Security Threat Response Manager Release 2013.2 Juniper Networks, Inc. 1194 North Mathilda Avenue Sunnyvale, CA 94089 USA 408-745-2000 www.juniper.net Published: 2015-04-27
Copyright Notice Copyright 2015 Juniper Networks, Inc. All rights reserved. Juniper Networks, Junos, Steel-Belted Radius, NetScreen, and ScreenOS are registered trademarks of Juniper Networks, Inc. in the United States and other countries. The Juniper Networks Logo, the Junos logo, and JunosE are trademarks of Juniper Networks, Inc. The following terms are trademarks or registered trademarks of other companies: Java TM and all Java-based trademarks and logos are trademarks or registered trademarks of Oracle and/or its affiliates. All other trademarks, service marks, registered trademarks, or registered service marks are the property of their respective owners. All specifications are subject to change without notice. Juniper Networks assumes no responsibility for any inaccuracies in this document or for any obligation to update information in this document. Juniper Networks reserves the right to change, modify, transfer, or otherwise revise this publication without notice. FCC Statement The following information is for FCC compliance of Class A devices: This equipment has been tested and found to comply with the limits for a Class A digital device, pursuant to part 15 of the FCC rules. These limits are designed to provide reasonable protection against harmful interference when the equipment is operated in a commercial environment. The equipment generates, uses, and can radiate radio-frequency energy and, if not installed and used in accordance with the instruction manual, may cause harmful interference to radio communications. Operation of this equipment in a residential area is likely to cause harmful interference, in which case users will be required to correct the interference at their own expense. The following information is for FCC compliance of Class B devices: The equipment described in this manual generates and may radiate radio-frequency energy. If it is not installed in accordance with Juniper Networks installation instructions, it may cause interference with radio and television reception. This equipment has been tested and found to comply with the limits for a Class B digital device in accordance with the specifications in part 15 of the FCC rules. These specifications are designed to provide reasonable protection against such interference in a residential installation. However, there is no guarantee that interference will not occur in a particular installation. If this equipment does cause harmful interference to radio or television reception, which can be determined by turning the equipment off and on, the user is encouraged to try to correct the interference by one or more of the following measures: Reorient or relocate the receiving antenna. Increase the separation between the equipment and receiver. Consult the dealer or an experienced radio/tv technician for help. Connect the equipment to an outlet on a circuit different from that to which the receiver is connected. Caution: Changes or modifications to this product could void the user's warranty and authority to operate this device. Disclaimer THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT, SUBJECT TO THE MODIFICTAIONS SET FORTH BELOW ON THIS PAGE, ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR JUNIPER NETWORKS REPRESENTATIVE FOR A COPY. Release 2013.2 Copyright 2015, Juniper Networks, Inc. All rights reserved. Printed in USA. Revision History April 2015 The information in this document is current as of the date listed in the revision history. END USER LICENSE AGREEMENT The Juniper Networks product that is the subject of this technical documentation consists of (or is intended for use with) Juniper Networks software. Use of such software is subject to the terms and conditions of the End User License Agreement ( EULA ) posted at http://www.juniper.net/support/eula.html, as modified by the following text, which shall be treated under the EULA as an Entitlement Document taking precedence over any conflicting provisions of such EULA as regards such software: As regards software accompanying the STRM products (the Program ), such software contains software licensed by Q1 Labs and is further accompanied by third-party software that is described in the applicable documentation or materials provided by Juniper Networks. 2
For the convenience of Licensee, the Program may be accompanied by a third party operating system. The operating system is not part of the Program, and is licensed directly by the operating system provider (e.g., Red Hat Inc., Novell Inc., etc.) to Licensee. Neither Juniper Networks nor Q1 Labs is a party to the license between Licensee and the third party operating system provider, and the Program includes the third party operating system AS IS, without representation or warranty, express or implied, including any implied warranty of merchantability, fitness for a particular purpose or non-infringement. For an installed Red Hat operating system, see the license file: /usr/share/doc/redhat-release-server-6server/eula. By downloading, installing or using such software, you agree to the terms and conditions of that EULA as so modified. 3
4
CONTENTS ABOUT THIS GUIDE Audience........................................................... 7 Documentation Conventions............................................ 7 Technical Documentation............................................... 7 Requesting Technical Support........................................... 8 1 PREPARING FOR YOUR UPGRADE Upgrade Considerations............................................... 9 STRM Software Version Requirements................................. 9 Memory and Disk Space Requirements................................ 10 Additional Software Requirements.................................... 10 Upgrade Priority Order in Distributed Deployment........................ 10 Upgrade Considerations for High Availability (HA) Deployment.............. 11 Upgrade Considerations on a Virtual Appliance.......................... 11 Pretesting your System............................................... 11 2 UPGRADING STRM Upgrading STRM Appliances........................................... 15 Clearing the Cache.................................................. 18 INDEX
ABOUT THIS GUIDE This guide provides information on how to upgrade your STRM systems to STRM 2013.2. Audience The STRM Upgrade Guide is intended for system administrators responsible for upgrading STRM systems. Documentation Conventions Table 1 lists conventions that are used throughout this guide. Table 1 Icons Icon Type Description Information note Information that describes important features or instructions. Caution Warning Information that alerts you to potential loss of data or potential damage to an application, system, device, or network. Information that alerts you to potential personal injury. Technical Documentation You can access technical documentation, technical notes, and release notes directly from the Juniper customer support website at https://www.juniper.net/support/. Once you access the Juniper customer support website, locate the product and software release for which you require documentation. Your comments are important to us. Please send your e-mail comments about this guide or any of the Juniper Networks documentation to: techpubs-comments@juniper.net. Include the following information with your comments: Document title Page number
8 ABOUT THIS GUIDE Requesting Technical Support Technical product support is available through the Juniper Networks Technical Assistance Center (JTAC). If you are a customer with an active J-Care or JNASC support contract, or are covered under warranty, and need postsales technical support, you can access our tools and resources online or open a case with JTAC. JTAC policies For a complete understanding of our JTAC procedures and policies, review the JTAC User Guide located at http://www.juniper.net/us/en/local/pdf/resource-guides/7100059-en.pdf. Product warranties For product warranty information, visit http://www.juniper.net/support/warranty/. JTAC Hours of Operation The JTAC centers have resources available 24 hours a day, 7 days a week, 365 days a year. Self-Help Online Tools and Resources For quick and easy problem resolution, Juniper Networks has designed an online self-service portal called the Customer Support Center (CSC) that provides you with the following features: Find CSC offerings: http://www.juniper.net/customers/support/ Search for known bugs: http://www2.juniper.net/kb/ Find product documentation: http://www.juniper.net/techpubs/ Find solutions and answer questions using our Knowledge Base: http://kb.juniper.net/ Download the latest versions of software and review release notes: http://www.juniper.net/customers/csc/software/ Search technical bulletins for relevant hardware and software notifications: https://www.juniper.net/alerts/ Join and participate in the Juniper Networks Community Forum: http://www.juniper.net/company/communities/ Open a case online in the CSC Case Management tool: http://www.juniper.net/cm/ To verify service entitlement by product serial number, use our Serial Number Entitlement (SNE) Tool: https://tools.juniper.net/serialnumberentitlementsearch/ Opening a Case with JTAC You can open a case with JTAC on the Web or by telephone. Use the Case Management tool in the CSC at http://www.juniper.net/cm/. Call 1-888-314-JTAC (1-888-314-5822 toll-free in the USA, Canada, and Mexico). For international or direct-dial options in countries without toll-free numbers, visit us at http://www.juniper.net/support/requesting-support.html.
1 PREPARING FOR YOUR UPGRADE Before you upgrade, we recommend that you review the information in this section and pretest your system. Preparing for your upgrade should prevent issues from occurring during the upgrade. Upgrade Considerations Read these upgrade considerations and prepare for your upgrade to ensure that your upgrade succeeds. CAUTION STRM/JSA upgrade from 2013.2.r3.607582 to 2013.2 fails. To upgrade an STRM/ a JSA appliance with image 2013.2.r3.607582, you must reimage the appliance to the common image 2013.2.r3.615469 or above. For more information, see Installing JSA Using a Bootable USB Flash-Drive Technical Note. NOTE STRM console upgrade from 2012.1 to 2013.2 fails due to an exception when importing vulnerabilities. This is due to the recent imported vulnerabilities from autoupdate (1358371559) containing a signature that exists in the same range as the vulnerabilities in the 2013.2 upgrade. To avoid the issue, before you upgrade to 2013.2, you must download the latest updates by running autoupdates. For more information on the known issues before or during upgrade, see STRM Release Notes. STRM Software Version Requirements To upgrade to STRM 2013.2, ensure the following requirements are met: You must be using at least STRM 2012.1. If you are not using at least STRM 2012.1, download and install STRM 2012.1 or higher from the Juniper customer support website. In the STRM user interface, click Help > About to view your STRM version information. We require that you upgrade all of the systems in your deployment to STRM 2013.2. When deploying an STRM/JSA appliance with image 2013.2.r3.607582, you must reimage the appliance to the common image 2013.2.r3.615469. For more
10 PREPARING FOR YOUR UPGRADE information, see Installing JSA Using a Bootable USB Flash-Drive Technical Note. Memory and Disk Space Requirements Before you upgrade, you must verify your deployment meets the following requirements: Appliances cannot be upgraded if they do not meet the minimum memory requirements of Flow Processor - 6 GB and STRM appliances - 8 GB: If you plan to enable payload indexing, we strongly recommend that your system include a minimum of 24 GB of memory. Any Flow Processor appliance with less than a 80 GB hard drive must use a fresh installation to use the latest software. For more information, see the STRM Installation Guide. The JavaTM Runtime Environment, version 1.6.0_u24, must be installed on the desktop system that you use to view the STRM user interface. The STRM 2013.2 upgrade requires the following minimum free disk space: Table 1-1 Free Space Requirements Partition Free space requirement / 3 GB or 10 GB /store /var/log /store/tmp 4 GB 500 MB 800 MB The root ( / ) partition requires 10 GB of drive space, if your appliance has less than 8 GB of available swap space or 5 GB of memory. Otherwise, appliances can upgrade with 3 GB of disk space on the root partition. The upgrade pretest determines when a partition does not include enough free space to complete an upgrade. You must free up disk space on the partition that is defined in the pretest error message before you can upgrade. Additional Software Requirements Before you install STRM, make sure you have the following applications installed on any desktop system that you use to access the STRM user interface: Java Runtime Environment (JRE) Adobe Flash 10.x You can download Java 1.6.0_u24 at the following website: http://java.com/. Make sure that you install JRE on your desktop system, not on the STRM system. Upgrade Priority Order in Distributed Deployment You must complete the upgrade process on your STRM Console first and you must be able to access the STRM user interface on your desktop system before upgrading your secondary Console and other systems in your deployment.
Pretesting your System 11 Upgrade your STRM systems in the following order: 1 Console 2 The following systems can be upgraded concurrently: Event Processors Event Collectors Flow Processors Upgrade Considerations for High Availability (HA) Deployment If you are upgrading STRM systems in an HA deployment, you must upgrade the primary system before upgrading the associated secondary system. The primary host must be the active system in your deployment. If the secondary host is the active system, the upgrade of the primary host to STRM 2013.2 cancels. For more information on managing HA, see the STRM Administration Guide. If you are upgrading STRM systems in an HA deployment that is configured with an offboard storage solution, you must first disconnect the HA pair, upgrade the primary system to STRM 2013.1, install STRM 2013.2 fresh on the associated secondary system, reconfigure external storage on both HA systems, and then reconnect the HA pair. For more information on reconnecting your offboard storage solutions, see the Reconfiguring Offboard Storage During an Upgrade to STRM 2013.2. CAUTION Disk replication and failovers are disabled until the primary and secondary hosts synchronize and the needs upgrade or failed status is cleared from the secondary host. During the upgrade of a secondary host, the System and License Management screen changes the status of the secondary host to upgrading. After the upgrade of the secondary host is complete, you may need to restore the configuration of the secondary host. For more information on restoring a failed host, see the STRM Administration Guide. Upgrade Considerations on a Virtual Appliance If your deployment consists of a virtual appliance and you have questions concerning your deployment, contact Juniper Customer Support for assistance. For information on STRM appliances and hardware, see the STRM Hardware Installation Guide. Pretesting your System Before you upgrade to STRM 2013.2, perform a pretest on all the systems in your deployment to ensure that your deployment meets the requirements for the upgrade. We recommend that you schedule the pretest during non-peak hours.
12 PREPARING FOR YOUR UPGRADE About this task The output of the pretest determines if your system meets the upgrade system requirements, such as: Memory requirements Partitioning Supported and required RPMs Log source limits Licensing Out of memory notifications Disk sentry notifications Invalid passwords Failed logins PostgreSQL issues Table constraint/key issues When pretesting your system, you are prompted to run PRETESTDOWN scripts after the initial PRETEST is complete. The PRETESTDOWN scripts require all services to be stopped to test the integrity of the database, resulting in a data outage. Step 1 Step 2 Step 3 Procedure Using SSH, log in to STRM as the root user. Username: root Password: <password> Choose one of the following: If you are upgrading a Console, go to Step 3. If you are upgrading a managed host, go to Step 4. If you are upgrading a secondary HA host, go to Step 5. Download and mount the STRM 2013.2 software: a Create the /store/iso folder by typing the following command: mkdir /store/iso Note: For 2013.2.r4, use the mkdir /isos command. b Access the STRM 2013.2 download from the following location: - www.juniper.net/support/products/strm/ c Copy the file to the /store/iso folder on your system. Note: For 2013.2.r4, copy the file to the /isos folder on your system. d Mount the ISO by typing the following command:
Pretesting your System 13 Step 4 mount o loop /store/iso/<iso file name> /media/cdrom Go to Step 6. Note: For 2013.2.r4, use the mount o loop /isos/<iso file name> /media/cdrom command. Copy the STRM 2013.2 ISO from the Console and mount the ISO: a Create the /store/iso folder by typing the following: mkdir /store/iso Note: For 2013.2.r4, use the mkdir /isos command.
14 PREPARING FOR YOUR UPGRADE Step 5 Step 6 Step 7 Step 8 b c Using SSH, log in to your Console as the root user: Username: root Password: <password> Copy the STRM 2013.2 ISO to the /store/iso folder on your system: scp <ISO file name> <username>@<ip_address>:/store/iso Where <ip_address> is the IP address of the managed host. Note: For 2013.2.r4, use scp <ISO file name> <username>@<ip_address>:/isos to copy the ISO. d Using SSH, log in to your managed host as the root user: Username: root Password: <password> e Mount the STRM 2013.2 ISO by typing the following command: mount -o loop /store/iso/<iso file name> /media/cdrom For 2013.2.r4, use the mount o loop /isos/<iso file name> /media/cdrom command. f Go to Step 6. Download and mount the STRM 2013.2 software for secondary HA systems: a Go to the Juniper customer support website to access the STRM 2013.2 download: b c www.juniper.net/support/products/ Copy the file to the / folder on your system. Mount the ISO by typing the following command: mount o loop /<ISO file name> /media/cdrom Perform the pretest by typing the following: /media/cdrom/setup -t Type Y to continue the pretest. Type Y to run the PRETESTDOWN scripts. Result Third-party RPMs are not supported on STRM systems. If the pretest discovers unsupported RPMs, you must remove the unsupported RPMs before upgrading your system. If the pretest discovers that required RPMs have been removed, you must re-install the required RPMs before continuing with your upgrade. If the pretest indicates a problem, contact Juniper Customer Support.
2 UPGRADING STRM Use these procedures to upgrade your STRM appliances. Upgrading STRM Appliances Use this procedure to upgrade your STRM appliances. Before you begin Before you begin, you recommend that take the following precautions: Backup your data before you begin any software upgrade. For more information on backup and recovery, see the STRM Administration Guide. Close all open STRM sessions to avoid access errors in your log file. Move any unsupported data from the root directory. During the upgrade, the following items are removed from the system: - Non-STRM user accounts - Data associated with non-strm user accounts - Non-STRM data stored in the root directory About this task When you upgrade your STRM appliance to STRM 2013.2, the CentOS operating system is replaced by Red Hat Enterprise Linux. The upgrade procedure may take an extended period of time to complete. You must not cancel or turn off the appliance when an upgrade is in progress. If your deployment includes offboard storage solutions, you must remount your external storage solutions when prompted during the upgrade to STRM 2013.2. For more information on configuring off-board storage, see the Configuring Offboard Storage Guide. If your system has multiple volumes and a DRAC card, the following message is displayed during the upgrade, indicating that the upgrade process might cancel due to an unsupported configuration: ERROR: Upgrade on systems without sda drive not supported or ERROR: Upgrade on PowerEdge 2950 only supported on single RAID 10 logical disk. If this error is displayed, contact Juniper Customer Support.
16 UPGRADING STRM The upgrade script runs a pretest to ensure your configuration meets the requirements for upgrading to STRM 2013.2. If the pretest encounters issues, information messages are displayed that may require your input. Answer any prompts that are displayed to continue the pretest. When the pretest is complete, the following message is displayed: The upgrade process has four phases: 1. Pretest checks (Completed) 2. Upgrade data and configuration settings (Next) 3. Install Red Hat Enterprise Linux 6 4. Install new software version with upgraded data Would you like to automatically restart your system at the end of the phase 2? (Y/N) If you type N to indicate that you do not want to automatically restart your system at the end of phase 2, you are required to manually restart your system when the upgrade prompts you. Depending on your system, phase 2 can take several minutes to complete. The upgrade might prompt you to delete patch files that are no longer required by the system to save storage space. When the phase 2 upgrade is complete, your system is automatically restarted. Step 1 Step 2 Step 3 Procedure Using SSH, log in to STRM as the root user. Username: root Password: <password> Choose one of the following: If you pretested your system as recommended, the ISO is already downloaded and mounted. Go to Step 6. If you are upgrading a Console, go to Step 3. If you are upgrading a managed host, go to Step 4. If you are upgrading a secondary HA host, go to Step 5. Download and mount the STRM 2013.2 installer (ISO) file: a Create the /store/iso folder by typing the following: mkdir /store/iso Note: For 2013.2.r4, use the mkdir /isos command. b Obtain the STRM 2013.2 ISO file: - Using your web browser, download the ISO from the following website: www.juniper.net/support/products/strm/
Upgrading STRM Appliances 17 Step 4 Step 5 Step 6 - Copy the ISO to the /store/iso folder on your system. Note: For 2013.2.r4, copy the file to the /isos folder on your system. c Mount the ISO by typing the following command: mount -o loop /store/iso/<iso file name> /media/cdrom Note: For 2013.2.r4, use the mount o loop /isos/<iso file name> /media/cdrom command. d Go to Step 6. Copy the 2013.2 ISO from the Console and mount the ISO: a Create the /store/iso folder by typing the following: mkdir /store/iso Note: For 2013.2.r4, use the mkdir /isos command. b c Using SSH, log in to your Console as the root user: Username: root Password: <password> Copy the 2013.2 ISO to the /store/iso folder on your system: scp <ISO file name> <username>@<ip_address>:/store/iso Where <ip_address> is the IP address of the managed host. Note: For 2013.2.r4, use scp <ISO file name> <username>@<ip_address>:/isos. d Using SSH, log in to your managed host as the root user: Username: root Password: <password> e Mount the ISO by typing the following command: mount -o loop /store/iso/<iso file name> /media/cdrom Note: For 2013.2.r4, use the mount o loop /isos/<iso file name> /media/cdrom command. f Go to Step 6. Download and mount the 2013.2 ISO for secondary HA systems: a b Obtain the STRM 2013.2 download: - Using your web browser, download the ISO from the following website: www.juniper.net/support/products/strm/ - Copy the STRM 2013.2 ISO to the / folder on your system. Mount the STRM 2013.2 ISO by typing the following command: mount -o loop /<ISO file name> /media/cdrom Type the following setup command: /media/cdrom/setup
18 UPGRADING STRM Step 7 Step 8 Step 9 At the prompt that asks for confirmation to pretest your system, type Y to continue. At the prompt that asks for confirmation to restart your system, type Y to continue the upgrade. Using SSH, log in to STRM as the root user. Username: root Password: <password> Result Your upgrade is complete when the upgrade confirmation message is displayed. Clearing the Cache If you have trouble accessing the STRM user interface after you upgrade to STRM 2013.2, we recommend that you clear your Java TM cache. Before you begin Before you clear the cache, ensure you have only one instance of your browser open. If you have multiple versions of your browser open, the cache fails to clear. The Java TM Runtime Environment must be installed on the desktop system you use to view STRM. You can download Java version 1.6.0_u24 at the following website: http://java.com/. About this task If you are using Microsoft Windows 7 as your operating system, the Java icon is typically located under the Programs pane, depending on how your Control Panel is configured to display features. If you are using the Mozilla Firefox web browser, you must clear the cache in the Microsoft Internet Explorer and Mozilla Firefox web browsers. Step 1 Step 2 Procedure Clear your Java cache: a On your desktop, select Start > Control Panel. The Control Panel is displayed. b Double-click the Java icon. The Java Control Panel is displayed. c In the Temporary Internet Files pane, click View. d On the Java Cache Viewer window, select all STRM Deployment Editor entries. e Click the Delete icon. f Click Close. g Click OK. Open your web browser.
Clearing the Cache 19 Step 3 Step 4 Clear the cache of your web browser. Choose one of the following options: If you are using the Microsoft Internet Explorer 7.0 or 8.0 web browser, select Tools > Delete Browsing History. If you are using the Microsoft Internet Explorer 9.0 web browser, click the gear icon in the right corner of the browser window, select Internet Options > General, and then click Delete in the Browsing History pane. If you are using the Mozilla Firefox 3.6.x web browser and above, select Tools > Clear Recent History > Clear Now. Log in to STRM: https://<ip Address> Where <IP Address> is the IP address of the STRM system. The default values are: Username: admin Password: <password> Where <password> is the password assigned to STRM during the installation process.
20 UPGRADING STRM
INDEX A audience 7 C conventions 7 customer support contacting 8 P pretesting your system 11 S software requirements 10 U upgrading STRM appliances 15