-3 DLP 5500 back panel Table 1-5 Port assignments Usage Common ports Serial Use these connection settings: Baud rate Parity None Data bits 8 Flow control None Stop bits (Copper) 5500 (Fiber)* 5500 (Fiber in copper mode) callout 7 callout 7 callout 7 VGA callout 6 callout 6 callout 6 12 McAfee Data Loss Prevention Prevent 11.1.x Hardware Guide

13 McAfee DLP Prevent hardware appliances Supported appliance models and features 1 Table 1-5 Port assignments (continued) Usage 5500 (Copper) 5500 (Fiber)* 5500 (Fiber in copper mode) USB callout 8 callout 8 callout 8 Remote Management Module (RMM) This port is labeled RMM on the appliance. callout 9 callout 9 callout 9 Power supplies callout 3 callout 3 callout 3 Network port assignments in McAfee DLP Prevent 10.x and later OOB port Out-of-band management traffic such as McAfee epolicy Orchestrator (McAfee epo ) management. This port is labeled N/A on the appliance. callout 4 callout 4 callout 4 LAN 1 port Data traffic for scanning (Optional) Management traffic callout 5 callout 2 callout 5 Network port assignments in McAfee DLP Prevent 9.x Management traffic callout 5 callout 5 Not applicable Scanning traffic callout 5 callout 5 Not applicable Callouts and ports that are not referenced here are unused. * If you are using a McAfee DLP Prevent appliance with a fiber port, you can switch it back to copper NIC. Front control panel The control panel is on the front of the chassis. Figure front control panel McAfee Data Loss Prevention Prevent 11.1.x Hardware Guide 13

14 1 McAfee DLP Prevent hardware appliances Supported appliance models and features 1 Power button 6 NIC 2 activity 2 System status 7 NIC 4 activity 3 Hard drive activity 8 NIC 1 activity 4 System ID button 9 NIC 3 activity 5 System cold reset button 10NMI button (recessed) Table system status indicator light states Color State Status Green Solid System booted and ready Blink System degraded: Non-critical threshold crossed Temperature Voltage Power supply input or output Fan redundancy lost, sufficient system cooling maintained Power supply redundancy lost Unable to use all of the installed memory one or more DIMMS failed or disabled, but functional memory remains available Battery failure Power unit sensor offset error asserted HDD HSC offline or degraded BMC executing uboot BMC Watchdog has reset the BMC 14 McAfee Data Loss Prevention Prevent 11.1.x Hardware Guide

15 McAfee DLP Prevent hardware appliances Supported appliance models and features 1 Table system status indicator light states (continued) Color State Status Amber Solid Fatal alarm System has failed or shut down: CPU CATERR signal asserted CPU 1 missing CPU Thermal Trip CPU ERR2 signal asserted MSID mismatch detected DIMM failure when only one DIMM is present Runtime memory uncorrectable error in non-redundant mode DIMM Thermal Trip or equivalent SSB Thermal Trip or equivalent BMC/Video memory test failed Both uboot BMC FW images are bad 240 VA fault Power fault Fatal error in processor initialization: Processor families not identical Processor models not identical Processor core/thread counts not identical Processor cache sizes not identical Unable to synchronize processor frequency Unable to synchronize QPI link frequency Blink Non-fatal alarm System is likely to fail: Critical threshold crossed Temperature Voltage Power supply input or output Voltage regulator device (VRD) hot asserted Minimum number of fans to cool the system not present or failed Hard drive fault Insufficient power supplies present Correctable memory error threshold crossed for a failing DDR3 DIMM when the system operates in a non-redundant mode Off Off System turned off McAfee Data Loss Prevention Prevent 11.1.x Hardware Guide 15

16 1 McAfee DLP Prevent hardware appliances Check your shipment Power supply indicator lights Each installed power supply module has a single indicator light to show the power supply status. Table power supply indicator light states Color State Status Green Solid Output ON and OK Amber Solid 1 Hz Blink AC present / Only 12 VSB on (power supply off) or power supply in cold redundant state 2 Hz Blink Power supply FW updating AC cord unplugged or AC power lost when a second parallel power supply still has AC input power Power supply critical event causing a shutdown: Failure Over Current Protection Over Voltage Protection Fan failed Blink Power supply warning events where the power supply continues to operate: High temperature High power High current Slow fan Off Off No AC power to all power supplies Check your shipment Each product ships with all items needed to install the appliance on a network. Check the contents list to verify that you received all items. Technical specifications Before you set up the McAfee DLP Prevent appliance, review the hardware specifications. Specification DLP 6600 DLP 5500 Form Factor 1U rack mountable; fits 19-inch rack 2U rack mountable; fits 19-inch rack CPU 2 x Intel Xeon E V4, 2.1 GHz, 8 cores, 20 MB cache 2x Intel E5-2620, 6 core, 15 M cache, 2.0 GHz, 7.20 GT/s Intel QPI Memory 32 GB 2400 Mhz, DDR4 32 GB P1333 MHz, DDR3 Hard Drives Network Interfaces 2x HDD, RPM 2.5" hot-swap, 600 GB, SAS drives 2x 10/100/1000/10000 interfaces and 1x 10/100/1000 interface 8 x 2 TB, 7200 RPM 3.5" hot-swap, SATA drives 4x 10/100/1000 interfaces Power Rating 2 x 750 W hot-swap power supply modules 2 x 760 W hot-swap power supply modules Dimension 16.93" W x 27.95" D x 1.72" H 17.57" W x 30.79" D x 3.43" H 16 McAfee Data Loss Prevention Prevent 11.1.x Hardware Guide

17 McAfee DLP Prevent hardware appliances Power redundancy 1 Specification DLP 6600 DLP 5500 Weight 41.9 lbs (19 kg) 67 lbs (30.3 kg) Remote Management Operating temperature Humidity range RMM4LITE, AXXRMM4LITE (MM# ) Intel Remote Management Modules 4 (AXXRMM4) +10 C to +35 C (50 F to 95 F) with the maximum rate of change not to exceed 10 C per hour 50% to 90%, non-condensing with a maximum wet bulb of 28 C (at temperatures from 25 C to 35 C) +10 C to +35 C (50 F to 95 F) maximum rate of change not to exceed 10 C per hour 50% to 90%, non-condensing with a maximum wet bulb of 28 C Power redundancy McAfee DLP Prevent appliance ships with more than one power supply and must be configured to provide redundancy while operating at nominal power. Use two electrical outlets that are on different circuit breakers to achieve additional protection. DLP 6600 and DLP 5500 appliance models use cold redundancy. One power supply operates for a period of time, then the other takes over. During the transition time, both power supplies operate. If one power supply fails, an alarm sounds and a warning indicator light illuminates. If a power supply fails, contact McAfee for a replacement unit. The motherboard is set to on by default. By default, DLP 6600 and DLP 5500 appliance models automatically come back up when power is restored. Set up the hardware Contents Install and remove rack handles Install the appliance in a rack Turn on the appliance Turn off and restart the appliance Managing hardware appliances with the RMM Connect your appliance Serial console settings Install and remove rack handles To install a rack handle, align it with the two holes on the side of the McAfee DLP Prevent appliance and attach the rack handle to the appliance with two screws as shown. Figure 1-5 Installing the rack handle McAfee Data Loss Prevention Prevent 11.1.x Hardware Guide 17

18 1 McAfee DLP Prevent hardware appliances Set up the hardware To remove a rack handle, remove the two screws holding the rack handle in place, and remove the rack handle from the server system as shown. Figure 1-6 Removing the rack handle Install the appliance in a rack To install the McAfee DLP Prevent appliance on the four-post 19-inch rack, use the rack-mounting kit. You can use the kit with most industry-standard rack cabinets. Task 1 For each mounting rail, use the following steps. a At the front of the rack, position the right or left mounting rail on the corresponding side so that the mounting bracket aligns with the rack holes. Always load the rack from the bottom up. If you are installing multiple appliances, start with the lowest available position. Figure 1-7 Slide rail installation b At the back of the rack, pull the back mounting-bracket (extending the mounting rail) so that it aligns with the rack holes. On each side of the rack, ensure that the mounting rails are the same level. Figure 1-8 Install rail to rack c Clip the rail to the rack and secure it with the tie wraps. 18 McAfee Data Loss Prevention Prevent 11.1.x Hardware Guide

19 McAfee DLP Prevent hardware appliances Set up the hardware 1 2 Slide both rails so they are fully extended. Figure 1-9 Full extend slide 3 Take assistance and lift the McAfee DLP Prevent appliance and install the chassis to the rail on both the sides. Drop in the rear spool first, then the middle, then the front. Figure 1-10 Install the appliance to rail At least two people are required to lift and attach the McAfee DLP Prevent appliance to the rack. If necessary, attach the lockable bezel to protect the front panel. 4 Lift the release tab and push the McAfee DLP Prevent appliance into the rack. Figure 1-11 Lift release tab and push appliance into rack To remove the McAfee DLP Prevent appliance from the rack, lift the release tab next to the chassis front spool, then lift it out of the rails. McAfee Data Loss Prevention Prevent 11.1.x Hardware Guide 19

20 1 McAfee DLP Prevent hardware appliances Set up the hardware Turn on the appliance The McAfee DLP Prevent appliance has redundant power supplies pre-installed. The appliance ships with two AC power cords specific to your country or region. The appliance turns on when the power is connected. Task 1 Plug in one end of the AC power cord to the first power supply module in the back panel, then plug in the other end into the power source. 2 Plug in one end of the other AC power cord to the second power supply module in the back panel, then plug in the other end to the power source. Turn off and restart the appliance Shut down and restart McAfee DLP Prevent appliance. To turn off the McAfee DLP Prevent appliance AC power, you must unplug both AC power cords from the back panel or power source. Shut down the appliance before removing the power cords. To shut down the McAfee DLP Prevent appliance: 1 Log on to the appliance as administrator. 2 From the appliance console menu, select Shutdown. The system turns off the AC power after it has completed the shutdown process. Alternatively, you can double-press the power button to shut down the appliance. To restart the McAfee DLP Prevent appliance, use one of the management methods to restart the appliance. Don't press the power button on the front panel to turn on/off the AC power, unless the system is unresponsive. Managing hardware appliances with the RMM Use the RMM also called the Baseboard Management Controller (BMC) to manage a hardware appliance remotely. The RMM is not available on virtual appliances. The RMM must be configured with its own IP address and cabled separately. Log on with the administrator account with the user name as admin and administrator password. Use the appliance console to enable and configure basic settings for the RMM. After configuring the RMM network settings, you can also access the appliance console using the integrated web server. From the web interface, you can check the hardware status, perform additional configuration, and remotely manage the appliance. Go to: IP address> Use the appliance administrator credentials to access the user interface. You can configure the RMM to use LDAP for authentication instead of the admin account. By default, all protocols used to access the RMM are enabled: HTTP/HTTPS SSH 20 McAfee Data Loss Prevention Prevent 11.1.x Hardware Guide

21 McAfee DLP Prevent hardware appliances Set up the hardware 1 IPMI over LAN Remote KVM Configure the RMM from BIOS Configure network settings used by the RMM. Before you begin Make sure that the server board has the latest BIOS firmware. McAfee publishes BIOS images for the appliance that contain the BMC firmware. Contact Technical Support for the latest version of the firmware. Downloading and using the system firmware from other sources might impact the appliance performance. You can enable or configure RMM from the text menu system, appliance console, serial console, or SSH session. In an uninstalled appliance, you can configure the RMM settings from BIOS using the root account. In an installed appliance, you can configure the RMM settings from the appliance console without entering the BIOS. Task 1 Log on to the appliance as administrator. 2 From the appliance console menu, select Reboot to restart the system. 3 Before the operating system boots, press F2 to enter the BIOS. 4 To configure the BMC LAN configuration for your appliance model, navigate to Server Management BMC LAN Configuration and press Enter. 5 Scroll down to Intel RMM4 IPv4 LAN Configuration and configure IP source, IP address, Subnet mask as needed. 6 Scroll down to User Configuration, then configure these settings: User ID Select root User status Select Enabled User name Enter root User password Enter the password. You must enter this password twice 7 Confirm the network and user information, and press F10 to save and exit the BIOS. The appliance boots with the new settings. 8 On the computer that connects to the RMM, open a web browser and enter: IP address Use the credentials root/password you entered in the earlier step. The appliance boots with the new settings. For more information about Intel RMM4, go to /server-products.html. McAfee Data Loss Prevention Prevent 11.1.x Hardware Guide 21

22 1 McAfee DLP Prevent hardware appliances Set up the hardware Connect your appliance When you connect your appliance to the network device, you can configure the appliance IP address and other parameters for integration in your network. Configure each appliance with the required static IP addresses. If no IP addresses are specified, the appliance is configured with the default static IP addresses. The default gateway for the appliance uses the LAN 1 network. Configure any routing required on the OOB interface using static routes. The hardware appliance has a Remote Management Module (RMM), which provides Lights Out Management functionality, such as remote KVM access and access to the appliance BIOS. Task 1 (Optional) Connect the McAfee DLP Capture Storage Array to the DLP 6600 appliance if you are using the DLP Capture feature. 2 Connect a monitor, keyboard, and mouse to the appliance. 3 Connect the LAN 1 interface of the appliance to your network. 4 (Optional) Connect the OOB interface to a different network. 5 (Optional) Connect the RMM interface to a management network. Use a closed or secure network for the RMM. See also Default IP addresses on page 22 Default IP addresses Use the default IP addresses rather than assigning dynamic IP addresses to configure each appliance. LAN /24 Use the LAN 1 network for McAfee DLP Prevent SMTP or ICAP traffic. You can also use it for management traffic. OOB /24 (Optional) Use the Out-of-band (OOB) network for management traffic including McAfee epo communication. If your network uses DHCP, the first IP address that the DHCP server assigns to the appliance is used instead. You can manually configure the IP address with the Setup Wizard. The appliance doesn't support using a continuous DHCP configuration. The default gateway for the appliance uses the LAN 1 network. Configure any routing required on the OOB interface using static routes. Serial console settings You can use the serial console to install the McAfee DLP appliance software only. You must use another method, such as the RMM, to configure network settings and register with McAfee epo. You can enable the RMM through the serial console. Installation progress does not appear when using the serial console. 22 McAfee Data Loss Prevention Prevent 11.1.x Hardware Guide

23 McAfee DLP Prevent hardware appliances Replace hardware components 1 Table 1-8 Serial connection parameters Port setting Value Baud rate Data bits 8 Stop bits 1 Parity None Flow control None Replace hardware components Contents Replace the hard drive Replace the power supply Replace the hard drive McAfee DLP Prevent appliances ship with replaceable hard drives. Each appliance uses hot-swappable hard drives connected to a RAID controller. The RAID controller allows the system to continue operating if a single hard drive fails. A single failed hard drive can be replaced while the system is still operational. Use only the replacement hard drives provided by McAfee. Do not reseat hard drives unless directed to by Technical Support. Task 1 Identify the failed hard drive. The McAfee DLP log files contain information about which drive failed. a Using a command-line session, log on to the appliance. b Generate the.zip file that contains the logs using one of these methods. From the console menu, select Generate MER and follow the on-screen instructions. From the shell, run: sudo /opt/mcafee/ldt/getlogs/getlogs.sh If you use the shell script, the file is located in /tmp and the file name is based on the appliance and the current time. You can use SCP to copy the files from the appliance. Provide these logs to technical support when requesting replacement hardware. 2 Remove the failed hard drive from the appliance. a Press the latch on the failed hard drive to release the spring-loaded handle. b Pull on the handle to remove the failed hard drive from the appliance. 3 On the replacement hard drive, press the latch to release the spring-loaded handle. McAfee Data Loss Prevention Prevent 11.1.x Hardware Guide 23

24 1 McAfee DLP Prevent hardware appliances Replace hardware components 4 Insert the replacement hard drive into the appliance. a Slide the drive into the empty hard drive bay until it is fully seated. b c Press the handle until it latches. If the appliance is turned off, turn it on. After the drive is inserted, the RAID controller begins the rebuild operation. Performance is reduced while the rebuild operation takes place. Do not turn off the appliance until the rebuild operation is complete. Replace the power supply McAfee DLP Prevent appliances ship with replaceable power supplies. Each model has dual power supplies that allow the appliance to continue operating if one power supply fails. The power supplies are hot-swappable, so a single power supply can be replaced while the system is still operating. A power supply can be replaced while the appliance is turned on and running or when the appliance is turned off. Use both power supplies in normal operation to minimize the risk of power failure to the system and use only the power supplies provided by McAfee. Task 1 Disconnect the power cord from the failed power supply. 2 Unlatch the handle and remove the failed power supply. 3 Slide the replacement power supply into the appliance until it is fully seated and the latch is engaged. 4 Connect the power cord to the replacement power supply. 24 McAfee Data Loss Prevention Prevent 11.1.x Hardware Guide

25 2 McAfee 2 DLP Capture Storage Array Details about McAfee DLP Capture Storage Array McAfee DLP Capture Storage Array ships on a JBOD (Just a Bunch of Disks) storage system. McAfee DLP Capture Storage Array integrates with the DLP 6600 appliance to provide additional storage space required for using the DLP Capture feature. Prepare the McAfee DLP Capture Storage Array for deployment and integration with the DLP 6600 appliance. For more information about the JBOD storage system, see the manufacturer's documentation. Contents McAfee DLP Capture Storage Array back panel Front control panel Power supply indicator lights Check your shipment Technical specifications McAfee DLP Capture Storage Array Power Redundancy Set up the hardware McAfee DLP Capture Storage Array back panel Familiarize yourself with the hardware components that are used on the back panel before setting up the McAfee DLP Capture Storage Array. Figure 2-1 Back panel of the McAfee DLP Capture Storage Array McAfee Data Loss Prevention Prevent 11.1.x Hardware Guide 25

26 2 McAfee DLP Capture Storage Array Details about McAfee DLP Capture Storage Array Callout Description 1 Hot-swap dual redundant power supply. 2 Power supply indicator lights. 3 Hot-swap fans covered by exhaust covers. To ensure proper air flow, don't prevent the fan exhaust covers from swinging open. 4 Mini-SAS port. 5 Console serial port Connect the console serial port to the DLP 6600 appliance USB port using the assembled 3.5 mm jack cable DB9 connecter USB adapter. Front control panel The control panel is on the front of the chassis. Figure 2-2 McAfee DLP Capture Storage Array front control panel Callout Behavior Status 1 System power switch Normal System off Press Boot up Long press System shutdown 2 Power status indicator LED Blue On No state Off 3 Power failure indicator LED Normal Off Failed Red 4 Temperature overheat indicator LED Normal Off 26 McAfee Data Loss Prevention Prevent 11.1.x Hardware Guide

27 McAfee DLP Capture Storage Array Details about McAfee DLP Capture Storage Array 2 Callout Behavior Status Failed Red 5 Fan fault indicator Normal Off Failed Red 6 System alert mute switch Normal Off Press Alert mute Power supply indicator lights Each installed power supply module has indicator lights at the back panel to show the power supply status. Callout LED Color LED State Power supply unit status 1 AC Green Off Solid Input power ON and OK Blink (flash) No AC power to the particular power supply unit Off No AC power to both power supply units 2 DC Green Solid Output power ON and OK, AC LEDs remain green Off Off No DC power to power supply 3! Amber Solid Power supply failure Blink (flash) Power supply warning Check your shipment The McAfee DLP Capture Storage Array package ships with all items needed to setup and connect the storage array to the DLP 6600 appliance. Check the contents list to verify that you received all items. Technical specifications Before you set up the McAfee DLP Capture Storage Array, review the hardware specifications. Specification Form Factor Hard Drives Drive Interface Power input Power Rating Dimension McAfee DLP Capture Storage Array 2U rack mountable; 3.5"; fits 19-inch rack Hot swap 12-bay SAS3 Universal AC power input: 100 V~240 V AC full range 549 W 1+1 hot-swap redundant 80+ Platinum 16.9" W x 21.0" D x 3.5" H McAfee Data Loss Prevention Prevent 11.1.x Hardware Guide 27

28 2 McAfee DLP Capture Storage Array Details about McAfee DLP Capture Storage Array Specification McAfee DLP Capture Storage Array Weight 22.1 kg (46.3 lbs) Cooling fans 2 x 6038 hot swap fans Operating temperature 0º C to 35º C (32 F to 95 F) Relative humidity range 20% to 80% McAfee DLP Capture Storage Array Power Redundancy McAfee DLP Capture Storage Array hardware consists of more than one power supply, which is configured to provide redundancy while operating at nominal power. Use two electrical outlets that are on different circuit breakers to achieve additional protection. If a power supply fails, a warning indicator light illuminates, contact McAfee for a replacement unit. Don't connect power to the McAfee DLP Capture Storage Array until the appliance is set up. If there is a power outage, the storage array automatically comes back up when power is restored. Set up the hardware Contents Install McAfee DLP Capture Storage Array in a rack Turn on the McAfee DLP Capture Storage Array Identify the RAID controller connections Identify the RAID backup unit Set up McAfee DLP Capture Storage Array for use with 6600 appliance Install McAfee DLP Capture Storage Array in a rack Use the provided rack mounting kit to install the McAfee DLP Capture Storage Array in a four-post 19-inch rack. Use only the rack-mounting kit provided with the McAfee DLP Capture Storage Array package for proper installation. 28 McAfee Data Loss Prevention Prevent 11.1.x Hardware Guide

29 McAfee DLP Capture Storage Array Details about McAfee DLP Capture Storage Array 2 Task 1 Separate the channels. Callout Description 1 Pull the release tab and slide the inner channel from the rail assembly. 2 Push the detent lock to slide the middle channel back into the outer rail. 3 Separated channels. McAfee Data Loss Prevention Prevent 11.1.x Hardware Guide 29

30 2 McAfee DLP Capture Storage Array Details about McAfee DLP Capture Storage Array 2 For each mounting rail, follow these steps: a b At the front of the rack, position the right or left mounting rail on the corresponding side so that the mounting bracket clips into the rack aligning with the rack holes. Callout Description 1 Position the mounting bracket clips. 2 Align with the rack hole. At the back of the rack, pull the back mounting-bracket (extending the mounting rail) so that it aligns with the rack holes and clip it into the rack in the same way as the front brackets. On each side of the rack, ensure that the mounting rails are at the same level. 3 Fit the rail inner channel to the side of the chassis; hook the rail into the metal work at the front, and then fix two screws on each side near the rear. Callout Description 1 Hook the slide into the chassis metal work. 2 Secure the screws near the rear of the chassis. Use the Phillips #2 screwdriver. Using an incorrect-sized screwdriver damages the screw heads Slide both rails so they are fully extended. McAfee Data Loss Prevention Prevent 11.1.x Hardware Guide

31 McAfee DLP Capture Storage Array Details about McAfee DLP Capture Storage Array 5 Take assistance and lift McAfee DLP Capture Storage Array and slide the chassis rail inner channel into the rail on both the sides. 6 Pull the release-tab forward to permit the chassis to slide back into the rack. 2 McAfee DLP Capture Storage Array turns on when the power is applied. Don't connect the power supplies until the DLP 6600 appliance is set up with the RAID controller unit. Turn on the McAfee DLP Capture Storage Array The McAfee DLP Capture Storage Array has two redundant power supplies preinstalled and ships with two AC power cords specific to your country or region. The McAfee DLP Capture Storage Array turns on when the power is applied. Don't connect to the power supply until the appliance is set up. Task 1 Plug in one end of the AC power cord to the first power supply module in the back panel, then plug in the other end into the power source. 2 Plug in one end of the other AC power cord to the second power supply module in the back panel, then plug in the other end to the power source. Identify the RAID controller connections The preinstalled hard disk drives in the McAfee DLP Capture Storage Array become the RAID volume for captured data in the DLP 6600 appliance when connected to the RAID controller. Use the numbered callouts in the figure to locate the RAID controller connecters that you need to connect. Callout Description 1 Connects the RAID controller by Mini-SAS cable to the appliance. 2 PCIe interface The interface between the RAID controller and the appliance. This connecter also provides power to the RAID board. 3 The connecter on the RAID controller is connected to the super capacitor cable. McAfee Data Loss Prevention Prevent 11.1.x Hardware Guide 31

32 2 McAfee DLP Capture Storage Array Details about McAfee DLP Capture Storage Array Identify the RAID backup unit The Flash Backed Write Cache (FBWC) installed on the RAID controller preserves the write cache contents in its flash memory. Upon power loss, the super capacitor provides power to the RAID card while it copies write cache contents into flash memory. The DLP 6600 appliance is installed with a single tier backup unit (super capacitor), by default. Replace the single tier backup unit with the double tier backup unit to protect the RAID cache if there is a power outage. Callout Description 1 Cable 1 Connects to the in-built RAID module in the appliance. 2 Cable 2 Connects to the RAID controller through the super capacitor cable. 3 Latch Slide the latch of the enclosure to include or release the super capacitor. 4 Double tier super capacitor in its enclosure. You can use Cable 1 and Cable 2 interchangeably. 32 McAfee Data Loss Prevention Prevent 11.1.x Hardware Guide

33 McAfee DLP Capture Storage Array Details about McAfee DLP Capture Storage Array 2 Set up McAfee DLP Capture Storage Array for use with 6600 appliance To run the DLP Capture feature, the DLP 6600 appliance must be connected to the McAfee DLP Capture Storage Array. If the appliance is turned on, shut down the appliance before removing the power cords. Make sure you unplug the power cords and the network cables from the appliance before you open the appliance cover. Before you handle the RAID controller and other hardware components, make sure that you fasten the Electrostatic Discharge (ESD) wrist strap to ground yourself to the chassis. Unpack the McAfee DLP Capture Storage Array package and verify that you received all parts listed in the contents sheet. Tasks Install the RAID controller on page 33 The preinstalled hard disk drives in the McAfee DLP Capture Storage Array are converted to a RAID volume when connected to the provided RAID controller. Install the controller in the 6600 appliance before connecting the appliance to McAfee DLP Capture Storage Array. Install the RAID backup unit on page 35 The super capacitor (RAID backup unit) protects the RAID cache in the event of a power outage. Install the super capacitor and connect it to the RAID controller. Connect the McAfee DLP Capture Storage Array to the DLP 6600 appliance on page 38 By connecting the McAfee DLP Capture Storage Array to the DLP 6600 appliance, you can use the DLP Capture feature. Install the RAID controller The preinstalled hard disk drives in the McAfee DLP Capture Storage Array are converted to a RAID volume when connected to the provided RAID controller. Install the controller in the 6600 appliance before connecting the appliance to McAfee DLP Capture Storage Array. Before you begin Fasten the disposable ESD wrist strap provided in the accessory kit to ground yourself before touching the RAID controller. Perform all installation at an ESD-safe workstation. Open the appliance top cover, based on the type of the chassis. Opening the top cover requires breaking the tamper label. Once, the appliance setup is complete, replace the tamper label with a spare tamper label included in McAfee DLP Capture Storage Array accessory kit. Look for the screw heads on the appliance top cover and unscrew them to open the appliance cover. There are four screws, one screw at the back and three screws at the front, which are concealed by anti-tamper labels. Use the Phillips #2 screwdriver. Using an incorrect-sized screwdriver damages the screw heads and the appliance cover. The top cover of the appliance is held in place by two thumbscrews. Unscrew the thumbscrews to open the appliance top cover; this is a tool-less installation. You don't have to unscrew the screw covered by a tamper label. Task 1 Remove the PCIe riser card attached to the motherboard of the appliance. Use the PCIe riser card that is farthest from the power supplies, as the PCIe riser card nearest to the power supplies is connected to a NIC card. 2 Remove the screw retaining the PCIe riser card blanking plate. McAfee Data Loss Prevention Prevent 11.1.x Hardware Guide 33

34 2 McAfee DLP Capture Storage Array Details about McAfee DLP Capture Storage Array 3 Install the RAID controller bus connecter into the PCIe slot. 4 Fix the bracket screw to secure the RAID controller. Callout Description 1 Align the RAID controller with the PCIe slot. 2 Press the RAID controller to fit into the PCIe slot. 3 Use the bracket screw to secure the RAID controller. 34 McAfee Data Loss Prevention Prevent 11.1.x Hardware Guide

35 McAfee DLP Capture Storage Array Details about McAfee DLP Capture Storage Array 2 Install the RAID backup unit The super capacitor (RAID backup unit) protects the RAID cache in the event of a power outage. Install the super capacitor and connect it to the RAID controller. Task 1 Install the RAID backup unit: a Disconnect the RAID backup adapter cable connected to the default RAID module in the appliance. b Install the RAID backup unit (super capacitor). Callout Description 1 Slide to release the enclosed single tier RAID backup. 2 Lift the latch to release the RAID backup unit from the single tier enclosure. Fix the existing super capacitor back into the provided double tier enclosure and then place the provided backup unit on top of the first backup unit. 3 Feed both Cable 1 and Cable 2 out of the enclosure. 4 Slide to insert the double tier enclosure, latched with both the RAID backup units. McAfee Data Loss Prevention Prevent 11.1.x Hardware Guide 35

36 2 McAfee DLP Capture Storage Array Details about McAfee DLP Capture Storage Array 2 Connect the cables. You can use Cable 1 and Cable 2 interchangeably. Callout Description 1 Reconnect the adapter of Cable 1 to the in-built RAID module. 2 The super capacitor cable is connected to the connecter on the RAID controller, by default. 3 Fit the PCIe riser card back, fitted with the RAID controller into the appliance. Make sure that the PCIe riser card is fully seated into the card edge connecter on the motherboard. 36 McAfee Data Loss Prevention Prevent 11.1.x Hardware Guide

37 McAfee DLP Capture Storage Array Details about McAfee DLP Capture Storage Array 2 4 Connect Cable 2 to the super capacitor cable. 5 Route the cable from the RAID controller toward the front of the fans and beside the chassis wall. Tuck in the cable firmly between the side of the plastic cover and the chassis. For bundling the cable, use the tie wraps included in the accessory kit box. Place the bundle beside Fan 1 to minimize the air flow restriction. Close the appliance cover. Replace the tamper label with the spare tamper label to cover the screw heads. Install the appliance in a rack. McAfee Data Loss Prevention Prevent 11.1.x Hardware Guide 37

38 2 McAfee DLP Capture Storage Array Details about McAfee DLP Capture Storage Array Connect the McAfee DLP Capture Storage Array to the DLP 6600 appliance By connecting the McAfee DLP Capture Storage Array to the DLP 6600 appliance, you can use the DLP Capture feature. Task 1 Install the storage array in a rack. Don't connect the power sources as both the appliance and McAfee DLP Capture Storage Array are set to on by default when the power sources are connected. Also, don't turn on the McAfee DLP Capture Storage Array until the appliance is set up. Apply the power only when the hardware installation is complete. 2 Locate the provided mini-sas cable. 3 Connect one end of the mini-sas cable to the RAID controller port at the back panel of the appliance and the other end to the McAfee DLP Capture Storage Array port. 4 Connect the console serial port to the DLP 6600 appliance USB port using the assembled 3.5 mm jack cable DB9 connecter USB adapter and plug in the USB connecter to connect to the appliance. 5 Connect the power supply cables of the appliance and McAfee DLP Capture Storage Array to its respective power supply source. Both the appliance and the storage array have dual hot-swap power supplies and automatically turn on when connected to the power supply. The McAfee DLP Capture Storage Array is not recognized until the appliance software is reinstalled. Reinstall the appliance software when you connect a capture storage disk to an existing appliance. 38 McAfee Data Loss Prevention Prevent 11.1.x Hardware Guide

39 A00