IBM Security Guardium Cloud Deployment Guide IBM SoftLayer

Transcription

1 IBM Security Guardium Cloud Deployment Guide IBM SoftLayer Deployment Procedure: 1. Navigate to 2. Log into your SoftLayer account 3. Using the SoftLayer menu, navigate to Devices > Manage > Images 4. On the Images Templates screen, list all Public Images 1

2 5. Filter the list of images using Template Name Guardium 6. Locate the Guardium image template corresponding to unit type Collector or Aggregator 7. To order the image, click on the Actions dropdown menu and order a Virtual Server based on a monthly or hourly billing cycle Note: Only Virtual Servers based on a monthly billing cycle are eligible for a Hardware Firewall 8. A new window will open with additional configurations that can be added to your order 9. Specify the following required configuration options a. Location i. Select a Data Center b. System Configuration i. Select a Computing Instance Note: IBM Security Guardium recommends a minimum of 4 vcpus ii. Select RAM Note: IBM Security Guardium recommends a minimum of 24 GB of RAM iii. Select the Second Disk option Note: To deploy a VM instance without a public IP, select Private Network Only under the Public Bandwidth section and Private Only under the Uplink Port Speeds section 10. After selecting your configurations, click Add to Order 2

3 11. Wait for order verification 12. After the order if verified, you will be redirected to the checkout screen 13. On the checkout screen: Review your order Specify a hostname and domain Accept the Cloud Service terms and Third-Party Service Agreement 3

4 Click Submit Order 14. Wait for your order to be placed 15. If the order is placed successfully, you will see an order confirmation. Please note down your order confirmation number 16. To view the status of your order, navigate to Account > Sales > Orders 4

5 17. Once your order has been approved navigate to Devices > Device List and locate the hostname and domain that you specified Configuring VM Network: Hardware Firewall configurations are only possible for a Virtual Server on a monthly billing cycle. Attempting to configure a Hardware Firewall for a Virtual Server on a hourly billing cycle will throw the following error: 1. Click on the Device Name in question 2. Scroll down to the Addons section 3. Click Order Hardware Firewall 5

6 4. Click Continue 5. On the checkout screen: Review your order Accept the Master Service Agreement Click Place Order 6. Browse to the Firewall tab 7. Configure security rules for the following: For UI: tcp:8443 For GIM: tcp: ; tcp:8081 For FAM: tcp: For Unix STAP: tcp: For Windows STAP: tcp: For Quick Search: tcp:8983; tcp:9983 For MySQL: tcp:3306 6

7 For a complete list of ports that are utilized in IBM Security Guardium, please refer to the following Technote: 8. Scroll down to the Network section and note down the following: Public IP Address (if applicable) Private IP Address Private Default gateway Private Subnet Mask Connecting to the Guardium Appliance in the Cloud In order to connect to the Guardium appliance via the private IP, you will need to establish VPN Access to the Softlayer Network. For steps on how to create and configure a VPN connection to the Softlayer Network, please refer to the following links: Connect to the GUI Once you have a VPN connection established open a web browser to this address: Login with the credentials provided by Guardium, the system will ask you to change the password upon first login 7

8 Connect to CLI To connect to the Guardium CLI, ssh (or use Putty) to the private IP and login as user cli. If it is the first time login in to system, it will ask you to change the password, change it and store it in a secure place. Configuring Appliance Network: 1. Verify that you can SSH into the appliance via CLI user Note: Default password is guardium. You will be prompted to change your password on first login 8

9 2. Configure network settings a. SSH into the appliance using the private ip as CLI user b. Change your password on first log in IBM Guardium, Command Line Interface (CLI) password: Last login: Fri Jan 20 21:12: Welcome cli - this is your first login in this system. Your password has expired. Changing password for 'cli' IBM Guardium, Command Line Interface (CLI) cli@ password: 9

10 c. Configure the system IP (use the private ip) localhost.domain.test> store network interface ip Mar 29 21:51:40 guard-network[2847]: INFO Sanitizing Hosts This change will take effect after the next network restart. d. Configure the netmask localhost.domain.test> store network interface mask This change will take effect after the next network restart. e. Configure the internal route localhost.domain.test> store network route default This change will take effect after the next network restart. f. Configure the network resolver localhost.domain.test> store network resolver This change will take effect after restart network. localhost.domain.test> store network resolver This change will take effect after restart network. g. Configure the hostname localhost.domain.test> store system hostname guardiumcollector Mar 29 14:23:06 guard-network[23308]: INFO set_hostname Mar 29 14:23:06 guard-network[23308]: INFO Host is currently localhost.domain.test Mar 29 14:23:06 guard-network[23308]: INFO Setting hostname to guardiumcollector.domain.test for ip

11 h. Configure the domain Localhost.domain.test> store system domain guardium.softlayer.com Mar 29 14:23:37 guard-network[23836]: INFO set_hostname Mar 29 14:23:37 guard-network[23836]: INFO Host is currently guardiumcollector.domain.test Mar 29 14:23:37 guard-network[23836]: INFO Setting hostname to guardiumcollector.guardium.softlayer.cloud.com for ip i. Restart network in order to apply changes localhost.domain.test> restart network Do you really want to restart network? (Yes/No) yes Restarting network Shutting down interface eth0: RTNETLINK answers: No such file or director [ OK ] Shutting down loopback interface: [ OK ]Bringing up loopback interface: [ OK ]Bringing up interface eth0: Determining IP information for eth0... done. In Standalone clause firewall/iptables rebuilt. setting solr Changing to port 8443 From port 8443 Stopping... success: true [ OK ]Network System Restarted. 11

12 Warning and Known Limitations: The following CLI commands will not work on an appliance deployed in the SoftLayer Cloud due to DHCP handling limitations in the appliance: show network verify show network interface inventory The following CLI command should not be run on the SoftLayer Cloud Platform as it may result in the appliance becoming inaccessible: store network interface reset store net interface inventory 2017 July-14 IBM Guardium Licensed Materials - Property of IBM. Copyright IBM Corp U.S. Government Users Restricted Rights - Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp. IBM, the IBM logo, and ibm.com are trademarks or registered trademarks of International Business Machines Corp., registered in many jurisdictions worldwide. Other product and service names might be trademarks of IBM or other companies. A current list of IBM trademarks is available on the Web at Copyright and trademark information ( 12