NS3x00 Quik Strt Guide Revision B MAfee Network Seurity Pltform This quik strt guide explins how to quikly set up nd tivte your MAfee Network Seurity Pltform NS3100 nd NS3200 Sensors in inline mode. These models hve throughput of 100 Mps nd 200 Mps respetively. All produt doumenttion referened in this quik strt guide is found on the MAfee Servie Portl. The NS3100/NS3200 Sensor model Figure 1 Sensor front pnel 1 Console port (1) 2 RJ-45 10/100/1000 Mngement port (MGMT) (1) 3 RJ-45 10/100/1000 Response port (R1) (1) 4 USB ports (1) 5 RJ-45 10/100/1000 Mps Ethernet Monitoring ports (8) Figure 2 Sensor rer pnel 1
1 Power supply inlet (1) 2 Fn units (3) 1 Verify the ontents in the ox The following essories re shipped in the NS3x00 Sensor rte: Sensor Power ords (MAfee provides stndrd nd interntionl power les) Printed Quik Strt Guide 2 Verify the hrdwre nd softwre requirements Mke sure to meet the following hrdwre requirements. For more informtion, see the MAfee Network Seurity Pltform Instlltion Guide. The following re the system requirements for Mnger server. Operting system Minimum required Any of the following: Windows Server 2008 R2 Stndrd or Enterprise Edition, English operting system, SP1 (64-it) (Full Instlltion) Windows Server 2008 R2 Stndrd or Enterprise Edition, Jpnese operting system, SP1 (64-it) (Full Instlltion) Windows Server 2012 Stndrd Edition (Server with GUI) English operting system Windows Server 2012 Stndrd Edition (Server with GUI) Jpnese operting system Windows Server 2012 R2 Stndrd Edition (Server with GUI) English operting system Windows Server 2012 R2 Stndrd Edition (Server with GUI) Jpnese operting system Windows Server 2012 R2 Dtenter Edition (Server with GUI) English operting system Windows Server 2012 R2 Dtenter Edition (Server with GUI) Jpnese operting system Only x64 rhiteture is supported. Reommended Sme s the minimum required. Memory 8 GB 8 GB or more CPU Server model proessor suh s Intel Xeon Sme Disk spe 100 GB 300 GB or more Network 100 Mps rd 1000 Mps rd Monitor 32-it olor, 1440 x 900 disply setting 1440 x 900 (or ove) 2
The following re the system requirements for lient systems onneting to the Mnger pplition. Minimum Operting system Windows 7 English or Jpnese Windows 8 English or Jpnese Windows 8.1 English or Jpnese Windows 10 English or Jpnese Reommended The disply lnguge of the Mnger lient must e sme s tht of the Mnger server operting system. RAM 2 GB 4 GB CPU 1.5 GHz proessor 1.5 GHz or fster Browser Internet Explorer 9, 10 or 11 Internet Explorer 11 Mozill Firefox Mozill Firefox 41.0.2 or ove Google Chrome in not supported sine the NPAPI plug-in is disled y defult nd will not e supported y Google going forwrd. This mens tht Jv pplet support is lso disled y defult. Instll the following softwre: 3 Sensor imge Mnger imge Signture set Instll the Sensor The mounting ers re pre-tthed to the Sensor. Instll the Sensor into the rk. 3
4 Connet the Mngement nd Console ports On the front pnel of the NS3x00 Sensors, plug Ctegory 5e Ethernet le in the Mngement port (leled MGMT). Plug the other end of the le into the network devie onneted to your Mnger server. On the front pnel of the NS3x00 Sensors, plug the DB9 Console les into the Console port (leled Console). d Connet the other end of the Console port le diretly to COM port of the PC or terminl server you re using to onfigure the Sensor (for exmple, PC running orretly onfigured Windows Hyperterminl softwre). You must diretly onnet to the onsole for initil onfigurtion, you nnot onfigure the Sensor remotely. Terminl servers re provided for onsole ess. The required settings for Hyperterminl re: Bud rte: 115200 Stop Bits: 1 Numer of Bits: 8 Control Flow: None Prity: None e Plug one end of the power le into the power inlet nd plug the other end into power soure. The Sensor ships with stndrd US power nd interntionl les. The NS-series Sensor does not hve power swith. You n diretly plug the power le into power soure. 4
5 Connet the monitoring ports This proedure desries how to onnet les to Sensor tht runs in inline mode. Plug the le pproprite for use with your trnseiver module into one of the monitoring ports leled x (for exmple, 1). Plug the le pproprite for use with your trnseiver module into one of the monitoring ports leled y (for exmple, 2). Connet the other end of eh le to the network devies tht you wnt to monitor. For exmple, if you pln to monitor trffi etween swith nd router, onnet the le onneted to 1 to the router nd the one onneted to 2 to the swith. 6 Instll the Mnger softwre For detiled instrutions, see the MAfee Network Seurity Pltform Instlltion Guide. You must hve dministrtor rights on the trget Windows Server to instll the Mnger softwre. A MySQL dtse is inluded with the Mnger nd is instlled (emedded) utomtilly on your trget Windows Server during this proess. The following steps riefly explin the Mnger instlltion: d e f Prepre the system ording to the requirements outlined in MAfee Network Seurity Pltform Instlltion Guide nd the MAfee Network Seurity Pltform Relese Notes. Close ll open pplitions. Go to the MAfee Updte Server (https://menshen1.intruvert.om) nd log on, using the grnt numer nd pssword. Go to the Mnger Softwre Updtes folder nd selet the ltest Mnger softwre version ville. Downlod the.zip file to the trget Windows Server nd extrt the setup file. Doule-lik Mnger_<version>_setup.exe nd follow the on-sreen prompts. 7 Strt the Mnger From the Strt menu, selet Progrms MAfee Network Seurity Mnger Network Seurity Mnger. 5
8 Add the Sensor to the Mnger The Mnger displys the Logon pge. Log on to the Mnger using the defult user nme (dmin) nd pssword (dmin123). Clik the Devies t. Selet the dmin domin from the Domin drop-down. To dd Sensor in the Mnger, selet Glol Add nd Remove Devies, then lik New. You do not require liense file to enle IPS on NS-series Sensors. The Add nd Remove Devies pge is displyed. We reommend using the Add Devie wizrd to dd devie. d Enter the following mndtory informtion in the pproprite fields. 1) Devie Nme The Sensor nme must egin with letter. The mximum length of the nme is 25 hrters. 2) Devie Type Speifies the type of devie to e dded. Selet IPS Sensor. 3) Shred Seret The shred seret must e minimum of 8 hrters nd mximum of 25 hrters in length. The key nnot strt with n exlmtion mrk nor n hve ny spes. The prmeters tht you n use to define the key re: 26 lphets: Upperse nd lowerse (A, B, C,...Z nd,,,...z) 10 digits: 0 1 2 3 4 5 6 7 8 9 Retype the pssword in Confirm Shred Seret. 32 symols: ~ `! @ # $ % ^ & * ( ) _ + = [ ] { } \ ; : " ',. <? / The Sensor nme nd shred seret key tht you enter in the Mnger must e identil to the shred seret tht you will lter enter during physil instlltion or initiliztion of the Sensor (using CLI interfe) in Step 9 - Configure Sensor informtion. If not, the Sensor will not e le to register itself with the Mnger. 6
4) Updting Mode Selet Online or Offline. Seleting Offline enles Offline Sensor updte. Online is the defult mode. 5) Contt Informtion (Optionl) Type the ontt informtion. 6) Lotion (Optionl) Type the lotion. e Clik Sve. The dded Sensor is displyed on the Add nd Remove Devies pge. 9 Configure Sensor informtion Configure the Sensor with the network informtion, nme, nd the shred seret key tht the Sensor uses to estlish seure ommunition with the Mnger. Use the nme nd key vlues you set in Step 8- Add the Sensor to the Mnger. The first time you onfigure Sensor, you must hve physil ess to the Sensor. At ny time during onfigurtion, you n type question mrk (?) to get help on the Sensor CLI ommnds. For list of ll ommnds, type ommnds. Log on to the Sensor using the terminl onneted to the Console port. At the prompt, log on using the defult Sensor user nme (dmin) nd pssword (dmin123). Optionl, ut reommended. Chnge the Sensor pssword. At the prompt, type: psswd.the Sensor prompts you to enter the new pssword nd prompts you for the old pssword. A pssword must ontin etween 8 25 hrters, is se sensitive, nd n onsist of ny lphnumeri hrter or symol. 7
d Set the nme of the Sensor: You n enter the setup ommnd t the prompt. This utomtilly prompts you to provide the informtion shown in items d through g nd item j. Alterntively, you n use the set ommnd. If you use the set ommnd, mnully enter the omplete ommnd syntx s shown in items d through g nd item j. At the prompt, type: set sensor nme <word>. Exmple: set sensor nme HR_sensor1 The Sensor nme is se-sensitive hrter string up to 25 hrters. The string n inlude hyphens, undersores, nd periods, nd must egin with letter. e f g If the Sensor is not on the sme network s the Mnger, set the ddress of the defult Gtewy. At the prompt, type: set sensor gtewy <A.B.C.D> Exmple: set sensor gtewy 192.1.1.1 Set the IP ddress of the Mnger server. At the prompt, type: set mnger ip <A.B.C.D>. Exmple: set mnger ip 192.2.2.2 Set the IP ddress nd sunet msk of the Sensor. At the prompt, type: set sensor ip <A.B.C.D> <E.F.G.H>. Exmple: set sensor ip 192.3.3.3 255.255.255.0 Speify n IP ddress using four otets seprted y periods: X.X.X.X, where X is numer etween 0 nd 255, followed y sunet msk in the sme formt. h If prompted, reoot the Sensor. Type: reoot The Sensor n tke up to five minutes to omplete its reoot. i j Ping the Mnger from the Sensor to determine if your onfigurtion settings to this point hve suessfully estlished the Sensor on the network. At the prompt, type: ping <mnger IP ddress>. If the ping is suessful, ontinue with the following steps. If not, type show to verify your onfigurtion settings nd hek tht the informtion is orret. Set the shred seret key vlue for the Sensor. At the prompt, type: set sensor shredseretkey The Sensor then prompts you to enter nd then onfirm the shred seret key vlue. This vlue is used to estlish trust reltionship etween the Sensor nd the Mnger. The seret key vlue n e etween 8 nd 25 hrters of ny ASCII text. The shred key vlue is se-sensitive. Mke sure tht the vlue mthes the shred seret key vlue you provided in the Mnger interfe in Step 8- Add the Sensor to the Mnger. k l To verify the onfigurtion informtion, type show. Chek tht ll informtion is orret. To exit the session, type exit. 8
10 Verify suessful instlltion In the Sensor CLI, type: sttus. The sttus report is displyed. The Sensor prmeter System Initilized must e yes, nd for Mnger ommunition Trust Estlished must e yes. From the Mnger Dshord, view the Mnger sttus in the System Helth monitor. 9
The Mnger sttus displys s Up nd Sensor sttus is Ative. From the Mnger, selet Devies <Admin Domin Nme> Devies <Devie Nme> Setup Physil Ports to open the ports pge. <Devie Nme> indites the nme of the Sensor you dded. d A poliy nmed Defult Inline IPS is tive upon Sensor ddition. To view this poliy, selet Poliy <Admin Domin Nme> Intrusion Prevention IPS Poliies. Selet Defult Inline IPS from the list nd lik View / Edit. The Defult Inline IPS poliy ontins ttks lredy onfigured with "loking" Sensor response tion. If ny ttk in the poliy is triggered, the Sensor utomtilly loks the ttk. To tune this or ny other MAfee-provided poliies, you n lone the poliy nd then ustomize it s desried in the MAfee Network Seurity Pltform IPS Administrtion Guide. e f Selet Devies <Admin Domin Nme> Devies <Devie Nme> Setup Physil Ports. Selet the port on the Sensor tht you led to view port settings. Mke sure tht your port settings mth the ling, for exmple, if port 1 is led for inline mode, then the Operting Mode in the port setting must e inline mode. For more informtion on port settings, see Configuring the monitoring nd response ports of Sensor hpter in the MAfee Network Seurity Pltform IPS Administrtion Guide. 10
11 You're up nd running! Your Sensor is tively monitoring onneted segments nd ommuniting with the Mnger for dministrtion nd mngement opertions. d For detiled usge instrutions, see the MAfee Network Seurity Pltform IPS Administrtion Guide, or lik the Detiled Help uttons in the upper-right orner of eh window in the Mnger. Strt the Anlysis Thret Anlyzer to view lert sttistis s ttks re deteted. A summry of lerts is displyed in the Unknowledged Alert Summry re of the Mnger Dshord pge. Hving prolems? See the MAfee Network Seurity Pltform Trouleshooting Guide for trouleshooting informtion. Most deployment prolems stem from onfigurtion mismthes etween the Sensor nd the network devies to whih it is onneted. Chek the duplex nd uto-negotition settings on oth devies to ensure tht they re synhronized. To ontt tehnil support, go to https://support.mfee.om. 11
Copyright 2017 MAfee, LLC MAfee nd the MAfee logo re trdemrks or registered trdemrks of MAfee, LLC or its susidiries in the US nd other ountries. Other mrks nd rnds my e limed s the property of others. 12 700-4498B00