Fidelis Deception Decoy Server FDH-1000-C Manuel utilisateur

www.fidelissecurity.com

About Fidelis Cybersecurity

Fidelis Cybersecurity, the industry innovator in Active XDR and proactive cyber defense solutions, safeguards

modern IT environments with unparalleled detection, deception, response, cloud security, and compliance

capabilities. We offer full visibility across hybrid environments via deep, dynamic asset discovery, multi-faceted

context, and risk assessment. These features help minimize attackable surface areas, automate exposure

prevention, threat detection, and incident response, and provide the context, accuracy, speed, and portability

security professionals need to find and neutralize adversaries earlier in the attack lifecycle. Fidelis Cybersecurity

is dedicated to helping clients become stronger and more secure. Fidelis is trusted by many top commercial,

enterprise, and government agencies worldwide. For more information, please visit www.fidelissecurity.com

Fidelis Deception® Decoy Server

Appliance

Quick Start Guide

Rev-K (HPE DL360 Gen10) Platform

www.fidelissecurity.com

1. System Overview

Fidelis Deception Decoy Server appliance runs emulated and Real OS decoys. It is connected to Trunk

port and/or multiple flat networks, and it communicates with assets on your networks.

Figure 1: Fidelis Deception – Decoy Server Appliance – Rev-K

The Decoy Server reports deception alerts when attackers access the decoy. The Decoy Server reports

the deception alerts to your on-premises Fidelis CommandPost or to the remote Fidelis Network Cloud.

Your configuration depends on which environment you are using.

Decoy Server Setup Checklist



Fidelis Decoy Server – Appliance Requirements

Appropriate rack space, power, and cooling (Appendix B)

Rack tools, rails, and connectors

Keyboard and video monitor / KVM switch for temporary appliance setup

Power cables – two per appliance, appropriate power source and region

Ethernet cables (cat5e and optical) for Admin, Monitor, and iLO ports (Section 3)

Network switches with enough physical ports (Section 4)

Optical transceivers for switches

Logical network information: IP addresses, hostnames (Section 5, Appendix A)

www.fidelissecurity.com

2. Documentation, Passwords, and Technical Support

Product Documentation

You can find Fidelis Network product documentation, appliance specifications, and instructions at

https://support.fidelissecurity.com or through the navigation item in the CommandPost user

interface.

Appliance Default Passwords

System Account Default Password

Appliance Console fidelis fidelispass

CommandPost user interface admin system

iLO administrator (printed on label, top of server)

Technical Support

For all technical support related to this product, check with your site administrator to determine support

contract details. For support of your product, contact your reseller. If you have a direct support contract

with Fidelis Cybersecurity, contact Fidelis Cybersecurity Technical support at:

•Phone: +1.301.652.7190

•Toll-free in the US and Canada: 1.800.652.4020

•Email: support@fidelissecurity.com

•Web: https://support.fidelissecurity.com

www.fidelissecurity.com

3. Decoy Server: Network Port and Cabling Requirements

You must connect each appliance to the various networks with appropriate cables and in some cases,

SFP+ transceivers. The tables below describe the physical connection and cable type associated with

each port on the appliance.

Decoy Server Appliances with Copper Ports

Port Label Physical Connection Type (default) Cable Type (minimum)

Admin (eth0) GbE Copper RJ45 (copper) Cat 5e patch cable

Decoys (eth1) GbE Copper RJ45 (copper) Cat 5e patch cable

Decoys (eth2) GbE Copper RJ45 (copper) Cat 5e patch cable

Decoys (eth3) GbE Copper RJ45 (copper) Cat 5e patch cable

iLO GbE Copper RJ45 (copper) Cat 5e patch cable

Figure 2: Rear Port Assignments– Decoy Server with Copper Ports (Rev-K)

Decoy Server FDH-1000-C

Decoy Server FDH-3000-

DL360

iLO

Admin

(eth0)

Decoys

(eth2)

Decoys

(eth3)

Decoys

(eth1)

www.fidelissecurity.com

Decoy Server 10GbE Optical Ports

Port Label Physical Connection Type (default) Cable Type (minimum)

Admin (eth0) GbE Copper RJ45 (copper) Cat 5e patch cable

Decoys (eth1) GbE Copper RJ45 (copper) Cat 5e patch cable

Decoys (eth2) GbE Copper RJ45 (copper) Cat 5e patch cable

Decoys (eth3) GbE Copper RJ45 (copper) Cat 5e patch cable

Decoys (eth4) Duplex LC Connector Multimode Fiber, 850nM, OM2

Decoys (eth5) Duplex LC Connector Multimode Fiber, 850nM, OM2

iLO GbE Copper RJ45 (copper) Cat 5e patch cable

Figure 3: Rear Port Assignments– Decoy Server 10GbE Optical Ports (Rev-K)

Decoy Server FDH-1000-F

Decoy Server FDH-3000-

DL360

iLO

Admin

(eth0)

Decoys

(eth2)

Decoys

(eth3)

Decoys

(eth1)

Decoys

(eth4)

Decoys

(eth5)

www.fidelissecurity.com

4. Decoy Server Networking Environment

Decoy server appliances can connect to multiple networks to deploy different decoy services. Decoys can

operate whether ports are connected to:

•Trunk ports, which enables communication on multiple subnets from the same port on the

appliance,

and/or

•Ports directly to specific subnets

Admin Network

The Admin network connects Fidelis Decoy server to the CommandPost, and optionally to an

on-premises Fidelis Sandbox. You need one switch port per Decoy server appliance for the Admin

network.

Appliance Switch Port Type Qty

Decoy Server GbE Copper RJ45 port 1

Decoy eth1, Decoy eth2, Decoy eth3

Ports to connect the Decoy server appliance to subnets through network switch directly certain subnets

and/or use trunk port.

Appliance Switch Port Type Qty

Decoy Server GbE Copper RJ45 port 3

Decoy eth4, Decoy eth5, Decoy eth6, Decoy eth7 (additional ports)

Most environments using higher network throughput will use these ports. You can connect the Decoy

server to a trunk port and/or to certain subnets through the switch.

Appliance Switch Port Type Qty

Decoy Server 1GbE GbE Copper RJ45 port 4

Decoy Server 10-GbE Duplex LC Connector, 1GbE or 10GbE 2

iLO Network

Optional network for remote/out-of-band server administration. You will need on additional switch port for

each iLO connection.

Appliance Switch Port Type Qty

Decoy Server GbE Copper RJ45 port 1

www.fidelissecurity.com

5. Decoy Server – Logical Network Configuration

Configure the Admin and iLO according to your network configuration. See the table below as a sample.

Appendix A has a worksheet you can use.

Note: The logical configuration for decoys is done as part of the decoys creation process.

Sample Configuration for Decoy Server

Network Setting Assignments

Interface Admin iLO

Hostname (FQDN) DecoyServer1.myorg.int

Static IP Address 10.1.2.3 10.2.3.4

Subnet Mask 255.255.255.0 255.255.255.0

Gateway 10.1.2.1 10.2.3.1

Proxy Server 10.5.6.7

DNS Servers 8.8.4.4, 8.8.8.8

NTP Servers 0.pool1.ntp.org

Time Zone UTC (+0)

6. Appliance Installation

Rack Installation

Install each appliance in an enclosure/location that has necessary power and cooling. Ensure that the

installation environment is within the operating temperature of the appliance. See Appendix B for

appliance operating temperature requirements.

Power

Connect power cables to the power supplies in the back of the appliance. See Appendix B for appliance

power requirements.

Network Cabling

Using the connectors and cables described in sections 3 and 4, begin to connect the appliances to the

networks. Cable the sensor appliance(s) to the switches:

1. Connect the Admin (eth0) port to the ADMIN switch port.

2. Optionally, connect the iLO port to the ADMIN (or iLO) switch port.

www.fidelissecurity.com

7. Decoy Server Network Configuration

1. Power on the appliance(s).

2. Connect to the component CLI using one of the following methods:

‒Via KVM Console

‒Via Console or iLO

Via KVM Console

Connect a keyboard and monitor to the appliance. For Fidelis Decoy Server version 9.4 or later,

the following screen is displayed. If you do not see this screen, connect via SSH (see instructions

below).

With Erase & Install deception server selected, press Enter.

www.fidelissecurity.com

Press Enter again when you see the screen above to confirm the installation. The software will be

applied, and the appliance rebooted. Continue with step 3.

Via Console or iLO

3. Use the following credentials at the login prompt. You will be required to change the password

immediately.

‒user: fidelis

‒default password: fidelispass

www.fidelissecurity.com

4. With Setup, select Configure network.

5. Skip the DHCP configuration by selecting No.

Note: It is recommended that you use a static IP address for the interface so that the

connection to the CommandPost/Management is not lost.

Ce manuel convient aux modèles suivants

Table des matières

Autres manuels Fidelis Matériel réseau

Fidelis

Fidelis Common Criteria Manuel utilisateur

Fidelis

Fidelis Collector Controller 10G Manuel utilisateur

Fidelis

Fidelis Network CommandPost Manuel utilisateur

Fidelis

Fidelis Network Collector SA Rev-1 Series Manuel utilisateur

Fidelis

Fidelis FDH-3000 Manuel utilisateur

Fidelis

Fidelis CommandPost+ Manuel utilisateur

Fidelis

Fidelis Network Collector SA Manuel utilisateur

Manuels Matériel réseau populaires d'autres marques

Matrix Switch Corporation

Matrix Switch Corporation MSC-HD161DEL Manuel utilisateur

B&B Electronics

B&B Electronics ZXT9-IO-222R2 Manuel utilisateur

Yudor

Yudor YDS-16 Manuel utilisateur

D-Link

D-Link ShareCenter DNS-320L Manuel utilisateur

Samsung

Samsung ES1642dc Instructions d'utilisation

Honeywell Home

Honeywell Home LTEM-PV Instructions de montage

evertz

evertz 7700 Series Manuel utilisateur

D-Link

D-Link ShareCenter DNS-343 Manuel utilisateur

Asante

Asante AsanteBridge 1012 Manuel utilisateur

FireBrick

FireBrick FB2700 Manuel utilisateur

Audiovox Electronics

Audiovox Electronics ARWH2T Manuel utilisateur

ADC

ADC DSX-1 Manuel

NetComm

NetComm NF2 Manuel utilisateur

Alcatel-Lucent

Alcatel-Lucent 5620 Manuel utilisateur

Dell EMC

Dell EMC XC6420 Series Manuel utilisateur

Lanner

Lanner NCA-1020A Manuel utilisateur

Allied Telesis

Allied Telesis AT-TN121-A Manuel utilisateur

Arista

Arista CCA-ETM-Q12 Manuel utilisateur