Analyzer Quick Start Guide

Transcription

1 September 18, 2006 Overview Introduction This guide provides connection and initial configuration instructions for your Proventia Network ADS Analyzer appliance. These instructions allow you to connect to the network with the minimum required setup. Additional Information Before you begin, you must decide where you are placing the appliances and which deployment scenario is best for your network. Reference: If you need additional information about the recommended firewall port configuration, or deployment scenarios, see the Proventia Network ADS Advanced Configuration Guide for this information before setting up your Analyzer. This guide is available on the ISS Customer Support Website at In this guide The Proventia Network ADS 3.6 Analyzer Quick Start Guide includes information about the following topics: Topic Page Before You Begin 2 Connecting the Appliance 4 Configuring the Appliance 5 Getting Technical Support 9 Proventia Network Anomaly Detection System Quick Start Guide, Version Internet Security Systems, Inc. All rights reserved worldwide. 1

2 Before You Begin Introduction This topic lists the package contents and the checklist for configuration settings information. Package contents Verify your package contains the following: Item Analyzer appliance Two AC power cords Recovery pack CD One crossover Ethernet cable One bezel faceplate Rack mount kit with slide rail and cable management arm Warranty statement Table 1: Appliance package contents Record your settings Use the following worksheet to collect and document the information for your Collectors: Item Description Location of certificate package The location where you have stored the certificate package. You must upload the certificate on each appliance from the computer you will use to configure your appliances. Shared secret The zone secret is a word or phrase that the system uses to encrypt traffic between the Analyzer and Collectors, for twotier mode deployments. You must set the same secret on the Collectors. Management IP address and Subnet Mask The unique IP address and the appropriate network mask. Important: If you do not set the correct IP address, you will be unable to access the Web user interface. SNMP (optional) The password or phrase that allows the Analyzer to poll configured routes for SNMP information. This only applies in one-tier mode deployments. Table 2: Checklist and worksheet for configuration settings information 2

3 Before You Begin Item Description Flow sources and types (optional) Default router (or gateway) The IP addresses for the routers that will send flows to the Analyzer and the type of flows (NetFlow, NetScout, or sflow). The number of sources you can enter depends upon the appliance model. This only applies in one-tier mode deployments. The first router hop that sends outbound network traffic, typically the subnet switch or router. Analyzer hostname The unique computer name for your appliance used for external alerting and identification. This can be either a fully qualified domain name or just the appliance name. Domain name server The IP address of the server you are using to perform domain name lookups. You must configure a DNS server for the Active Threat Feed (ATF) to work. SMTP server The SMTP relay address that sends outgoing mail. Administrative password The password for administrative access to the appliance. NTP Server (optional) The IP address for the server that synchronizes network time. Table 2: Checklist and worksheet for configuration settings information (Continued) Proventia Network Anomaly Detection System Quick Start Guide, Version

4 Connecting the Appliance Introduction This topic provides instructions for connecting the Analyzer appliance. Diagram Use the following diagram as a reference for connecting your Analyzer: Figure 1: Back panel of the appliance Note: Although ISS recommends using the ADS Setup Wizard to complete the initial setup of your appliances, you can use the quick installation script in the command line interface (CLI). Reference: See Chapter 2, "Using the Command Line Interface," in the Proventia Network ADS Advanced Configuration Guide for connection and installation information. Procedure To connect your appliance for using the Proventia Network ADS Web-based Wizard: 1. Plug one end of the provided crossover cable into the Management Interface port on the back panel of the Analyzer. 2. Plug the other end of the crossover cable into the Ethernet port on the computer you will use to configure the Analyzer. Note: Within Proventia Network ADS application, the Ethernet ports are referenced by their hardware identifiers, as follows: Management/NetFlow port is equivalent to e3/4/0 Packet capture port for Standalone mode Analyzers is equivalent to e3/4/1 3. Plug the AC Power connector into the back of the Analyzer, and then plug the other end into a standard AC receptacle. 4. Turn on the appliance, and then start your computer. 4

5 Configuring the Appliance Configuring the Appliance Introduction This topic covers the following details: configuration setup options prerequisites to use the setup wizard instructions to change the network adapter TCP/IP settings directions to configure the Analyzer steps to connect the analyzer to the network Prerequisite Before you begin, you must change your network adapter TCP/IP settings on your computer to use the Web-based Setup Wizard with the crossover connection. Changing network adapter TCP/IP settings To change your TCP/IP settings: 1. Access your Local Area Connection properties on your PC in one of the following ways: Right-click My Network Places, and then choose Properties. Go to your control panel, and then choose Network Connections. 2. Right-click Ethernet Connections, and then choose Properties. 3. Select Internal Protocol TCP/IP. 4. Click Properties. 5. Configure your computer with the following settings: IP address: Netmask: Default gateway: Note: If your operating system is not Microsoft Windows, refer to your computer documentation for instructions on how to change your network adaptor IP address. You must reset your network adaptor IP to your original settings before you can access the Proventia Network ADS web user interface. Configuring the Analyzer To configure the Analyzer appliance using the crossover connection and the Web-based Wizard: 1. Connect the cables and reset your TCP/IP settings, as instructed above. 2. Open a browser window, and then enter The Proventia Network ADS Setup Wizard Welcome screen appears. 3. Click NEXT. 4. Read the ISS Software License Agreement, select the check box to accept the license, and then click ACCEPT. 5. Read the GPL License Agreement, select the check box to accept the license, and then click ACCEPT. The Certificate Package screen appears. Proventia Network Anomaly Detection System Quick Start Guide, Version

6 6. To install the certificate package provided by ISS, click Browse, and then select the location where you stored the certificate package. 7. Click NEXT to install the certificate package. The Zone Secret screen appears. 8. Type a zone secret in the Collector Communication Shared Secret box. The Analyzer uses the shared secret to verify communication from its Collectors. Note: The shared secret can be any word or phrase, but you must configure the same secret on all Collectors. 9. Click NEXT. The Network Interfaces screen appears. 10. Type the management interface address in the IP address box. 11. Type in the Subnet Mask. 12. Click NEXT. The Flow Sources screen appears. 13. In the SNMP polling pane, type the SNMP community string in the Community string box if you want the Analyzer to poll the configured routers for SNMP information. Note: This step should be skipped for a two-tier deployment. 14. In the Configure flow sources pane, do one of the following: Select the check box for the flow sources (Netflow, Netscout, sflow) that you want the Analyzer to collect all data from. Type specific routers from which you want the Analyzer to collect information. Important: Steps 14 to 19 should be skipped for a two-tier deployment. Note: You can configure a combination of the flow source options. Example: You can configure all NetFlow sources, by selecting the NetFlow check box, and then also enter two specific sflow sources. 15. To specify a router, type the router's IP address in the Flow source IP box. 16. Select one of the following choices from the Type list to indicate which type of flow this router collects: NetFlow NetScout sflow 17. Select one of the following from the Interface list to specify if you want the Analyzer to also collect interface data from the routers: Yes No 18. Click ADD to add the flow source. When you add a flow source, it appears in the table above the Flow source boxes. Note: You can click REMOVE to delete a configured flow source from the table. 19. Repeat Steps 15 through 18 to add additional flow sources. The number of sources you can add depends upon the model you have purchased. 6

7 Configuring the Appliance 20. Click NEXT when you have finished adding all flow sources. The Default Route screen appears. 21. Type the IP address for the default route (or gateway) for the Analyzer in the Default Route box. 22. Click NEXT. The Appliance Hostname screen appears. 23. Type the Analyzer name you want to appear in alert notifications and on Collectors in the Hostname box. Note: Type either a fully-qualified domain name (ISSAnalyzer.iss.net) or just the appliance name (ISSAnalyzer). 24. Click NEXT. The Network Services screen appears. 25. Select the check boxes for the types of network services you want to allow. Note: You must explicitly allow a service to run. Otherwise your network access is denied. Important: ISS recommends that you enable SSH because it provides access to a command line interface (CLI) that updates appliance software and allows troubleshooting. 26. Click NEXT. The Domain Name Service screen appears. 27. Type the IP address of your DNS Server. 28. Click NEXT. The Outgoing Mail Server screen appears. 29. Type the IP address of the outgoing mail server in the SMTP Relay box. 30. Click NEXT. The Administrator Password screen appears. 31. Type the password for the "admin" primary administrator account in the Password box. 32. Re-type the password in the Confirm Password box, and then click NEXT. The System Time screen appears. 33. Select the timezone for the Analyzer location from the Timezone list. 34. Do one of the following to set the system time: Type the IP address for the server that synchronizes network time protocol in the NTP Server box. Type the Month, Day, Year, hours (HH) and minutes (MM). 35. Click NEXT. The Review screen appears. 36. Review the settings, and then do one of the following: If you want to change settings, click PREVIOUS to return to a prior page and change the settings. Proventia Network Anomaly Detection System Quick Start Guide, Version

8 If the settings are correct, do one of the following: If you want to... Do this... And then... Keep the appliance in its current location, Move the appliance to an alternate location, Click APPLY CHANGES AND REBOOT. The appliance will restart. Click APPLY CHANGES AND SHUTDOWN, and then wait one minute and turn off the appliance. See the Proventia Network ADS User Guide to start using ADS. Disconnect the Ethernet cable between your computer and the appliance, and then follow the steps below to connect the Analyzer to the network. Connecting the Analyzer to the network To connect to the network to access the Web user interface: 1. Connect an Ethernet cable between the Analyzer s Management port on the back panel and the network you will use to manage it. Note: In Standalone mode, you can also connect an Ethernet cable between the Packet Capture port and a SPAN port or network tap. If you use the Packet Capture port, you do not need to configure settings because it automatically captures any traffic it detects. 2. Turn on the appliance, and it runs as configured. Reference: See "Using the Proventia Network ADS Web User Interface," in the Proventia Network ADS User Guide for instructions about accessing and using ADS. 8

9 Getting Technical Support Getting Technical Support Introduction ISS provides technical support through its Web site and by or telephone. The ISS Web site The Internet Security Systems (ISS) Resource Center Web site ( support/) provides direct access to online user documentation, current versions listings, detailed product literature, white papers, and the Technical Support Knowledgebase. Support levels ISS offers three levels of support: Standard Select Premium Each level provides you with 24x7 telephone and electronic support. Select and Premium services provide more features and benefits than the Standard service. Contact Client Services at if you do not know the level of support your organization has selected. Hours of support The following table provides hours for Technical Support at the Americas and other locations: Location Americas All other locations Hours 24 hours a day Monday through Friday, 9:00 A.M. to 6:00 P.M. during their local time, excluding ISS published holidays Note: If your local support office is located outside the Americas, you may call or send an to the Americas office for help during off-hours. Table 3: Hours for technical support Contact information The following table provides electronic support information and telephone numbers for technical support requests: Regional Office North America Electronic Support Connect to the MYISS section of our Web site: Telephone Number Standard: (1) (888) (toll free) (1) (404) Select and Premium: Refer to your Welcome Kit or call your Primary Designated Contact for this information. Latin America support@iss.net (1) (888) (toll free) (1) (404) Table 4: Contact information for technical support Proventia Network Anomaly Detection System Quick Start Guide, Version

10 Regional Office Electronic Support Telephone Number Europe, Middle East, and Africa (44) (1753) Asia-Pacific, Australia, and the Philippines (1) (888) (toll free) (1) (404) Japan Domestic: (81) (3) Table 4: Contact information for technical support (Continued) 10