Network Security Platform Active Fail
Active Fail-Open Kit Quick Start Guide Revision B McAfee Network Security Platform McAfee Network Security Platform IPS Sensors, when deployed in-line, route all incoming traffic through a designated port pair. However, at times a Sensor might need to be turned off for maintenance or its ports can go down because of an outage. At times like this, you might want to continue allowing traffic to pass through without interruption. For such requirements, you can consider an external device called a fail-open switch. The fail-open switch can either be an active fail-open switch or a passive fail-open switch. An active fail-open switch constantly monitors Sensor state. It does this by sending a heartbeat signal through its ports. The heartbeat signal is sent through the one of the Monitor ports and received through the other, indicating that the Sensor is functioning normally. The table below shows you the various models of active fail-open switches. Fail-open switch SKU NS-9x00 NS-7x00 M-8000, M-6050 M-4050, M-3050 M-2950, M-2850 Active-Fiber (850 nm) IAC-AF85010- Yes Yes Yes Yes No IAC-AF131010- Yes Yes Yes Yes No Yes Yes Yes Yes Yes IAC-AF131085- Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes KT1 10G (62.5 µm) Active-Fiber (1310 nm) KT1 10G (8.5 µm) Active-Fiber (850 nm) IAC-AF85062KT1 1G (62.5 µm) Active-Fiber (1310 nm) KT1 1G (8.5 µm) Active-Copper IAC-AFOCG- 10/100/1000 module KT2 Active Fail-Open IAC-AFOCH- Chassis KT2 1 You must also make sure you have the requisite SFP/SFP+'s, or XFPs when making this choice. Fiber fail-open switches consist of two types: single mode and multi-mode fibers. The table below gives you some relevant details about both types of fiber optic fail-open switches. This is especially relevant because you must determine the type of fiber that is used your organization network before you decide which type of fail-open switch to use. Also, all product documentation for fail-open kits and decals on the fail-open switches will repeatedly refer to these parameters. The table below shows you the differences between single-mode and multi-mode fiber specifications. Type Fiber thickness Wavelength range Single mode (Long reach) 8.5 µm 1300 nm to 1550 nm Multi-mode (Short reach) 50 µm or 62.5 µm 850 nm to 1300 nm For more details about fail-open kits, refer the chapter, Fail-Open operation in Sensors in the McAfee Network Security Platform IPS Administration Guide. Since this Quick Start Guide will make references to information associated with that chapter, it will help to keep a copy of it easily accessible before you begin installing and configuring your fail-open switch. Working To begin with, the Sensor and the fail-open switch need to be appropriately cabled with each other. The Sensor ports are then configured for fail-open operation. For more details about configuring Sensor monitoring ports, refer to the section, Configure Sensor Monitoring Ports on page 9. After connecting and configuring the Sensor and fail-open switch, the switch begins to send a heartbeat signal to the Sensor. Each heartbeat signal, once sent, returns from the Sensor to the fail-open switch. When the fail-open switch does not receive this response from the Sensor for a specified period, the switch removes the Sensor from the data path and begins to route traffic to the network through its own ports. A 1G fiber or a Copper fail-open switch sends a heartbeat signal every second. When the fail-open switch does not receive a response for 3 seconds, it changes its working mode to "unknown" and begins to route traffic through itself. A 10G fiber fail-open switch sends a heartbeat signal every 10 milliseconds (ms). If the fail-open switch does not receive a response from the Sensor for 100 ms, it removes the Sensor from the data path and begins to route traffic through its own ports. 1 Inside the box Every fail-open kit consists of a similar set of components. Although the type of cables and the switch vary from one model to another, the list of items in the kit itself remains the same. The table below provides you the list of items. 2 Qty Item Description 1 • 10/100/1000 Copper fail-open module, or • 1G 850 nm Fiber (62.5 µm) fail-open module, or • 1G 1310 nm Fiber (8.5 µm) fail-open module, or • 10G 850 nm Fiber (62.5 µm) fail-open module, or • 10G 1310 nm Fiber (8.5 µm) fail-open module Fail-Open switch module 1 Active Fail-Open switch 1U 1RU host hardware to plug in up to four fail-open switches in a chassis for four fail-open standard rack. switches 2 Power supplies and cords for the host system One power supply acts as the primary and the other as the redundant power supply in case of a failure 4 Copper: 3m RJ-45 to RJ-45 cable Connects the fail-open switch to network devices and the Sensor. Fiber: 3m LC-LC 1 2 For a fiber fail-open kit, these cables will either be single mode or multi-mode cables depending on the requirements provided at the time of purchase. RS232 RJ-11 programming Connects the fail-open switch to a computer to access the switch cable CLI that is used to configure switch parameters. Install the active fail-open switch and chassis Before you begin • Identify the rack in which you plan to install the fail-open chassis. • If you are using a physical Sensor, make sure that you are able to physically connect the chassis with the monitoring ports. You can install up to four fail-open switches in a single chassis. You can install an active fail-open switch module in the chassis on the fly while the chassis is powered on in the rack. a Install the ears of the chassis. b Slide the switch into one of the openings in the chassis, until the face plate of the switch rests against the chassis. 3 c Secure the switch to the chassis by inserting screws provided through the holes on the fail-open switch face plate and into the panel. If you are attempting to install a switch while the chassis is powered on, you must wait for 4 seconds after inserting the switch and fastening its screws. d Place the 1U chassis against the front of a standard 19-inch rack. e Secure the chassis by inserting screws through holes on ears of the chassis (refer the Before you begin instructions for this section). f (Optional) Install up to three additional switches by following these steps: a Remove screws holding each of the removable blank plates from the front of the chassis. b Follow steps 1 and 2 of this procedure for installing a switch in the chassis for additional fail-open switches. The fail-open switch is ready to be connected to a Sensor. 3 Remove an active fail-open switch from the chassis Before you begin You must make sure the fail-open switch is fully powered off before you attempt to remove it from the chassis. Follow the steps in this section to power off and remove the fail-open switch. a b 4 Power off the fail-open switch using the web interface or CLI command prompt. • If you are using the web interface, click the Rescue tab and check the Power Off checkbox in the System Restore section. To access the web interface, refer Manage the fail-open switch through a web interface on page 10. • If you are using the CLI command prompt, type power_off and press Enter. To access the CLI command prompt, refer Configure fail-open switch parameters on page 7. When the fail-open switch is powered off, remove the captive screws and slide it out of the chassis. 4 Connections with the fail-open switch To accurately detect attacks, a Sensor must be aware of which traffic is outside the network and which traffic is inside. Identifying traffic direction is accomplished through the proper cabling of the fail-open switch as well as appropriate port configuration of the Sensor monitoring ports in the Manager. The switch LED indicates if traffic is passing to the Sensor. Connect the fail-open switch to network devices Callout Description 1 10/100/1000 Copper fail-open switch module 2 Connection to network device (inside) 3 Connection to network device (outside) 4 Sensor monitoring port G3/1 (inside) 5 Sensor monitoring port G3/2 (outside) 6 Sensor monitoring ports on an NS9200. The steps below provide steps for connections for both copper and fiber fail-open switches. a Plug the inside network cable connector into the Cat 5/Cat 5e/LC port, labeled Network 0 or Net 0 for copper or Network A (in a triangle) for fiber, on the fail-open switch. b Plug the other end of this cable to the corresponding network device. c Plug the outside network cable connector into the Cat 5/Cat 5e/LC port, labeled Network 1 or Net 1 for copper or Network B (in a triangle) for fiber, on the fail-open switch. d Plug the other end of this cable to the corresponding network device. The fail-open switch is now connected to network devices for the inside network and outside network. Your next step is to connect the fail-open switch to the Sensor. 5 (Either) Connect a copper fail-open switch Before you begin • You will require two Cat 5/Cat 5e Ethernet cables to connect your fail-open switch to the Sensor. • You will require two copper SFPs to be inserted into two corresponding blank ports on the Sensor. For more details about your Sensor, refer the Sensor Product Guide for the appropriate model. a Connect a Cat 5/Cat 5e Ethernet cable (inside) into the copper SFP in port Gx/a or xA, where x and a are port numbers. b Connect the other end of the cable into the labeled Port 0 on the fail-open switch. c Connect a Cat 5/Cat 5e Ethernet cable (outside) into the corresponding Gx/b or xB peer port.(For example, if you used G1/1 in step 1, plug the cable into port G1/2). d Connect the other end of the cable into the labeled Port 1 of the bypass switch. With this cable configuration, Sensor Monitoring port G1/1 views traffic as originating inside the network, and port G1/2 views traffic as originating outside the network. Note that this configuration (G1/1 = outside, G1/2 = inside) must match the port configuration specified for this Sensor, and that the ports must be configured as such. (Or) Connect a fiber fail-open switch Before you begin • You will require two LC-LC cables to connect your fail-open switch to the Sensor. • If you are connecting a 1-Gigabit fail-open switch, you will require two fiber SFPs to be inserted into two corresponding blank ports on the Sensor. • If you are connecting a 10-Gigabit fail-open switch, you will require two fiber XFP/SFP +s to be inserted into two corresponding blank ports on the Sensor. For more details about the SFP/XFP/SFP+ compatible with your Sensor, refer the Sensor Product Guide for the appropriate model. a Connect an LC-LC cable into the LC receptacle of port Gx/a or xA, where x and a are the corresponding 1-Gigabit or 10-Gigabit port numbers. b Connect the other end of the LC cable into the LC receptacle labeled Monitor A of the fail-open switch. c Connect an LC-LC cable into the corresponding Gx/b or xB peer port. (For example, if you used G1/3 in step 1, plug the cable into port G1/4). d Connect the other end of this cable into the port labeled Monitor B of the fail-open switch. With this cable configuration, Sensor Monitoring port G1/3 views traffic as originating inside the network, and port G1/4 views traffic as originating outside the network. Note that this configuration 6 (G1/3 = outside, G1/4 = inside) must match the port configuration specified for this Sensor, and that the ports must be configured as such. 5 Configure fail-open switch parameters You can configure various parameters on your fail-open switch. All configuration options, status, and statistics are accessible from the fail-open switch Command Line Interface (CLI). After you have configured basic network settings – IP address, gateway, and subnet mask – you will be able to access the fail-open switch through SSH. SSH is enabled on every fail-open switch by default and can be disabled through the CLI. Your fail-open switch only supports IPv4 addresses. The steps below explain the configuration of parameters for your fail-open switch. a Connect an RJ-11 cable to the front of the module. b Connect the other end to a computer running a terminal emulation software such as HyperTerminal or PuTTY. c Launch the terminal emulation software, and set the communications parameters as shown below: • Baud rate: 9600 It is recommended not to alter the baud rate of the Management port. d • Data bits: 8 • Parity: None • Stop bits: 1 • Flow control: None Power up the fail-open switch. The CLI banner and login prompt appear. e At the login prompt, type McAfee00 and press Enter. f At the password prompt, type McAfee00 and press Enter. The fail-open switch CLI prompt appears. g Configure or modify parameters related to fail-open switch access and its ports using the commands listed. 7 Command Description set_ip xxx.xxx.xxx.xxx Configures fail-open switch IPv4 address. Reboot the fail-open switch for the new IPv4 address to take effect. set_netmask xxx.xxx.xxx.xxx Configures fail-open switch subnet mask. set_gateway xxx.xxx.xxx.xxx Configures default gateway IPv4 address. Reboot the fail-open switch for the new subnet mask to take effect. Reboot the fail-open switch for the new gateway IPv4 address to take effect. set_link <port> <on/ off> Sets the port of a 1G Copper fail-open switch to auto-negotiate. set_link <port> off fd 100m Sets the port to 100 Mbps full-duplex. set_link <port> <enable/ disable>_autoneg Sets the port of a 1G Fiber fail-open switch to auto-negotiate. For the <port> use mon0, mon1, net0, or net1. For the <port> use the syntaxes specified above. For the <port> use mon0, mon1, net0, or net1. 10G Fiber fail-open switches do not have such a command since auto-negotiate is enabled by default. h Configure or modify parameters for other settings of the fail-open switch using these commands. Command Description set_ssh_state <on/off> Enables or disables the SSH status on the fail-open switch. set_web_https_state <on/ off> Enables or disables web access to the fail-open switch interface. set_snmp_srv_ip Configures SNMP server IPv4 address. The SNMP server IPv4 address can also be set in the web interface. set_trap <parameter> <on/ off> i 8 Enables or disables the following SNMP traps: • appl fail – Application state change. • net link – Network port state change trap. • bypass – Bypass state change trap. • error – Error notification trap. • mon link – Monitoring port state change trap. • update – Update complete trap. View essential fail-open switch parameters using the commands listed. If your fail-open switch parameters have never been configured before, you will see factory settings. Command Description get_ip Displays fail-open switch IPv4 address. get_netmask Displays fail-open switch subnet mask. get_gateway Displays default gateway address. get_ssh_state Displays the SSH status, which is enabled by default. get_snmp_srv_ip Displays the SNMP server IPv4 address. get_params Displays fail-open switch parameters. get_web_https_state Displays status of web access to the fail-open switch interface. get_link <port> Displays port status. For the <port> use mon0, mon1, net0, or net1. 6 Configure Sensor Monitoring Ports Before you begin • The Sensor must be set up with trust established with a Manager server. • The Sensor has a free port pair which can be deployed in in-line fail-open mode. • It is assumed that you have inserted necessary transceiver modules into the Sensor if you have completed cabling the Sensor and fail-open switch. When you set up a Sensor for the first time, its ports are disabled by default. The Sensor ports must be manually configured for in-line fail-open operation. a In the Manager, go to Devices | <Admin_Domain_Name> | Devices | <Device_Name> | Setup | Physical Ports. b Double-click port one of the configurable ports, say G2/1. A configuration panel appears on the right side of the window. c Click the State drop-down and select Enabled. You are asked whether you want to proceed since this configuration will also impact port G2/2. d Click Yes to proceed. This enables port G2/1-G2/2. e Select the Auto Negotiate checkbox and make sure the Speed (Duplex) is set to 1 Gbps (Full). f Click the Mode drop-down and select In-line Fail-Open – Active. g Click the Placement drop-down and select Inside Network or Outside Network, depending on how you want to configure your ports. 9 McAfee recommends choosing Gx/1 or xA as Inside Network and Gx/2 or xB as Outside Network. h Click Save. The Sensor and fail-open switch are setup. When traffic passes through the ports, you will notice the port link status changes to Up and turns green. 7 Manage the fail-open switch through a web interface If you have configured an IPv4 address for your fail-open switch, you have the option to manage your fail-open switch through a web-interface. a To access the fail-open switch web interface, enter the IPv4 address of the fail-open switch which you have configured. The fail-open switch web interface appears on the log on screen. b To log on, enter the default username and password, McAfee00 and McAfee00. You are routed to the fail-open web interface landing page which shows you information about the present settings configured in the fail-open switch. Configuration of necessary settings is explained in the relevant sections. 8 Enable tap mode for the fail-open switch Before you begin • Configure an IPv4 address for your fail-open switch. • Make sure you can access the fail-open switch web-interface using a web browser. You are able to enable tap mode for your active fail-open switch if you use a tap to route network traffic to the Sensor Monitoring ports. a 10 Log on to the web interface of the active fail-open switch. Use default credentials to access the web interface. For more information about the web interface refer Fail-Open switch web interface. b Click the Bypass tab to access the Bypass configuration page. c Click the HB active mode drop down menu and select Off. d In the Active bypass section, select tap. e Click Apply to save your configuration. You have set your active fail-open to tap mode of operation. Return from tap mode to inline mode a Click the Bypass tab to access the bypass configuration page. b Click the HB Active mode drop-down menu and select On. c Click Apply to save your configuration. You have reconfigured your fail-open switch to run in inline mode of operation. 9 Configure notification by SNMP traps Before you begin • To configure SNMP traps, you will require a server that will act as an SNMP server. The SNMP server can be any Windows or Linux system installed with an MIB browser such as iReasoning. • Make sure your fail-open switch IP address can be reached within the network. 11 • Make sure your SNMP server and fail-open switch are able to communicate. • In addition, you will need to obtain MIB files to decode alert codes sent by the fail-open switch. These files are specific to the fail-open switch and can be obtained by contacting Technical Support. The SNMP feature of your fail-open switch can only be used to send notifications through SNMP traps. a Connect an RJ-45 cable to the Management port at the back of the fail-open switch. b Connect the other end to a network device so that the SNMP server is reachable through the network. c Copy the fail-open switch MIB files to a suitable location on the SNMP server. d Set up the fail-open switch IP address, network mask, and SNMP manager IP address by logging on to the web interface. For details about the logging on to the web interface refer Manage the fail-open switch through a web interface on page 10. You are also able to configure various other parameters specific to SNMP traps. For details about these commands, refer Configure fail-open switch parameters on page 7. e On the web interface, click the SNMP tab. The SNMP configuration page appears. f To configure the SNMP server IPv4 address, enter it in the Server IP field. The credentials used will be the default credentials for the fail-open switch. 12 g (Optional) If you want to configure multiple SNMP accounts, in the SNMP trap account section select set from the Operations drop-down. If you do not configure additional SNMP trap accounts, all traps will be routed to the main SNMP trap account you have setup here. h Enter the IPv4 address for the other account. i (Optional) You can specify an alternate SNMPv3 password for the additional SNMP server. SNMP Community strings are used only by devices which support SNMPv1 and SNMPv2c protocols. SNMPv3 uses username and password authentication, along with an encryption key. You can configure a community string if the SNMP software you use requires you to configure one regardless of the requirements in this user-interface. j Click Apply to save your configuration. k In the SNMP server, configure these settings to enable SNMPv3 traps for the active fail-open kit. • USM user: McAfee00 • Auth password: McAfee00 • Security level: auth, priv • Privacy algorithm: AES • Auth algorithm: SHA • Privacy password: McAfee00 l Load MIB file. If you do not have the appropriate MIB file, contact McAfee Support. m Make sure the SNMP server and fail-open switch are able to communicate through the network. You have configured your active fail-open switch to send SNMP traps to an SNMP server. You are also provided the option to configure multiple SNMP trap accounts. Access the SNMP server to view triggers. 10 Verify your installation Follow these steps to make sure your setup is working as designed. a Check the icons in the Manager beside the ports you have configure as in-line fail-open passive. They must show Up. b c Check the Bypass LED on the Sensor. LED status Description ON The Sensor is in inline fail-open, inline fail-closed, SPAN, or TAP mode. OFF The Sensor is in bypass mode. Check the PWR LEDs on the chassis. 13 Depending on which power source you use, you will see that PWR LED glowing. d Check the port status and operating mode status of the GE in-line fail-open ports. The picture below shows you the fail-open switch in normal mode since the Sensor ports are operating normally. When the fail-open switch in bypass mode since the Sensor ports have gone down. Item Description NRM Glows green when the Sensor is in normal mode of operation. WDT Indicates watch dog timer. The Watch Dog Timer LED always blinks amber, whether the fail-open switch is in normal or bypass mode. The blink indicates that the heartbeat pulse is being sent through the fail-open connection. The watchdog timer is always blinking, even when the fail-open switch is bypassing the Sensor, because it is always sending and listening for the correct heartbeat state from the Sensor monitoring ports. BYP Glows red when fail-open switch is in bypass mode of operation. 11 Troubleshooting During normal in-line fail-open operation of the Sensor, fail-open switch constantly sends a heartbeat signal to the Sensor. If this signal does not return to the fail-open switch within a programmed interval, the fail-open switch removes the Sensor from the data path, and moves into bypass mode, providing continuous data flow with little network interruption. While the fail-open switch is in bypass mode, traffic passes directly through it, bypassing the Sensor. When normal Sensor operation resumes, you might or might not need to manually re-enable the monitoring ports from the Manager interface, depending on the activity leading up to the Sensor's failure. The following section describes how to return the Sensor to in-line mode. 14 What happens when a Sensor fails? When a Sensor fails with a fail-open switch in place, the following events occur in the stated order. • The Manager reports a Sensor in bad health or Port pair is in bypass mode error in the System Health pane. • The Sensor reboots and the fail-open switch begins forwarding traffic. All traffic now bypasses the Sensor and flows through the fail-open switch with minimal traffic disruption. A Sensor reboot breaks the link connecting the devices on either side of the Sensor and requires the renegotiation of the network link between the two devices surrounding the Sensor. Depending on the network equipment, this disruption ranges from a couple of seconds to more than a minute with certain vendors' devices. • Upon reboot completion, the Sensor resumes its heartbeat, and one of the following occurs: • If the reboot occurred during normal operation as described, the fail-open switch resumes passing data through the Sensor and the Sensor returns to in-line fail-open mode. • If the reboot occurred due to an error, the fail-open switch continues to bypass the Sensor until the administrator manually re-enables Sensor ports in the Manager. After the ports are re-enabled, the fail-open switch resumes passing data through the Sensor and the Sensor returns to in-line mode. A brief link disruption is likely to occur while the links are renegotiated to place the Sensor back in in-line mode. • The errors on the Manager disappear and normal health is reported. Common problems and solutions This section lists some common installation problems and their solutions. Problem Possible Cause Solution Network or link problems. Improper cabling or port configuration. Ensure that the transmit and receive cables are properly connected to the fail-open switch. Sensor LED is off. The Sensor is turned off. Restore Sensor power. The Sensor port cable is disconnected. Check the Sensor cable connections. Sensor is operational, but Network device cables have Check the cables and ensure that they are is not monitoring traffic. been disconnected. properly connected to both the network devices and the fail-open switch. The Sensor ports have not been enabled in the Sensor. Ports are disabled on a Sensor failure; they must be re-enabled in the Manager for the Sensor monitoring to resume. 15 Problem Possible Cause Solution Runts or giants errors on switch and routers. Improper cabling or port configuration. Ensure that the transmit and receive cables are properly connected to the fail-open switch. The system fault “Switch absent” appears on the Operational Status page of the Manager. Improper cabling. Ensure that the transmit and receive cables are properly connected to the fail-open switch. Copyright © 2014 McAfee, Inc. www.intelsecurity.com Intel and the Intel logo are trademarks/registered trademarks of Intel Corporation. McAfee and the McAfee logo are trademarks/ registered trademarks of McAfee, Inc. Other names and brands may be claimed as the property of others. 16 700-4420B00
© Copyright 2024