Finjan NG-8000 Manuel utilisateur

Software Release 9.0

NG-8000

NG-5000

NG-6000

Setup and

Conguration Guide

Setup and Configuration Guide

Vital Security™ Appliance Series NG-5000/NG-6000/NG-8000 Setup and Configuration Guide

reserved.

All text and figures included in this publication are the exclusive property of Finjan and are for your

personal and non-commercial use. You may not modify, copy, distribute, transmit, display, perform,

reproduce, publish, license, create derivative works from, transfer, use or sell any part of its content

in any way without the express permission in writing from Finjan. Information in this document is

subject to change without notice and does not present a commitment or representation on the part

of Finjan.

The Finjan technology and/or products and/or software described and/or referenced to in this

material are protected by registered and/or pending patents including U.S. Patents No. 3952315,

6092194, 6154844, 6167520, 6480962, 6209103, 6298446, 6353892, 6804780, 6922693,

6944822, 6993662, 6965968, 7058822, 7076469, 7155743, 7155744 and may be protected by

other U.S. Patents, foreign patents, or pending applications.

Finjan, Finjan logo, Vital Security, Vulnerability Anti.dote and Window-of-Vulnerability are

trademarks or registered trademarks of Finjan. Sophos is a registered trademark of Sophos plc.

McAfee is a registered trademark of McAfee Inc. Kaspersky is a registered trademark of Kaspersky

Lab. Websense® is a registered trademark of Websense, Inc. IBM® Proventia® Web Filter is a

registered trademark of IBM Corporation. Microsoft and Microsoft Office are registered trademarks

of Microsoft Corporation. All other trademarks are the trademarks of their respective owners.

For additional information, please visit www.finjan.com or contact one of our regional offices:

Catalog number: SACG-9.0-01

Email:[email protected]m

Internet:www.finjan.com

USA: San Jose

2025 Gateway Place Suite 180 San Jose,

CA 95110, USA

Toll Free: 1 888 FINJAN 8

Tel: +1 408 452 9700 Fax: +1 408 452 9701

[email protected]

Europe: UK

4th Floor, Westmead House,

Westmead,

Farnborough, GU14 7LP, UK

Tel: +44 (0)1252 511118

Fax: +44 (0)1252 510888

[email protected]

USA: New York

Chrysler Building

405 Lexington Avenue, 35th Floor

New York, NY 10174, USA

Tel: +1 212 681 4410 Fax: +1 212 681 4411

[email protected]

Europe: Germany

Alte Landstrasse 27, 85521

Ottobrun, Germany

Tel: +49 (0)89 673 5970

Fax: +49 (0)89 673 597 50

salesce@finjan.com

Israel/Asia Pacific

Hamachshev St. 1,

New Industrial Area Netanya, Israel 42504

Tel: +972 (0)9 864 8200

Fax: +972 (0)9 865 9441

[email protected]

Europe: Netherlands

Printerweg 56

3821 AD° Amersfoort

Netherlands

Tel: +31 334 543 555

Fax: +31 334 543 550

salesne@finjan.com

Contents i

CONTENTS

1. Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

Finjan Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

About This Manual . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2

2. Finjan Appliances. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3

Vital Security Appliance Series NG-8000 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3

NG-8000 Front Panel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4

NG-8000 Rear Panel. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

NG-8000 Hardware Specifications. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

Vital Security Appliance Series NG-6000. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

NG-6000 Front Panel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

NG-6000 Rear Panel. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

NG-6000 Hardware Specifications. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

Vital Security Appliance Series NG-5000. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

NG-5000 Front Panel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

NG-5000 Rear Panel. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

NG-5000 Hardware Specifications. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16

3. Configuring the Vital Security Appliance . . . . . . . . . . . . . . . . . . . . . 17

Management Console System Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

Operating Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

Software Requirements. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

Connecting your Vital Security Appliance (NG-5000/6000/8000). . . . . . . . . . . . . . . 18

Limited Shell Connection Procedure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

Using an Ethernet Cable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

Using a Serial Cable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

Initial Setup of your Vital Security Appliance using Limited Shell. . . . . . . . . . 20

Initial Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

Running the Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

Limited Shell commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30

Limited Shell Configuration Commands. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33

access_list . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33

change_password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33

config . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34

Setup and Configuration Guide

Contentsii

config_network. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .34

config_time. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .39

config_psweb . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .39

disable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .40

disable_service_snmpd. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .40

disable_service_ssh . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .40

enable. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .40

enable_service_snmpd . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .41

enable_service_ssh . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .41

ethconf . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .41

flush_dnscache. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .42

reset_config . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .43

Limited Shell Monitoring Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .43

arp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .43

df . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .43

ifconfig. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .43

ip2name . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .44

iptraf. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .45

last . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .46

name2ip . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .46

netstat. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .47

ping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .47

poweroff. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .48

reboot. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .48

restart_role. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .48

save_support_logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .48

setup. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .49

show. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .49

show_config . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .50

show_network. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .50

show_service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .51

show_dbsize . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .52

show_route . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .52

show_time. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .53

supersh. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .53

tcpdump . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .53

top . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .54

traceroute . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .54

uptime . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .55

Setup and Configuration Guide

iii

Contents

vmstat . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55

w . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56

wget. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56

First Login to the Management Console . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56

Update Mechanism. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57

Installing Updates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58

Configuring Next Proxy for Updates. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58

Configuring the Firewall for Automatic Updates . . . . . . . . . . . . . . . . . . . 58

Offline Updates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58

Routing Traffic through the Appliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59

Configuring Workstations for Routing Traffic through the Appliance . . . . . . . 59

Transparent Proxy. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59

Working with HTTP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61

HTTP Proxies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61

Working with Caching Proxies. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61

Downstream . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61

Upstream . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62

HTTP Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62

Working with ICAP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62

Why work with ICAP? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63

Vital Security as an ICAP Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63

REQMOD – RESPMOD Deployment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63

ICAP Clients . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64

4 . Configuring ICAP Clients . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65

Network Appliance NetCache Series (NetApp) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65

Blue Coat . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69

A Installation Details . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79

Installing your Vital Security Appliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79

Remote Installation on NG-8000 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82

Post-Installation Bonding Script on NG-8000 . . . . . . . . . . . . . . . . . . . . . . . . . . 87

B. Post-Installation System Hardening . . . . . . . . . . . . . . . . . . . . . . . . . . 89

System Hardening . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89

Policy Server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89

Setup and Configuration Guide

Contentsiv

Management Access List . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .89

Management Console Password. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .90

Default SNMP v2 Community String . . . . . . . . . . . . . . . . . . . . . . . . . . . .90

User Access to the Scanning Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . .90

Scanning Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .91

Proxy IP Address . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .91

Management Access List . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .91

Nortel Switches (Applicable only to NG-8000 Series). . . . . . . . . . . . . . . . . . . .92

Defaults SNMP Community String . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .92

Telnet and HTTP Access to the Switch . . . . . . . . . . . . . . . . . . . . . . . . . . .92

Default User and password. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .92

Chapter 1 - Introduction 1

CHAPTER

NTRODUCTION

1 Finjan Overview

Cyber-threats are fast increasing and pose a serious and growing problem for corporate

networks, appearing in different forms and using a variety of tactics – viruses, worms,

Trojans, and more. New, ultra-fast viruses can infect your system within seconds, long

before traditional signature-based solutions can protect you. While waiting for anti-virus

companies to release a new virus signature, thousands of unprotected computers may

have already been infected, leaving no alternative other than to shut down the corporate

network.

Finjan’s real-time web security solutions provide zero-hour protection against known and

unknown web attacks without requiring immediate signature or patch updates. Powered by

our Vital Security™ Web Appliances and utilizing patented real-time content inspection

technologies, Finjan’s proven security solutions effectively combat a wide array of web

threats, including Spyware, Phishing, Trojans, obfuscated malicious code and other types

of malware.

Finjan’s unique and patented proactive behavior-inspection technology at the gateway

offers instant protection against new virus, worm and malicious mobile code outbreaks

without time-sensitive signature-file updates, thus closing the Window-of-Vulnerability™

and providing networks with true zero-day protection. By detecting and stopping all such

attacks before they enter the corporate network, our solutions help to ensure continuous

business operations and save the time and money associated with security incidents.

Vital Security - Finjan’s Integrated Security Platform - is a complete and integrated

Secure Content Management solution in which individual best-of-breed security

applications work together in concert to respond proactively to the changing security

threats of both today and tomorrow.

Finjan's integrated “all-in-one” security appliances provide proactive, layered protection

against complex threats and vulnerabilities. Centralized management and reporting

enables IT managers to set organization-wide security policies, safeguard confidential data

and generate detailed reports as required for regulatory compliance.

Setup and Configuration Guide

Chapter 1 - Introduction2

2About This Manual

Chapter Description

Chapter 1 Finjan Overview - An introduction to Finjan's Vital

Security.

Chapter 2 Finjan Appliances - An introduction to Finjan's Vital

Security Appliances, including a brief description of the

Vital Security Appliances NG-8000/NG-6000/NG-5000.

Chapter 3 Getting Started – This chapter details everything you

need to know about getting started and lists the

necessary steps to be taken when installing and

working with your appliance.

This includes:

System requirements (hardware and software)

Information on supported protocols (HTTP and ICAP)

Configuration of end-user machines

Transparent proxy configuration

Connecting – describing the steps to be taken prior to

accessing the web-based Management Console. This

includes the Limited Shell.

Chapter 4 Configuring the ICAP Clients – This chapter discusses

configuration of Network Appliance (NetApp) and Blue

Coat

Appendix A Installation Details - using USB Disk-On-Key

Appendix B System Hardening (Post Installation)

Chapter 2 - Finjan Appliances 3

CHAPTER

INJAN

PPLIANCES

This manual deals with the following Vital Security appliances:

NG-8000

NG-6000

NG-5000

Each Vital Security appliance is supplied with a default IP address, and can be remotely

accessed for initial setup by any PC in the same subnet. Vital Security uses a secure ssh

connection to a command-line interface for first time setup, as well as for https connection

for ongoing management.

1Vital Security Appliance Series NG-8000

This appliance is a specially configured chassis containing multiple hot swappable blades,

with redundant power supplies, disks, blowers and switches, etc. The Vital Security

Operating System (VSOS) is preinstalled and preconfigured.

The Vital Security Appliance NG-8000 is supplied as one or more separate blades. You

can assign system roles according to your requirements using each blade as a separate

server, or activate more than one service on a single blade.

NOTE: Pictures of appliances displayed in this chapter are for general reference

only and may differ from the specific appliances you receive.

Setup and Configuration Guide

Chapter 2 - Finjan Appliances4

Figure 2-1: NG-8000 Superformance Appliance

1.1 NG-8000 Front Panel

Figure 2-2: NG-8000 Front Panel

5678

Autres manuels pour NG-8000

Ce manuel convient aux modèles suivants

Table des matières

Autres manuels finjan Matériel réseau

finjan

finjan NG-8000 Manuel utilisateur

Manuels Matériel réseau populaires d'autres marques

Matrix Switch Corporation

Matrix Switch Corporation MSC-HD161DEL Manuel utilisateur

B&B Electronics

B&B Electronics ZXT9-IO-222R2 Manuel utilisateur

Yudor

Yudor YDS-16 Manuel utilisateur

D-Link

D-Link ShareCenter DNS-320L Manuel utilisateur

Samsung

Samsung ES1642dc Instructions d'utilisation

Honeywell Home

Honeywell Home LTEM-PV Instructions de montage

evertz

evertz 7700 Series Manuel utilisateur

D-Link

D-Link ShareCenter DNS-343 Manuel utilisateur

Asante

Asante AsanteBridge 1012 Manuel utilisateur

FireBrick

FireBrick FB2700 Manuel utilisateur

Audiovox Electronics

Audiovox Electronics ARWH2T Manuel utilisateur

ADC

ADC DSX-1 Manuel

NetComm

NetComm NF2 Manuel utilisateur

Alcatel-Lucent

Alcatel-Lucent 5620 Manuel utilisateur

Dell EMC

Dell EMC XC6420 Series Manuel utilisateur

Lanner

Lanner NCA-1020A Manuel utilisateur

Allied Telesis

Allied Telesis AT-TN121-A Manuel utilisateur

Arista

Arista CCA-ETM-Q12 Manuel utilisateur