Installing Data Exchange Layer

Transcription

1 McAfee Data Exchange Layer Installation Guide (McAfee epolicy Orchestrator) Installing Data Exchange Layer System requirements Make sure that your system environment meets these requirements and that you have administrator rights. Component Products Version VMware vsphere ESXi 5.1 or later McAfee epo or later McAfee epo product extensions and packages (checked in) McAfee Agent or later McAfee Agent extension or later Products installed on each of your managed systems McAfee Agent or later Supported operating systems for the DXL client You can install the Data Exchange Layer client on several operating systems. See KB90421 for a complete list of supported operating types and versions. Hypervisor Support for DXL You can install DXL on a Hypervisor virtual machine. See KB90421 for a complete list of supported Hypervisor software. Standalone DXL roker System requirements for a standalone DXL roker installation are: Recommended 1

2 4 cores 8 GB RAM 25 GB Hard Disk Minimum 2 cores 4 GB RAM 20 GB Hard Disk Data Exchange Layer protocols and ports The Data Exchange Layer framework uses these network protocols and ports. Make sure these ports are open and availale for use with DXL. 2

3 Install DXL Follow these tasks if you are installing the DXL client and rokers for the first time on a system. 1 Install the extensions 4 Deploy the DXL client 2 Check in the DXL packages 5 Verify the installation 3 Download the DXL roker software s Install the extensions on page 3 Install the Data Exchange Layer extensions in the McAfee epo server. Check in the DXL packages on page 3 Check in the Data Exchange Layer packages to the Master Repository on the McAfee epo server. Download the DXL roker software on page 4 Download and install the DXL roker software manually from the McAfee product download wesite, or use the McAfee epo Software Catalog. Deploy the DXL client on page 6 Deploy the DXL client to each of your managed systems. Do not deploy DXL clients on a roker system. Verify the installation on page 6 After you complete the DXL roker appliance pages in VMware, verify that the installation was successful. Install the extensions Install the Data Exchange Layer extensions in the McAfee epo server. 1 Select Menu Software Extensions. 2 Click Install Extension and install the extensions in the following order. a DXL Broker Management c DXL Client DXL Client Management Check in the DXL packages Check in the Data Exchange Layer packages to the Master Repository on the McAfee epo server. 1 Select Menu Master Repository, then click Check In Package. 2 Check in these DXL packages: DXL Client DXL Broker DXL Platform 3

4 Download the DXL roker software Download and install the DXL roker software manually from the McAfee product download wesite, or use the McAfee epo Software Catalog. The roker appliance is installed using VMware vsphere (.ova file) or y running the DXL roker file (.iso file). Download one of the roker appliance files and save it locally efore continuing. After downloading the DXL software, install the rokers. You can install them on a VMware system, or using a Linux image. s Install DXL rokers using VMware on page 4 The DXL appliance is availale on the Software Catalog and the McAfee download site. There are two options, an OVA and an ISO. Both are packaged as a.zip file and must e extracted efore installing. Install DXL rokers on a Linux system on page 5 The Linux system must e managed y McAfee epo and include McAfee Agent version or later. Ensure that all needed communication ports are open through the local firewall. Install DXL rokers using VMware The DXL appliance is availale on the Software Catalog and the McAfee download site. There are two options, an OVA and an ISO. Both are packaged as a.zip file and must e extracted efore installing. 1 Depending on which appliance option you downloaded, do one of the following: If you downloaded the DXL roker ISO component, use the.iso file to install the appliance on a supported platform. If you downloaded the DXL roker OVA component, open the VMware vsphere client, then click File Deploy OVF Template. Browse to and select the DXL.ova file on your computer. Click Next and complete the steps in the wizard, then turn on the virtual machine and open a Console window. 2 Install and configure the DXL roker appliance. a Read and accept the license agreement. You can press Enter to view each page, or skip to the last page. c d e Create a root password for the appliance. The password must e at least nine characters. Enter the operational account name, real name, and password, using the Ta key to move to the next field. When finished, press Y to continue. The account name is typically something like jsmith and is used to log on to and administer the appliance. The real name is your full name, for example, John Smith. On the Network Selection page, enter N to continue. Select a configuration type, then enter Y to continue. DHCP Enter D. Manual IP address Enter M, then enter the remaining information. f g Enter the host name and domain name of the computer where you are installing the appliance. Enter Y to continue. Enter up to three Network Time Protocol servers to synchronize the time of the appliance. Use the default server listed, or enter the address for up to three servers. Enter Y to continue. 4

5 h i j k Enter the IP address or fully qualified domain name, port, and account information for your McAfee epo server. The user account must have administrator rights. Enter Y to continue. Open a we rowser and navigate to McAfee epo and verify that the McAfee epo server certificate's Common Name (CN) and fingerprint matches the information shown. How to verify certificates depends on your rowser. For most rowsers, clicking the Lock icon in the address ar allows you to view certificate details. Specify the port that DXL uses. Use the default port, or enter a port numer within the range shown, then enter Y to continue. When the logon screen appears, close it. 3 Log on to McAfee epo as an administrator and verify that there is a DXL roker listed in the System Tree. See Verify the installation for additional information aout making sure that the DXL roker installed successfully. Install DXL rokers on a Linux system The Linux system must e managed y McAfee epo and include McAfee Agent version or later. Ensure that all needed communication ports are open through the local firewall. You can install and deploy a roker on systems running these Linux versions: 64-it Red Hat Enterprise Linux 6.x 64-it Red Hat Enterprise Linux 7.x 64-it CentOS 6.x 64-it CentOS 7.x 1 In McAfee epo, select Menu Software Product Deployment, then click New Deployment. 2 Complete the new deployment information, then start the deployment. 3 After the deployment task completes, configure the roker. a To use a communication port other than the default 8883, update the DXL roker configuration file /opt /McAfee/dxlroker/conf/dxlroker.conf. Change the listenport setting. # The roker listen port listenport=8883 5

6 Update the firewall to allow communication on the roker port with the following commands, replacing <listenport> with the correct port. iptales (Red Hat Enterprise Linux 6.x / CentOS 6.x): iptales -N DXLBROKER iptales -I INPUT -j DXLBROKER iptales -A DXLBROKER -p tcp -m tcp --dport <listenport> -j ACCEPT service iptales save ip6tales -N DXLBROKER ip6tales -I INPUT -j DXLBROKER ip6tales -A DXLBROKER -p tcp -m tcp --dport <listenport> -j ACCEPT service ip6tales save firewalld (Red Hat Enterprise Linux 7.x / CentOS 7.x): firewall-cmd --zone=pulic --permanent --add-port=<listenport>/tcp firewall-cmd --reload c Restart the DXL Broker service. $> service dxlroker restart Log files for installing and deploying rokers on a Linux system are availale to help with trouleshooting: /var/log/dxlroker <version_numer> <uild_numer>.log /var/log/dxlroker uninstall.log Deploy the DXL client Deploy the DXL client to each of your managed systems. Do not deploy DXL clients on a roker system. Before you egin If deploying the DXL client on a supported Linux 64-it system, perform these steps on the system efore deploying: On CentOS and Red Hat systems, enter sudo yum install glic.i686 listdc++.i686 On Deian and Uuntu systems, enter sudo apt-get install li32stdc++6 1 In McAfee epo, select Menu Software Product Deployment, then click New Deployment. 2 Complete the new deployment information, then start the deployment. Verify the installation After you complete the DXL roker appliance pages in VMware, verify that the installation was successful. 1 On the System Tree main page, verify that the roker is listed and tagged as DXLBROKER. If the roker is not tagged as DXLBROKER, run the Manage DXL Brokers server task. 6

7 2 In the System Tree, select the DXL roker name, then click the Products ta. Verify that the DXL roker and version are listed. a If the DXL roker and version are not listed, click Wake Up Agents. On the Wake Up McAfee Agent page, select Force complete policy and task update, then click OK. It might take a few minutes for the roker properties to e sent to the appliance. When the installation is successful, the installed rokers are tagged as DXLBROKER and the correct DXL version is displayed in the Products ta. You can also click the McAfee shield icon in the Windows taskar and look for the McAfee Data Exchange Layer heading. You can see the roker connection status, and the roker name, address, and port numer that the DXL client is connected to. Trouleshooting the installation McAfee provides log files and scripts that can help you resolve common issues that might occur during installation. Accessing log files To trouleshoot installation prolems, view the log files. Have these files availale if you contact technical support. /var/log/dxlroker <version_numer> <uild_numer>.log /var/log/dxlplatform <version_numer> <uild_numer> <timestamp>.log Reconfiguring the installation using scripts You can use scripts to reconfigure the DXL rokers and the McAfee Agent. The scripts are located in the /home/ <username> directory. They must e executed with sudo permissions, for example, sudo /home/myname/ reconfig dxl. Script name Description Reoot? change-hostname Changes the host name of the current DXL roker appliance. It restarts the McAfee Agent and the roker. change-services Enales or disales the DXL roker. If the roker was initially disaled during first oot, the script prompts for roker configuration information. reconfig-dxl Reconfigures the DXL port. No reconfig-ma Reconfigures the McAfee Agent. The agent and DXL roker services are restarted. New keystores are generated when the service starts. Before using this script, read this KnowledgeBase article for important information: KB85043 Recommended No Recommended reconfig-network Reconfigures the current network interface (from DHCP to manual, or from manual to DHCP). Required reconfig-ntp Reconfigures the Network Time Protocol servers. No 7

8 Upgrade DXL Upgrade from a previous version of Data Exchange Layer. Before upgrading Data Exchange Layer, create a snapshot of your virtual machine in the VMware vsphere client. For instructions, see the VMware vsphere documentation. Download the DXL software manually from the McAfee product download wesite, or use the McAfee epo Software Catalog. Check in the packages to the Master Repository, and the extensions using the Extensions page. s Upgrade the extensions on page 8 Install the Data Exchange Layer extensions to the McAfee epo server. Check in the DXL packages on page 3 Check in the Data Exchange Layer packages to the Master Repository on the McAfee epo server. Upgrade the DXL roker on page 9 To upgrade the DXL rokers on the appliance, create a client task that includes a product deployment task in McAfee epo. Verify the DXL roker upgrade on page 9 After you complete the DXL upgrade, verify that the upgrade was successful. Upgrade the DXL client on page 10 Upgrade the DXL client on each of your managed systems. Verify the DXL client upgrade on page 10 After you complete the DXL client upgrade, verify that the upgrade was successful. Upgrade the extensions Install the Data Exchange Layer extensions to the McAfee epo server. Before you egin The DXL extension version must e the same or newer than the DXL roker version. You cannot install an older extension version with a newer roker version. 1 Select Menu Software Extensions. 2 Click Install Extension and install the extensions in the following order. a DXL Broker Management c DXL Client DXL Client Management Check in the DXL packages Check in the Data Exchange Layer packages to the Master Repository on the McAfee epo server. 8

9 1 Select Menu Master Repository, then click Check In Package. 2 Check in these DXL packages: DXL Client DXL Broker DXL Platform Upgrade the DXL roker To upgrade the DXL rokers on the appliance, create a client task that includes a product deployment task in McAfee epo. 1 Select Menu Policy Client Catalog. 2 Select McAfee Agent, then click New. 3 In the New window, select Product Deployment, then click OK. 4 Complete the new deployment information for the DXL roker. For the Target platforms option, make sure that only McAfee Linux OS is selected. Create a task for each package. Packages must e updated in this order: If you initially installed the roker appliance using the TIE.ova file, upgrade only the roker (the platform updates come from Threat Intelligence Exchange). If you installed the roker appliance using the DXL.ova or.iso file, upgrade oth the platform and the roker. a DXL Platform DXL Broker 5 Save the task and run it against the DXL roker. 6 In the System Tree, select a DXL roker name, then click the Properties ta. 7 Click Wake Up Agents and select Force complete policy and task update. It might take a few minutes for the roker properties to e sent to the appliance. Log files are located here: /var/log/dxlroker <version_numer> <uild_numer>.log /var/log/dxlplatform <version_numer> <uild_numer> <timestamp>.log /var/mcafee/dxlroker/logs/ipe start.log /var/mcafee/dxlroker/logs/ipe.log Verify the DXL roker upgrade After you complete the DXL upgrade, verify that the upgrade was successful. 9

10 1 In the System Tree main page, verify that the updated roker is listed and tagged as DXLBROKER. If it isn't, run the Manage DXL Brokers server task. 2 In the System Tree, select the DXL roker name, then click the Products ta. Verify that the updated DXL roker and version are listed. a If the DXL roker and version are not listed, click Wake Up Agents. c Select Force complete policy and task update, then click OK. It might take a few minutes for the roker properties to e sent to the appliance. If the DXLBROKER tag does not appear in the System Tree, run the Manage DXL Brokers server task again. When the installation is successful, the correct DXL version is displayed in the Products ta, and the installed rokers are tagged as DXLBROKER. Upgrade the DXL client Upgrade the DXL client on each of your managed systems. 1 Select Menu Policy Client Catalog. 2 Select McAfee Agent, then click New. 3 Select Product Deployment, then click OK. 4 Complete the new deployment information: From the Products and components list, select Data Exchange Layer Client. 5 Save the task and run it on each of your managed systems. You might have to wait several minutes for the task to complete, depending on how usy your McAfee epo server is. 6 In the System Tree, select the DXL client system, then click the Products ta. 7 Click Wake Up Agents and select Force complete policy and task update. It might take a few minutes for the client properties to e sent to the McAfee epo server. Verify the DXL client upgrade After you complete the DXL client upgrade, verify that the upgrade was successful. 1 In the System Tree, select a DXL client system, then click the Products ta. 2 Verify that the updated DXL client and version are listed. 3 Select a DXL client system, and from the Actions menu, select DXL Lookup in DXL. Make sure that the connection state is Connected. 4 You can also click the McAfee shield icon in the Windows taskar and look for the McAfee Data Exchange Layer heading. You can see the roker connection status, and the roker name, address, and port numer that the DXL client is connected to. 10

11 Uninstall DXL Follow these steps to uninstall DXL. 1 Select Menu Software Product Deployment New Deployment. 2 Complete and save the new deployment information for the uninstall. 3 In the Product Deployment page, from the Action drop-down, select Uninstall. Then start the deployment to uninstall DXL. Copyright 2018 McAfee, LLC McAfee and the McAfee logo are trademarks or registered trademarks of McAfee, LLC or its susidiaries in the US and other countries. Other marks and rands may e claimed as the property of others