McAfee 8.1 Network Security Platform Installation Guide

Installation Guide
Revision E
McAfee Network Security Platform 8.1
COPYRIGHT
Copyright © 2015 McAfee, Inc., 2821 Mission College Boulevard, Santa Clara, CA 95054, 1.888.847.8766, www.intelsecurity.com
TRADEMARK ATTRIBUTIONS
Intel and the Intel logo are registered trademarks of the Intel Corporation in the US and/or other countries. McAfee and the McAfee logo, McAfee Active
Protection, McAfee DeepSAFE, ePolicy Orchestrator, McAfee ePO, McAfee EMM, McAfee Evader, Foundscore, Foundstone, Global Threat Intelligence,
McAfee LiveSafe, Policy Lab, McAfee QuickClean, Safe Eyes, McAfee SECURE, McAfee Shredder, SiteAdvisor, McAfee Stinger, McAfee TechMaster, McAfee
Total Protection, TrustedSource, VirusScan are registered trademarks or trademarks of McAfee, Inc. or its subsidiaries in the US and other countries.
Other marks and brands may be claimed as the property of others.
LICENSE INFORMATION
License Agreement
NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS
FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU
HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR
SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A
FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET
FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF
PURCHASE FOR A FULL REFUND.
2
McAfee Network Security Platform 8.1
Installation Guide
Contents
Preface
5
About this guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Audience . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Find product documentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
5
5
5
6
1
Network Security Platform overview
7
2
Preparation for the Manager installation
9
Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
General settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Other third-party applications . . . . . . . . . . . . . . . . . . . . . . . . . .
Server requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Manager installation with local service account privileges . . . . . . . . . . . . . . .
Client requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Java runtime engine requirements . . . . . . . . . . . . . . . . . . . . . . . .
Database requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Recommended Manager specifications . . . . . . . . . . . . . . . . . . . . . . . . .
Determine your database requirements . . . . . . . . . . . . . . . . . . . . . .
Pre-installation recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . .
How to plan for installation . . . . . . . . . . . . . . . . . . . . . . . . . . .
Functional requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . .
How to use anti-virus software with the Manager . . . . . . . . . . . . . . . . . .
User interface responsiveness . . . . . . . . . . . . . . . . . . . . . . . . .
Download the Manager/Central Manager executable . . . . . . . . . . . . . . . . . . . .
3
Install the Manager/Central Manager
9
9
10
10
12
12
14
14
14
15
15
15
16
18
19
20
21
Install the Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Installing the Central Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
Log files related to Manager installation and upgrade . . . . . . . . . . . . . . . . . . . 38
4
Starting the Manager/Central Manager
41
Authentication of access to the Manager using CAC . . . . . . . . . . . . . . . . . . . .
Verify the CAC certificate format . . . . . . . . . . . . . . . . . . . . . . . .
Set up CAC users in the Manager . . . . . . . . . . . . . . . . . . . . . . . .
Enable the CAC authentication . . . . . . . . . . . . . . . . . . . . . . . . .
Log on to the Manager using the CAC authentication . . . . . . . . . . . . . . . .
Troubleshooting tips . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Shut down the Manager/Central Manager services . . . . . . . . . . . . . . . . . . . .
Shut down the Central Manager . . . . . . . . . . . . . . . . . . . . . . . . .
Close all the client connections . . . . . . . . . . . . . . . . . . . . . . . . .
Shut down using the Network Security Platform system tray icon . . . . . . . . . . .
Shut down using the Control Panel . . . . . . . . . . . . . . . . . . . . . . . .
5
Adding a Sensor
McAfee Network Security Platform 8.1
42
43
43
43
44
44
45
45
46
46
47
49
Installation Guide
3
Contents
Before you install Sensors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Network topology considerations . . . . . . . . . . . . . . . . . . . . . . . .
Safety measures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Usage restrictions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Unpack the Sensor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Cable specifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Network Security Platform fail-closed dongle specification . . . . . . . . . . . . . .
Console port pin-outs . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Auxiliary port pin-outs . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Response port pin-outs . . . . . . . . . . . . . . . . . . . . . . . . . . . .
How to monitor port pin-outs . . . . . . . . . . . . . . . . . . . . . . . . . .
Configuration of a Sensor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Configuration overview . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Establishment of a Sensor naming scheme . . . . . . . . . . . . . . . . . . . .
Communication between the Sensor and the Manager . . . . . . . . . . . . . . . .
Add a Sensor to the Manager . . . . . . . . . . . . . . . . . . . . . . . . . .
Configure the Sensor . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Verification of successful configuration . . . . . . . . . . . . . . . . . . . . . .
How to change Sensor values . . . . . . . . . . . . . . . . . . . . . . . . . .
How to add a secondary Manager IP . . . . . . . . . . . . . . . . . . . . . . .
Remove a secondary Manager IP . . . . . . . . . . . . . . . . . . . . . . . .
6
Configuration of devices using the Manager
61
Install Sensors using the wizard . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Add and configure Sensors . . . . . . . . . . . . . . . . . . . . . . . . . . .
Add and configure the XC Clusters . . . . . . . . . . . . . . . . . . . . . . .
Possible actions from the device list nodes . . . . . . . . . . . . . . . . . . . . . . .
Options available in the devices page . . . . . . . . . . . . . . . . . . . . . . .
Deploy pending changes to a device . . . . . . . . . . . . . . . . . . . . . . .
Update the latest software images on all devices . . . . . . . . . . . . . . . . . .
Download software update files for offline devices . . . . . . . . . . . . . . . . .
Manage failover pairs . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Specify proxy server for internet connectivity . . . . . . . . . . . . . . . . . . . . . .
Configure NTP server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
7
Managing configuration for each device
61
62
69
69
70
77
79
80
85
87
88
91
Configuration and management of devices . . . . . . . . . . . . . . . . . . . . . . .
Update configuration of a Sensor or an NTBA Appliance . . . . . . . . . . . . . . .
Update software for a Sensor or NTBA Appliance . . . . . . . . . . . . . . . . . .
Shut down a Sensor or NTBA Appliance . . . . . . . . . . . . . . . . . . . . . .
Troubleshooting your device configuration . . . . . . . . . . . . . . . . . . . . . . . .
Upload diagnostics trace . . . . . . . . . . . . . . . . . . . . . . . . . . .
Management of device access . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Configure TACACS+ authentication . . . . . . . . . . . . . . . . . . . . . . .
Management of SNMPv3 users . . . . . . . . . . . . . . . . . . . . . . . . .
Management of NMS IP addresses . . . . . . . . . . . . . . . . . . . . . . . .
91
92
93
94
94
94
95
95
96
98
8
Configuration of the Update Server
101
9
Uninstallation of the Manager/Central Manager
103
Uninstall using the Add/Remove program . . . . . . . . . . . . . . . . . . . . . . .
Uninstall using the script . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Index
4
49
49
50
50
51
51
52
52
52
53
54
54
54
55
55
55
56
59
59
60
60
McAfee Network Security Platform 8.1
103
105
107
Installation Guide
Preface
This guide provides the information you need to install your McAfee product.
Contents
About this guide
Find product documentation
About this guide
This information describes the guide's target audience, the typographical conventions and icons used
in this guide, and how the guide is organized.
Audience
McAfee documentation is carefully researched and written for the target audience.
The information in this guide is intended primarily for:
•
Administrators — People who implement and enforce the company's security program.
•
Users — People who use the computer where the software is running and can access some or all of
its features.
Conventions
This guide uses these typographical conventions and icons.
Book title, term,
emphasis
Title of a book, chapter, or topic; a new term; emphasis.
Bold
Text that is strongly emphasized.
User input, code,
message
Commands and other text that the user types; a code sample; a displayed
message.
Interface text
Words from the product interface like options, menus, buttons, and dialog
boxes.
Hypertext blue
A link to a topic or to an external website.
Note: Additional information, like an alternate method of accessing an
option.
McAfee Network Security Platform 8.1
Installation Guide
5
Preface
Find product documentation
Tip: Suggestions and recommendations.
Important/Caution: Valuable advice to protect your computer system,
software installation, network, business, or data.
Warning: Critical advice to prevent bodily harm when using a hardware
product.
Find product documentation
After a product is released, information about the product is entered into the McAfee online Knowledge
Center.
Task
6
1
Go to the McAfee ServicePortal at http://support.mcafee.com and click Knowledge Center.
2
Enter a product name, select a version, then click Search to display a list of documents.
McAfee Network Security Platform 8.1
Installation Guide
1
Network Security Platform overview
McAfee Network Security Platform [formerly McAfee IntruShield®] is a combination of network
appliances and software built for the accurate detection and prevention of intrusions, denial of service
(DoS) attacks, distributed denial of service (DDoS) attacks, malware download, and network misuse.
Network Security Platform provides comprehensive network intrusion detection and can block, or
prevent, attacks in real time, making it truly an intrusion prevention system (IPS).
McAfee Network Security Platform 8.1
Installation Guide
7
1
Network Security Platform overview
8
McAfee Network Security Platform 8.1
Installation Guide
2
Preparation for the Manager installation
This section describes the McAfee Network Security Manager (Manager) hardware and software
requirements and pre-installation tasks you should perform prior to installing the software.
In this section, unless explicitly stated, Central Manager and Manager are commonly referred to as
"Manager."
Contents
Prerequisites
Recommended Manager specifications
Pre-installation recommendations
Download the Manager/Central Manager executable
Prerequisites
The following sections list the Manager installation and functionality requirements for your operating
system, database, and browser.
We strongly recommend that you also review Network Security Platform 7.5.3 Release Notes.
If you are installing the Manager as part of an upgrade to the latest version of Network Security
Platform, also refer to Network Security Platform 7.5 Upgrade Guide.
General settings
•
McAfee recommends you use a dedicated server, hardened for security, and placed on its own
subnet. This server should not be used for programs like instant messaging or other non-secure
Internet functions.
•
You must have Administrator/root privileges on your Windows server to properly install the Manager
software, as well as the installation of an embedded MySQL database for Windows Managers during
Manager installation.
McAfee Network Security Platform 8.1
Installation Guide
9
2
Preparation for the Manager installation
Prerequisites
•
It is essential that you synchronize the time on the Manager server with the current time. To keep
time from drifting, use a timeserver. If the time is changed on the Manager server, the Manager will
lose connectivity with all McAfee® Network Security Sensors (Sensors) and the McAfee® Network
Security Update Server [formerly IPS Update Server] because SSL is time sensitive.
•
If Manager Disaster Recovery (MDR) is configured, ensure that the time difference between the
Primary and Secondary Managers is less than 60 seconds. (If the spread between the two exceeds
more than two minutes, communication with the Sensors will be lost.)
For more information about setting up a time server on Windows Servers, see the following
Microsoft KnowledgeBase article: http://support.microsoft.com/kb/816042/.
Once you have set your server time and installed the Manager, do not change the time on the
Manager server for any reason. Changing the time may result in errors that could lead to loss of
data.
Other third-party applications
Install a packet log viewing program to be used in conjunction with the Threat Analyzer interface. Your
packet log viewer, also known as a protocol analyzer, must support library packet capture (libpcap)
format. This viewing program must be installed on each client you intend to use to remotely log onto
the Manager to view packet logs.
Wireshark (formerly known as Ethereal) is recommended for packet log viewing. WireShark is a network
protocol analyzer for Windows servers that enables you to examine the data captured by your
Sensors. For information on downloading and using Ethereal, go to www.wireshark.com.
Server requirements
The following table lists the 8.1 Manager server requirements:
Operating
system
Minimum required
Recommended
Any of the following:
Same as the minimum
required.
• Windows Server 2008 R2 Standard or Enterprise Edition,
SP1 (Full Installation), English operating system
• Windows Server 2008 R2 Standard or Enterprise Edition,
SP1 (Full Installation), Japanese operating system
• Windows Server 2012 Standard Edition (Server with a GUI)
English operating system
• Windows Server 2012 Standard Edition (Server with a GUI)
Japanese operating system
• Windows Server 2012 R2 Standard Edition (Server with a
GUI) English operating system
• Windows Server 2012 R2 Standard Edition (Server with a
GUI) Japanese operating system
• Windows Server 2012 R2 Datacenter Edition (Server with a
GUI) English operating system
• Windows Server 2012 R2 Datacenter Edition (Server with a
GUI) Japanese operating system
Only X64 architecture is supported.
Memory
10
8 GB
McAfee Network Security Platform 8.1
8 GB or more
Installation Guide
Preparation for the Manager installation
Prerequisites
2
Minimum required
Recommended
CPU
Server model processor such as Intel Xeon
Same
Disk space
100 GB
300 GB or more
Network
100 Mbps card
1000 Mbps card
Monitor
32-bit color, 1440 x 900 display setting
1440 x 900 (or above)
How to host the Manager on a VMware platform
The following are the system requirements for hosting Central Manager/Manager server on a VMware
platform.
Table 2-1 VMware ESX server requirements
Component
Minimum
Virtualization software • ESXi 5.0
• ESXi 5.1
• ESXi 5.5
CPU
Intel Xeon ® CPU ES 5335 @ 2.00 GHz; Physical Processors – 2; Logical
Processors – 8; Processor Speed – 2.00 GHz
Memory
Physical Memory: 16 GB
Internal Disks
1 TB
Table 2-2 Virtual machine requirements
Component
Minimum
Recommended
Operating
system
Any of the following:
Same as minimum
required.
• Windows Server 2008 R2 – Standard or Enterprise
Edition with SP1 English operating system
• Windows Server 2008 R2 – Standard or Enterprise
Edition with SP1 Japanese operating system
• Windows Server 2012 Standard Edition (Server with a
GUI) English operating system
• Windows Server 2012 Standard Edition (Server with a
GUI) Japanese operating system
• Windows Server 2012 R2 Standard Edition (Server with
a GUI) English operating system
• Windows Server 2012 R2 Standard Edition (Server with
a GUI) Japanese operating system
• Windows Server 2012 R2 Datacenter Edition (Server
with a GUI) English operating system
• Windows Server 2012 R2 Datacenter (Server with a
GUI) Japanese operating system
Only X64 architecture is supported.
Memory
8 GB
8 GB or more
Virtual CPUs
2
2 or more
Disk Space
100 GB
300 GB or more
McAfee Network Security Platform 8.1
Installation Guide
11
2
Preparation for the Manager installation
Prerequisites
Manager installation with local service account privileges
The Manager installs the following services as a Local Service:
•
McAfee® Network Security Manager
•
McAfee® Network Security Manager Database
•
McAfee® Network Security Manager User Interface (Apache)
McAfee® Network Security Manager Watchdog runs as a Local System to facilitate restart of the
Manager in case of abrupt shutdown.
The Local Service account has fewer privileges on accessing directories and resources than the Local
System. By default, the Manager installation directory and database directory are granted full
permission to the Local Service account during installation or upgrade of Manager.
Set the permissions to a Local Service as needed in the following scenarios:
•
Backup directory location: If the backup directory was different from the Manager installed
directory before upgrade to the current release, full permission on these directories for a Local
Service should be granted.
•
Notification script execution: If a user uses a script that accesses directories or resources located in
directories other than in Manager installed directories for notifications like alerts, faults etc.,full
permission on these directories for a Local Service should be granted.
•
Database configuration: If a user has a MySQL database configured for using a directory for
temporary files other than the one provided during installation, then those directories should be
given full permissions for a Local Service.
Client requirements
The following are the system requirements for client systems connecting to the Manager application.
Minimum
Operating
system
Recommended
• Windows 7 English or Japanese
• Windows 8 English or Japanese
• Windows 8.1 English or Japanese
The display language of the Manager client must be
same as that of the Manager server operating
system.
RAM
2 GB
4 GB
CPU
1.5 GHz processor
1.5 GHz or faster
Browser
• Internet Explorer 9, 10 or 11
• Internet Explorer 11
• Mozilla Firefox
• Mozilla Firefox 20.0 or
above
• Google Chrome (App mode in Windows 8 is not
supported)
• Google Chrome 24.0 or
above
If you are using Google Chrome, add the Manager
certificate to the trusted certificate list.
12
McAfee Network Security Platform 8.1
Installation Guide
Preparation for the Manager installation
Prerequisites
2
For the Manager client, in addition to Windows 7 and Windows 8, you can also use the operating
systems mentioned for the Manager server.
If you are using Google Chrome and the Manager page does not load, then clear the cache and
re-launch the browser.
The following table lists the 8.1 Central Manager / Manager client requirements when using Mac:
Mac operating system
Browser
• Lion
Safari 6 or 7
• Mountain Lion
Manager client display settings (Windows)
•
Access the Manager through a client browser. See Client requirements for the list of supported
clients and browsers.
•
Set your display to 32-bit color. Right-click on the Desk Top and select Screen Resolution and go to
Advanced Settings | Monitor, and configure Colors to True Color (32bit).
•
McAfee recommends setting your monitor's screen area to 1440 x 900 pixels. Right-click on the
Desk Top and select Screen Resolution. Set Resolution to 1440 x 900.
•
Browsers typically should check for newer versions of stored pages. For example, Internet Explorer,
by default, is set to automatically check for newer stored page versions. To check this function,
open your Internet Explorer browser and go to Tools | Internet Options | General. Click the Settings button
under Browsing History or Temporary Internet files, and under Check for newer versions of stored pages:
select any of the four choices except for Never. Selecting Never will cache Manager interface pages
that require frequent updating, and not refreshing these pages may lead to system errors.
•
If you are using Internet Explorer 8 or 9, then go to Tools | Compatibility View Settings and make sure
Display intranet sites in Compatibility View and Display all websites in Compatibility View check boxes are not
selected.
Invoking Threat Analyzer in a Manager Client System
Note that the Manager has to be accessed using the server system's host name (https://
<Manager_hostname>). The .jar file downloaded for the Threat Analyzer is signed using a certificate
that is generated based on the client hostname. If your client is located in a different domain than that
of the Manager, you must map the hostname to its IP address in your client system's Windows hosts
file.
Navigate to C:\WINDOWS\system32\drivers\etc on your client system and edit the hosts file. For
example, if your host name is manager-host1, and its IP address is 102.54.94.97, your entry would
appear as: 102.54.94.97 manager-host1
Internet Explorer settings when accessing the Manager from the server
McAfee recommends accessing the Central Manager and Manager from a client system. However,
there may be occasions when you need to manage from the server itself. To do so, you must make the
following changes to the server's Internet Explorer options.
Regardless of whether you use a client or the server, the following Internet Explorer settings must be
enabled. On Windows client operating machines, these are typically enabled by default but disabled on
server operating systems.
McAfee Network Security Platform 8.1
Installation Guide
13
2
Preparation for the Manager installation
Recommended Manager specifications
1
2
In the Internet Explorer, go to Tools | Internet Options | Security | Internet | Custom Level and enable the
following:
•
ActiveX controls and plug-ins: Run ActiveX controls & plug-ins
•
ActiveX controls and plug-ins: Script ActiveX controls marked safe for scripting
•
Downloads: File Download
•
Miscellaneous: Allow META REFRESH
•
Scripting: Active Scripting
In the Internet Explorer, go to Tools | Internet Options | Privacy and ensure the setting is configured as
something below Medium High. For example, do not set it at High or at Block all Cookies. If the setting is
higher than Medium High, you will receive an Unable to configure Systems. Permission denied error
and the Manager configuration will not function.
Java runtime engine requirements
When you first log onto the Manager, a version of JRE is automatically installed on the client machine
(if it is not already installed). This version of the JRE software is required for operation of various
components within the Manager including Threat Analyzer and the Custom Attack Editor. The client
JRE version bundled with the Manager is 1.7.0_51.
Database requirements
The Manager requires communication with MySQL database for the archiving and retrieval of data.
The Manager installation set includes a MySQL database for installation (that is, embedded on the
target Manager server). You must use the supported OS listed under Server requirements and must
use the Network Security Platform-supplied version of MySQL (currently 5.6.12). The MySQL database
must be a dedicated one that is installed on the Manager.
If you have a MySQL database previously installed on the Manager server, uninstall the previous version
and install the Network Security Platform version.
See also
Server requirements on page 10
Recommended Manager specifications
McAfee® Network Security Manager (Manager) software runs on a dedicated Windows server.
The larger your deployment, the more high-end your Manager server should be. Many McAfee®
Network Security Platform issues result from an under-powered Manager Server. For example, to
manage 40 or more McAfee® Network Security Sensors (Sensors), we recommend larger
configurations than the minimum-required specifications mentioned in Server requirements.
14
McAfee Network Security Platform 8.1
Installation Guide
Preparation for the Manager installation
Pre-installation recommendations
2
The Manager client is a Java web application, which provides a web-based user interface for
centralized and remote Sensor management. The Manager contains Java applets. Because Java
applets take advantage of the processor on the host from which they are being viewed, we also
recommend that the client hosts used to manage the Network Security Platform solution exceed the
minimum-required specifications mentioned in Client requirements.
You will experience better performance in your configuration and data-forensic tasks by connecting to
the Manager from a browser on the client machine. Performance may be slow if you connect to the
Manager using a browser on the server machine itself.
Determine your database requirements
The amount of space required for your database is governed by many factors, mostly unique to the
deployment scenario. These factors determine the amount of data you want to retain in the database
and the time for which the data has to be retained.
Things to consider while determining your database size requirements are:
•
Aggregate alert and packet log volume from all Sensors — Many Sensors amount to higher alert volume and
require additional storage capacity. Note that an alert is roughly 2048 bytes on average, while a
packet log is approximately 1300 bytes.
•
Lifetime of alert and packet log data — You need to consider the time before you archive or delete an alert.
Maintaining your data for a long period of time (for example, one year) will require additional
storage capacity to accommodate both old and new data.
As a best practice, McAfee recommends archiving and deleting old alert data regularly, and attempting
to keep your active database size to about 60 GB.
For more information, see Capacity Planning, McAfee Network Security Platform Manager Administration
Guide.
Pre-installation recommendations
®
These McAfee® Network Security Platform [formerly McAfee® IntruShield ] pre-installation
recommendations are a compilation of the information gathered from individual interviews with some
of the most seasoned McAfee Network Security Platform System Engineers at McAfee.
How to plan for installation
Before installation, ensure that you complete the following tasks:
•
The server, on which the Manager software will be installed, should be configured and ready to be
placed online.
•
You must have administrator privileges for Manager server.
•
This server should be dedicated, hardened for security, and placed on its own subnet. This server
should not be used for programs like instant messaging or other non-secure Internet functions.
•
Make sure your hardware requirements meet at least the minimum requirements.
•
Ensure the proper static IP address has been assigned to the Manager server. For the Manager
server, McAfee strongly recommends assigning a static IP against using DHCP for IP assignment.
•
If applicable, configure name resolution for the Manager.
McAfee Network Security Platform 8.1
Installation Guide
15
2
Preparation for the Manager installation
Pre-installation recommendations
•
Ensure that all parties have agreed to the solution design, including the location and mode of all
McAfee® Network Security Sensor, the use of sub-interfaces or interface groups, and if and how the
Manager will be connected to the production network.
•
Get the required license file and grant number. Note that you do not require a license file for using
Manager/Central Manager version 6.0.7.5 or above.
•
Accumulate the required number of wires and (supported) GBICs, SFPs, or XFPs. Ensure these are
approved hardware from McAfee or a supported vendor. Ensure that the required number of
Network Security Platform dongles, which ship with the Sensors, are available.
•
Crossover cables will be required for 10/100 or 10/100/1000 monitoring ports if they are directly
connected to a firewall, router, or end node. Otherwise, standard patch cables are required for the
Fast Ethernet ports.
•
If applicable, identify the ports to be mirrored, and someone who has the knowledge and rights to
mirror them.
•
Allocate the proper static IP addresses for the Sensor. For the Sensors, you cannot assign IPs using
DHCP.
•
Identify hosts that may cause false positives, for example, HTTP cache servers, DNS servers, mail
relays, SNMP managers, and vulnerability scanners.
See also
Server requirements on page 10
Functional requirements
Following are the functional requirements to be taken care of:
•
Install Wireshark (formerly known as Ethereal http://www.wireshark.com) on the client PCs.
Ethereal is a network protocol analyzer for Unix and Windows servers, used to analyze the packet
logs created by Sensors.
•
Ensure the correct version of JRE is installed on the client system, as described in the earlier
section. This can save a lot of time during deployment.
•
Manager uses port 4167 as the UDP source port to bind for IPv4 and port 4166 for IPv6. If you
have Sensors behind a firewall, you need to update your firewall rules accordingly such that ports
4167 and 4166 are open for the SNMP command channel to function between those Sensors and
the Manager. This applies to a local firewall running on the Manager server as well.
•
Determine a way in which the Manager maintains the correct time. To keep time from drifting, for
example, point the Manager server to an NTP timeserver. (If the time is changed on the Manager
server, the Manager will lose connectivity with all Sensors and the McAfee® Network Security
Update Server because SSL is time sensitive.)
•
If Manager Disaster Recovery (MDR) is configured, ensure that the time difference between the
Primary and Secondary Managers is less than 60 seconds. (If the spread between the two exceeds
more than two minutes, communication with the Sensors will be lost.)
•
If you are upgrading from a previous version, we recommend that you follow the instructions in the
respective version's release notes or, if applicable, the McAfee Network Security Platform Upgrade
Guide.
Install a desktop firewall
A desktop firewall on the Manager server is recommended. Certain ports are used by the components
of McAfee Network Security Platform. Some of these are required for Manager -- Sensor and Manager
client-server communication. All remaining unnecessary ports should be closed.
16
McAfee Network Security Platform 8.1
Installation Guide
Preparation for the Manager installation
Pre-installation recommendations
2
McAfee strongly recommends that you configure a packet-filtering firewall to block connections to
ports 8551, 8552, 3306, 8007, 8009, and 8552 of your Manager server. The firewall can either be a
host-based or network-based. Set your firewall to deny connections to these ports if the connections
are not initiated by the localhost. The only connections that should be allowed are those from the
Manager server itself; that is, the localhost. For example, if another machine attempts to connect to
port 8551, 8552, 3306, 8007 and 8009 the firewall should automatically block any packets sent. If you
need assistance in blocking these, contact McAfee Technical Support.
Use a scanning tool such as Vulnerability Manager to ensure that there no ports open other than what is
required.
If a firewall resides between the Sensor, Manager, or administrative client, which includes a local
firewall on the Manager, the following ports must be opened:
Port #
Protocol Description
Direction of
communication
• 4167 (high ports) (source
port on the Manager for
IPv4 communication)
UDP
Default SNMPv3 (command
channel)
Manager-->Sensor
8500 (destination port on the UDP
Sensor)
Default SNMPv3 (command
channel)
Manager --> Sensor
8501
TCP
Proprietary (install port)
Sensor-->Manager
8502
TCP
Proprietary (alert channel/
control channel)
Sensor-->Manager
8503
TCP
Proprietary (packet log channel) Sensor-->Manager
8504
TCP
Proprietary (file transfer
channel)
8506
TCP
Proprietary (install channel for
Sensor-->Manager
2048-bit certificates). For
information on 2048-bit
certificates, see Migration from
1024-bit to 2048-bit encryption.
8507
TCP
Proprietary (alert channel/
control channel for 2048-bit
certificates).
Sensor-->Manager
8508
TCP
Proprietary (packet log channel
for 2048-bit certificates).
Sensor-->Manager
8509
TCP
Proprietary (Bulk file transfer
channel for 2048-bit
certificates).
Sensor-->Manager
8510
TCP
Proprietary (Bulk file transfer
channel for 1024-bit
certificates).
Sensor-->Manager
8555
TCP
SSL/TCP/IP (Threat Analyzer)
client-->Manager
443
TCP
HTTPS
client-->Manager
• 4166 (source port on the
Manager for IPv6
communication)
McAfee Network Security Platform 8.1
Sensor-->Manager
Installation Guide
17
2
Preparation for the Manager installation
Pre-installation recommendations
Port #
Protocol Description
Direction of
communication
80
TCP
Web-based user interface
client-->Manager
(Webstart/JNLP, Console
Applets)
22
TCP
SSH
Remote console access
If you choose to use non-default ports for the Install port, Alert port, and Log port, ensure that those
ports are also open on the firewall.
•
Note that 3306/TCP is used internally by the Manager to connect to the MySQL database.
•
If you have Email Notification or SNMP Forwarding configured on the Manager, and there is firewall
residing between the Manager and your SMTP or SNMP server, ensure the following ports are
available as well.
Additional communication ports
Port #
Protocol
Description
Direction of communication
25
TCP
SMTP
Manager-->SMTP server
49
TCP
TACACS+ Integration
Sensor-->TACACS+ server
162
UDP
SNMP Forwarding
Manager-->SNMP server
389
TCP
LDAP Integration (without SSL)
Manager-->LDAP server
443
TCP
Secure communication for MDR
Manager 1 -->Manager 2
443
TCP
Secure communication for MDR
Manager 2-->Manager 1
514
UDP
Syslog forwarding (ACL logging)
Manager-->Syslog server
636
TCP
LDAP Integration (with SSL)
Manager-->LDAP server
1812
UDP
RADIUS Integration
Manager-->RADIUS server
If you have McAfee ePO™ integration configured on Manager, and there is firewall between Manager
and the McAfee ePO™ Server, ensure the following port is also allowed through firewall.
Port
Description
Communication
8443
McAfee ePO communication port
Manager to McAfee ePO™ server
•
™
Close all open programs, including email, the Administrative Tools > Services window, and
instant messaging before installation to avoid port conflicts. A port conflict may prevent the
application from binding to the port in question because it will already be in use.
The Manager is a standalone system and should not have other applications installed.
How to use anti-virus software with the Manager
Some of the Manager's operations might conflict with the scanning processes of McAfee VirusScan or
any other anti-virus software running on the Manager. For example, the anti-virus software might scan
every temporary file created in the Manager installation directory, which might slow down the
18
McAfee Network Security Platform 8.1
Installation Guide
Preparation for the Manager installation
Pre-installation recommendations
2
Manager's performance. So, be sure to exclude the Manager installation directory and its
sub-directories from the anti-virus scanning processes. Specifically, be sure to exclude the following
folders:
•
<Manager installation directory>\MySQL and its sub-folders. If these folders are not excluded,
Network Security Platform packet captures may result in the deletion of essential MySQL files.
•
<Manager installation directory>\App\temp\tftpin\malware\ and its sub-folders.
If you install McAfee VirusScan 8.5.0i on the Manager after the installation of the Manager software, the
MySQL scanning exceptions will be created automatically, but the Network Security Platform exceptions
will not.
McAfee VirusScan and SMTP notification
From 8.0i, VirusScan includes an option (enabled by default) to block all outbound connections over
TCP port 25. This helps reduce the risk of a compromised host propagating a worm over SMTP using a
homemade mail client.
VirusScan avoids blocking outbound SMTP connections from legitimate mail clients, such as Outlook
and Eudora, by including the processes used by these products in an exclusion list. In other words,
VirusScan ships with a list of processes it will allow to create outbound TCP port 25 connections; all
other processes are denied that access.
The Manager takes advantage of the JavaMail API to send SMTP notifications. If you enable SMTP
notification and also run VirusScan 8.0i or above, you must therefore add java.exe to the list of
excluded processes. If you do not explicitly create the exclusion within VirusScan, you will see a Mailer
Unreachable error in the Manager Operational Status to each time the Manager attempts to connect to
its configured mail server.
To add the exclusion, follow these steps:
Task
1
Launch the VirusScan Console.
2
Right-click the task called Access Protection and choose Properties from the right-click menu.
3
Highlight the rule called Prevent mass mailing worms from sending mail.
4
Click Edit.
5
Append java.exe to the list of Processes to Exclude.
6
Click OK to save the changes.
User interface responsiveness
The responsiveness of the user interface, the Threat Analyzer in particular, has a lasting effect on your
overall product satisfaction.
In this section we suggest some easy but essential steps, to ensure that Network Security Platform
responsiveness is optimal:
•
During Manager software installation, use the recommended values for memory and connection
allocation.
•
You will experience better performance in your configuration and data forensic tasks by connecting
to the Manager from a browser on a client machine. Performance may be slow if you connect to the
Manager using a browser on the server machine itself.
McAfee Network Security Platform 8.1
Installation Guide
19
2
Preparation for the Manager installation
Download the Manager/Central Manager executable
•
Perform monthly or semi-monthly database purging and tuning. The greater the quantity of alert
records stored in the database, the longer it will take the user interface to parse through those
records for display in the Threat Analyzer. The default Network Security Platform settings err on the
side of caution and leave alerts (and their packet logs) in the database until the user explicitly
decides to remove them. However, most users can safely remove alerts after 30 days.
It is imperative that you tune the MySQL database after each purge operation. Otherwise, the purge
process will fragment the database, which can lead to significant performance degradation.
•
Defragment the disks on the Manager on a routine basis, with the exception of the MySQL
directory. The more often you run your defragmenter, the quicker the process will be. Consider
defragmenting the disks at least once a month.
Do NOT attempt to defragment the MySQL directory using the operating system's defrag utility. Any
fragmentation issues in the tables are rectified when you tune the database. For more information
on database tuning, see the Manager Administration Guide.
•
Limit the quantity of alerts to view when launching the Threat Analyzer. This will reduce the total
quantity of records the user interface must parse and therefore potentially result in a faster initial
response on startup.
•
When scheduling certain Manager actions (backups, file maintenance, archivals, database tuning),
set a time for each that is unique and is a minimum of an hour after/before other scheduled
actions. Do not run scheduled actions concurrently.
Download the Manager/Central Manager executable
You need to download the version of the Manager or Central Manager that you want to install. You
need to download it from the McAfee Update Server.
Task
1
Keep the following information handy before you begin the installation process. You must have
received the following from McAfee via email.
•
20
Grant Number and Password – If you have not received your credentials, contact McAfee
Technical Support [http://mysupport.mcafee.com/]
2
Close all open applications.
3
Go to McAfee Update Server [https://menshen.intruvert.com/] and log on, using the Grant Number
and Password.
4
Go to Manager Software Updates | <required version number> folder and select the required Manager software
version.
5
Download the zip and extract the setup file.
McAfee Network Security Platform 8.1
Installation Guide
3
Install the Manager/Central Manager
Before you begin
Close all open programs, including email, the Administrative Tools | Services window, and instant
messaging to avoid port conflicts. A port conflict may cause the Manager program to incur
a BIND error on startup, hence failing initialization.
Close any open browsers and restart your server after installation is complete. Open
browsers may be caching old class files and cause conflicts.
IIS (Internet Information Server) and PWS (Personal Web Server) must be disabled or
uninstalled from the target server.
This section contains installation instructions for the Central Manager and Manager software on your
Windows server, including the installation of a MySQL database.
In this section, unless explicitly stated, Central Manager and Manager are commonly referred to as
"Manager."
Task
1
Prepare your target server for Manager software installation. See Preparing for installation.
2
Install the Manager software. See Installing the Manager.
3
Start the Manager program. During initial client login from the Manager server or a client machine,
the required Java runtime engine software must be present for proper program functionality. See
Starting the Manager software.
Tasks
•
Install the Manager on page 22
See also
Starting the Manager/Central Manager on page 3
Contents
Install the Manager
Installing the Central Manager
Log files related to Manager installation and upgrade
McAfee Network Security Platform 8.1
Installation Guide
21
3
Install the Manager/Central Manager
Install the Manager
Install the Manager
The steps presented are for installation of the Manager/ Central Manager software. The installation
procedure prompts you to submit program and icon locations, including the location and access
information of your database. Read each step carefully before proceeding to the next step.
Notes:
22
•
Ensure that the prerequisites have been met and your target server has been prepared before
commencing installation.
•
You can exit the setup program by clicking Cancel in the setup wizard. Upon cancellation, all
temporary setup files are removed, restoring your server to its same state prior to installation.
•
After you complete a step, click Next; click Previous to go one step back in the installation process.
•
Unless specified during installation, Network Security Manager is installed by default.
•
The Installation Wizard creates the default folders based on the Manager Type you are installing.
For example, for a first-time installation of Network Security Manager, the default location is C:
\Program Files\McAfee\Network Security Manager\App. For Network Security Central Manager, it is
C:\Program Files\ McAfee\Network Security Central Manager\App. Similarly, the Wizard creates
default folders for the MySQL database as well. For the sake of explanation, this section mentions
only the folder paths for Network Security Manager unless it is necessary to mention the path for
Network Security Central Manager.
•
Before you begin to install, make sure the Windows Regional and Language Options are configured
accordingly. For example, if you are installing it on Windows Server 2008 R2 Standard or Enterprise
Edition, Japanese Operating System, SP1 (64 bit) (Full Installation), ensure that the Windows
Regional and Language Options are configured for Japanese.
•
When you install the Manager for the first time, it is automatically integrated with McAfee Global
Threat Intelligence to send your alert, general setup, and feature usage data to McAfee for
optimized protection. If you do not wish to send these data, then disable the integration with
Global Threat Intelligence. However, note that to be able to query McAfee GTI IP Reputation for
information on the source or target host of an attack, you need to send at least your alert data
summary to McAfee. For details, see McAfeeINetwork Security platform Integration Guide.
McAfee Network Security Platform 8.1
Installation Guide
3
Install the Manager/Central Manager
Install the Manager
Task
1
Log on to your Windows server as Administrator and close all open programs.
2
Run the Manager executable file that you downloaded from the McAfee Update Server.
The Installation Wizard starts with an introduction screen. See also the Manager/Central Manager
executable.
McAfee Network Security Platform 8.1
Installation Guide
23
3
Install the Manager/Central Manager
Install the Manager
3
24
Confirm your acknowledgement of the License Agreement by selecting I accept the terms of the License
Agreement.
McAfee Network Security Platform 8.1
Installation Guide
Install the Manager/Central Manager
Install the Manager
4
3
From the Manager Type drop-down list, select Network Security Manager or Network Security Central Manager.
For an upgrade, Network Security Manager or Network Security Central Manager is displayed
accordingly, which you cannot change.
Once installed, the Network Security Central Manager cannot be converted to Network Security
Manager or vice versa.
5
Choose a folder where you want to install the Manager software.
McAfee Network Security Platform 8.1
Installation Guide
25
3
Install the Manager/Central Manager
Install the Manager
For a first-time installation, the default location is C:\Program Files\McAfee\Network Security
Manager\App. For an upgrade, it is the same location as that of the earlier version.
•
Restore Default Folder: Resets the installation folder to the default location.
•
Choose: Browse to a different location.
Installing the Manager software on a network-mapped drive may result in improper installation.
The Manager software cannot be installed to a directory path containing special characters such
as a comma (,), equal sign (=), or pound sign (#).
6
Choose a location for the Manager shortcut icon:
•
On the Start Menu
•
On the Desktop
•
On the Quick Launch Bar
•
Create Icons for All Users
You can include or remove multiple options by selecting the the relevant checkboxes.
26
McAfee Network Security Platform 8.1
Installation Guide
Install the Manager/Central Manager
Install the Manager
7
3
Type the password for your default user.
Use a combination of alphabets [both uppercase (A-Z) and lowercase (a-z)], numbers [0-9] and/or,
special characters like "~ ` ! @ # $ % - * _ + [ ] : ; , ( ) ? { }".
Do not use null or empty characters.
McAfee Network Security Platform 8.1
Installation Guide
27
3
Install the Manager/Central Manager
Install the Manager
8
Set the following:
•
Database Type is displayed as MySQL.
You must use only the MySQL bundled with the Manager installation file. Provide the database
connection information as follows:
•
Database Name: Type a name for your database. It is recommended you keep the default entry of lf
intact.
The MySQL database name can be a combination of alphabets [both uppercase (A-Z) and
lowercase (a-z)], numbers [0-9] and/or, special characters like dollar and underscore [$ _].
•
Database User: Type a user name for database-Manager communication; this account name is used
by the Manager. This account enables communication between the database and the Manager.
When typing a user name, observe the following rules:
- The MySQL database user name can be a combination of alphabets [both uppercase (A-Z) and
lowercase (a-z)], numbers [0-9] and/or, special characters like "~ ` ! @ # $ % - * _ + [ ] : ; ,
( ) ? { }".
- The first character must be a letter.
- Do not use null or empty characters.
- Do not use more than 16 characters.
•
Database Password: Type a password for the database-Manager communication account. This
password relates to the Database User account.
- The MySQL database password can be a combination of alphabets [both uppercase (A-Z) and
lowercase (a-z)], numbers [0-9] and/or, special characters like "~ ` ! @ # $ % - * _ + [ ] : ; ,
( ) ? { }".
- Do not use null or empty characters.
This password is not the root password for database management; you will set the root password
in a subsequent step.
•
28
MySQL Installation Directory: Type or browse to the absolute location of your selected Manager
database. For a first-time installation, the default location is: C:\program files\McAfee\Network
Security Manager\MySQL. For upgrades, the default location is the previous installation
directory. You can type or browse to a location different from the default. However, the database
must be on the same server as the Manager.
McAfee Network Security Platform 8.1
Installation Guide
Install the Manager/Central Manager
Install the Manager
9
3
Click Next.
If you are creating a new database, Network Security Platform a message appears asking to confirm
that you really want to create a new database. Click Continue to continue with the installation.
McAfee Network Security Platform 8.1
Installation Guide
29
3
Install the Manager/Central Manager
Install the Manager
10 Type the root password for your database. If this is the initial installation, type a root password and
then type it again to confirm.
The MySQL Root Password is required for root access configuration privileges for your MySQL database.
Use a combination of alphabets [both uppercase (A-Z) and lowercase (a-z)], numbers [0-9] and/or,
special characters like "~ ` ! @ # $ % - * _ + [ ] : ; , ( ) ? { }".
Do not use null or empty characters.
For security reasons, you can set a MySQL Root Password that is different from the Database Password that
you set in a previous step.
11 Choose the folder in want you wish to install the Solr database.
The Manager uses Apache Solr for quick retrieval of data. Solr is an open-source search platform
from the Apache Lucene project. The Manager makes use of Solr to retrieve data to be displayed in
the Manager Dashboard and Analysis tabs.
For a first‑time installation, the default location is C:\Program Files\McAfee\Network Security
Manager\Solr.
The following options are available in the wizard:
30
•
Restore Default Folder: Resets the installation folder to the default location.
•
Choose: Click to browse to a different location.
McAfee Network Security Platform 8.1
Installation Guide
Install the Manager/Central Manager
Install the Manager
3
Solr is used by the Manager to enhance database access. This helps in faster data refresh in the
Manager dashboard and monitors.
Verify that you have at least 20 GB of free space before you install Solr.
The Solr installation directory screen will not be displayed during the Network Security Central
Manager installation.
McAfee Network Security Platform 8.1
Installation Guide
31
3
Install the Manager/Central Manager
Install the Manager
12 Click Next.
The 8.1 Manager installation is supported only on 64-bit OS. If you try installing in a 32-bit OS a
warning message will be displayed. Click Ok on the warning message to exit the Manager installation
wizard.
Enter a value to set Actual Maximum RAM Usage.
The RAM size indicated here determines the recommended amount of program memory (virtual
memory) to allocate for server processes required by Network Security Platform. Since Jboss
memory uses hard-disk-based memory (program memory), the total amount of both can exceed
the Manager server's RAM memory size.
The Recommended Maximum RAM Usage is Physical Server Memorydivided by 2 or 1170 MB - whichever is
greater. The Actual Maximum RAM Usage can be between 768 MB and three-fourth of the Physical Server
Memory size.
32
McAfee Network Security Platform 8.1
Installation Guide
Install the Manager/Central Manager
Install the Manager
3
13 Set the following (applicable only Network Security Manager):
•
Number of Sensors: Select the numbers of McAfee® Network Security Sensors (Sensors) to be
managed by this installation of the Manager.
•
Actual Maximum DB connections: Enter the maximum number of concurrent database connections
allowed from the Manager. The default is 40. The recommended number indicated above is
based on the Number of Sensors.
14 If the Manager server has multiple IPv4 or IPv6 addresses, you can specify a dedicated address
that it should use to communicate with the Network Security Platform devices.
McAfee Network Security Platform 8.1
Installation Guide
33
3
Install the Manager/Central Manager
Install the Manager
To specify an IP address, select Use IPV4 Interface? or Use IPV6 Interface? and then select the address from
the corresponding drop-down list.
In the Wizard, the option to specify a dedicated interface is displayed only if the Manager has more
than one IPv4 or IPv6.
•
When configuring the sensors, you need to configure the same IP that you selected here as the
IP address used to communicate with the Network Security Platform devices.
•
If the Manager has an IPv6 address, then you can add Sensors with IPv6 addresses to it.
•
If an IP address is not displayed in the drop-down list or if a deleted IP address is displayed,
then cancel the installation, restart the server, and re-install the Manager.
•
Post-installation, if you want to change the dedicated IP address that you already specified, you
need to re-install the Manager.
15 In the Manager Installation wizard, review the Pre-Installation Summary section for accurate folder locations
and disk space requirements. This page lists the following information:
34
•
Product Name: Shows product as Manager (for both Manager and Central Manager).
•
Install Folder: The folder you specified in Step 5.
•
Shortcut Folder: The folder you specified in Step 6.
•
Manager type: Type of Manager being installed.
•
Database: The type of database being used by Network Security Platform, which is MySQL.
McAfee Network Security Platform 8.1
Installation Guide
Install the Manager/Central Manager
Install the Manager
•
Database Installation location: The location on your hard drive where the database is to be located,
which you specified in Step 7.
•
Dedicated Interface: The IPv4 and IPv6 addresses that you specified for Manager-to-Sensor
communication are displayed.
McAfee Network Security Platform 8.1
Installation Guide
3
35
3
Install the Manager/Central Manager
Install the Manager
16 Click Install.
The Manager software and the MySQL database are installed to your target server. In case of an
upgrade, database information is synchronized during this process.
Post-installation, you can check the initdb.log (from <Manager install directory>\App) for any
installation errors. In case of errors, contact McAfee Support with initdb.log.
17 A congratulatory message appears upon successful installation.
The Manager Installation Wizard displays the following fields.
•
URL for access web-based user interface. For example, if the Manager server's computer name
is Callisto, then the url is https://Callisto
•
Default username
•
Launch the Web-based user interface on exit? checkbox
(by default, the check box is selected).
36
McAfee Network Security Platform 8.1
Installation Guide
Install the Manager/Central Manager
Installing the Central Manager
3
18 Click Done.
If the installation wizard prompts for a restart, it is recommended to restart the system before
logging onto the Manager.
The restart option might be displayed if there are any pending OS flags reset required by the
installer, for proper removal/updates of temporary files used during installation.
19 Use the shortcut icon that you created to begin using the Manager.
The Manager program opens by default in HTTPS mode for secure communication.
All the Manager services will be started after clicking the Done button at the end of installation.
20 Type a valid login ID (default: admin) and password (default: admin123) for Network Security
Manager and login ID (default: nscmadmin) and password (default: admin123) for Network
Security Central Manager.
Upon initial client logon, you are required to install Java applications. See Java installation for client
systems.
21 You can use the Manager Initialization Wizard to complete the basic configuration steps.
See also
Prerequisites on page 9
Download the Manager/Central Manager executable on page 20
Installing the Central Manager
The installation of the Central Manager is similar to that of Manager. Follow the steps provided in
Installing the Manager.
McAfee Network Security Platform 8.1
Installation Guide
37
3
Install the Manager/Central Manager
Log files related to Manager installation and upgrade
During installation, you need to select the Manager type as Network Security Central Manager. By default, Network
Security Manager is selected.
Figure 3-1 Central Manager installation
Sensor communication Interface is not present during Central Manager installation.
There can be only one active installation on a Windows machine. Every Central Manager and Manager
installation has its own MySQL database. No centralized database exists in an Central Manager setup.
Central Manager has to be of equal or later version than the corresponding Managers.
See also
Install the Manager on page 22
Log files related to Manager installation and upgrade
Two log files specifically related to Manager/Central Manager installation and upgrade are available:
38
•
mgrVersion.properties: Every fresh installation or upgrade of the Central Manager or Manager is
logged to this file. Each entry contains the version of the Central Manager or Manager that you
installed or upgraded to. It also contains the date and time of when you performed this action. This
can help you troubleshoot issues. For example, you can go through this log to correlate an issue
with a specific Manager upgrade. This file is stored at <Central Manager or Manager install
directory>\App\config.
•
dbconsistency.log: When you upgrade the Central Manager or Manager, the installed database
schema is compared against the actual schema of the version you are upgrading to. This
comparison is to check for any inconsistencies. The details of this comparison are logged to this file
as error, warning, and informational messages. This file is stored at <Central Manager or
Manager install directory>\App. You can verify this log to check if any database inconsistency
is the cause of an issue. This file is updated whenever you upgrade the Central Manager or
Manager.
McAfee Network Security Platform 8.1
Installation Guide
Install the Manager/Central Manager
Log files related to Manager installation and upgrade
3
Warning message during downgrade
Downgrade of Central Manager or Manager is not supported. To revert to an earlier version, you must
uninstall your current version, install the older version, and restore the database backup from that
older version. There can be instances when you may inadvertently attempt to install an older version
of the Central Manager or Manager when a later version is already installed. In such cases, the
Installation Wizard displays the following warning message.
Figure 3-2 Attempted Download Detected dialog
McAfee Network Security Platform 8.1
Installation Guide
39
3
Install the Manager/Central Manager
Log files related to Manager installation and upgrade
40
McAfee Network Security Platform 8.1
Installation Guide
4
Starting the Manager/Central Manager
This section assumes you have permissions granting you access to the software. In Network Security
Platform, this translates to a Super User role at the root admin domain. Your actual view of the
interface may differ, depending on the role you have been assigned within Network Security Platform.
For example, certain tasks may be unavailable to you if your role denies you access. If you find you
are unable to access a screen or perform a particular task, consult your Network Security Platform
Super User.
For testing purposes, you can access the Manager from the server. For working with the Manager/
Central Manager, McAfee recommends that you access the server from a client machine. Running the
Manager/Central Manager interface client session on the server can result in slower performance due to
program dependencies, such as Java, which may consume a lot of memory.
To view the Manager/Central Manager interface, do the following:
Task
1
Make sure the following services are running on the Manager server:
•
McAfeeNetwork Security Manager
•
McAfeeNetwork Security Manager Database
•
McAfeeNetwork Security Manager User Interface
•
McAfee Network Security Manager Watchdog. The default Windows Startup Type for this service is
manual. So, you might have to manually start this service.
See Manager installation with Local Service account privileges section.
If you have installed the Central Manager, then make sure the following services are running on the
Central Manager server:
•
McAfee Network Security Central Manager
•
McAfee Network Security Central Manager Database
•
McAfee Network Security Central Manager User Interface
•
McAfee Network Security Central Manager Watchdog. The default Windows Startup Type for this
service is manual. So, you might have to manually start this service.
McAfee Network Security Platform 8.1
Installation Guide
41
4
Starting the Manager/Central Manager
Authentication of access to the Manager using CAC
Start the services using one of these methods to start the Manager, Database, User Interface, and
Watchdog services:
2
•
Select Start | Settings | Control Panel. Double-click Administrative Tools, and then double-click Services.
Locate the services starting with McAfee Network Security Manager.
•
Right-click on the Manager icon at the bottom-right corner of your server and start the required
service. The database service is not available with this option.
Open the Manager
•
Server - Double-click the shortcut icon that you created during installation.
•
Client machine Start your browser (Internet Explorer 8.0 9.0 or 10, or Firefox 7.0) and then type the URL of the
Manager server:
https://<hostname or host-IP>
3
Log on to the Manager by entering the default logon ID and password.
If pop-up blocker settings is enabled in the browser, you will not be able to type your login
credentials. In such an instance, disable the pop-up blocker settings in your browser and then try to
access the Manager using your login ID and password. If the pop-up blocker is enabled, the login
and password text boxes are disabled and it remains disabled till you disable the pop-up blocker and
refresh the browser.
The Manager software requires Java runtime engine software for some of its components. When
you first log onto the Manager from a client system, you are prompted to download and install the
appropriate version of the JRE software.
You must download and install these programs for proper functioning of the Manager program. See
Java runtime engine requirements.
Tasks
•
Shut down the Manager/Central Manager services on page 45
Contents
Authentication of access to the Manager using CAC
Shut down the Manager/Central Manager services
Authentication of access to the Manager using CAC
Common Access Card (CAC) is a smart card that is used for general identification as well as
authentication of user access to secure networks. CAC holds a unique digital certificate and user
information such as photograph, personal identification number (PIN) and signature to identify each
user. Network Security Platform provides an option of authentication of users who tried to log onto the
Manager based on their smart card verification.
When a smart card reader is connected to your Manager client, and a user swipes a smart card, the
card reader authenticates if the digital certificate and the user information are trusted and valid. If the
user information is trusted, the client browser retrieves the certificate from CAC, with the help of the
CAC software and sends it to the Manager. The Manager receives the certificate, verifies if the
certificate issued is from a trusted Certificate Authority (CA). If the certificate is from a trusted CA, a
secure session is established and the user is permitted to log on.
42
McAfee Network Security Platform 8.1
Installation Guide
Starting the Manager/Central Manager
Authentication of access to the Manager using CAC
4
At a high level, authenticating user access to the Manager through CAC can be brought about by a
4-step process:
•
Verify the CAC certificate format
•
Set up user accounts
•
Enable CAC authentication
•
Log on to the Manager using CAC
Verify the CAC certificate format
.pem is the universal standard to read digital certificate files. If your CA certificate is using other
formats such as .cer, you need to convert those to .pem format. To convert a .cer certificate to .pem
format:
Task
•
Open the command prompt, locate the OpenSSL/bin folder, and execute the following command:
openssl x509 -in <XXX.cer> -inform DER -out <YYY.pem> -outform PEM
All the PEM-encoded certificate can be combined into one master CA file, and the SSLCACertificateFile
must contain a list of Root CA's and intermediary CA's that are trusted by the Manager.
Set up CAC users in the Manager
Task
1
Connect the smart card reader to your Manager client through a USB port.
The smart card reader can be connected to a Manager server, if the server doubles up as a
Manager client.
a
Refer the card reader manufacturer's recommendations for the necessary device drivers to be
installed.
b
Install the ActivIdentify and ActivClient CAC software on the Manager client.
These software are provided to you along with the card reader device and help validate the
digital certificate and user information stored in the card.
McAfee currently supports integration with smart card reader model SCR3310 from TxSystems.
2
Insert a card into the card reader.
3
Open the CAC Client software | Smart Card Info | User Name.
The user name is a combination of alphanumeric characters and a few special characters like "." or
spaces. For example, "BROWN.JOHN.MR.0123456789"
4
Log onto the Manager and create a user with the exact same name that is, "BROWN.JOHN.MR .
0123456789".
5
Close the current browser session of the Manager.
Enable the CAC authentication
The CAC authentication feature is disabled by default. It is mandatory to setup the CAC user accounts,
before enabling it.
McAfee Network Security Platform 8.1
Installation Guide
43
4
Starting the Manager/Central Manager
Authentication of access to the Manager using CAC
To enable CAC, do the following:
CAC Authentication can be enabled only through the MySQL command line.
Task
1
Log onto the MySQL command line and enter:
update iv_emsproperties set value='TRUE' where
name='iv.access.control.authentication.requireClientCertificateBasedAuthentication'
2
Perform the following tasks:
a
Change the corresponding Apache files to enable Client-Authentication:
Apache/conf/iv_ssl.conf –
b
Uncomment the following lines:
#RewriteRule ^(.*)$ - [E=RedirectPort=444] #Listen 0.0.0.0:444
c
Set SSLCACertificateFile attribute to point to the file containing the trusted CA Certificates.
d
In Apache/conf/iv_ssl_mapping.conf, uncomment the following line:
#RewriteRule ^(.*)$ - [E=RedirectPort=444]
3
Close all client connections.
4
Stop the McAfee® Network Security Manager service.
5
Stop the McAfee® Network Security Manager User Interface service.
6
Restart both the McAfee® Network Security Manager service and the McAfee® Network Security
Manager User Interface service.
For details on how to close client connections, stop/ restart the Manager services etc.
Log on to the Manager using the CAC authentication
Task
1
Insert a card into the card reader.
2
Start a fresh browser session for the Manager.
You are prompted to choose a CA certificate.
3
Select the certificate.
You are prompted to enter the PIN.
4
Enter the PIN.
A maximum of 3 attempts is allowed while entering PIN, following which, the user will be locked
out.
If the user name, certificate, and PIN match, you are directly given access to the Manager Home
Page.
Troubleshooting tips
44
•
If the card is not inserted in the card reader, the Manager will not be accessible in this setup.
•
When authenticating users through CAC, you do not have to enter your Manager user name and
password while logging on.
McAfee Network Security Platform 8.1
Installation Guide
Starting the Manager/Central Manager
Shut down the Manager/Central Manager services
4
•
If you are locked out after entering invalid PIN, you can use the ActivClient CAC software to get a new
PIN.
•
If you are unable to view the Manager Login page after CAC authentication has been enabled, it
means that the CAC certificate was NOT signed by a trusted CA listed in the SSLCACertificateFile. To
remedy the problem, import the relevant CA into the SSLCACertificateFile trusted CA list.
•
You have imported the relevant CA into the SSLCACertificateFile trusted CA list, and yet you are
unable to view the Manager Login page, then check whether a firewall is blocking your access to
destination port 444 on the Manager server.
•
If you are able to view the Manager Login page but are unable to log onto the Manager, it means
that the user name on the CAC card does not match the user name in the Manager database. To
remedy the problem, verify that the user name on the CAC card exactly matches the Manager user
name.
Shut down the Manager/Central Manager services
A proper shutdown of the Manager/Central Manager prevents data corruption by allowing data transfer
and other processes to gracefully end prior to machine shutdown.
Shutting down the Manager
A proper shutdown of the Manager services requires the following steps be performed:
Task
1
Close all client connections. See Closing all client connections.
2
Stop the McAfee® Network Security Manager service.
3
Stop the McAfee® Network Security Manager User Interface service.
4
Stop the McAfee® Network Security Manager Watchdog service.
5
Stop the McAfee® Network Security Manager MySQL service.
Tasks
•
Shut down the Central Manager on page 45
•
Close all the client connections on page 46
•
Shut down using the Network Security Platform system tray icon on page 46
•
Shut down using the Control Panel on page 47
See also
Close all the client connections on page 46
Shut down the Central Manager
Task
1
Close all client connections.
2
Stop the McAfee® Network Security Central Manager service.
3
Stop the McAfee® Network Security Central Manager User Interface service.
McAfee Network Security Platform 8.1
Installation Guide
45
4
Starting the Manager/Central Manager
Shut down the Manager/Central Manager services
4
Stop the McAfee® Network Security Central Manager Watchdog service.
5
Stop the McAfee® Network Security Central Manager MySQL service.
In a crash situation, the Manager/Central Manager will attempt to forcibly shut down all its services.
Close all the client connections
The following procedure details the recommended steps for determining which users are currently
logged on to the Manager/Central Manager server. All client-session configuration and data review
should be gracefully closed prior to server shutdown.
Task
1
Log onto the Manager/Central Manager server through a browser session.
2
In the Dashboard, view the Manager Summary to view the currently logged on users.
3
Ask the users to close all Manager windows such as Threat Analyzer and Manager Home page and
log out of all open browser sessions.
Shut down using the Network Security Platform system tray
icon
Task
1
Right-click the Manager/Central Manager icon in your System Tray. The icon displays as an "M"
enclosed within a shield.
Figure 4-1 Network Security Manager Service
2
Select Stop Manager or Stop Central Manager. Once this service is completely stopped, continue to the
next step.
Figure 4-2 Stop Central Manager Service option
46
3
Go to Start | Settings | Control Panel.
4
Open Administrative Tools.
5
Open Services.
6
Find and select McAfee® Network Security Manager Database or McAfee® Network Security Central
Manager Database in the services list under the "Name" column.
McAfee Network Security Platform 8.1
Installation Guide
Starting the Manager/Central Manager
Shut down the Manager/Central Manager services
7
4
Click the Stop Service button. Once this service is completely stopped, continue to the next step.
Figure 4-3 Stop Service option
8
You can now safely shut down/reboot your server.
Shut down using the Control Panel
Task
1
Go to Start | Settings | Control Panel.
2
Open Administrative Tools.
3
Open Services.
4
Select Network Security Manager Service or Network Security Central Manager Service in the services list under the
Name column.
McAfee Network Security Platform 8.1
Installation Guide
47
4
Starting the Manager/Central Manager
Shut down the Manager/Central Manager services
5
Click the Stop Service button.
Once this service is completely stopped, continue to the next step.
Figure 4-4 Stop Service option
6
Find and select McAfee Network Security Manager Database or McAfee Network Security Central Manager Database in
the services list under the "Name" column.
7
Click the Stop Service button. Once this service is completely stopped, continue to the next step.
Figure 4-5 Service window
8
48
You can now safely shut down/reboot your server.
McAfee Network Security Platform 8.1
Installation Guide
5
Adding a Sensor
After installing the Manager software and a successful logon session, the next step is to add one or
more Sensors to the Manager. For more information on configuring a Sensor, see McAfee Network
Security Platform CLI Reference Guide and McAfee Network Security Platform IPS Administration
Guide.
For information on adding and deploying a Virtual IPS Sensor, see Virtual IPS Sensor deployment,
Network Security Platform IPS Administration Guide.
Contents
Before you install Sensors
Cable specifications
Configuration of a Sensor
Before you install Sensors
This section describes best practices for deployment of McAfee Network Security Sensor (Sensor) on
your network and is generic to all Sensor appliance models.
Topics include system requirements, site planning, safety considerations for handling the Sensor, and
usage restrictions that apply to all Sensor models.
Sensor specifications, such as physical dimensions, power requirements, and so on are described in
each Sensor model's Product Guide.
Network topology considerations
®
Deployment of McAfee® Network Security Platform [formerly McAfee® IntruShield ] requires basic
knowledge of your network to help determine the level of configuration and amount of installed
Sensors and McAfee Network Security Manager (Manager) required to protect your system.
The Sensor is purpose-built for the monitoring of traffic across one or more network segments.
McAfee Network Security Platform 8.1
Installation Guide
49
5
Adding a Sensor
Before you install Sensors
Safety measures
Please read the following warnings before you install the product. Failure to observe these safety
warnings could result in serious physical injury.
Read the installation instructions before you connect the system to its power source.
To remove all power from the Sensor, unplug all power cords, including the redundant power cord.
Only trained and qualified personnel should be allowed to install, replace, or service this equipment.
The Sensor has no ON/OFF switch. Plug the Sensor into a power supply ONLY after you have completed
rack installation.
Before working on equipment that is connected to power lines, remove jewelry (including rings,
necklaces, and watches). Metal objects will heat up when connected to power and ground and can
cause serious burns or weld the metal object to the terminals.
This equipment is intended to be grounded. Ensure that the host is connected to earth ground during
normal use.
Do not remove the outer shell of the Sensor. Doing so will invalidate your warranty.
Do not operate the system unless all cards, faceplates, front covers, and rear covers are in place. Blank
faceplates and cover panels prevent exposure to hazardous voltages and currents inside the chassis,
contain electromagnetic interference (EMI) that might disrupt other equipment, and direct the flow of
cooling air through the chassis.
To avoid electric shock, do not connect safety extra-low voltage (SELV) circuits to telephone-network
voltage (TNV) circuits. LAN ports contain SELV circuits, and WAN ports contain TNV circuits. Some LAN
and WAN ports both use RJ-45 connectors. Use caution when connecting cables.
This equipment has been tested and found to comply with the limits for a Class A digital device,
pursuant to Part 15 of the FCC Rules. These limits are designed to provide reasonable protection against
harmful interference when the equipment is operated in a commercial environment. This equipment
generates, uses, and can radiate radio frequency energy and, if not installed and used in accordance
with the instruction manual, may cause harmful interference to radio communications. Operation of this
equipment in a residential area is likely to cause harmful interference in which case the user will be
required to correct the interference at his own expense.
Fiber-optic ports
•
Fiber-optic ports (for example, FDDI, OC-3, OC-12, OC-48, ATM, GBIC, and 100BaseFX) are
considered Class 1 laser or Class 1 LED ports.
•
These products have been tested and found to comply with Class 1 limits of IEC 60825-1, IEC
60825-2, EN 60825-1, EN 60825-2, and 21CFR1040.
To avoid exposure to radiation, do not stare into the aperture of a fiber-optic port. Invisible radiation
might be emitted from the aperture of the port when no fiber cable is connected.
Usage restrictions
The following restrictions apply to the use and operation of a Sensor:
50
•
You may not remove the outer shell of the Sensor. Doing so will invalidate your warranty.
•
The Sensor appliance is not a general purpose workstation.
McAfee Network Security Platform 8.1
Installation Guide
Adding a Sensor
Cable specifications
•
McAfee prohibits the use of the Sensor appliance for anything other than operating the Network
Security Platform.
•
McAfee prohibits the modification or installation of any hardware or software in the Sensor
appliance that is not part of the normal operation of the Network Security Platform.
5
Unpack the Sensor
To unpack the Sensor:
Task
1
Place the Sensor box as close to the installation site as possible.
2
Position the box with the text upright.
3
Open the top flaps of the box.
4
Remove the accessory box.
5
Verify you have received all parts. These parts are listed on the packing list and in Contents of the
Sensor box, below.
6
Pull out the packing material surrounding the Sensor.
7
Remove the Sensor from the anti-static bag.
8
Save the box and packing materials for later use in case you need to move or ship the Sensor.
See also
Contents of the Sensor box on page 51
Contents of the Sensor box
The following accessories are shipped in the Sensor box:
•
One Sensor
•
One power cord. McAfee provides a standard, 2m NEMA 5-15p (US) power cable (3 wire).
International customers must procure a country-appropriate power cable with specific v/a ratings.
•
One set of rack mounting ears.
•
Fail-closed dongles (two for the I-1200, four for the I-1400, six for I-2700).
•
One printed McAfee Network Security Platform Quick Start Guide.
•
Release notes.
Cable specifications
This section lists the specifications for all cables to use with McAfee Network Security Sensor (Sensor).
McAfee Network Security Platform 8.1
Installation Guide
51
5
Adding a Sensor
Cable specifications
Network Security Platform fail-closed dongle specification
The I-1200 and I-1400 Sensors, for example, require the dongle specified in the following for all
monitoring modes requiring a fail-closed connection. Configurations requiring the dongle are described
in the corresponding McAfee Network Security Platform Sensor Product Guide chapter on cabling the
Sensor.
Figure 5-1 Fail-closed dongle specification
Console port pin-outs
McAfee supplies a console cable. The specifications for this cable are as follows:
The Console port is pinned as a DCE so that it can be connected to a PC's COM1 port with a
straight-through cable.
Pin #
Signal
Direction on Sensor
1
DCD
Output
2
RXD
Output
3
TXD
Input
4
DTR
Input
5
GND
not applicable
6
DSR
Output
7
RTS
Input
8
CTS
Output
9
No Connection
Not applicable
Auxiliary port pin-outs
The Auxiliary (Aux) port is pinned as a DTE so that it can be connected to a modem with a
straight-through cable.
52
Pin #
Signal
Direction on Sensor
1
DCD
Input
2
RXD
Input
McAfee Network Security Platform 8.1
Installation Guide
Adding a Sensor
Cable specifications
Pin #
Signal
Direction on Sensor
3
TXD
Output
4
DTR
Output
5
GND
n/a
6
DSR
Input
7
RTS
Output
8
CTS
Input
9
RI
Input
5
Management port pin-outs
The Management (Mgmt) port uses a Cat 5/Cat 5e cable.
Pin #
Signal
Direction on Sensor
1
TxD+
Output
2
TxD-
Output
3
RxD+
Input
4
These pins are terminated to ground through a 75 ohm resistor & capacitor.
5
6
RxD-
Input
7
These pins are terminated to ground through a 75 ohm resistor & capacitor.
8
Category 5 Enhanced (Cat 5e) cable is required for transmission speeds up to 1 Gigabit per second
(Gigabit Ethernet). For Ethernet networks running at 10 or 100 Mbps, Category 5 (Cat 5) OR Cat 5e
cable can be used.
Throughout this guide, cabling specifications will be mentioned as Cat 5/Cat 5e.
Response port pin-outs
The Response ports use Cat 5/Cat 5e cables.
Pin #
Signal
Direction on Sensor
1
TxD+
Output
2
TxD-
Output
3
RxD+
Input
4
These pins are terminated to ground through a 75 ohm resistor & capacitor.
5
6
RxD-
Input
7
These pins are terminated to ground through a 75 ohm resistor & capacitor.
8
McAfee Network Security Platform 8.1
Installation Guide
53
5
Adding a Sensor
Configuration of a Sensor
How to monitor port pin-outs
The following ports are relevant go Monitoring port pin-outs.
•
Gigabit Ethernet (GE) ports
•
Fast Ethernet (FE) 10/100/1000 ports
See also
Gigabit Ethernet (GE) ports on page 54
Fast Ethernet (FE) 10/100/1000 ports on page 54
Gigabit Ethernet (GE) ports
GBIC monitoring ports use cables appropriate for the type of GBIC you choose to use. This includes
cabling for failover between the GBIC ports on two failover Sensors.
Fast Ethernet (FE) 10/100/1000 ports
10/100/1000 monitoring ports use Cat 5/Cat 5e cables. The Sensor's normal mode of operation, using
pins 1&2 and 3&6, is to fail-open—that is, data will continue to pass through the Sensor allowing
continued data flow. In this mode, pins 4&5 are terminated to ground via 75 ohm and a capacitor.
Pin #
Signal
Direction on Sensor
1
TxD+ FO
(See text above.)
2
TxD- FO
3
RxD+
Input
4
TxD+ FC
Reserved for use in the fail-closed dongle.
5
TxD- FC
6
RxD-
7
These pins are terminated to ground through a 75 ohm resistor & capacitor.
Input
8
Configuration of a Sensor
This section describes how to configure a McAfee Network Security Sensor (Sensor). This information
is generic to all Sensor appliance models.
The information presented in this chapter was developed based on devices in a specific lab
environment. All Sensors used in this document started with a cleared (default) configuration. If you are
working in a live network, please ensure that you understand the potential impact of any command
before using it. For more information on the available Sensor CLI commands, see the McAfee Network
Security Platform CLI Guide.
Configuration overview
At a high level, the process of configuring the Sensor involves the following steps. Detailed
instructions follow in subsequent sections of this chapter.
Task
54
1
(Pre-installation) Establish a Sensor naming scheme for your Sensors.
2
Install and bring up the Sensor. (This information is described in detail in the Product Guide for
each Sensor model.)
McAfee Network Security Platform 8.1
Installation Guide
5
Adding a Sensor
Configuration of a Sensor
3
Add the Sensor to Manager using the McAfee Network Security Manager (Manager) Configuration
page.
4
Configuring the Sensor with a unique name and shared key value.
5
Configuring the Sensor's network information (for example, IP address and netmask, Sensor name,
and so on).
6
Verify that the Sensor is on the network. (See Configuring the Sensor)
7
Verify connectivity between the Manager and the Sensor. (See Verifying successful configuration)
See also
Establishment of a Sensor naming scheme on page 55
Add a Sensor to the Manager on page 55
Configure the Sensor on page 56
Verification of successful configuration on page 59
Establishment of a Sensor naming scheme
Once you have configured a Sensor with a name, you will be unable to change the name without
reconfiguring the Sensor. McAfee recommends that you establish an easily recognizable naming
scheme prior to deployment that indicates your Sensors' locations or purposes, and which ensures
unique names. The Manager will not recognize two Sensors with identical names.
Sensors are represented by name in several areas of McAfee® Network Security Platform and its alert
data: the Manager Configuration page, alert and configuration reports, and the Threat Analyzer. Thus,
it is a good idea to make your Sensor naming scheme clear enough to interpret by anyone who might
need to work with the system or its data.
For example, if you were deploying Sensors at a university, you might name your Sensors according to
their location on the campus:Sensor1_WeanHall, Sensor2_WeanHall, Sensor1_StudentUnion, Sensor1_Library, and so
on.
Sensor name is case-insensitive. Do not use case to distinguish between Sensors; for example, do not
use both Sensor1 and sensor1.
Communication between the Sensor and the Manager
The Sensor initiates all communication with the Manager server until secure communication is
established between the them. Later, configuration information is pushed from Manager to Sensor. The
Manager does not poll the network to discover the Sensor.
All communication between the Manager and Sensor is secure. Refer to KnowledgeBase article KB55587
for details.
Add a Sensor to the Manager
After a Sensor is configured with a name and shared key value, you can add the Sensor in the
Manager Configuration page.
Adding a physically installed and network-connected Sensor to the Manager activates communication
between them.
The process of installing and connecting a Sensor is described in the McAfee Network Security Platform
Product Guide for each Sensor model.
McAfee Network Security Platform 8.1
Installation Guide
55
5
Adding a Sensor
Configuration of a Sensor
The following steps describe how to add a Sensor to the Manager:
Task
1
Start the Manager software.
2
Log on to the Manager (the default username is
admin ; the default password is admin123).
3
In the System page, select the Domain to which you want to add the Sensor and then select Global |
Add and Remove Devices | New.
The Add New Device form appears.
Figure 5-2 Add New Device window
4
Type the same Device Name you entered on the Sensor.
The exact same Sensor Name and Shared Secret must also be entered into the CLI of the Sensor during
physical installation. If not, the Manager will not recognize a Sensor trying to communicate with the
Manager.
5
Ensure the selected Sensor type is IPS Sensor
6
Enter the Shared Secret.
7
Confirm the Shared Secret.
8
Select an Updating Mode as Online or Offline.
Online is the default mode.
9
(Optional) Type the Contact Information and Location.
10 Click Save or click Cancel to end the installation.
Configure the Sensor
At any time during configuration, you can type ? to get help on the Sensor CLI commands. To see a
list of all commands, type commands. These commands are described in the McAfee Network Security
Platform CLI Guide.
The first time you configure a Sensor, you must have physical access to the Sensor.
If you are moving a Sensor to a new environment and wish to wipe the Sensor back to its factory
default settings, start by typing factorydefaults from the CLI. See the McAfee Network Security
Platform CLI Guide for specific details on the usage of command.
56
McAfee Network Security Platform 8.1
Installation Guide
Adding a Sensor
Configuration of a Sensor
5
Task
1
Open a hyperterminal session to configure the Sensor. (For instructions on connecting to the
Console port, see the section Cabling the Console Port, in the McAfee Network Security Platform
Product Guide for your Sensor model.)
2
At the login prompt, log on to the Sensor using the default username
admin and password admin123.
McAfee strongly recommends that you change the default password later for security purposes
as described in Step 9.
By default, the user is prompted for configuration set up, immediately after login. Else, the user can
choose to start the setup later from command prompt using the setup command. For more
information, see the McAfee Network Security Platform CLI Guide.
3
Set the name of the Sensor. At the prompt, type:
set sensor name <WORD>
The Sensor name is a case-sensitive alphanumeric character string up to 25 characters. The string
can include hyphens, underscores, and periods, and must begin with a letter.
For example, set Sensor name Engineering_Sensor1
4
Set the IP address and subnet mask of the Sensor. At the prompt, type:
set sensor ip <A.B.C.D> <E.F.G.H>
Specify a 32-bit address written as four eight-bit numbers separated by periods as in
<A.B.C.D>
where:
•
A,B,C or D is an eight-bit number between 0-255.
•
<E.F.G.H> represents the subnet mask.
For example,
set sensor ip 192.34.2.8 255.255.255.0 Or Specify an IPv6 address as given below:
set sensor ipv6 <A:B:C:D:E:F:G:H/I>
where:
•
A:B:C:D:E:F:G:H> is a 64-bit address written as octet (eight groups) of four hexadecimal
numbers, separated by colons. Each group A,B,C,D (etc) represents a group of hexadecimal
numbers between 0000-FFFF. This is followed by a prefix length I with value between 0 and
128. For example, set sensor ipv6 2001:0db8:8a2e:0000:0000:0000:0000:0111/64
If one or more four-digit group(s) is 0000, the zeros may be omitted and replaced with two colons
(::). For example, set sensor ipv6 2001:0db8:8a2e::0111/64
Setting the IP address for the first time—that is, during the initial configuration of the Sensor—does
not require a Sensor reboot. Subsequent changes to the IP address will, however, require that you
reboot the Sensor for the change to take effect. If a reboot is necessary, the CLI will prompt you to
do so. For information on rebooting, see Conditions requiring a Sensor reboot, McAfee Network
Security Platform Troubleshooting Guide.
5
If the Sensor is not on the same network as the Manager, set the address of the default
gateway
McAfee Network Security Platform 8.1
Installation Guide
57
5
Adding a Sensor
Configuration of a Sensor
Note that you should be able to ping the gateway (that is, gateway should be reachable). At the
prompt, type: set sensor gateway <A.B.C.D>
Use the same convention as the one for Sensor IP address. For example, set sensor gateway
192.34.2.8
Or Specify an IPv6 address of the gateway for the Manager server as given below:
set sensor gateway-ipv6 <A:B:C:D:E:F:G:H>
where:
•
<A:B:C:D:E:F:G:H>is a 128-bit address written as octet (eight groups) of four hexadecimal
numbers, separated by colons. Each group A,B,C,D etc( ) is a group of hexadecimal numbers
between 0000-FFFF. For example, set sensor gateway-ipv6 2001:0db8:8a2e:
0000:0000:0000:0000:0111
If one or more four-digit group(s) is 0000, the zeros may be omitted and replaced with two colons
(::)
For example, set sensor gateway-ipv6 2001:0db8:8a2e::0111
6
Set the IPv4 or IPv6
address of the Manager server. At the prompt, type:
set manager ip <A.B.C.D>
Use the same convention as the one for Sensor IP address. For example, set manager ip
192.34.3.2
Or Type an IPv6 address of the Manager server, as given below: set manager ip
<A:B:C:D:E:F:G:H>
where:
•
<A:B:C:D:E:F:G:H> is a 128-bit address written as octet (eight groups) of four hexadecimal
numbers, separated by colons. Each group (A,B,C,D etc) is a group of hexadecimal numbers
between 0000-FFFF. For example: set manager ip 2001:0db8:8a2e:
0000:0000:0000:0000:0111
If one or more four-digit group(s) is 0000, the zeros may be omitted and replaced with two colons
(::). For example: set manager ip 2001:0db8:8a2e::0111
7
Ping the Manager from the Sensor to determine if your configuration settings to this point have
successfully established the Sensor on the network. At the prompt, type: ping <manager IP
address>
The success message " host <ip address> is alive " appears. If not, type show to verify your configuration
information and check to ensure that all information is correct. If you run into any difficulties, see
McAfee Network Security Platform Troubleshooting Guide.
8
Set the shared key value for the Sensor. This value is used to establish a trust relationship between the
Sensor and the Manager.
At the prompt, type:
set sensor sharedsecretkey
The Sensor then prompts you to enter a shared secret key value. Type the shared secret key value
at the prompt. The Sensor then prompts you to verify the value. Type the value again.
The shared secret key value must be between 8 and 25 characters of ASCII text. The shared secret
key value is case-sensitive. For example, IPSkey123
58
McAfee Network Security Platform 8.1
Installation Guide
Adding a Sensor
Configuration of a Sensor
9
5
(Optional, but recommended) Change the Sensor password. At the prompt, type:
passwd
The Sensor prompts you to enter the new password and prompts you for the old password.
A password must be between 8 and 25 characters, is case-sensitive, and can consist of any
alphanumeric character or symbol.
McAfee strongly recommends that you choose a password with a combination of characters that is
easy for you to remember but difficult for someone else to guess.
10 To exit the session, type
exit.
Verification of successful configuration
There are three ways to check that the Sensor is configured and available:
•
On the Sensor, type status (For more information on the status command, see the McAfee
Network Security Platform CLI Guide.)
•
In the Manager Dashboard, check the System Health status. (See if the Sensor is active. If the link
is yellow, click on the cell to see the System Faults on the Sensor. For more information on this
process, see McAfee Network Security Platform Manager Administration Guide.)
•
In the Manager, click System and select the Domain to which the Sensor belongs. Then click Devices
and select the Sensor. Then go to Setup | Monitoring Ports.. Look at the color of the button(s)
representing the ports on the Sensor, and check the color legend on the screen to see the status of
the Sensor's ports. (For more information on this process, see McAfee Network Security Platform
Manager Administration Guide.)
If you have difficulty in troubleshooting the above, see McAfee Network Security Platform
Troubleshooting Guide. Also, see McAfee Network Security Platform CLI Guide for a description of all
available CLI commands.
How to change Sensor values
Changing certain values on the Sensor, like the Sensor's name or Sensor IP address, require you to
"break trust" between the Sensor and the Manager before you make the change, and then re-establish
the communication with the Manager. Essentially, the Manager knows the Sensor by a specific set of
information; if you want to change any of it, you must re-establish the communication with the
Manager.
Changing any of these values requires you to "break trust" with the Manager:
•
Sensor name
Changing a Sensor's name requires you to delete it from the Manager and re-add it, or in other
words, re-configure the Sensor from the beginning. For instructions, see Add the Sensor to Manager
and then Configuring the Sensor.
•
Sensor shared secret
•
Manager IP
•
Sensor IP and subnet mask
See also
Add a Sensor to the Manager on page 55
Configure the Sensor on page 56
McAfee Network Security Platform 8.1
Installation Guide
59
5
Adding a Sensor
Configuration of a Sensor
Change the Sensor IP or the Manager IP
Task
1
On the Sensor, type deinstall.
This breaks the trust relationship with the Manager.
2
Type the command and the new value.
For example, type set manager IP 192.168.3.2.
3
Type the Sensor Shared Secret. (This value must match the value set for the Sensor in the Manager
interface.)
For example, set sensor sharedsecretkey. The Sensor then prompts you to enter a shared
secret key value. Type the shared secret key value at the prompt. The Sensor then prompts you to
verify the value. Type the value again.
The shared secret key value must be between 8 and 25 characters of ASCII text. The shared secret
key value is case-sensitive. For example, IPSkey123.
4
If you changed the Sensor IP address, then you must reboot the Sensor.
Type reboot. You must confirm that you want to reboot the Sensor.
How to add a secondary Manager IP
Note that this command is used to add an IP address for a second NIC in one Manager server; this is
not a command to use to set up a Manager Disaster Recovery peer—or Secondary—Manager.
To add a secondary Manager IP,
On the Sensor, type set manager secondary ip <A.B.C.D.>
Specify a 32-bit address written as four eight-bit numbers separated by periods, where A,B,C or D
represents an eight-bit number between 0-255.
For example, set manager secondary ip 192.168.3.19
Or
Type set manager secondary ip <A:B:C:D:E:F:G:H>
where <A:B:C:D:E:F:G:H> is a 128-bit address written as octet (eight groups) of four hexadecimal
numbers, separated by colons. Each group ( A,B,C,D etc.) is a group of hexadecimal numbers
between 0000-FFFF.
For example: set manager secondary ip 2001:0db8:8a2e:0000:0000:0000:0000:0111
If one or more four-digit group(s) is 0000, the zeros may be omitted and replaced with two colons
(::).
For example, set manager secondary ip 2001:0db8:8a2e::0111
Remove a secondary Manager IP
To remove a secondary Manager IP, type deletemgrsecintf
60
McAfee Network Security Platform 8.1
Installation Guide
6
Configuration of devices using the
Manager
This section discusses the concepts and configuration instructions for managing devices like the
Sensors and the NTBA Appliance using the Manager resource tree.
The Devices page can be accessed from the menu bar of the Manager. This page allows you to manage
the group of Network Security Sensors and/or NTBA Appliances integrated with the Manager. The
configuration settings for a specific domain specified under the Global tab sets general rules that are
applied by default to all physical devices added within the Manager. These added devices appear in the
list of devices visible in the Device drop down. These devices adopt the parent domains' general rules.
See also
Deploy pending changes to a device on page 77
Contents
Install Sensors using the wizard
Possible actions from the device list nodes
Specify proxy server for internet connectivity
Configure NTP server
Install Sensors using the wizard
This section describes the Sensor Installation Wizard in detail and provides information on how to use
the tool.
To get McAfee® Network Security Platform up and running, you need to add a Sensor to the Manager
and configure them as well. The Sensor Installation Wizard guides you through the steps involved in
adding and configuring Sensors. The Wizard enables you to complete the required steps in a
sequence.
To use this feature, you need to have Super User role in the root admin domain.
You can use the wizard only to install Sensors to the root admin domain.
McAfee Network Security Platform 8.1
Installation Guide
61
6
Configuration of devices using the Manager
Install Sensors using the wizard
Supported Sensor models
The Sensor installation using the wizard supports the following models:
•
You can install I-series and M-series Sensors using the wizard.
•
For I series Sensors:
•
•
For M series Sensors:
•
•
You can change port configuration (inline, tap, and span) and other configuration per port such
as, full duplex, speed, and apply policy per port, and finally push configuration changes.
For an IPS Sensor, you can change port configuration (inline, tap and span) and other
configuration per port such as, full duplex, speed, and apply policy per port and finally push
configuration changes.
This wizard does not support NTBA Appliance installation.
Add and configure Sensors
The process of adding and configuring a Sensor involves invoking the Sensor installation wizard,
importing signature sets from a local directory, adding a Sensor to the Manager, assigning port
configuration on a Sensor, pushing configuration to the Sensor, selecting the signature set update
method, downloading the latest signature set, configuring the Sensor using the command line
interface, applying policies to the interfaces on the Sensor, and viewing the Sensor installation
summary page.
Start the device installation wizard
Task
1
From Manager, go to Devices | <Admin domain name> | Global | Add Device Wizard to invoke the Add New Device
wizard.
To exit the wizard at any time, click the Global tab.
2
Click Next.
Select a signature set update method
In the Choose signature set update method page, you can identify the latest signature set available on your
Manager, and decide whether you need to download the latest signature set from the Update Server.
Task
1
Indicate how you want to obtain the latest signature set:
•
Importing Signature sets from a Local Directory – You can import the signature set into Manager from a
local directory.
•
Downloading the latest Signature set from McAfee Update Server -- You can download the latest signature set
from McAfee® Network Security Update Server (Update Server).
•
Skip Update Server authentication and signature set download -- Use this option to continue with the default
signature set that you received along with the Manager installation.
•
2
62
The Choose signature set method page displays the version of the current signature set available
on the Manager.
Click Next.
McAfee Network Security Platform 8.1
Installation Guide
Configuration of devices using the Manager
Install Sensors using the wizard
6
Tasks
•
Download the latest signature set on page 63
•
Import signature sets from a local directory on page 63
Download the latest signature set
To download the latest signature set from the Update Server:
Task
1
In the Choose signature set update method page, select McAfee Update Server option.
2
Click Next.
The Authentication page is displayed.
3
Enter the Customer ID and Customer password provided by McAfee.
4
Click Next.
The available signature sets are listed.
5
Select the required signature set version and then click Next.
The Signature set download status page is displayed.
6
Click Next after the download is complete.
After the signature set has been downloaded, the Add a Sensor page is displayed.
Import signature sets from a local directory
To import a signature set from a local directory
Task
1
In the Choose signature set update method page, select the Import signature set from local directoryoption.
2
Click Next.
The Import Attack Set page is displayed.
McAfee Network Security Platform 8.1
Installation Guide
63
6
Configuration of devices using the Manager
Install Sensors using the wizard
3
Click Browse to select the file from the directory.
4
Click Next.
The Import Status is displayed.
Figure 6-1 Import Status window
After the signature set has been pushed, the Add a Sensor page is displayed.
Add a Sensor to the Manager
To add a Sensor, perform the following steps:
Task
1
Click Devices | <Admin Domain> | Global | Add and Remove Devices. Click New.
2
Enter relevant details in the Add New Device dialog.
a
Enter the Device Name.
The Sensor name must begin with a letter. The maximum length of the name is 25 characters.
b
Enter the Sensor Type, IPS Sensor, Virtual HIP Sensor, NTBA Appliance, or Load Balancer.
c
Enter the Shared Secret. Re-enter to confirm.
The shared secret must be a minimum of 8 characters and maximum of 25 characters in length.
The key cannot start with an exclamation mark nor can have any spaces. The parameters that
you can use to define the key are:
•
26 alphabets: upper and lower case (a,b,c,...z and A, B, C,...Z)
•
10 digits: 0 1 2 3 4 5 6 7 8 9
•
32 symbols: ~ ` ! @ # $ % ^ & * ( ) _ + - = [ ] { } \ | ; : " ' , . <? /
The Sensor name and shared secret key that you enter in the Manager must be identical to
the shared secret that you will later enter during physical installation/initialization of the
Sensor (using CLI). If not, the Sensor will not be able to register itself with Manager.
3
Select the Updating Mode, either Online or Offline.
Selecting Offline enables Offline Sensor update.Online is the default mode.
64
McAfee Network Security Platform 8.1
Installation Guide
Configuration of devices using the Manager
Install Sensors using the wizard
4
Enter Contact Information and Location (optional)
5
Click Save.
6
An information box confirms successful addition of Sensor.
7
Click Next.
8
The new Sensor is listed in the Sensors page.
6
You can select the Sensor and click Edit to edit the Sensor settings.
Configure the Sensor using CLI
Task
1
Open a HyperTerminal session to configure the Sensor. This task is performed to establish the trust
with the Sensor
Figure 6-2 CLI window
For instructions, see Cabling the Console Port, McAfee Network Security Platform Sensor Product
Guide for your Sensor model.
2
At the login prompt, log on to the Sensor using the default username
admin and password admin123.
McAfee strongly recommends that you change the default password later for security purposes.
3
Set the name of the Sensor. At the prompt, type: set Sensor name <WORD>
Example: set Sensor name Engineering_Sensor1.
The Sensor name is a case-sensitive alphanumeric character string up to 25 characters. The string
can include hyphens, underscores, and periods, and must begin with a letter.
McAfee Network Security Platform 8.1
Installation Guide
65
6
Configuration of devices using the Manager
Install Sensors using the wizard
4
Set the IP address and subnet mask of the Sensor. At the prompt, type: set Sensor ip <A.B.C.D>
<E.F.G.H>
Specify a 32-bit address written as four octets separated by periods: X.X.X.X, where X is a number
between 0-255. For example: set Sensor ip 192.34.2.8 255.255.255.0
Setting the IP address for the first time-that is, during the initial configuration of the Sensor-does
not require a Sensor reboot. Subsequent changes to the IP address will, however, require that you
reboot the Sensor for the change to take effect. If a reboot is necessary, the CLI will prompt you to
do so. For information on rebooting, see the McAfee Network Security Platform Troubleshooting
Guide.
5
If the Sensor is not on the same network as Manager, set the address of the default gateway. At
the prompt, type: set Sensor gateway <A.B.C.D>
Use the same convention as the one for Sensor IP address. For example: set Sensor gateway
192.34.2.8.
6
Set the IP address of Manager server. At the prompt, type:
set Manager ip <A.B.C.D>.
Use the same convention as the one for Sensor IP address. Example: set Manager ip
192.34.3.2.
7
Ping Manager from the Sensor to determine if your configuration settings to this point have
successfully established the Sensor on the network. At the prompt, type:
ping <manager IP address>.
If the ping is successful, continue with the following steps. If not, type show to verify your
configuration information and check to ensure that all information is correct. If you run into any
difficulties, see the McAfee Network Security Platform Troubleshooting Guide.
8
Set the shared key value for the Sensor. This value is used to establish a trust relationship between
the Sensor and Manager. At the prompt, type:
set Sensor sharedsecretkey.
The Sensor then prompts you to enter a shared secret key value. Type the shared secret key value
at the prompt. The Sensor then prompts you to verify the value. Type the value again.
The shared secret key value must be between 8 and 25 characters of ASCII text. The shared secret
key value is case-sensitive. Example: IPSkey123
9
(Optional, but recommended) Change the Sensor password. At the prompt, type:
passwd.
The Sensor prompts you to enter the new password and prompts you for the old password.
The password must be a minimum of 8 characters in length, and can be upto 25 characters long.
The characters that can be used while setting a new password are:
•
26 alphabets: both upper and lower case are supported (a,b,c,...z and A, B, C,...Z)
•
10 digits: 0 1 2 3 4 5 6 7 8 9
•
Symbols: ~ ` ! @ # $ % ^ & * ( ) _ + - = [ ] { } \ | ; : " ' , . < /
The question mark (?) symbol is not supported in a Sensor password.
10 To exit the session, type exit.
66
McAfee Network Security Platform 8.1
Installation Guide
Configuration of devices using the Manager
Install Sensors using the wizard
6
11 Switch back to the Sensor Installation Wizard to continue with the Sensor installation. At this point
you are on the Sensor Discovery page.
12 Click Next.
View the discovery status of a Sensor
The Sensor [Sensor_name ] Discovery Status page shows whether connection has been established between
the Sensor and the Manager.
If the Sensor has not been added or if you had entered an incorrect shared secret key, then click Re-try
discovery and provide the correct details.
The action buttons on the page is described as follows:
Field
Description
Back
Brings you to the Add Sensor page.
Cancel
Cancels the discovery process of a Sensor in the network.
Re-try Discovery
Starts the discovery process once again.
Next
Moves you to the Edit Port configuration to Sensor page to configure port for a Sensor.
Assign port configuration on a Sensor
The Edit Port Configuration page is displayed.
You can edit the configuration for a particular port. To edit a port's configuration:
Task
1
Select a port from the list of ports displayed.
2
Click Edit.
3
Select the mode of operation for the port from the Operation Mode list:
4
5
•
Inline Fail-Open
•
Internal Tap
•
Span or Hub
•
Inline Fail-Close
Specify whether you want to connect the port from inside or outside using the Port Connected Network
list.
•
Port A (Inside) Port B (Outside)
•
Port A (Outside) Port B (Inside)
•
Not specified
Click Next.
The Assign policies to Sensor page is displayed. Select the policy from the list of policies and apply them
to the Sensor.
McAfee Network Security Platform 8.1
Installation Guide
67
6
Configuration of devices using the Manager
Install Sensors using the wizard
Apply policies to the interfaces on the Sensor
Task
1
Select a policy and apply them to Sensor, default policy applied is Default Inline IPS policy.
2
If required, change the applied policies for the interfaces on the Sensor.
All interfaces inherit a policy from the Sensor by default. The Sensor inherits the policy from the
parent admin domain, and takes the default Inline IPS policy by default.
3
Click Next.
The Signature Set Push Statuspage is displayed.
Push configuration to the Sensor
Task
1
Click Next to push the configuration information to the Sensor.
The Signature Set Push Status page is displayed.
2
Click Next.
The Sensor Installation Summary page is displayed.
View the Sensor installation summary page
Once the Sensor has been successfully installed, the Sensor Installation Summary page is displayed.
The following fields are displayed:
Field
Description
Sensor Name
Name of the Sensor
Sensor Model
Model of Sensor
Trust Status
The status of the trust: established or not
Applied Signature Set
Signature set version number applied to the Sensor
Interface Name
Ports on the Sensor
Operation Status
Status of the port: enabled or disabled
IP
Set the IP address of the Sensor
Mask
Set the subnet mask of the Sensor
Gateway
Set the address of the default gateway
VLAN ID
Set the VLAN ID of the monitoring ports.
Task
1
Click Done.
Installation Wizard welcome page is displayed to enable you to install another Sensor.
68
2
Repeat steps to add and configure another Sensor.
3
Click Resource Tree in the Resource pane to exit the wizard.
McAfee Network Security Platform 8.1
Installation Guide
Configuration of devices using the Manager
Possible actions from the device list nodes
6
Add and configure the XC Clusters
An XC Cluster in McAfee® Network Security Platform, comprising an XC-240 Load Balancer and
M-8000XC Sensors, functions like a single virtual Sensor. The XC Cluster handles traffic at wire-speed,
efficiently inspects, detects and prevents intrusions, misuse, denial of service (DoS) attacks, and
distributed denial of service (DDoS) attacks with a high degree of accuracy. It enables high traffic
loads to be processed by distributing the traffic flow to multiple Sensors to avoid congestion providing
a maximum throughput of 80 Gbps.
Once deployed, XC Clusters are configured and managed through the command line and the Manager.
For more information, see McAfee Network Security Platform XC Cluster Administration Guide.
Possible actions from the device list nodes
The four Device List node tabs are Devices (Device List), Configuration Update (download configuration to
devices), Software Upgrade, and Failover Pairs. The following actions are possible through these tabs:
•
Managing Devices — Add devices to the Manager; accept communication from an initialized,
physically installed and network-connected devices like IPS Sensors, NTBA Appliances or virtual HIP
Sensors to the Manager.
•
Updating the configuration of all devices — All changes done via the Configuration page that apply to
your Sensors are not pushed until you perform a Device List | Configuration Update | Update (all Sensors in
a domain) or Device List | Sensor_Name | Configuration Update | Update (single Sensor) action.
•
Updating software to all devices — Download software and signature files from the Manager via
McAfee® Network Security Update Server [formerly IPS Update Server]
•
Creating Failover Pairs — Pair two devices for failover operation.
Figure 6-3 Devices tab
See also
Deploy pending changes to a device on page 77
Update the latest software images on all devices on page 79
McAfee Network Security Platform 8.1
Installation Guide
69
6
Configuration of devices using the Manager
Possible actions from the device list nodes
Options available in the devices page
The Devices action presents a read-only view of operational and status details for all the devices added
under the devices node. Each installed device is displayed with its corresponding type, operating ports,
operating mode, administrative status, and Operational Status.
Using this page, you can configure physical devices like IPS Sensors, NTBA Appliance or Load Balancer
to the Manager. Once you add a device on the Device List node, you must establish between the
device and the Manager by executing the setup CLI command.
You can use this page to also add virtual HIP Sensors to the Manager. The trust establishment for the
Virtual HIP Sensor is done using McAfee ePO™ console.
See also
Edit device settings on page 76
Add a device using the wizard
Adding a device to the Manager enables the Manager to accept communication from a physically
installed and network-connected device. Once communication has been established, the Manager
allows editing of the device configuration. The alert data is available in the Threat Analyzer and Report
queries.
McAfee recommends adding a device to the Manager first. The Add Device Wizard will be displayed once the
Manager Initialization Wizard is completed.
70
McAfee Network Security Platform 8.1
Installation Guide
Configuration of devices using the Manager
Possible actions from the device list nodes
6
To add a device to the Manager:
Task
1
Click Devices | <Admin domain name> | Global | Wizards | Add Device.
Figure 6-4 Add Device link under the Wizard node
The Add Device page is displayed.
Figure 6-5 Add Device page
The Preparation page is displayed.
2
Click Next.
The Add New Device page is displayed.
3
Enter the device name.
The Name must begin with a letter and can contain alphanumeric characters, hyphens, underscores
and periods. The length of the name is not configurable.
4
Select the Device Type as IPS Sensor.
McAfee Network Security Platform 8.1
Installation Guide
71
6
Configuration of devices using the Manager
Possible actions from the device list nodes
5
Enter Shared Secret (repeat at Confirm Shared Secret).
The shared secret must be a minimum of 8 characters in length: the length of the shared secret is not
configurable. The shared secret cannot start with an exclamation mark or have any spaces. The
characters that can be used while creating a shared secret are as follows:
•
26 alpha: upper and lower case (a,b,c,...z and A, B, C,...Z)
•
10 digits: 0 1 2 3 4 5 6 7 8 9
•
32 symbols: ~ ` ! @ # $ % ^ & * ( ) _ + - = [ ] { } \ | ; : " ' , . <? /
IMPORTANT: The device name and shared secret are case-sensitive. The Device Name and Shared Secret
must also be entered on the device command line interface (CLI) during physical installation and
initialization. If not, the device will not be able to register itself with the Manager.
6
Select Updating Mode as Online or Offline. Online is the default mode.
Devices with Online update mode will have the signature set/software directly pushed to the devices.
Devices for which you want the signature set/software to be manually pushed can be done by
selecting the update mode as Offline.
7
[Optional] Enter the Contact Information and Location.
8
Click Next.
The Trust Establishment page is displayed.
9
Follow the instructions on the page to complete the command line interface (CLI) setup and click
Check Trust.
Using the command line interface (CLI), enter the necessary information for the device identification
and communication as described in Configure the Sensor on page 56. If you set up the device first,
you will need to return to the device after the Manager addition to reset the shared secret key and
begin device-to-Manager communication.
10 Click Next.
The Next button will be enabled once the trust between the device and the Manager is established.
The Port Settings page is displayed.
11 Make the necessary changes and click Next.
The Policy Assignments page is displayed.
12 Make the necessary changes and click Next.
The DNS Settings page is displayed.
The DNS Settings page is applicable only to M-series Sensor (software version above 7.0).
13 Configure the DNS server details. Click Next.
The Application Identification page is displayed.
The Application Identification page is applicable only to M-series Sensor (software version above 7.0).
14 Select the Enable Application Identifier? check box for the required ports. Click Next.
72
McAfee Network Security Platform 8.1
Installation Guide
Configuration of devices using the Manager
Possible actions from the device list nodes
6
15 Click Update to start update.
The Update Configuration page is displayed.
16 Click Finish.
You will now be able to see the device when you click on the Device drop-down.
Figure 6-6 Device added to the Device drop-down
Add the NTBA Appliance to the Manager
Adding an NTBA Appliance to the Manager enables the Manager to accept communication from a
physically installed and network-connected Appliance. After communication has been established, the
Manager allows editing of the Appliance configuration. The alert data is available in the Threat
Analyzer and Report queries.
You can add a device by selecting Devices | <Admin Domain Name> | Global | Add and Remove Devices but it is
recommended to use the Add Device Wizard to add all devices (except Virtual HIP Sensors) and to establish
the trust between the Manager and the device.
McAfee Network Security Platform 8.1
Installation Guide
73
6
Configuration of devices using the Manager
Possible actions from the device list nodes
Task
1
The Add Device Wizard window is displayed after the Manager Initialization Wizard is completed.
McAfee recommends adding an Appliance to the Manager first.
Select Devices | <Admin Domain Name> | Global | Add Device Wizard.
The Preparation page is displayed.
Figure 6-7 Add Device Wizard
2
Click Next.
The Add New Device page is displayed.
3
Enter the device name.
The name must begin with a letter and can contain alphanumeric characters, hyphens, underscores
and periods. The length of the name is not configurable.
4
Select the Device Type as NTBA Appliance.
5
Enter the Shared Secret (repeat at Confirm Shared Secret).
The device name and shared secret are case-sensitive. The Device Name and Shared Secret must also be
entered on the device command line interface (CLI) during physical installation and initialization. If
not, the Appliance will not be able to register itself with the Manager.
The shared secret must be a minimum of 8 characters in length: the length of the shared secret is not
configurable. The shared secret cannot start with an exclamation mark or have any spaces. The
characters that can be used while creating a shared secret are as follows:
6
74
•
26 alpha: upper and lower case (a,b,c,...z and A, B, C,...Z)
•
10 digits: 0 1 2 3 4 5 6 7 8 9
•
32 symbols: ~ ` ! @ # $ % ^ & * ( ) _ + - = [ ] { } \ | ; : " ' , . <? /
Select the updating mode.
McAfee Network Security Platform 8.1
Installation Guide
Configuration of devices using the Manager
Possible actions from the device list nodes
7
[Optional] Enter the Contact Information and Location.
8
Click Next.
6
The Trust Establishment page is displayed.
9
Follow the instructions on the page to complete the command line interface (CLI) setup and click
Check Trust.
Using the command line interface (CLI), enter the necessary information for the Appliance
identification and communication as described in Configure the Sensor on page 56. If you set up
the Appliance first, you will need to return to the Appliance after the Manager addition to reset the
shared secret key and begin Appliance-to-Manager communication.
10 Click Next.
The Next button will be enabled once the trust between the Appliance and the Manager is
established.
The Port Settings page is displayed.
11 Make the necessary changes and click Next.
The General Settings page is displayed.
12 Define essential NTBA Appliance settings, including flow record listening port and Ethernet port IP
settings. Click Next.
The DNS Settings page is displayed.
The DNS Settings page is applicable only to M-series and NS-series Sensors (software version above
7.0).
13 Configure the DNS server details. Click Next.
The Exporters page is displayed. You can add a new exporter or edit the existing one.
14 Define exporters that will forward records to the NBA Sensor for processing and click Next.
The Inside Zones page is displayed. You can add a new inside zone or edit the existing one.
15 Define inside zones and click Next.
The Outside Zones page is displayed. You can add a new outside zone or edit the existing one.
16 Define outside zones and click Next.
The Active Device Profiling page appears.
17 Select the Active Device Profiling checkbox and click Next.
The Update Configuration page is displayed.
18 Click Update to start update.
The Update Configuration page is displayed.
McAfee Network Security Platform 8.1
Installation Guide
75
6
Configuration of devices using the Manager
Possible actions from the device list nodes
19 Click Finish.
The NTBA Appliance appears added under the Device drop-down list in the Devices tab. It also
appears in the Add and Remove Devices in the Global tab.
Figure 6-8 Add and Remove Devices
20 To edit or delete an existing device, click Edit or Delete.
21 Skip the Chapter, Setting up Virtual NTBA Appliance on an ESX server, and proceed to Chapter,
Configuring NTBA Appliance settings.
Edit device settings
You can edit all the parameters except Device Type. The shared secret is the most important to note.
Changing the shared secret can be performed in the event you want to re-secure your system's
integrity.
McAfee recommends changing the Shared Secret from the Manager first. You do not have to immediately
change the shared secret in the device CLI; the Manager and the device will continue to communicate.
However, when you update the Shared Secret on the CLI, you must type the same value as entered in
this action.
To edit a device, do the following:
Task
1
Select Devices | <Admin Domain> | Global | Add and Remove Devices.
2
Select the device.
3
Click Edit.
4
Make the required changes.
5
Click Save to save the changes; click Cancel to abort.
Double asterisks indicate that the data for the field is missing or that data has been retrieved from
the database rather than from the device. This could indicate that the device is inactive or not
initialized.
See also
Options available in the devices page on page 70
76
McAfee Network Security Platform 8.1
Installation Guide
6
Configuration of devices using the Manager
Possible actions from the device list nodes
Delete a device configuration
To delete a previously added device, select the device from the by going to Devices | <Admin Domain> |
Global | Add and Remove Devices and click Delete. Confirm the deletion by clicking OK.
Do not delete the device from the Manager if you plan to generate reports with data specific to the
device.
If the device is in the middle of active communication with the database, deleting the device may not be
successful (the device still appears in the Resource Tree). If you experience this problem, check your
device to make sure communication to the Manager is quiet, then re-attempt the delete action.
Deploy pending changes to a device
When you make any configuration changes, or policy changes on the Manager, or a new/updated
signature set is available from McAfee, you must apply these updates to the devices (such as Sensors
and NTBA Appliances) in your deployment for the changes to take effect.
Note the following:
•
Configuration changes such as port configuration, non-standard ports and interface traffic types are
updated regardless of the changes made to the Sensor, interface/ subinterface.
•
NTBA configuration updates refer to the changes done in the various tabs of the Devices node.
•
Policy changes are updated on the Sensor or NTBA Appliance in case of a newly applied policy, or
changes made to the current enforced policy.
•
Signature updates contain new and/or modified signatures that can be applied to the latest attacks.
You can deploy the configuration changes to all the devices in the admin domain from the Global tab.
The navigation path for this is Devices | <Admin Domain Name> | Global | Deploy Pending Changes.
Alternatively, you can deploy the configuration changes at a device level by selecting Devices | <Admin
Domain Name> | Devices | <Device name> | Deploy Pending Changes. In this case, the Deploy Pending Changes option
is available in the menu only if the device is active.
Task
1
Select Devices | <Admin Domain Name> | Global | Deploy Pending Changes.
The Deploy Pending Changes page is displayed.
Figure 6-9 Deploy Pending Changes page
McAfee Network Security Platform 8.1
Installation Guide
77
6
Configuration of devices using the Manager
Possible actions from the device list nodes
The columns in the table are as follows:
2
•
Device Name — Unique name of each device
•
Last Update — Last day and time device configuration was updated
•
Updating Mode — Online or offline update mechanism selected for the device
•
Pending Changes — Summary of changes that have been made.
•
Configuration & Signature Set — A selected checkbox indicates that the device is to be updated for any
configuration change other than those related to SSL key management
•
Status— Displays the status of the Sensor during update.
Click Deploy.
The Manager processes these updates in three stages — Queued, Deploying, Completed — and
displays the current stage in the Status Column.
Figure 6-10 Configuration update
Status
Description
Queued
The Queued status indicates that the Manager is preparing to deploy updates to the
devices. If more than one device is being updated, devices are updated one at a time
until all downloads are complete. If you want to cancel the updates for certain devices,
click the X. Consider the following:
• The deployment of the configuration changes or signature file updates can be
cancelled for bulk updates only.
• Updates cannot be cancelled when deployed for individual devices.
• After you click Deploy, wait for five seconds before you start cancelling the updates for
devices.
• Once cancelled, the checkbox is deselected, suggesting that the update was cancelled.
There is no status change to indicate the cancellation of an update.
Deploying In this state, the configuration changes are applied to the devices. There is no option to
abort the update process for devices in which the deployment of updates are already in
progress. When the deployment is cancelled for any device, the item will still be
selected for future updates unless it is explicitly deselected.
Completed Shows that all the configuration changes have been updated for the devices.
3
78
Click Offline Update Files to view and export the deployment changes file to offline Sensors. The
changes can then be deployed to the Sensors manually using the CLI command window.
McAfee Network Security Platform 8.1
Installation Guide
Configuration of devices using the Manager
Possible actions from the device list nodes
4
Click Refresh to refresh the page and the status of the deployment.
5
Click Clear Status to clear the status column in the UI.
6
Clearing the status does not cancel the deployment. The update process will be running in the
background.
See also
Possible actions from the device list nodes on page 69
Configuration of devices using the Manager on page 4
Update the latest software images on all devices
Going to Devices | <Admin Domain Name> | Global | Deploy Device Software enables an on-demand download of
the latest software updates from your Manager to all of your Sensors under a Device List node. If
more than one version is available, select the most recent version (that with the highest version
number). If multiple versions are available for download, such as 7.1.1.4, 7.1.1.5, and 7.1.1.6, and
you select 7.1.1.6, previous versions (7.1.1.4 and 7.1.1.5) are still available for download. However, if
you upgrade to a new major version (7.1.x.x), previous major versions (6.1.x.x) are not available. The
latest version of software always contains the changes in every previous release. The Manager also
provides an option to concurrently perform the Sensor upgrade by selecting the Sensors in the Upgrade
field under Device List | Software Upgrade.
After software download to your Sensors, you must reboot all updated Sensors.
To download a software update, do the following:
Task
1
Select Devices | <Admin Domain Name> | Global | Deploy Device Software.
The Download Software to Devices page is displayed.
2
Select the New Version to be downloaded to the Sensor.
Figure 6-11 Software Upgrade window
3
To select a Sensor for update, select the check boxes (for the specific Sensor) in the Upgrade
column.
The Manager provides this option to concurrently perform the software upgrade for multiple
Sensors.
4
To select a Sensor for reboot, select the check boxes (for the specific Sensor) in the Reboot column.
By default the Reboot option is disabled. It gets enabled only after you select the Sensor(s) in the
Upgrade column. This option triggers a full reboot even if hitless reboot option is available for the
corresponding Sensors. The Reboot option can also be disabled if required.
McAfee Network Security Platform 8.1
Installation Guide
79
6
Configuration of devices using the Manager
Possible actions from the device list nodes
5
Click the Upgrade button to initiate the process.
6
The Offline Upgrade Files is used to update and export Offline Sensors.
Refresh enables you to see the new Sensor software version after reboot.
Clear Status is used for clearing the cached status.
See also
Possible actions from the device list nodes on page 69
Download software update files for offline devices on page 80
Download software update files for offline devices
Some users manage devices that are connected to the Manager across very low bandwidth links such
as dial-up links. In addition to the low bandwidth, these links may also be intermittent and may
corrupt a large file being downloaded. To alleviate this issue, the Manager provides an option to
generate and store the signature set file and/or software update files for the device on a CD is
provided. Users can ship the CD to the remote location and then use a TFTP server to transfer the file
onto the device.
The update files are encrypted using a symmetric key cipher. The download consists of the encrypted
signature set and/or image file and a meta information file that contains the details of the download
created. These three files are zipped together to create a download file that can be saved on CD and
later be uploaded to the device via TFTP. This is illustrated as follows:
Figure 6-12 Encryption process
See also
Configure a new device for offline signature set update on page 81
Update configuration for offline devices on page 82
Update software for offline devices on page 83
Configure an existing device for offline signature set update on page 81
Export software for offline devices on page 82
Export software for offline devices on page 84
Update the latest software images on all devices on page 79
80
McAfee Network Security Platform 8.1
Installation Guide
Configuration of devices using the Manager
Possible actions from the device list nodes
6
Configure a new device for offline signature set update
The Manager provides an option to generate and store the signature set and/or device image file on
an application directory. You can export the generated file to a directory or a CD, manually ship the CD
to a remote location, and then use a TFTP server to transfer the file onto the device.
You can select the device Update Mechanism mode while adding a new device. By default, all devices
added to the Manager have the update mode as Online. Devices with Online update mode will have the
signature set / software directly pushed to the devices as it has been done in the past. Devices for
which you want the signature set /software to be manually pushed can be done by selecting the
update mode as Offline. You can edit the update mode later, if required.
Follow this procedure to configure a new device for Offline update:
Task
1
Click Devices | <Admin Domain> | Global | Add and Remove Devices
2
Click New.
The Add New Device page is displayed.
3
Enter a name against Device Name, Select IPS Sensor against Device Type, Enter Shared Secret and Confirm
Shared Secret.
4
Select Offline under Updating Mode and click Save.
The device is configured for Offline update.
The Updating Mode configured on the Primary device of the Fail Over - Pair determines the signature
file generation for download.
If the Primary device is configured for OfflineUpdating Mode, then two individual signature files are
generated for Primary and Secondary devices, irrespective of the Secondary device configuration.
If the Primary device is configured for OnlineUpdating Mode, then signature file will be downloaded
online to both devices, irrespective of the Secondary device configuration.
See also
Download software update files for offline devices on page 80
Configure an existing device for offline signature set update
Follow this procedure to configure an existing device for offline signature set update:
Task
1
Click Devices | <Admin Domain> | Global | Add and Remove Devices to view the list of devices configured.
2
Select the device and click Edit. Select Offline against Updating Mode and click Save.
3
The information box confirms a successful edit. The device is configured for Offline update.
The Updating Mode configured on the Primary device of the Failover - Pair determines the signature file
generation for download.
If the Primary device is configured for Offline Updating Mode, then two individual signature files are
generated for Primary and Secondary devices, irrespective of the Secondary device configuration.
If the Primary device is configured for Online Updating Mode, then signature file will be downloaded
online to both devices, irrespective of the Secondary device configuration.
McAfee Network Security Platform 8.1
Installation Guide
81
6
Configuration of devices using the Manager
Possible actions from the device list nodes
See also
Download software update files for offline devices on page 80
Update configuration for offline devices
Follow this procedure for updating device configuration for offline devices:
Task
1
Click Devices | <Admin Domain> | Global | Deploy Configuration Changes.
2
The list of devices for which configuration can be downloaded are listed under Configuration Update.
Select the Configuration Update check box against the device listed as Offline in the Updating Mode column.
Click Update.
3
The update is listed under Sigfile for Offline Sensors in the Configuration Update tab on the Device List node
and is ready for export.
The Updating Mode configured on the Primary device of the Fail Over - Pair determines the signature
file generation for download.
If the Primary device is configured for OfflineUpdating Mode, then two individual signature files are
generated for Primary and Secondary device, irrespective of the secondary device configuration.
If the Primary device is configured for OnlineUpdating Mode, then signature file will be downloaded
online to both devices, irrespective of the secondary device configuration.
See also
Download software update files for offline devices on page 80
Export software for offline devices
Follow this procedure to export a signature set for offline devices:
Task
1
Click Devices | <Admin Domain> | Devices | Maintenance | Export Configuration .
Figure 6-13 IPS Sensors tab
2
Select radio button under the Export File column in the device listed under Available Configuration Files for
Offline Devices. Click Export.
3
Select the Save File option. Click OK and save the signature file in the desired location in the local
machine.
Tasks
•
82
Perform an offline download of the signature set on page 83
McAfee Network Security Platform 8.1
Installation Guide
Configuration of devices using the Manager
Possible actions from the device list nodes
6
See also
Download software update files for offline devices on page 80
Perform an offline download of the signature set
To perform an offline download of the signature set:
Task
1
Copy the signature set to the tftp server.
2
Connect to the device through CLI and configure the tftp server IP.
3
Execute the loadconfiguration signature filename.
4
Once the signature file is copied on to the device, check with "downloadstatus" command in the CLI
to get the status.
Update software for offline devices
Follow this procedure for updating device configuration for offline devices:
Task
1
Click Devices | <Admin Domain> | Global | Deploy Device Software.
Figure 6-14 Configuration Update sub-tab
McAfee Network Security Platform 8.1
Installation Guide
83
6
Configuration of devices using the Manager
Possible actions from the device list nodes
2
The list of devices for which software can be downloaded are listed under Deploy Device Software table.
Select the checkbox against the device listed as Offline in the Upgrade column. Click Update.
Figure 6-15
3
Download Status dialog
The update is listed under Available Configuration Files for Offline Devices in the Configuration Update table is
ready for export.
See also
Download software update files for offline devices on page 80
Export software for offline devices
Follow this procedure to export a signature set for offline devices:
Task
1
Click Devices | <Admin Domain> | Devices | <Device Name> | Maintenance | Export Configuration.
Figure 6-16 Device List tab
2
Select all required configuration that you wish to export and click Export column.
3
Select the Save File option. Click OK and save the device software in the desired location.
Tasks
•
Import software for offline devices on page 85
See also
Download software update files for offline devices on page 80
84
McAfee Network Security Platform 8.1
Installation Guide
Configuration of devices using the Manager
Possible actions from the device list nodes
6
Import software for offline devices
To perform an offline download of the device software:
Task
1
Set up the Manager and device.
2
Import the device image jar file on to the Manager, using Manage | Updating | Manual Import.
3
Click Deploy Device Software, which is also located under the Updating tab.
4
Select the device and image to apply and click Upgrade. The offline image is generated in the same
page below, under Available Upgrade Files for Offline Devices.
5
Execute the loadconfiguration imagefile name from the CLI.
6
Once the imagefile copied on to the device (it takes some time), check with "downloadstatus"
command in the CLI to get the status.
7
Reboot the device on successful loading of the image.
Manage failover pairs
When you go to Devices | <Admin Domain Name> | Global | Failover Pairs, you can add new failover pairs. A
failover pair will be managed just as any other device is managed, by going to Devices | <Admin Domain
Name> | <Device Name> | Devices
Using the Failover Pairs tab, you can enable failover configuration for two identical Network Security
Sensor models. The term "failover pair" refers to the pair of devices that constitute the
Primary-Secondary arrangement required for failover functionality. The Primary/Secondary designation
is used purely for configuration purposes and has no bearing on which device considers itself active.
Primary device designation determines which device's configuration is preserved and copied to the
Secondary device by Manager. Both devices receive configuration and update changes from Manager;
however, the Secondary accepts the changes as if they are coming directly from the Primary device. In
the event of primary failure, the Secondary device will see all changes as coming directly from
Manager.
Two devices in a failover pair can have different fail-open/fail-closed settings. It is possible to
configure, for example, one device to fail open, and the second device to fail closed. The intended use
of this option is in an Active-Standby configuration with the Active link configured to fail closed (to
force traffic to the standby link in case of failure), and the Standby link configured to fail open (to
provide uninterrupted traffic flow should both devices fail).
For more information on high availability using failover pairing, see the McAfee Network Security
Platform IPS Administration Guide.
I-series Sensor model
Port(s) used for failover
I-4010
6A and 6B
I-4000
2A and 2B
I-3000
6A and 6B
I-2700
4A. Note that 4B remains unused.
I-1400
Response Port (R1)
I-1200
Response Port (R1)
McAfee Network Security Platform 8.1
Installation Guide
85
6
Configuration of devices using the Manager
Possible actions from the device list nodes
M-series Sensor model
Port(s) used for failover
M-8000
3A and 3B
M-6050
4A. Note that 4B remains unused.
M-4050
2A
M-3050
2A
M-2950
6A
M-2850
6A
M-1450
4A
M-1250
4A
NS-series Sensor model
Port(s) used for failover
NS9300
G1/1 and G1/2 (40G QSFP+)
NS9200
G0/1
NS9100
G0/1
NS7300
G0/1 (10G SFP+)
NS7200
G0/1 (10G SFP+)
NS7100
G0/1 (10G SFP+)
To configure two devices for failover, do the following:
Task
1
Click Devices | <Admin Domain> | Global | Failover Pairs.
2
Click New. The Add a Failover Pair dialog opens.
The Add button shows up in the UI only when there are at least two devices of the same model in
the Device List node and a failover pair has not been created using these two devices.
3
Select the Model. Both devices in a failover pair must be the same model.
4
Type a failover pair Name that will uniquely identify the grouping.
5
Select the Template Device from the drop-down menu.
6
Select the Peer Device from the drop-down menu.
Figure 6-17 Add a Failover Pair window
86
McAfee Network Security Platform 8.1
Installation Guide
Configuration of devices using the Manager
Specify proxy server for internet connectivity
6
7
Enable or disable Fail open for the failover pair as per your requirement. By default, it is disabled.
8
Click Create; click Cancel to abort. Upon saving, a message informs you that the failover pair creation
will take a few moments. Click OK. The new failover pair will appear as a child node of the devices
node under which it was created.
If you have created a failover pair while maintaining an open Threat Analyzer window, the Threat
Analyzer will continue to report alerts from both the Primary and Secondary devices, respectively,
identifying each device by the given device name and not by the name of the failover pair. This may
cause confusion in the event that both devices detect identical alerts. (In true failover operation, if
both devices detect the same alert, only one alert instance is reported with the name of the failover
pair as the identifying device.) Restart the Threat Analyzer for proper alert reporting. The same is
true in reverse if a failover pair is deleted. You must restart the Threat Analyzer to view alerts
separately from each device.
Tasks
•
Changing reserved VLAN ID within a failover pair on page 87
Changing reserved VLAN ID within a failover pair
In cases where the reserved device VLAN ID conflicts with one already used on your network, change
the reserved VLAN ID.
The Device Reserved VLAN ID field is displayed only for I-3000 and I-4010 models.
To change the reserved VLAN ID for a Failover Pair:
Task
1
Select the Manage Cluster Configuration tab for the failover pair interface. (Failover-Pair-Name | Physical Failover
Pair | Cluster Settings)
2
Type a new Device Reserved VLAN ID.
3
Click Submit.
Specify proxy server for internet connectivity
If you employ a proxy server for internet connectivity, you can configure the Manager or your devices
to connect to that server for proxy service. This is necessary if you want to download updates directly
to Manager from the update server or if you wish to download host reputation and country of origin
information during integration with McAfee® TrustedSource™.
The Manager supports application-level HTTP/HTTPS proxies, such as Squid, iPlanet, Microsoft Proxy
Server, and Microsoft ISA.
To use Microsoft ISA, you must configure this proxy server with basic authentication. Network Security
Platform does not support Microsoft ISA during NTLM (Microsoft LAN Manager) authentication.
SOCKS, a network-level proxy, is not currently supported by Network Security Platform.
Follow this procedure to specify your proxy server:
Task
1
Select Manage | <Admin Domain> | Setup | Proxy Server.
The Proxy Server page is displayed.
McAfee Network Security Platform 8.1
Installation Guide
87
6
Configuration of devices using the Manager
Configure NTP server
2
Select the Use a Proxy Server? checkbox.
3
Enter the Proxy Server Name or IP Address. This can be either IPv4 or IPv6 address.
4
Enter the Proxy Port of your proxy server.
5
Enter User Nameand Password.
6
Provide the appropriate URL. You may test to ensure that the connection works by entering a Test
URL and clicking Test Connection.
7
Click Save to save your settings.
When the Manager or the device makes a successful connection, it displays a message indicating
that the proxy server settings are valid.
Configure NTP server
NTP support allows you to configure the Sensor as an NTP client that synchronizes time from a public
NTP server instead of updating time only with the Manager server.
If NTP is configured and Manager connectivity is established, then the Sensor receives time from both
the NTP server and the Manager. If there is loss of connectivity with either the Manager or NTP server,
then the other takes over as the time source.
The Manager should be synced with an NTP server, prior to starting NTP on the Sensor. Not doing this
will break the communication between the Sensors and the Manager.
If the Manager is not using the time received from the NTP server then while switching from NTP
server to the Manager and vice versa, there might be issues because of the time difference.
To specify your NTP server, do the following:
Task
1
Select Devices | <Admin Domain Name> | Global | Default Device Settings | Common | NTP.
The NTP Server page appears.
The NTP can also be configured for each device as well.
2
To enable communication with the NTP server, select Enable NTP Server?
To stop NTP from the Manager, unselect this option.
3
Configure the two NTP servers: the Sensor will use one of the configured NTP severs based on least
RTT (Round-Trip Time).
a
Type the IP Address. This can be an IPv4 or IPv6 address.
b
Enter the Polling Interval. The range is 3 ~ 17. The configured polling interval is applied as 2^x
seconds (2 power x).
c
Select Authentication to enable authenticating the NTP servers.
d
Enter the Authentication Key and Authentication Key ID.
e
Select the Authentication Key Type; MD5, SHA, or SHA1.
The parameters in d and e are provided by the NTP service provider.
88
McAfee Network Security Platform 8.1
Installation Guide
Configuration of devices using the Manager
Configure NTP server
f
Click on the Test Connection button to check the connectivity to the NTP server. The status of the
connectivity tests is displayed in the NTP page.
g
Click Save to save your settings.
6
The IPv4 and IPV6 addresses are mutually exclusive. At any configuration either the IPV4 or
IPV6 address will be used. For the IPV6 address to work, the Sensor management port should be
assigned an IPV6 address.
Figure 6-18 Configure NTP servers
McAfee Network Security Platform 8.1
Installation Guide
89
6
Configuration of devices using the Manager
Configure NTP server
90
McAfee Network Security Platform 8.1
Installation Guide
7
Managing configuration for each device
The Devices tab in the Devices page represents the physical Sensor installed in your network. Each
device is a uniquely named (by you) instance of a Sensor. All actions available in the <Device_Name>
page customize the settings for a specific Sensor.
After properly installing and initializing a Sensor, then adding the Sensor to the Manager, it appears in
the Device drop down list, where it was added, and inherits all of the configured device settings. After
adding a device, the device can be specifically configured to meet user requirements by selecting the
uniquely named device node.
For more information on interfaces and subinterfaces, see Network Security Platform IPS
Administration Guide.
Many device configurations performed within the Devices page do not immediately update to the
devices. You must perform either update the configuration of all devices or the specific device to push
the configuration information from Manager to your device.
The <Device_Name> page for a Sensor in general contains Summary, Policy, Setup, Maintenance, Troubleshooting,
Deploy Configuration Changes, and IPS Interfaces pages.
Contents
Configuration and management of devices
Troubleshooting your device configuration
Management of device access
Configuration and management of devices
The <Device_Name> once selected from the drop down sets specific rules for the chosen device. The
available actions are as follows:
•
Viewing the details of a selected Device— View/edit a device details.
•
Configuring device monitoring and response ports— View/edit the parameters of ports on a specific
device.
•
Updating the software on a Device— Update the software on a device.
McAfee Network Security Platform 8.1
Installation Guide
91
7
Managing configuration for each device
Configuration and management of devices
•
Rebooting a Device— Reboot a device.
•
Shutting down a Device— Shut down (turns off) a device.
Update configuration of a Sensor or an NTBA Appliance
Configuration updates refer to changes to device and interface/subinterface configurations, such as
port configuration, non-standard ports, interface traffic types, and configuration changes to the Sensor
or NTBA Appliance.
Signature updates have new and modified signatures that can apply to the attacks enforced in a
chosen policy. Policy changes update the device in case of a newly applied policy or changes made to
the current enforced policy.
You can schedule configurations to be pushed to the NTBA Appliances and Sensors from Manage | <Admin
Domain Name> | Automatic Updating | IPS Signature Sets. The Automatic IPS Signature Set Deployment options allow you
to set the time when these configurations can be deployed on Sensors and NTBA. Configurations are
automatically deployed based on schedule.
All configurations in the Policy page that apply to your Sensors or NTBA Appliance can also be manually
pushed from Devices | <Admin Domain Name> | Global | Deploy Pending Changes (all Sensors and NTBA Appliance
in a domain) or Devices | <Admin Domain Name> | Devices | <NTBA Appliance> | Deploy Pending Changes (to a single
Sensor or NTBA Appliance) action.
Scheduled deployment
1
Select Manage | <Admin Domain Name> | Automatic Updating | IPS Signature Sets. The IPS Signature Sets page is
displayed.
Figure 7-1 IPS Signature Sets page
2
92
From the Automatic IPS Signature Set Deploymentoptions set the schedule for deploying signature updates:
•
For Deploy in Real Time, select Yes. (This option pushes signature sets update to all Sensors and
NTBA Appliances immediately after it is downloaded to the Manager.) By default, No is the
default option.
•
For Deploy at Scheduled Interval, select Yes to schedule for automatic deployment of signature sets.
McAfee Network Security Platform 8.1
Installation Guide
Managing configuration for each device
Configuration and management of devices
•
•
3
7
In Schedule, set the frequency by which you want the Manager to check for a newly downloaded
signature set. The choices are:
•
Frequently — Several times a day during a specified period at interval indicated in the Recur
every option
•
Daily — Once a day
•
Weekly — Once a week
Select the Start Time, End Time, and Recur every options to specify intervals. Based on Schedule
frequency, these fields allow you to select options.
Click Save.
On-demand deployment
Task
1
Select Devices | <Admin Domain Name> | Devices | <NTBA Appliance> | Deploy Pending Changes.
The Deploy Pending Changes page is displayed.
Figure 7-2 Deploy Pending Changes page
2
View the update information. If changes have been made, the Configuration & Signature Set column is
checked by default.
3
Click Update.
A pop-up window displays configuration download status.
Update software for a Sensor or NTBA Appliance
The Upgrade action enables an on-demand download of the latest or earlier software updates for a
Sensor or NTBA Appliance from your Manager. All the software versions, applicable to the device and
available in the Manager are listed. From this, you can choose the version that you want to push to
the device. These versions are the ones that you downloaded from the update server onto your
Manager.
You can only update online devices. Make sure it is discovered, initialized, and connected to the
Manager.
You can switch between different minor versions of the device software. Consider the scenario where
you downloaded 6.0.1.1, 6.0.1.2, and 6.0.1.3 versions for M6050 Sensors from the update server onto
the Manager. Also, assume that currently the M6050 Sensor that you want to update is on 6.0.1.2. You
can now update this Sensor to either 6.0.1.1 or 6.0.1.3. Subsequently, you can also revert to 6.0.1.2.
However, you cannot switch between major versions of the software through the Manager. For example,
you cannot switch between 6.0 and 5.1 versions of device software using the Manager.
After you update the software of a device, you must restart it.
McAfee Network Security Platform 8.1
Installation Guide
93
7
Managing configuration for each device
Troubleshooting your device configuration
Task
1
Click Devices | <Admin Domain Name> | Devices | <Device Name> | Maintenance | Deploy Device Software.
The Deploy Device Software page is displayed.
In case of Sensors in fail-over pair, select a Sensor under the fail-over pair name node, and then
select Upgrade.
<Device_Name> refers to name of the Sensor or NTBA Appliance.
2
Select the required version from the Software Ready for Installation section.
The Software Ready for Installation section lists the applicable versions of software that you downloaded
from the update server (Manage | Updating | Download Device Software).
3
Click Upgrade.
When a device is being updated, it continues to function using the software that was present
earlier.
4
After the update is complete, restart the Sensor or NTBA Appliance.
If the device that you updated is a Sensor in a fail-over pair (not applicable to NTBA Appliance),
then update the other Sensor in the pair also to the same version. Note that both the Sensors of a
fail-over pair need to be of the same software version.
Shut down a Sensor or NTBA Appliance
The Shut Down action turns off a Sensor or an NTBA Appliance with no restart.
Task
1
Select Devices | <Admin Domain Name> | Devices | <Device Name> | Maintenance | Shut Down.
The Shut Down page is displayed.
2
Click Shut Down Now.
The <Device Name> could be a Sensor or an NTBA Appliance.
Troubleshooting your device configuration
Using the Troubleshooting tab, you can perform the following actions:
•
Upload a diagnostic trace
•
Enable layer 2 settings
Upload diagnostics trace
The Diagnostics Trace action uploads a device diagnostics log from a Sensor or NTBA Appliance to your
Manager server. The diagnostics file includes debug, log, and other information that can be used to
determine device or NTBA Appliance malfunctions or other performance issues. Once uploaded to your
Manager, this file can be sent through email to McAfee Technical Support for analysis and
troubleshooting advice.
94
McAfee Network Security Platform 8.1
Installation Guide
Managing configuration for each device
Management of device access
7
Task
1
Select Devices | <Admin Domain Name> | Devices | <Device Name> | Troubleshooting | Diagnostics Trace.
The <Device Name> could refer to a Sensor or an NTBA Appliance.
The Diagnostics Trace page is displayed.
Figure 7-3 Diagnostics Trace page
2
Select the Upload? checkbox if it is not already selected.
3
Click Upload.
The status appears in the Upload diagnostics Status pop-up window.
4
Click Close Window when the message "DOWNLOAD COMPLETE" appears. The trace file is saved to
your Manager server at:
<Install Dir> \temp \tftpin \< Device Name \trace\. Once downloaded, the file also
appears in the Uploaded Diagnostics Trace Files dialog box under this action.
5
[Optional] Export a diagnostics file to a client machine by selecting the file from the Uploaded
Diagnostics Files listed and clicking Export. Save this file to your client machine. Saving the file is
particularly useful if you are logged in remotely, need to perform a diagnostics trace, and send the
file to technical support.
Management of device access
From the device Access tab, you can perform the following actions:
•
Configure TACACS+ authentication
•
Manage NMS users
•
Manage NMS IPs
Configure TACACS+ authentication
The TACACS+ action enables you to enable and disable TACACS+ authentication for the selected
device.
Task
1
Select Devices | <Admin Domain Name> | Devices | <Device_Name> | Setup | Remote Access | TACACS+.
2
Select Yes to enable TACACS+.
3
Select Inherit from Parent Domain to use the TACACS+ settings in the parent domain.
McAfee Network Security Platform 8.1
Installation Guide
95
7
Managing configuration for each device
Management of device access
4
Enter the TACACS+ Server IP Address in the IP Address fields; you can enter up to four IP Addresses
for the TACACS+ server. At least one IP Address is required if you enable TACACS+.
5
Select Yes to Enable Encryption.
When you enable encryption, you need to enter an encryption key in the Enable Encryptionfield. The
maximum length of the key is 64 bytes.
6
Click Save to save the configuration.
Management of SNMPv3 users
The SNMPv3 Users tab enables you to manage SNMP users at the device level.
The device has to be in the active state to manage SNMP users. The device can create its own SNMP
users or can associate users from the domain. Only 10 users can be configured in the device.
During export and import of device configuration, only the users created in the device directly are
considered, the users allocated from the domain are not considered.
The SNMP users function allows you to do the following:
•
Allocating users from domain— Add available users from domain to the device.
•
Adding new SNMP users to the Devcie— Add new users to the device.
•
Editing a SNMP User— Edit the NMS users.
•
Deleting an SNMP User— Delete allocated NMS users from device or delete new users from devices.
Figure 7-4 SNMPv3 Users sub-tab
Only 10 users can be allocated or added onto the device.
Add new SNMP users to the device
You can add SNMP users at the device level.
96
McAfee Network Security Platform 8.1
Installation Guide
Managing configuration for each device
Management of device access
7
To add SNMP user do the following:
Task
1
Select Devices | <Admin Domain Name> | Devices | <Device_Name> | Setup | Remote Access | NMS | NMS Users.
2
Click New.
Figure 7-5 Add SNMPv3 User Account dialog
The Add SNMPv3 User Account dialog is displayed.
3
Enter the User Name.
The length of the user name should be between 8 to 31 characters. It can consist of alphabets and
numerals. Special characters and spaces are not allowed.
4
Enter the Authentication Key (re-enter at Confirm Authentication Key).
5
Enter the Private Key (re-enter at Confirm Private Key).
The length of the Authentication and Private key should be between 8 to 15 characters.
Since the communication is over SNMP version 3, the supported authentication protocol is "MD5"
and encryption algorithm is "DES".
6
Click Save.
The user is now added to the device and is displayed in the NMS User table.
Edit a SNMP user
Users created only at the device level are editable from the Device Settings tab of the specific device.
To edit a previously added SNMP user, do the following:
Task
1
Select Devices | <Admin Domain Name> | Devices | <Device_Name> | Setup | Remote Access | NMS | NMS Users.
2
Select the SNMP user created in the device from the list.
3
Click Edit.
4
Enter the Authentication Key and Private Key (confirm at Confirm AuthenticationKey and Private Key).
5
Click Save; click Cancel to abort.
Delete an SNMP user
SNMP users can be deleted at the device settings level.
McAfee Network Security Platform 8.1
Installation Guide
97
7
Managing configuration for each device
Management of device access
To delete an SNMP user, do the following:
Task
1
Select Devices | <Admin Domain Name> | Devices | <Device_Name> | Setup | Remote Access | NMS | NMS Users.
2
Select the user from the SNMP User List.
3
Click Delete.
4
Confirm deletion by clicking OK.
If an allocated user (user created at domain) is deleted, it is deleted only at the device settings level
and not from the domain.
Management of NMS IP addresses
The NMS IP action allows you to do the following:
•
Allocating IP addresses from domain— Add IP addresses to device.
•
Adding new NMS IP address to the device— Allocate available IP addresses from the domain.
•
Deleting NMS IP addresses— Delete NMS IP addresses from device and domain.
Third-party NMS (SNMP over IPv6) is supported only on 8500 ports of I-series Sensors. NMS will not
work for default port 161 of I-series, M-Series and NS-Series Sensors.
Add new NMS IP address to the device
To add NMS IP addresses to the device from the Manager, do the following:
Task
1
Select Devices | <Admin Domain Name> | Global | Default Device Settings | Common | Remote Access | NMS |
Permitted NMS
2
Click New.
Figure 7-6 Add NMS IP dialog
The Add NMS IPpage is displayed.
3
In IP Address, enter the NMS IP address. You can enter either IPv4 or IPv6 address.
While adding NMS IP address, you can add a maximum of 10 IPv4 addresses and 10 IPv6 addresses.
4
Click Save.
Delete NMS IP addresses
NMS IP addresses can be deleted from the device and from the domain.
98
McAfee Network Security Platform 8.1
Installation Guide
Managing configuration for each device
Management of device access
7
To delete NMS IP addresses, do the following:
Task
1
Select Devices | <Admin Domain Name> | Global | Default Device Settings | Common | Remote Access | NMS | NMS
Devices.
2
Select the IP from the Permitted List.
3
Click Delete.
4
Confirm Deletion by clicking OK.
If allocated IP addresses are deleted, then it is deleted only from the device and not from the
domain.
Users can communicate to the device from only the NMS IP addresses added above. User may be
able to communicate with the device until 180 inactive seconds from the deleted IP address, if a
request is made from the same IP address before 180 seconds, then the connection from that IP
address is still valid for another 180 seconds.
McAfee Network Security Platform 8.1
Installation Guide
99
7
Managing configuration for each device
Management of device access
100
McAfee Network Security Platform 8.1
Installation Guide
8
Configuration of the Update Server
After installing the Manager software, one of the first tasks you will perform is setting the schedule for
receiving updates from the McAfee® Network Security Update Server (Update Server). These updates
include signature files for your Sensors and software for your Manager and/or Sensors.
You can only perform one download/upload at a time from any Network Security Platform component,
including the Update Server.
You can perform the following actions using the Update Server:
•
Downloading software updates— Download the latest Sensor or NTBA Appliance software image file
from the Update Server to the Manager.
•
Downloading signature set updates— Download the latest attack and signature information from
the Update Server to the Manager.
•
Automating updates— Configure the frequency by which the Manager checks the Update Server for
updates, and the frequency by which Sensors and NTBA Appliances receive signature updates from
the Manager.
•
Manually importing a Sensor and NTBA Appliance image or signature set— Manually import
downloaded Sensor or NTBA Appliance software image and signature files to the Manager.
For more information on the Update Server, see McAfee Network Security Platform Manager
Administration Guide.
McAfee Network Security Platform 8.1
Installation Guide
101
8
Configuration of the Update Server
102
McAfee Network Security Platform 8.1
Installation Guide
9
Uninstallation of the Manager/Central
Manager
You uninstall McAfee® Network Security Manager (Manager) and McAfee® Network Security Central
Manager (Central Manager) using the standard Windows Add/Remove Programs feature.
Contents
Uninstall using the Add/Remove program
Uninstall using the script
Uninstall using the Add/Remove program
You must have Administrator privileges on your Windows server to uninstall McAfee Network Security
Manager (Manager) or McAfee Network Security Central Manager (Central Manager). Follow the steps
given below for uninstalling Central Manager and Manager.
To uninstall the Manager software:
McAfee recommends you stop the Manager service and applicable Java services before starting an
uninstall. If not, you will have to manually delete files from the Network Security Platform program
folder.
McAfee Network Security Platform 8.1
Installation Guide
103
9
Uninstallation of the Manager/Central Manager
Uninstall using the Add/Remove program
Task
1
Go to Start | Settings | Control Panel | Add/Remove Programs and select Network Security Platform.
Figure 9-1 Uninstall Manager window
104
McAfee Network Security Platform 8.1
Installation Guide
9
Uninstallation of the Manager/Central Manager
Uninstall using the script
2
Click Uninstall to start the uninstallation process.
3
After uninstallation, the message All items were successfully uninstalled is displayed.
Figure 9-2 Uninstall Complete window
Uninstallation of the Network Security Platform database (MySQL) is not part of this uninstallation.
Uninstall using the script
You can also uninstall the McAfee Network Security Manager (Manager)/McAfee Network Security
Central Manager (Central Manager) by executing a script from the Network Security Platform program
folder.
To uninstall via script:
Task
1
Navigate to the directory containing the uninstallation script. The default path is: <Network Security
Platform installation directory>\UninstallerData
2
Run
Uninstall ems.exe.
McAfee Network Security Platform 8.1
Installation Guide
105
9
Uninstallation of the Manager/Central Manager
Uninstall using the script
106
McAfee Network Security Platform 8.1
Installation Guide
Index
A
about this guide 5
anti-virus software 18
authenticated proxy server 87
Authenticated Proxy server 69, 70, 76
B
Browser display settings 13
C
cable specifications 51
CAC authentication 42
Central Manager
shutting down 45
client connections
closing 46
communication 55
configuration 54, 91
control panel
shutting down 47
conventions and icons used in this guide 5
diagnostics trace
upload 94
documentation
audience for this guide 5
product-specific, finding 6
typographical conventions and icons 5
F
fail-closed dongle specification 52
fail-open functionality
about; fail-closed functionality 79, 87
failover pairs
manage 85
fiber-optic ports 50
functional requirements 16
I
in-line mode 93
installation
planning 15
pre-requisites 15
D
J
database requirements
determine 15
MySQL 14
java runtime engine 14
dedicated interface 22
dedicated server 9
desktop firewall
installing 16
device
add 70
device access
manage 95
device configuration
update 77
device configuration; troubleshooting 94
Device installation wizard 62
devices
configure 61
configure; manage 91
delete 77
McAfee Network Security Platform 8.1
M
Manager installation; local service account 12
Manager specifications 14
Manager uninstallation; Central Manager uninstallation 103
add/remove program 103
using script 105
Manager; Central manager
downloading executable 20
Manager; Central Manager
installation 21
shutting down 45
start 41
McAfee ServicePortal, accessing 6
N
network topology 49
Installation Guide
107
Index
new SNMP users
add 96
NMS IP address; new
add 98
NMS IP addresses
delete 98
manage 98
NTP server 88
O
offline devices
export software 82, 84
software; update 83
update 82
offline download 85
offline signature set update 81
P
port pin-outs 52–54
pre-installation 9
pre-requisites
installation 9
S
Sensor statistics 62
Sensor to Manager
add 55
Sensor values; change 59
Sensor; NTBA appliance
shut down 94
Sensors
install 61
server requirements 10
ServicePortal, finding product documentation 6
signature set
offline download 83
signature set update 62
signature sets
import 63
SNMP user
delete 97
edit 97
SNMPv3 users 96
software update files
download; offline devices 80
successful configuration
verifying 59
system requirements; client 12
safety warnings 50
T
secondary Manager IP
add 60
remove 60
Senor
configure; CLI 65
Sensor
add 49, 64
configure 54, 56
install 49
unpack 51
Sensor box contents 51
Sensor installation wizard 62
Sensor IP; Manager IP
change 60
Sensor naming scheme 55
Sensor or NTBA Appliance
update configuration 92
sensor responsibilities 68
TACACS+ authentication 95
technical support, finding product information 6
third-party applications 10
troubleshooting 38
108
McAfee Network Security Platform 8.1
U
update server
configuring 101
Update Server
signature updates;updates 63
usage restrictions 50
user interface; MySQL 19
V
VirusScan; SMTP 19
VMware platform 11
Installation Guide
0E00
">