Revision D MAfee Network Seurity Pltform (M-8000 Quik Strt Guie) This Quik Strt Guie explins how to quikly set up n tivte your MAfee Network Seurity Pltform [formerly MAfee IntruShiel ] M-8000 Sensor in in-line moe. If you re setting up your Sensor in SPAN or Tp moe, see the M-8000 Prout Guie for ling instrutions. All prout oumenttion referene in this Quik Strt Guie is foun on the MAfee Servie Portl. The Sensor front pnel 1 Power supply A (2-inlue) 7 XFP 10 Gigit Ethernet Monitoring ports (12) 2 Power supply B (2-optionl; sol seprtely) 8 Compt Flsh port (2) 3 RS-232C Control port (2) 9 RJ-45 Response port (1) 4 RS-232C Auxiliry port (2) 10 10/100/1000 Mngement port (1) 5 RJ-11 Fil-Open Control ports (14) 11 Interonnet ports (2) 6 SFP 1 Gigit Ethernet Monitoring ports (16) Cling the Sensor's XFP (10 Gigit Smll Form-ftor Pluggle) n SFP (Smll Form-ftor Pluggle) Gigit Ethernet Monitoring ports for in-line moe enles you to onfigure the Sensor to rop ttks efore they reh their trget. 1
Sensor setup overview This setion explins how to position n le the vrious ports of your Sensor. This setion lso riefly explins how to instll the Mnger n then the Sensor to the Mnger, n verify tht you hve suessfully estlishe ommunition etween the Sensor n the Mnger. 1 Position the Sensor Detils on ll of the tsks in Step 1 re ville in the M-8000 Sensor Prout Guie for your Sensor moel. Also see M-series Slie Ril Assemly Proeure. Relese the rils n tth inner rils (of three-in-one set) to the hssis y fstening it with the srews provie. Atth L-shpe n externl rils to the rk frme. Instll the primry Sensor into rk n mount ers. You n lso mi-mount the Sensor (optionl). Instll the reunnt power supply (optionl). 2
e f Instll moules in the Sensor's Monitoring ports. Repet Steps through e for the seonry Sensor. 2 Cle the Mngement n Console ports Before you egin Ensure the Sensor is powere OFF efore tthing les. Plug Ctegory 5e Ethernet le in the (Mngement) Mgmt port of M-8000 P. Plug the other en of the le into the network evie onnete to your Mnger server. Plug the DB9 Console le supplie in the Sensor ox into the Console port (lele Console on the Sensor front pnel) of M-8000 P. You n use the Console port on the seonry Sensor, M-8000 S, for flsh reovery proess or to trouleshoot. Connet the other en of the Console port le iretly to COM port of the PC or terminl server you will e using to onfigure the Sensor (for exmple, PC running orretly onfigure Winows Hyperterminl softwre). You must onnet iretly to the onsole for initil onfigurtion; you nnot onfigure the Sensor remotely. The require settings for Hyperterminl re: Bu rte: 38400 Stop Bits: 1 Numer of Bits: 8 Control Flow: None Prity: None e Plug the femle en of power le into the power inlet n plug the other en into power soure. The Sensor ships with stnr US power n interntionl les. The M-8000 oes not hve power swith; you nee to only plug the power le into power soure. 3
3 Cle the Monitoring ports This proeure esries how to le Sensor to run in In-line moe. Plug the le pproprite for use with your XFP or SFP moule into one of the Monitoring ports lele xa (for exmple, 1A). MAfee supports only those SFP/XFP moules purhse through MAfee or from MAfee-pprove venor. Do not use XC ports. These ports re reserve for interonnetion etween the primry (M-8000 P) n seonry (M-8000 S) Sensors. Plug nother le into the peer of the port use in Step 1. This port will e lele xb (for exmple, 1B). Connet the other en of eh le to the network evies tht you wnt to monitor. (For exmple, if you pln to monitor trffi etween swith n router, onnet the le onnete to 1A to the router n the one onnete to 1B to the swith.) For instrutions on how to le the Sensor to run in other operting moes, see the M-8000 Sensor Prout Guie for your Sensor moel. 4 Cle the interonnet ports This proeure esries how to onnet the primry Sensor to the seonry Sensor. Plug the supplie Ethernet le into the XC1 port of the primry Sensor. Connet the other en of the Ethernet le use in Step 1 into the XC4 port of the seonry Sensor. Insert the supplie XFP moules into the XC2, XC3, XC5, n XC6 ports on the primry n seonry Sensors. MAfee supports only those XFP moules purhse through MAfee or from MAfee-pprove venor. e Plug one en of n LC-LC fier-opti le into the XC2 port of the primry Sensor n onnet the other the le to the XC5 port of the seonry Sensor. Plug one en of n LC-LC fier-opti le into the XC3 port of the primry Sensor n onnet the other the le to the XC6 port of the seonry Sensor. 4
5 Instll the Mnger Softwre For etile instrutions, refer to MAfee Network Seurity Pltform Instlltion Guie. You must hve ministrtor privileges on the trget Winows server to instll the Mnger softwre. A MySQL tse is inlue with the Mnger n is instlle (emee) utomtilly on your trget Winows server uring this proess. Following steps riefly explin the Mnger instlltion: e f Prepre the system oring to the requirements outline in MAfee Network Seurity Pltform Instlltion Guie n the Network Seurity Pltform Relese Notes. Close ll open pplitions. Go to MAfee Upte Server n log on, using the grnt numer n psswor. Go to Mnger Softwre Uptes foler n selet the ltest Mnger softwre version ville. Downlo the zip file to the trget Winows server n extrt the setup file. Doule-lik Mnger_<version>_setup.exe n follow the on sreen prompts. 6 Strt the Mnger Clik Strt Progrms MAfee Network Seurity Mnger Network Seurity Mnger. You o not require liense file for using Mnger/Centrl Mnger version 5.1.17.2 or ove, n 6.0.7.x or ove. 7 Aing the Sensor to the Mnger The Mnger isplys the Login ID pge. Log on to the Mnger. The efult Login ID is min n the efult Psswor is min123. 5
Clik Login. To Sensor in the Mnger, lik Devies t Glol A n Remove Devies, n then lik New. The A New Devie pge is isplye. Enter informtion in the pproprite fiels n lik Sve. Rememer the Shre Seret vlue entere t this step. This vlue is use while you onfigure the Sensor. For more informtion on the fiels in A New Devie pge, see MAfee Network Seurity Pltform Instlltion Guie. 8 Configure Sensor informtion Configure the Sensor with the network informtion, nme, n the shre seret key tht the Sensor uses to estlish seure ommunition with the Mnger. Use the nme n key vlues you set in Step 2. The first time you onfigure Sensor, you must hve physil ess to the Sensor. You onfigure the M-8000 Sensor using the CLI of the primry Sensor (M-8000 P). 6
At ny time uring onfigurtion, you n type question mrk (?) to get help on the Sensor CLI ommns. For list of ll ommns, type ommns. Log on to the primry Sensor using the terminl onnete to the Console port. At the prompt, log on using the efult Sensor usernme (min) n psswor (min123). Optionl, ut reommene. Chnge the Sensor psswor. At the prompt, type: pssw.the Sensor prompts you to enter the new psswor n prompts you for the ol psswor. A psswor must ontin etween 8 to 25 hrters, is se-sensitive, n n onsist of ny lphnumeri hrter or symol. Set the nme of the Sensor: You n enter the setup ommn t the prompt n this will utomtilly prompt you to provie the informtion shown in items 4 through 7 n item 10. Or, you use the set ommn inste. If you use the set ommn, you must mnully enter the omplete ommn syntx s shown in items 4 through 7 n item 10. At the prompt, type: set sensor nme <wor>. Exmple: set sensor nme HR_sensor1 The Sensor nme is se-sensitive hrter string up to 25 hrters. The string n inlue hyphens, unersores, n perios, n must egin with letter. e f If the Sensor is not on the sme network s the Mnger, set the ress of the efult gtewy. At the prompt, type: set sensor gtewy <A.B.C.D> Exmple: set sensor gtewy 192.168.3.68 Set the IP ress of the Mnger server. At the prompt, type: set mnger ip <A.B.C.D>. Exmple: set mnger ip 192.168.2.8 7
g Set the IP ress n sunet msk of the Sensor. At the prompt, type: set sensor ip <A.B.C.D> <E.F.G.H>. Exmple: set sensor ip 192.168.2.12 255.255.255.0 Speify n IP ress using four otets seprte y perios: X.X.X.X, where X is numer etween 0 n 255, followe y sunet msk in the sme formt. h If prompte, reoot the Sensor. Type: reoot The Sensor n tke up to five minutes to omplete its reoot. i j Ping the Mnger from the Sensor to etermine if your onfigurtion settings to this point hve suessfully estlishe the Sensor on the network. At the prompt, type: ping <mnger IP ress>. If the ping is suessful, ontinue with the following steps. If not, type show to verify your onfigurtion settings n hek tht the informtion is orret. Set the shre seret key vlue for the Sensor. At the prompt, type: set sensor shreseretkey. The Sensor then prompts you to enter n, susequently, onfirm the shre seret key vlue. This vlue is use to estlish trust reltionship etween the Sensor n the Mnger. The seret key vlue n e etween 8 n 25 hrters of ny ASCII text. The shre key vlue is se-sensitive. Mke sure the vlue mthes the shre seret key vlue you provie in the Mnger interfe. k l To verify the onfigurtion informtion, type show. Chek tht ll informtion is orret. To exit the session, type exit. 9 Verify suessful instlltion A hnshke proess egins etween the Sensor n the Mnger. The evies will tke few seons to estlish ommunition. Perform the following steps to verify suessful ommunition etween the Sensor n the Mnger. In the Sensor CLI, type: sttus. 8
The sttus report ppers Return to the Mnger. In the Mnger - Dshor t, view the Mnger sttus in the System Helth setion. Mnger sttus shoul e up n Sensor sttus shoul e tive. From the Mnger - Dshor, lik Devie t Devies. 9
Selet your e Sensor: Devie List Sensor_Nme. The ports for this Sensor pper uner the Sensor_Nme noe. "Devie_Nme" inites the nme of the Sensor you e. e A poliy nme Defult Inline IPS is tive upon Sensor ition. To view this poliy, selet Poliy t IPS Poliies IPS Poliy Eitor. Now selet Defult Inline IPS from the list n lik View / Eit. The Defult Inline IPS poliy ontins ttks lrey onfigure with "loking" Sensor response tion; if ny ttk in the poliy is triggere, the Sensor utomtilly loks the ttk. To tune this or ny other MAfee-provie poliies, you n lone the poliy n then ustomize it s esrie in the MAfee Network Seurity Pltform IPS Aministrtion Guie. f Clik Devies t Devies Devie List Devie_Nme Setup Physil Ports. For more informtion on port settings, see Configurtion Sensor monitoring n response ports, MAfee Network Seurity Pltform IPS Aministrtion Guie. g Clik the utton representing the ports on the Sensor tht you le. Ensure tht your port settings mth the ling (for exmple, In-line moe). 10 You're up n running! Your Sensor is tively monitoring onnete segments n ommuniting with the Mnger for ministrtion n mngement opertions. Re MAfee Network Seurity Pltform Quik Tour for n overview of the system. For etile usge instrutions, see MAfee Network Seurity Pltform Instlltion Guie n MAfee Network Seurity Pltform IPS Aministrtion Guie, or lik the Detile Help uttons in the upper-right orner of eh winow in the Mnger. Lunh the Thret Anlyzer from the Home pge to view lert sttistis s ttks re etete. These will isply in the Unknowlege Alert Summry re of the Mnger Home pge. Hving prolems? Chek MAfee Network Seurity Pltform Trouleshooting Guie for trouleshooting informtion. Note tht most eployment prolems stem from onfigurtion mismthes etween the Sensor n the network evies to whih it is onnete. Chek your uplex n uto-negotition settings on oth evies to ensure they re synhronize. If you nee to ontt Tehnil Support, go to https://mysupport.mfee.om. 10
11
Copyright 2018 MAfee, LLC MAfee n the MAfee logo re tremrks or registere tremrks of MAfee, LLC or its susiiries in the US n other ountries. Other mrks n rns my e lime s the property of others. 12 700-2400D00