G400/G2000 Appliances User Guide

Transcription

1 G400/G2000 Appliances User Guide

2 Internet Security Systems, Inc Barfield Road Atlanta, Georgia United States (404) Internet Security Systems, Inc All rights reserved worldwide. Customers may make reasonable numbers of copies of this publication for internal use only. This publication may not otherwise be copied or reproduced, in whole or in part, by any other person or entity without the express prior written consent of Internet Security Systems, Inc. Patent Pending. Internet Security Systems, System Scanner, Wireless Scanner, SiteProtector, Proventia, Proventia Web Filter, Proventia Mail Filter, Proventia Filter Reporter, ADDME, AlertCon, ActiveAlert, FireCell, FlexCheck, Secure, SecurePartner, SecureU, and X- Press Update are trademarks and service marks, and the Internet Security Systems logo, X-Force, SAFEsuite, Internet Scanner, Database Scanner, Online Scanner, and RealSecure registered trademarks, of Internet Security Systems, Inc. Network ICE, the Network ICE logo, and ICEpac are trademarks, BlackICE a licensed trademark, and ICEcap a registered trademark, of Network ICE Corporation, a wholly owned subsidiary of Internet Security Systems, Inc. SilentRunner is a registered trademark of Raytheon Company. Acrobat and Adobe are registered trademarks of Adobe Systems Incorporated. Certicom is a trademark and Security Builder is a registered trademark of Certicom Corp. Check Point, FireWall-1, OPSEC, Provider-1, and VPN-1 are registered trademarks of Check Point Software Technologies Ltd. or its affiliates. Cisco and Cisco IOS are registered trademarks of Cisco Systems, Inc. HP-UX and OpenView are registered trademarks of Hewlett-Packard Company. IBM and AIX are registered trademarks of IBM Corporation. InstallShield is a registered trademark and service mark of InstallShield Software Corporation in the United States and/or other countries. Intel and Pentium are registered trademarks of Intel. Lucent is a trademark of Lucent Technologies, Inc. ActiveX, Microsoft, Windows, and Windows NT are either registered trademarks or trademarks of Microsoft Corporation. Net8, Oracle, Oracle8, SQL*Loader, and SQL*Plus are trademarks or registered trademarks of Oracle Corporation. Seagate Crystal Reports, Seagate Info, Seagate, Seagate Software, and the Seagate logo are trademarks or registered trademarks of Seagate Software Holdings, Inc. and/or Seagate Technology, Inc. Secure Shell and SSH are trademarks or registered trademarks of SSH Communications Security. iplanet, Sun, Sun Microsystems, the Sun Logo, Netra, SHIELD, Solaris, SPARC, and UltraSPARC are trademarks or registered trademarks of Sun Microsystems, Inc. in the United States and other countries. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. in the United States and other countries. Adaptive Server, SQL, SQL Server, and Sybase are trademarks of Sybase, Inc., its affiliates and licensers. Tivoli is a registered trademark of Tivoli Systems Inc. UNIX is a registered trademark in the United States and other countries, licensed exclusively through X/Open Company, Ltd. All other trademarks are the property of their respective owners and are used here in an editorial context without intent of infringement. Specifications are subject to change without notice. Disclaimer: The information contained in this document may change without notice, and may have been altered or changed if you have received it from a source other than ISS or the X-Force. Use of this information constitutes acceptance for use in an AS IS condition, without warranties of any kind, and any use of this information is at the user s own risk. ISS and the X-Force disclaim all warranties, either expressed or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall ISS or the X-Force be liable for any damages whatsoever, including direct, indirect, incidental, consequential or special damages, arising from the use or dissemination hereof, even if ISS or the X-Force has been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages, so the foregoing limitation may not apply. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation, or favoring by Internet Security Systems, Inc. The views and opinions of authors expressed herein do not necessarily state or reflect those of Internet Security Systems, Inc., and shall not be used for advertising or product endorsement purposes. Links and addresses to Internet resources are inspected thoroughly prior to release, but the ever-changing nature of the Internet prevents Internet Security Systems from guaranteeing the content or existence of the resource. When possible, the reference contains alternate sites or keywords that could be used to acquire the information by other methods. If you find a broken or inappropriate link, please send an with the topic name, link, and its behavior to support@iss.net. March 27, 2005

3 Contents Preface vii Overview vii About Proventia Appliance Documentation ix Conventions Used in this Guide x Getting Technical Support xi Chapter 1: to the Proventia G400/G2000 Appliances Overview About the Proventia Intrusion Prevention Appliances What s New in This Release Overview of Inline Appliance Operation Modes Overview of Inline Appliance with HA Operation Modes Part I: Getting Started Chapter 2: Using Proventia Manager Overview Before You Begin Accessing Proventia Manager Starting Proventia Manager Installing the License File Using the Proventia Manager Home Page Chapter 3: Updating the Appliance Overview Updating the Appliance Using the SiteProtector X-Press Update Server Viewing the Status of Updates Installing Available Updates Configuring Automatic Updates Manually Downloading and Installing Updates Configuring an Update Advanced Parameter Part II: Configuring the Appliance Chapter 4: High Availability Overview About High Availability High Availability Configuration Overview High Availability Deployment High Availability Configuration Procedures SiteProtector Management with HA Chapter 5: Appliance Settings Overview Setting Up a Local Configuration Interface and Logging On the Appliance Logging Out of the Local Configuration Interface Proventia G400/G2000 Appliances User Guide iii

4 Contents Section A: Configuring Appliance and Agent Settings Overview Viewing the Appliance Settings Backing Up the Current Configuration Restoring a Configuration Disabling Remote Root Access to the Appliance Rebooting or Shutting Down the Appliance Viewing the Status of Appliance Components Restarting the Agent Changing the Agent Name Section B: Configuring Network, Time, and SNMP Settings Overview Changing the Network Configuration Settings Changing the Host Configuration Settings Changing the Link Speed and Duplex Mode Settings Changing the Date and Time Settings Changing the Time Zone Setting Changing NTP Settings Changing Appliance Passwords through the Local Configuration Interface Changing SNMP Settings Chapter 6: Configuring Responses Overview About Responses Configuring an Response Configuring a Log Evidence Response Configuring Quarantine Response Objects Configuring an SNMP Response Configuring a User Specified Response Chapter 7: Monitoring Events Overview About Events Section A: Security Events Overview About Security Events Using Response Filters About Protection Domains Managing Quarantine Rules Section B: Connection Events Overview About Connection Events Adding a Connection Event Editing the Properties of a Connection Event Removing a Connection Event Section C: User-Defined Events Overview About User-Defined Events Adding a User-Defined Event Editing the Properties of a User-Defined Event Removing a User-Defined Event Context Descriptions for User-Defined Events Regular Expressions in User-Defined Events iv

5 Contents Section D: Trons Events Overview About Trons Events Adding a Trons Rule Editing the Properties of a Trons Rule Removing a Trons Rule Part III: Managing the Appliance Chapter 8: Firewall Settings Overview About Firewall Rules Firewall Rules Language Customizing Firewall Rules Firewall Advanced Parameters Chapter 9: Managing the System Overview Viewing the Status of System Settings Changing Appliance Passwords in Proventia Manager Configuring an SNMP Trap Configuring an Notification Response Editing the Network Card Properties Configuring the Size of the Alert Queue Configuring an Advanced Local Tuning Parameter Configuring a Global Tuning Parameter Configuring the External Kill Port Using the Traceroute Utility Pinging a Computer Stopping the Appliance Chapter 10: Managing Alerts Overview Accessing the Alerts Page Getting More Information about Alerts Refreshing and Searching the Alerts List Saving the Alerts List Clearing the Alerts List Managing Saved Alert Files Chapter 11: Managing with SiteProtector Overview Managing with SiteProtector Enabling SiteProtector Management Configuring SiteProtector Management Settings Index Proventia G400/G2000 Appliances User Guide v

6 Contents vi

7 Preface Overview Purpose of this guide This guide explains how to configure and use the Proventia G400/G2000 appliances and the Proventia Manager software. Scope The Proventia G400/G2000 Appliances User Guide includes information about the following topics: changing configuration settings using the Proventia Manager Local Management Interface (LMI) configuring events, responses, rules, policies. and advanced parameters reinstalling the appliance software customizing firewall rules configuring quarantine responses reinstalling the appliance software high availability Audience This guide is intended for network security system administrators who are responsible for configuring and managing the Proventia G400/G2000 appliances in a network environment. A fundamental knowledge of network security policies and IP network configuration is helpful. What s new in this guide The latest up-to-date documentation is always available in the Proventia Manager appliance Help, and in the Readme files associated with each release. This guide supports the 1.0 release of the next generation of Proventia Intrusion Prevention Appliances. The documentation is available in the Help, and in the Readme files associated with each release. This release contains new information about the following: new models G400 and G2000 (copper, fiber, and copper-fiber) changes to the Proventia Setup Utility for the G400 and G2000 models ability to select operational mode at the port level ability to manage the appliance locally using Proventia Manager using protection domains as virtual sensors high availability failover protection Proventia G400/G2000 Appliances User Guide vii

8 Preface About Proventia Appliance Documentation Complete all of the installation procedures before you configure your appliance. The Quick Start Guide included with your appliance provides the installation procedures. What s in this guide This guide explains how to configure the G400/G2000 appliances using the Proventia Manager software and the Proventia Setup Utility (your local configuration interface). Use Part I Getting Started to learn about the appliance features and capabilities. Procedures are provided about how to start using Proventia Manager to access and manage the appliance. Information is provided to help you verify your initial appliance configuration settings. Use Part II Configuring the Appliance to learn the procedures for configuring intrusion prevention, firewall settings, and high availability. Use Part III Managing the Appliance to locate information about how to manage and maintain your Proventia G400/G2000 appliances. Locating additional documentation Additional documentation described in this topic is available on the ISS Web site at Related publications See the following for more information about the appliance: Document Proventia G400/G2000 Appliances Quick Start Guide Proventia G400/G2000 Help Proventia G Series Appliance Data Sheet Proventia G Series Appliance Frequently Asked Questions Readme File Contents Instructions and requirements for installation and initial configuration of the G400/G2000 appliance. Help located in Proventia Manager. General information about appliance features located at documents.iss.net/literature/proventia/ ProventiaGSeries_Datasheet.pdf. Frequently asked questions about the appliance and its functions located at proventia/proventiagseries_faq.pdf. The most current information about product issues and updates, and how to contact Technical Support located at Table 1: Reference documentation viii

9 Conventions Used in this Guide Conventions Used in this Guide This topic explains the typographic conventions used in this guide to make information in procedures and commands easier to recognize. In procedures The typographic conventions used in procedures are shown in the following table: Convention What it Indicates Examples Bold An element on the graphical user interface. Type the computer s address in the IP Address box. Select the Print check box. Click OK. SMALL CAPS A key on the keyboard. Press ENTER. Press the PLUS SIGN (+). Constant width Constant width italic A file name, folder name, path name, or other information that you must type exactly as shown. A file name, folder name, path name, or other information that you must supply. A sequence of commands from the taskbar or menu bar. Save the User.txt file in the Addresses folder. Type IUSR SMA in the Username box. Type Version number in the Identification information box. From the taskbar, select Start Run. On the File menu, select Utilities Compare Documents. Table 2: Typographic conventions for procedures Command conventions The typographic conventions used for command lines are shown in the following table: Convention What it Indicates Examples Constant width bold Italic Information to type in exactly as shown. Information that varies according to your circumstances. md ISS md your_folder_name [ ] Optional information. dir [drive:][path] [filename] [/P][/W] [/D] Two mutually exclusive choices. { } A set of choices from which you must choose one. verify [ON OFF] % chmod {u g o a}=[r][w][x] file Table 3: Typographic conventions for commands Proventia G400/G2000 Appliances User Guide ix

10 Preface Getting Technical Support ISS provides technical support through its Web site and by or telephone. The ISS Web site The Internet Security Systems (ISS) Resource Center Web site ( support/) provides direct access to frequently asked questions (FAQs), white papers, online user documentation, current versions listings, detailed product literature, and the Technical Support Knowledgebase ( Support levels ISS offers three levels of support: Standard Select Premium Each level provides you with 24-7 telephone and electronic support. Select and Premium services provide more features and benefits than the Standard service. Contact Client Services at if you do not know the level of support your organization has selected. Hours of support The following table provides hours for Technical Support at the Americas and other locations: Location Americas All other locations Hours 24 hours a day Monday through Friday, 9:00 A.M. to 6:00 P.M. during their local time, excluding ISS published holidays Note: If your local support office is located outside the Americas, you may call or send an to the Americas office for help during off-hours. Table 4: Hours for technical support Contact information The following table provides electronic support information and telephone numbers for technical support requests: Regional Office North America Electronic Support Connect to the MYISS section of our Web site: Telephone Number Standard: (1) (888) (toll free) (1) (404) Select and Premium: Refer to your Welcome Kit or call your Primary Designated Contact for this information. Latin America support@iss.net (1) (888) (toll free) (1) (404) Table 5: Contact information for technical support x

11 Getting Technical Support Regional Office Electronic Support Telephone Number Europe, Middle East, and Africa (44) (1753) Asia-Pacific, Australia, and the Philippines (1) (888) (toll free) (1) (404) Japan Domestic: (81) (3) Table 5: Contact information for technical support (Continued) Proventia G400/G2000 Appliances User Guide xi

12 Preface xii

13 Chapter 1 to the Proventia G400/ G2000 Appliances Overview This chapter describes the Proventia G400/G2000 appliances. The appliances come pre-configured with factory default settings that protect your system with a minimum of additional configuration. In this chapter This chapter contains the following topics: Topic Page About the Proventia Intrusion Prevention Appliances 2 What s New in This Release 4 Overview of Inline Appliance Operation Modes 6 Proventia G400/G2000 Appliances User Guide 1

14 Chapter 1: to the Proventia G400/G2000 Appliances About the Proventia Intrusion Prevention Appliances The Proventia Intrusion Prevention appliances are inline intrusion prevention systems (IPS) that automatically block malicious attacks while preserving network bandwidth and availability. Appliance diagram Figure 1 shows a functional overview of the Proventia Intrusion Prevention appliances: attack traffic permitted traffic payload HTTP header payload HTTP header Firewall inspects header Proventia inspects HTTP packet Allows web traffic to pass Protects against attack Protected Network The Proventia Intrusion Prevention appliances offer proven intrusion prevention technology including: high speed deep traffic analysis multiple methods of detection automatic updates from ISS X-Force the world leader in security research and vulnerability detection high availability configuration In addition, the Proventia Intrusion Prevention appliances have automatic protection capabilities including ISS X-Force tagging of events such as block or alert and tuning. Installing and configuring an appliance ISS delivers appliances with pre-installed software. See the Quick Start Guide that is provided with the appliance for instructions on installing the hardware and configuring the software. Managing the appliance from the console After you complete the configuration steps listed on the Quick Start Guide, you must configure additional appliance settings and edit appliance policies from the SiteProtector management console. Reference: For instructions on managing the appliance from the management console, see the SiteProtector user documentation at documentation/ or the SiteProtector Help. 2

15 About the Proventia Intrusion Prevention Appliances Accessing the SiteProtector Help To access the SiteProtector Help: 1. On the Console menu bar, select Help SiteProtector Help. 2. Open the Working with Proventia A and Proventia G Appliances and Sensors section. 3. Look up Working with Proventia Appliance Policies and Working with Asset Properties and Responses. Licensing The Proventia Intrusion Prevention appliances require a properly configured license key. If you have not installed the appropriate license key through the management console and Proventia Manager, you will not be able to update the appliance. Contact your local sales representative to purchase a license for the appliance. Proventia Setup Utility The Proventia Intrusion Prevention Setup Utility is your local configuration interface. Use this tool to initially configure your appliance settings. See Using the Proventia Setup Utility on page 46. Proventia Manager Proventia Manager offers a Web-based graphical user interface (GUI) for local appliance management. Use Proventia Manager to manage the appliance. Proventia Manager provides local management of the following functions: monitoring the status of the appliance configuring operation modes configuring firewall settings managing appliance settings and activities reviewing alert details configuring high availability managing policies with protection domains (The only to place to view this function). Note: You can only use Proventia Manager or SiteProtector to manage policies. You cannot use both at the same time to manage policies. High availability The Proventia G400/G2000 High Availability (HA) feature enables the Proventia G Intrusion Prevention appliances to work in an existing high availability network environment. The appliances pass all traffic between them over mirroring links. This ensures that both appliances see all of the traffic over the network, and thus maintain state. This also allows the appliances to see asymmetrically routed traffic, if necessary, and thus fully protect the network. The Proventia G High Availability support is limited to two cooperating appliances. Both appliances process packets inline and block attack traffic that arrives on their inline monitoring ports, not on their interconnection/mirror ports. Both appliances also report events received on their inline monitoring ports to the management console. Proventia G400/G2000 Appliances User Guide 3

16 Chapter 1: to the Proventia G400/G2000 Appliances What s New in This Release This release includes support for the new Intrusion Prevention appliances: Proventia G400 and Proventia G2000. These appliances are inline intrusion prevention systems (IPS) that automatically block malicious attacks while preserving network bandwidth and availability. The new appliances offer the following capabilities: three modes of operation, configured at the port level inline protection inline simulation passive monitoring high availability (HA) modes (cannot be configured at port level) normal mode HA simulation mode HA protection mode rules firewall rules granular policy implementation (Protection Domains) quarantine response block TCP dump agent settings for processing traffic SNMP configuration (Simple Network Management Protocol) X-Force recommended blocking responses a Web-based local management interface (Proventia Manager) New modes of operation The inline appliance can operate in one of six modes. Three of those modes operate in a high availability environment. Use this feature to tune the appliance without disrupting your network, blocking legitimate traffic, or high availability deployment. Reference: See Overview of Inline Appliance Operation Modes on page 6 for more information. Firewall rules You can configure firewall rules that apply globally to stop attackers from accessing Trojan viruses or probing networks. When appropriate, using firewall rules is preferred over using connection events to help improve the efficiency of the appliance. Reference: See Customizing Firewall Rules on page 127 for more information. Quarantine response The inline appliance uses the quarantine response to block traffic for a specified amount of time after an initial attack. Reference: See Overview of Inline Appliance Operation Modes on page 6 and Configuring Quarantine Response Objects on page 74 for more information. 4

17 What s New in This Release Block response The inline appliance uses the block response to block and reset a connection in which an event occurs or to drop the packet that triggered an event. Reference: See Overview of Inline Appliance Operation Modes on page 6 for more information. Event details for quarantine and block responses You can view event details in SiteProtector to determine if the block or quarantine responses were used for an event. Agent settings for processing traffic You can configure settings that tell the agent how to process traffic when the network is congested, when the agent is not responding, or during an agent update. Reference: See the chapter on Managing the System on page 131 for more information. Proventia G400/G2000 Appliances User Guide 5

18 Chapter 1: to the Proventia G400/G2000 Appliances Overview of Inline Appliance Operation Modes Three operation modes The inline appliances include three operation modes as follows: passive monitoring inline simulation inline protection You selected one of these operation modes when you installed the appliance software. Or you can use the default operation mode and install a different one later. Passive monitoring In this mode, block is the only response that can modify network traffic. When block response is enabled, the appliance will send a reset to block a TCP connection. Works similar to IDS, sniffing traffic, but not inline. Usage: Use this mode to tune the appliances for subsequent inline protection by sampling traffic. Inline simulation This mode includes all the functionality of the passive monitoring mode. In addition, firewall rule actions Drop and DropAndReset are disabled. The block and quarantine responses are enabled, but packets are not dropped when these responses are invoked. In inline simulation mode, the appliance does not reset TCP connections by default. In this mode, traffic is not impacted. : Use this mode when you need to do the following: tune your policies in a production environment without the risk of adversely affecting your network traffic verify that the appliances are not disrupting your network or blocking legitimate traffic Inline protection This mode includes all the functionality of passive monitoring mode. In addition, all firewall rules are enabled, so any packets that match a Drop and DropAndReset firewall action are dropped and not processed any further by the appliance. In this mode, all rules configured are applied. Changing appliance modes If you change from the passive monitoring mode to the inline simulation or inline protection mode, you must also change the network connections to your appliance. An appliance operating in passive monitoring mode requires a connection to a tap, hub, or SPAN port. 6

19 Overview of Inline Appliance with HA Operation Modes Overview of Inline Appliance with HA Operation Modes Three operation modes In a HA configuration, the appliance can only operate in either inline simulation or inline protection modes. Normal monitoring mode is not supported. If HA simulation mode is selected, all monitoring adapters will be put in inline simulation mode automatically. If HA protection mode is selected, all monitoring adapters will be put in inline protection mode automatically. In normal mode, each adapter can be configured to run in a different operational mode. High Availability addresses the operation of inline appliances in a high availability environment. It does not address the availability or fault-tolerance of the appliances themselves. Therefore, there is no separate high availability solution for appliances configured and wired for passive monitoring mode. normal mode HA simulation mode HA protection mode You selected one of these operation modes when you installed the appliance software. Or you can use the default operation mode and install a different one later. Normal mode In Normal operation mode, the appliance does not cooperate with another appliance. Appliance can be configured to run in inline protection, inline simulation and passive monitoring modes at the adapter level. HA simulation mode In HA simulation mode, both HA partner appliances monitor traffic inline but do not block any traffic. Instead they provide passive notification responses. The appliances also monitor the traffic on each other s segment via mirror links ready to take over notification in case of network failover. HA protection mode In protection mode, both HA partner appliances monitor traffic inline and each report and block the attacks received on their inline ports. The appliances also monitor the traffic on each other s segment via mirror links ready to take over reporting and protection in case of network failover. Proventia G400/G2000 Appliances User Guide 7

20 Chapter 1: to the Proventia G400/G2000 Appliances 8

21 Part I TM Getting Started

22

23 Chapter 2 Using Proventia Manager Overview This chapter describes how to start using the Proventia Manager. Proventia Manager is the Web-based GUI for the G400 and G2000 appliances. Use Proventia Manager to perform updates, make adjustments, and augment configuration settings. Note: Initial appliance installation and network configuration steps are defined in the Proventia G400/G2000 Appliances Quick Start Guide. In this chapter This chapter contains the following topics: Topic Page Before You Begin 12 Accessing Proventia Manager 13 Starting Proventia Manager 14 Installing the License File 15 Using the Proventia Manager Home Page 16 Recommendations Prior to using the appliance, you must install the license key. Additionally, ISS recommends that you perform the following tasks: view your component status on the Home page update the firmware configure update settings configure and update intrusion prevention settings configure the firewall Proventia G400/G2000 Appliances User Guide 11

24 Chapter 2: Using Proventia Manager Before You Begin Before you access the Proventia Manager, you must complete the initial configuration and setup of the appliance. Initial configuration Before you begin, make sure you have completed all of the steps in the Quick Start Guide for your appliance. Initial requirements Verify that you have done the following: 1. Properly installed the hardware and connected the cables. 2. Created a connection using a VT100 compatible terminal emulation program, with the recommended settings. 3. Completed all initial setup configurations, including the following: logged on to the appliance with the Proventia Setup Utility (your local configuration interface) configured the command line and Web passwords configured the management interface configured the time and date applied the settings Important: You can find detailed procedures for these steps in the Quick Start Guide. The Proventia G400/G2000 Appliances Quick Start Guide is available on the ISS Web site at 12

25 Accessing Proventia Manager Accessing Proventia Manager Before you configure your appliance, you must log on to Proventia Manager. This topic explains what steps are required before you can access Proventia Manager. Prerequisites After you perform network configurations, you must do the following before you can access the Proventia Manager: Prerequisite Verify that you received a valid license from your ISS Operations or Partner personnel. Download the license, and then save it locally to upload to the appliance. ISS recommends that you upload the license so that you can download the latest updates automatically. Reference: See Installing the License File on page 15. Verify that you have Internet Explorer Version 6 or later installed. Connect a computer or laptop to the internal network. Verify that your Client TCP/IP settings are properly configured for your network. Table 6: Prerequisites for accessing Proventia Manager Reference: See the Help for more information about accessing and using the Proventia Manager. Proventia G400/G2000 Appliances User Guide 13

26 Chapter 2: Using Proventia Manager Starting Proventia Manager Procedure To start Proventia Manager: 1. Start Internet Explorer Type followed by the IP address of the appliance s management interface you configured during initial setup. Reference: See the Proventia G400/G2000 Appliances Quick Start Guide for detailed instructions. Important: You must use a secure connection to access Proventia Manager. Be sure you use in the address bar. 3. Log in using the user name admin and the Proventia Manager password that you configured for the appliance during initial setup. 4. If a message informs you that you do not have Java2 Runtime Environment (JRE) Version installed, install it now, and then return to this procedure and log in again. A Welcome screen appears. 5. Select Yes or No to access the Getting Started procedures. 6. Click Launch Proventia Manager. Note: ISS recommends that you use the Getting Started procedures to help you customize the appliance settings. If this screen does not appear, you can also access the Getting Started procedures from the Help. Accessing the Proventia Manager Help To access the Proventia Manager Help: On the Proventia Manager Home page, click Help. The Home Page topic appears. 14

27 Installing the License File Installing the License File You must install a license file for Proventia Manager. Use the procedure below to install the license file. This is necessary to make your appliance run at full capability. Installation involves saving the license file information to the appropriate location so that the Proventia Manager software can locate and acknowledge it. Note: To purchase a license file for your appliance, contact your ISS sales representative. Prerequisite Before you install the license file, complete the following: register your customer license download the license from the ISS Registration Center ( support) About the Licensing page The Licensing page displays important information about the current status of your license file, including expiration dates. Additionally, this page allows you to access the License Information page, which includes information about how to acquire a current license. Installing the license file To install the license file: 1. On the Proventia Manager navigation pane, select System Licensing. The Licensing page appears. 2. Click Browse. 3. Locate the license file that you downloaded. 4. Click OK. The license directory path appears in the field. 5. Click Upload. The license is installed in the appropriate directory for the appliance. Reference: See the Help for more information about accessing and using the Proventia Manager. Proventia G400/G2000 Appliances User Guide 15

28 Chapter 2: Using Proventia Manager Using the Proventia Manager Home Page The Proventia Manager Home page provides a snapshot of the current status of the appliance. Check the Home page often to obtain the following information: protection status system status important messages Tip: See the Help for more information about accessing the Home page. Protection status The protection status area describes the current status the intrusion prevention component. Selecting a component name links you to the component status page. Protection status icons Determine the current status of a component by glancing at the status icon. Status icons are as follows: Icon Description Indicates that the component is active. Indicates that the component is stopped. Indicates that the component is in an unknown state. This status may require immediate attention. Table 7: Protection status icons System status The system status group box describes the current status of the system. The following table describes the data available in the system status area: Statistic Model Number Base Version Number Uptime Last Restart Description The model number of the appliance. Model possibilities are: G400 G2000 The base version of the appliance software. Note: The base version is the software version shipped with the appliance, or the software version of the most recent firmware update. The length of time that the appliance has been online. The time is given in the following format: x days, x hours, x minutes The time the appliance was last restarted. The time is given in the following format: yyyy-mm-dd hh:mm:ss Example: :24:37 Table 8: System Status statistics 16

29 Using the Proventia Manager Home Page Statistic Last Firmware Update Last Intrusion Prevention Update Last System Backup Backup Description Description The time the appliance firmware was last updated. The time is given in the following format: yyyy-mm-dd hh:mm:ss - version: x.x Example: :25:56 - version: 1.7 The time the appliance firmware was last updated. The time is given in the following format: yyyy-mm-dd hh:mm:ss - version: x.x Example: :34:36 - version: 1.7 The time the last system backup was created. The time is given in the following format: yyyy-mm-dd hh:mm:ss Example: :49:01 The type of backup on the appliance. The backup possibilities are: Factory Default Full System Backup Table 8: System Status statistics (Continued) Important messages The Home page displays important messages about licensing and updates. If you have not configured your system to download updates automatically, such messages may appear with a link to the appropriate Proventia Manager page. Proventia G400/G2000 Appliances User Guide 17

30 Chapter 2: Using Proventia Manager 18

31 Chapter 3 Updating the Appliance Overview This chapter describes how to update your appliance in Proventia Manager. You can manually download and/or install firmware updates and security updates, or you can configure the appliance to automatically download and install some or all updates at designated times. In this chapter This chapter contains the following topics: Topic Page Updating the Appliance 20 Using the SiteProtector X-Press Update Server 22 Viewing the Status of Updates 23 Installing Available Updates 25 Configuring Automatic Updates 26 Manually Downloading and Installing Updates 29 Configuring an Update Advanced Parameter 31 Proventia G400/G2000 Appliances User Guide 19

32 Chapter 3: Updating the Appliance Updating the Appliance You should always make sure your appliance is running the latest firmware and intrusion prevention updates. Your appliance retrieves updates from the ISS Download Center, accessible over the Internet. You can update the appliance in two ways: configure automatic updates find, download, and install updates manually Types of updates You can install the following updates: firmware updates intrusion prevention updates You can find updates from the Updates to Download page, and you can schedule automatic update downloads and installations from the Update Settings page. Note: Some firmware updates require that you reboot your appliance. How the appliance find updates When you click the Find Updates button on the Update Status page, the appliance checks for the following: updates that are already downloaded to the appliance and ready to be installed updates that are available for download from the ISS Download Center If the appliance finds updates to download or install, an alert message displays a link to the appropriate page (the Download Updates or Install Updates page). Update packages and rollbacks A rollback removes the last intrusion prevention update that was installed on the appliance. You cannot roll back firmware updates. ISS recommends that you perform a full system backup before you install a firmware update. If you enable automatic firmware updates, you can enable the Perform Full System Backup Before Installation option. After an update is installed, the appliance deletes the update package and the downloaded package is no longer on your appliance. If you roll back the update, the appliance is available for update downloads and installation the next time updates are available or at the next scheduled automatic update. If you manage your appliance with SiteProtector If you manage your appliance with SiteProtector, you can install an update while the appliance is registered with the SiteProtector Agent Manager. Note: See Using the SiteProtector X-Press Update Server on page 4. 20

33 Updating the Appliance Update process and recommendations ISS recommends that you do the following when you schedule updates: Create a system backup prior to installing any firmware updates. Note: To ensure that you have a system backup before each automatic firmware update installation, you can enable the Perform Full System Backup Before Installation option on the Update Settings page. If you enable automatic system backup before firmware installation, then the appliance reboots and creates the system backup before it installs the firmware update. Your appliance stores only one system backup, so if you select this option then the appliance overwrites the previous system backup. Schedule automatic update checks at least one hour before installing firmware updates or performing a system backup, to allow time for the updates to download Schedule firmware updates outside business hours, as the appliance may go offline for several minutes during the installation process Example You can configure the appliance to automatically download and install updates as follows: check for updates daily at 3:00 AM automatically download and install security updates automatically download firmware updates automatically perform a system backup and install available firmware updates daily at 5:05 AM The following table describes the appliance update process with these settings: Stage Description 1 At 3:00 AM, the appliance checks the ISS Download Center for updates. 2 The appliance downloads security and firmware updates. 3 The appliance installs security updates immediately. 4 At 5:05 AM, the appliance does the following: reboots, and then creates a system backup installs the firmware update, and then reboots if necessary Table 9: An example of the update process Proventia G400/G2000 Appliances User Guide 21

34 Chapter 3: Updating the Appliance Using the SiteProtector X-Press Update Server By default, the appliance uses the ISS Download Server at If you use SiteProtector to manage your appliance, you can configure the appliance to use the SiteProtector X-Press Update Server as an alternate download server for updates. Configure the appliance to use the SiteProtector X-Press Update Server as an alternate update download server on the Update Settings page. Why use the alternative download server? If you use SiteProtector to manage your appliance, you may want to use the SiteProtector X-Press Update Server as an alternate update server for the following reasons: If you have a large deployment of appliances, you can save bandwidth on your Internet connection. Your appliances can request updates from one SiteProtector update server, rather than each appliance using bandwidth to download the same updates from the default ISS Download Center. If you want to download updates in a more secure environment and do not want every appliance to have access to the Internet for update downloads, the appliances can request updates from the SiteProtector update server. In this scenario, only the SiteProtector update server requires an Internet connection. Configuring the Update Server You use the advanced parameter Update.source.url to configure the Update Server. Reference: See Configuring an Update Advanced Parameter on page 31 for a procedure. 22

35 Viewing the Status of Updates Viewing the Status of Updates You can perform the following tasks on the Update Status page (select Updates on the Proventia Manager navigation pane): view the status of downloads and installations view the history of firmware update installations roll back intrusion prevention updates manually find updates available for download Finding updates When you click the Find Updates button on the Update Status page, the appliance checks for the following: updates that are available for download from the ISS Download Center updates available for install that are already downloaded to the appliance If the appliance finds updates to download or install, an alert message displays a link to the appropriate page (the Download Updates or Install Updates page). To find available updates: 1. On the Proventia Manager navigation pane, select Updates. If your appliance model requires it, the Export Administration Regulation window appears. 2. If needed, review the Export Agreement, select Yes, and then click Submit. The Update Status page appears. 3. In the Updates area, click Find Updates. To view available downloads or updates, do one of the following: if the appliance displays an available download alert message, click View Available Downloads to go to the Available Downloads page if the appliance displays an available install alert message, click View Available Installs to go to the Available Installs page select Available Downloads or Available Installs on the navigation pane Rolling back updates A rollback removes the last intrusion prevention update that was installed on the appliance. You cannot rollback firmware updates. Note: ISS recommends that you perform a full system backup before you install a firmware update. If you enable automatic firmware updates, you can enable the Perform Full System Backup Before Installation option. Update packages and rollbacks After you install an update, the appliance deletes the update package. Therefore, the downloaded package is no longer on your appliance. If you roll back the update, then the update will be found as available for download and installation the next time you find updates or at the next scheduled automatic update. Proventia G400/G2000 Appliances User Guide 23

36 Chapter 3: Updating the Appliance Cumulative updates and rollbacks Updates are cumulative. See the following example for a description of the appliance behavior during the rollback of cumulative updates. Example: If you install version 1.1, do not install version 1.2, and then install version 1.3, version 1.2 is installed with version 1.3. However, the appliance does not rollback to version 1.2. A rollback to the last update takes the appliance back to version 1.1. To roll back an update: 1. On the Proventia Manager navigation pane, select Updates. The Update Status page displays the status of the Intrusion Prevention and the Firmware updates. 2. Click the corresponding Rollback Last Update link, and then click OK. The page automatically refreshes. If not, you can press F5to refresh the page and check the progress of the rollback. 24

37 Installing Available Updates Installing Available Updates Use the Update Settings page to configure how the appliance locates, downloads, and installs available updates. Note: If the icon appears next to a field on this page, then data is required in the field or the data in the field is invalid. If the icon appears next to a policy or a tab on this page, then the policy or tab contains invalid settings or empty fields that require data. Updates in SiteProtector If you manage your appliance with SiteProtector, you can install an update while the appliance is registered with the SiteProtector console. Troubleshooting If you experience unusual behavior after you apply a firmware update, try the following: 1. Close your Web browser. 2. Clear your Java cache. 3. Restart your Web browser and logon to Proventia Manager. Note: For more information about how to clear your Java cache, see your operating system documentation. Proventia G400/G2000 Appliances User Guide 25

38 Chapter 3: Updating the Appliance Configuring Automatic Updates You can configure your Proventia appliance to automatically download and install updates based on your settings. Configure the following items for the automatic updates: enable or disable automatic updates enable or disable automatic installations schedule automatic updates and installations Prerequisite You must install a Intrusion Prevention license before you can configure automatic updates. See Installing the License File on page 15. Automatic update tasks You can set the following on the Update Settings page: Task Option Description 1 Automatically check for updates Configure this option to automatically check for any available updates. 2 Security updates Configure this option to automatically download available security updates. 3 Firmware updates Configure this option to automatically download firmware updates. 4 Install options Configure this option to automatically backup your system and install updates. Table 10: Automatic update options Settings to define You must define the following settings to configure automatic updates for your appliance: when to check for updates when to download and install security updates when to download firmware updates how and when to install firmware updates which firmware update version(s) to install Task 1: Automatically checking for updates To specify when the appliance checks for updates: 1. On the Proventia Manager navigation pane, select Updates Settings. If your appliance model requires it, the Export Administration Regulation window appears. 2. If needed, review the Export Agreement, select Yes, and then click Submit. The Update Settings page appears. 3. Select the Update Settings tab. 4. Do one of the following: 26

39 Configuring Automatic Updates To check for updates daily or weekly: - select Check for updates daily or weekly - select the day to check for updates from the Day of Week list - select a time from the Time of Day list Note: If you want to check for updates on the same day that you select the Time of Day setting, you must schedule update checks at least 1 hour prior to your scheduled automatic updates to ensure that updates are downloaded before the scheduled automatic update time. To check for updates more often than daily, select Check for updates at given intervals, and then use the slider bar to select a value or type a value in the Interval (minutes) field. The minimum interval is 60 minutes. The maximum interval is 1440 minutes. Task 2: Configuring automatic security updates To specify whether the appliance automatically downloads and installs security updates: 1. To automatically download security updates, select the Automatically Download check box. 2. To automatically install security updates, select the Automatically Install check box. Task 3: Configuring firmware updates To configure firmware updates, select options from the following table: If you want to... Then do this... Automatically download firmware updates Perform a full system backup before the appliance installs the firmware update Download firmware updates but not install them Automatically install firmware updates Select the Automatically Download check box. Note: The appliance automatically downloads firmware updates each time it checks for updates. You can specify how often the appliance checks for updates in the Automatically Check for Updates area. Select Perform Full System Backup Before Installation. Important: This option is enabled by default. ISS recommends that you perform a full system backup before installing a firmware update. Your appliance stores only one system backup, so if you select this option then the appliance overwrites the previous system backup. Select Do Not Install. Note: This option allows you to install updates manually. See Manually Downloading and Installing Updates on page 29. Select Automatically Install Updates. Important: If you select this option, the appliance may go offline for several minutes during the installation process. Table 11: Configure firmware updates Proventia G400/G2000 Appliances User Guide 27

40 Chapter 3: Updating the Appliance Task 4: Specifying when to install firmware updates To specify when to install firmware updates, select one of the options described in the following table: If you want to... Then select this option... And then do this... Install updates at a specific date and time Install new updates as soon as they are automatically downloaded Delayed Note: You must configure the automatic installation to occur at least 1 minute after automatic update downloads are complete. Immediate Note: ISS does not recommend this option, as the installation process takes the system offline for several minutes. Select a day from the Day of Week list. Select a time from the Time of Day list. N/A Install one instance of updates at a specific date and time Schedule One-Time Install Type a date in the Date field. Note: The date must be in the following format: yyyy-mm-dd Type a time in the Time field. Note: The time must be in the following military time format: hh:mm Task 5: Specifying firmware update versions to install To specify which firmware update versions to install: 1. In the Which version to Install area, select one of the following: To install all versions up to the most recent version, select All Available Updates. To install all versions up to a specific version number, select Up To Specific Version, and then type the version in the Version field. 2. Do one of the following: On the Proventia Manager screen, click Save Changes. 28

41 Manually Downloading and Installing Updates Manually Downloading and Installing Updates If you do not have automatic updates configured for the appliance or you want to install an available update off schedule, you can find and manually install updates. Manual updates task overview You must complete the following tasks to manually update the appliance: Task Description 1 Find available updates 2 Download updates 3 Install updates Table 12: Manual updates task overview Task 1: Finding available updates The appliance first checks for updates locally, then connects to the ISS Download Center for updates that have not been downloaded. When you click the Find Updates button on the Update Status page, the appliance checks for the following: updates available for install that are already downloaded to the appliance updates that are available for download from the ISS Download Center Note: If the appliance finds updates to download or install, an alert message displays a link to the appropriate page. To find available updates: 1. On the Proventia Manager navigation pane, select Updates. If your appliance model requires it, the Export Administration Regulation window appears. 2. If needed, review the Export Agreement, select Yes, and then click Submit. The Update Status page appears. 3. In the Updates area, click Find Updates. 4. Do the following to view the available updates: Click the View Available Downloads link in the alert message. On the Proventia Manager navigation pane, click Updates Available Downloads. Task 2: Downloading updates manually To download updates: 1. If updates are available to download, the following message appears: There are updates available. Click here to see details. 2. Click the link in the message. The Updates to Download page appears. Proventia G400/G2000 Appliances User Guide 29

42 Chapter 3: Updating the Appliance 3. Click Download All Available Updates. The Downloading Alert page displays while the appliance downloads the updates. After the download is complete, the available updates message is cleared from the Updates to Install page. Task 3: Installing updates manually To install updates manually: 1. On the Proventia Manager navigation pane, select Updates Available Installs. 2. If your appliance model requires it, the Export Administration Regulation window appears. 3. If needed, review the Export Agreement, select Yes, and then click Submit. The Available Installs page appears, and available updates to install are displayed in the Updates to Install table. 4. Select the updates you want to install, and then click Install Updates. Note: Some firmware updates require that you reboot your appliance. For more information about product issues and updates, see the Proventia G Series Readme on the ISS Download Center at You can view the status of the installation in the Update History table on the Update Status page. 30

43 Configuring an Update Advanced Parameter Configuring an Update Advanced Parameter You may need to tune the update settings. You can tune these settings by adding or editing name and value pairs in the Updates Settings Advanced Parameters tab. Adding an update advanced parameter To add an update advanced parameter: 1. On the Proventia Manager navigation pane, select Updates Settings. The Update Settings page appears. 2. Select the Advanced Parameters tab. 3. Click Add. The Add Advanced Parameter window appears. 4. Type the parameter name in the Name field. 5. Type a meaningful description of the parameter in the Description field. 6. Specify the value type and value in the Value area. 7. Do one of the following: On the Proventia Manager screen, click Save Changes. Editing an update advanced parameter To edit an update advanced parameter: 1. On the Proventia Manager navigation pane, select Updates Settings. The Update Settings page appears. 2. Select the Advanced Parameters tab. 3. Select a parameter to edit, and then click Edit. The Edit Advanced Parameter window appears. 4. Edit the properties of the parameter, and then click OK. 5. Do one of the following: On the Proventia Manager screen, click Save Changes. Copying and pasting an update advanced parameter You can copy and paste a parameter before you edit it. This is useful if you want to add an parameter that is similar to an parameter already in the list. To copy and paste an update advanced parameter: 1. On the Proventia Manager navigation pane, select Updates Settings. The Update Settings page appears. 2. Select the Advanced Parameters tab. 3. Select a parameter, and then click the Copy icon. The appliance copies the parameter to the clipboard. 4. Click the Paste icon. The appliance copies the parameter to the end of the list. 5. If needed, edit the properties of the parameter, and then click OK. 6. Do one of the following: On the Proventia Manager screen, click Save Changes. Proventia G400/G2000 Appliances User Guide 31

44 Chapter 3: Updating the Appliance Removing an update advanced parameter To remove an update advanced parameter: 1. On the Proventia Manager navigation pane, select Updates Settings. The Update Settings page appears. 2. Select the Advanced Parameters tab. 3. Select a parameter, and then click Remove. The parameter is removed. 4. Do one of the following: On the Proventia Manager screen, click Save Changes. 32

45 Part II TM Configuring the Appliance

46

47 Chapter 4 High Availability Overview This chapter explains how to configure the Proventia G Intrusion Prevention appliances that works in an existing high availability network environment. Additional documentation described in this topic is available on the ISS Web site at In this chapter This chapter contains the following topics: Topic Page About High Availability 36 High Availability Configuration Overview 38 High Availability Deployment 39 High Availability Configuration Procedures 41 SiteProtector Management with HA 44 Proventia G400/G2000 Appliances User Guide 35

48 Chapter 4: High Availability About High Availability The Proventia G appliances using high availability features pass all traffic between them over mirroring links. This ensures that both appliances see all of the traffic over the network, and thus maintain state. This also allows the appliances to see asymmetrically routed traffic, if necessary, and thus fully protect the network. The Proventia G High Availability support is limited to two cooperating appliances. Both appliances process packets inline and block attack traffic that arrives on their inline monitoring ports, not on their interconnection/mirror ports. Both appliances also report events received on their inline monitoring ports to the management console. Supported network configurations High availability networks are typically configured in one of two ways: Primary / Secondary configuration: With this configuration, the traffic flows only on one of the redundant network segments and the primary devices on the network handle all of the traffic until one of the devices fails, at which point the traffic fails over to the secondary redundant network segment and the secondary devices take over. Clustering configuration: With this configuration, the traffic is load balanced and both sets of devices are active and see traffic all of the time. Proventia G high availability feature supports both of these network configurations. In order to accomplish this, both Proventia G appliances must maintain identical state. The Proventia G appliances are connected together by mirror links (which actually consists of multiple connections over multiple ports). These mirror links pass all traffic that an appliance receives on its inline ports to the other appliance. This ensures that the protocol analysis modules on both appliances process all of the traffic over the network, and thus maintain state. In addition, this allows the appliances to process asymmetrically routed traffic, and thus fully protects the network. Finally, this ensures that there is no gap in protection during failover. If you run the Proventia Setup Utility when the HA feature is enabled, you cannot modify network settings. Processing responses Both appliances process packets received from all redundant segments but only block attack traffic that arrives on their inline ports when appropriate. Both appliances report events to the management console at all times. However, responses will be processed only for events that are generated by packets that arrive on inline ports. Appliances process but do not block or report events that are generated by traffic that arrive on mirroring ports. As both appliances see all the traffic at all times, failover time for response processing is eliminated. Both appliances maintain current state, so if one HA network segment fails the other appliance will receive all packets on its inline ports, resulting in events being generated as soon as the network fails over. Note: A small number of signatures, such as Port Scans, can result in duplicate events being generated, one by each appliance in a clustered configuration. HA Modes In a HA configuration, the appliance can only operate in either inline simulation or inline protection modes. Passive monitoring mode is not supported. Adapter level operation modes supported in normal mode is also not supported in an HA configuration. If HA simulation mode is selected, all monitoring adapters will be put in inline simulation mode automatically. If HA protection mode is selected, all monitoring 36

49 About High Availability adapters will be put in inline protection mode automatically. In normal mode, each adapter can be configured to run in a different operational mode. High Availability addresses the operation of inline appliances in a high availability environment. It does not address the availability or fault-tolerance of the appliances themselves. Therefore, there is no separate high availability solution for appliances configured and wired for passive monitoring mode. The Proventia G appliances with high availability can be configured in the three modes, see Table 13: Setting Normal mode HA Simulation mode HA Protection mode Description Regular operation mode. In this mode, appliance does not cooperate with another appliance. Appliance can be configured to run in inline protection, inline simulation and passive monitoring modes at the adapter level. Both HA partner appliances monitor traffic inline, but do not block any traffic. Instead, both appliances monitor traffic and provide passive notification responses. The appliances also monitor the traffic on each other s segment via mirror links ready to take over notification in case of network failover. Both HA partner appliances monitor traffic inline and each report and block the attacks that are configured with block response, quarantine response, and firewall rules. The appliances also monitor the traffic on each other s segment via mirror links ready to take over reporting and protection in case of network failover. Table 13: HA appliance modes Proventia G400/G2000 Appliances User Guide 37

50 Chapter 4: High Availability High Availability Configuration Overview This topic provides an overview of the HA configuration page and tasks you must perform to use the high availability feature. You must use the Proventia Setup Utility and Proventia Manager to perform the initial configuration steps and create firewall access policies on each appliance. After you complete the initial configuration, you enable and configure high availability on the designated primary appliance only. For more information, see High Availability Deployment on page 39. Prerequisites High Availability support is provided by firmware update 1.1. You must install the 1.1 firmware update to enable the high availability feature. SiteProtector must be updated to 5.6 prior to installing the Proventia G Firmware 1.1. Licensing Licensing for a high availability configuration is identical to licensing for a non-ha appliance; each individual appliance will request a single license from Site Protector. Limitations In HA mode, using adapter parameters as part of the firewall rules and protection domain definitions is not supported. As same traffic may flow on different adapters in an HA environment, using adapter parameters may cause the two HA partner appliances to become unsynchronized. Important: In protection domain definitions, Adapter field must be set to Any. In constructed firewall rule definitions, all adapters must be selected. In manually constructed firewall rule definitions, the adapter keyword must not be used. For example, the firewall rule adapter A,B,G Portia top is valid normal mode but not supported in an HA mode. Proventia Manager High availability configurations are visible to Proventia Manager and are capable of accepting policies and updates, but it is recommended to use SiteProtector to manage the G400 or G2000 appliances when using inline high availability configurations. Each pair of Proventia G appliances in a high availability configuration must be put in the same group in SiteProtector so that updates to the appliances can be easily synchronized, including application of XPUs and policies. Both appliances will report to SiteProtector using unique IDs. It is recommended that both HA partner appliances are configured to use the same policies. The user may choose to apply content updates and firmware updates serially so that one appliance is always operational in order to maintain network connectivity, particularly when both appliances are configured to fail closed. Connecting cables for HA Reference: For more information about connecting cables for HA, see your Proventia G400/G2000 Quick Start Guide. 38

51 High Availability Deployment High Availability Deployment This topic describes a typical deployment scenario for using the Proventia G appliances in a high availability environment. It includes the following: a logical diagram for a standard HA deployment a physical network diagram for a standard deployment Logical Diagram You can manage your HA appliance cluster from Proventia Manager. If you use a SiteProtector console to manage your appliances, you can manage the HA cluster from the SiteProtector Agent Manager. A Logical HA diagram is shown in Figure 1: Figure 1: Logical HA diagram for standard deployment Proventia G400/G2000 Appliances User Guide 39