ForeScout CounterACT Manuel utilisateur

Forescout

Quick Installation Guide

Single Appliance

Version 8.1

Quick Installation Guide Single Appliance

Version 8.1 2

Contact Information

Forescout Technologies, Inc.

190 West Tasman Drive

San Jose, CA 95134 USA

https://www.forescout.com/support/

Toll-Free (US): 1.866.377.8771

Tel (Intl): 1.408.213.3191

Support: 1.708.237.6591

About the Documentation

Refer to the Resources page on the Forescout website for additional technical

documentation: https://www.forescout.com/company/resources/

Have feedback or questions? Write to us at documentation@forescout.com

Legal Notice

Delaware corporation. A list of our trademarks and patents can be found at

https://www.forescout.com/company/legal/intellectual-property-patents-trademarks. Other

brands, products, or service names may be trademarks or service marks of their respective

owners.

2019-03-18 14:40

Quick Installation Guide Single Appliance

Version 8.1 3

Table of Contents

Welcome to Version 8.1 ............................................................................... 5

Forescout Package Contents ..........................................................................5

Overview...................................................................................................... 6

1. Create a Deployment Plan ........................................................................ 6

Decide Where to Deploy the Appliance............................................................6

Appliance Interface Connections.....................................................................6

Management Interface..............................................................................6

Monitor Interface......................................................................................9

Response Interface...................................................................................9

2. Set up your Switch ................................................................................. 11

A. Switch Connection Options ......................................................................11

1 Standard Deployment (Separate Management, Monitor and Response

Interfaces) ............................................................................................11

2 Passive Inline Tap................................................................................11

3 Active (Injection-Capable) Inline Tap .....................................................11

4 IP Layer Response (for Layer-3 Switch Installations)................................11

B. Switch Setting Notes...............................................................................12

VLAN (802.1Q) Tags...............................................................................12

Additional Guidelines ..............................................................................12

3. Connect Network Cables and Power On.................................................. 13

A. Unpack the Appliance and Connect Cables.................................................13

B. Record the Interface Assignments ............................................................13

C. Power on the Appliance...........................................................................14

4. Configure the Appliance ......................................................................... 15

5. Remote Management.............................................................................. 19

iDRAC Setup..............................................................................................19

Enable and Configure the iDRAC Module....................................................19

Connect the Module to the Network ..........................................................21

6. Verify Connectivity................................................................................. 23

Verify the Management Interface Connection.................................................23

Perform a Ping Test ....................................................................................23

7. Set Up the Forescout Console................................................................. 24

Install the Console......................................................................................24

Perform Initial Setup ..................................................................................25

Before You Start the Initial Setup.............................................................26

Quick Installation Guide Single Appliance

Version 8.1 4

Additional Forescout Documentation.......................................................... 27

Documentation Downloads ......................................................................27

Documentation Portal .............................................................................28

Forescout Help Tools...............................................................................28

Quick Installation Guide Single Appliance

Version 8.1 5

Welcome to Version 8.1

The Forescout platform provides infrastructure and device visibility, policy

management, orchestration and workflow streamlining to enhance network security.

The platform provides enterprises with real-time contextual information of devices

and users on the network. Policies are defined using this contextual information that

helps ensure compliance, remediation, appropriate network access and streamlining

of service operations.

This guide describes the

installation for a single

stand-alone CounterACT

Appliance preinstalled

with version 8.0. Some

Appliances may come

preinstalled with a later version. To use version 8.1, follow the approved

upgrade path, outlined in the version Release Notes.

For more detailed information or information about upgrade or about deploying

multiple Appliances for enterprise-wide network protection, refer to the Forescout

Installation Guide and Forescout Administration Guide. See Additional Forescout

Documentation for information on how to access these guides.

Additionally, you can navigate to the support website located at:

http://www.forescout.com/support for the latest documentation, knowledge base

articles, and updates for your Appliance.

Forescout Package Contents

Your Forescout package includes the following components:

The CounterACT Appliance

Front Bezel

Rail Kits (Mounting brackets)

Power cord(s)

DB9 Console connecting cable (for serial connections only)

Enterprise Products Safety, Environmental, and Regulatory Information

Getting Started document (CT-xxxx Appliances based on hardware revision 5x

and Forescout 51xx Appliances only)

Quick Installation Guide Single Appliance

Version 8.1 6

Overview

Perform the following to set up your Forescout deployment:

1. Create a Deployment Plan

2. Set up your Switch

3. Connect Network Cables and Power On

4. Configure the Appliance

5. Remote Management

6. Verify Connectivity

7. Set Up the Forescout Console

1. Create a Deployment Plan

Before performing the installation, you should decide where to deploy the Appliance

and learn about Appliance interface connections.

Decide Where to Deploy the Appliance

Selecting the correct network location where the Appliance will be installed is crucial

for a successful deployment and optimal performance. The correct location will

depend on your desired implementation goals and network access policy. The

Appliance should be able to monitor the traffic that is relevant to the desired policy.

For example, if your policy depends on monitoring authorization events from

endpoints to corporate authentication servers, the Appliance will need to be installed

so that it sees endpoint traffic flowing into authentication server(s).

For more information about installation and deployment, refer to the Forescout

Installation Guide. See Additional Forescout Documentation for information on how

to access this guide.

Appliance Interface Connections

The Appliance is generally configured with three connections to the network switch.

Management Interface

The management interface allows you to manage the Forescout platform and

perform queries and deep inspection of endpoints. The interface must be connected

to a switch port with access to all network endpoints.

Each Appliance requires a single management connection to the network. This

connection requires an IP address on the local LAN and port 13000/TCP access from

machines that will be running the Console management application. The

management port must have access to additional network services.

Quick Installation Guide Single Appliance

Version 8.1 7

Network Access Requirements

Port Service To or From

Forescout

Platform

Function

22/TCP

SSH

From Allows remote inspection of OS X and

Linux endpoints.

Allows the Forescout platform to

communicate with network switches

and routers.

To Allows access to the Forescout

platform command line interface.

2222/TCP SSH To (High Availability) Allows access to the

physical Appliances that are part of the

High Availability pair.

Use 22/TCP to access the shared

(virtual) IP address of the pair.

25/TCP SMTP From Allows the Forescout platform access

to the enterprise mail relay.

53/UDP DNS From Allows the Forescout platform to

resolve internal IP addresses.

80/TCP HTTP To Allows HTTP redirection.

123/UDP NTP From Allows the Forescout platform access

to a local time server or

ntp.forescout.net.

By default the Forescout platform

accesses ntp.foreScout.net

135/TCP MS-WMI From Allows remote inspection of Windows

endpoints.

139/TCP

SMB, MS-RPC From

Allows remote inspection of Windows

endpoints (For endpoints running

Windows 7 and earlier).

445/TCP Allows remote inspection of Windows

endpoints.

Quick Installation Guide Single Appliance

Version 8.1 8

Port Service To or From

Forescout

Platform

Function

161/UDP SNMP From Allows the Forescout platform to

communicate with network switches

and routers.

For information about configuring

SNMP, refer to the Forescout

Administration Guide.

162/UDP SNMP To Allows the Forescout platform to

receive SNMP traps from network

switches and routers.

For information about configuring

SNMP, refer to the Forescout

Administration Guide.

389/TCP

(636) LDAP From Allows the Forescout platform to

communicate with Active Directory.

Allows communication with the

Forescout platform’s web-based

portals.

443/TCP HTTPS To Allows HTTP redirection using TLS.

2200/TCP SecureConnector

for Linux To Allows SecureConnector to create a

secure (encrypted SSH) connection to

the Appliance from Linux machines.

SecureConnector is a script based

agent that enables management of

Linux endpoints while they are

connected to the network.

10003/TCP SecureConnector

for Windows To Allows SecureConnector to create a

secure (encrypted TLS) connection to

the Appliance from Windows machines.

SecureConnector is an agent that

enables management of Windows

endpoints while they are connected to

the network. Refer to the Forescout

Administration Guide for more

information about SecureConnector.

When SecureConnector connects to an

Appliance or to the Enterprise Manager

it is redirected to the Appliance to

which its host is assigned. Ensure this

port is open to all Appliances and to

the Enterprise Manager to allow

transparent mobility within the

organization.

Quick Installation Guide Single Appliance

Version 8.1 9

Port Service To or From

Forescout

Platform

Function

10005/TCP SecureConnector

for OS X To Allows SecureConnector to create a

secure (encrypted TLS) connection to

the Appliance from OS X machines.

SecureConnector is an agent that

enables management of OS X

endpoints while they are connected to

the network. Refer to the Forescout

Administration Guide for more

information about SecureConnector.

When SecureConnector connects to an

Appliance or to the Enterprise Manager

it is redirected to the Appliance to

which its host is assigned. Ensure this

port is open to all Appliances and to

the Enterprise Manager to allow

transparent mobility within the

organization.

13000/TCP Forescout

platform From/To For deployments with only one

Appliance – from the Console to the

Appliance.

For deployments with more than one

Appliance – from the Console to the

Appliance and from one Appliance to

another. Appliance communication

includes communication with the

Enterprise Manager and the Recovery

Enterprise Manager, using TLS.

Monitor Interface

The monitor interface allows the Appliance to monitor and track network traffic. Any

available interface can be used as the monitor interface.

Traffic is mirrored to a port on the switch and monitored by the Appliance. The use of

802.1Q VLAN tagging depends upon the number of VLANs being mirrored.

Single VLAN: When monitored traffic is generated from a single VLAN, the

mirrored traffic does not need to be VLAN tagged.

Multiple VLANs: If monitored traffic is from more than one VLAN, the

mirrored traffic must be 802.1Q VLAN tagged.

When two switches are connected as a redundant pair, the Appliance must monitor

traffic from both switches.

No IP address is required on the monitor interface.

Response Interface

The Appliance responds to traffic using the response interface. Response traffic is

used to protect against malicious activity and to perform policy actions. These

Quick Installation Guide Single Appliance

Version 8.1 10

actions may include, for example, redirecting web browsers or performing session

blocking. The related switch port configuration depends upon the traffic being

monitored.

Any available interface can be used as the response interface.

Single VLAN: When monitored traffic is generated from a single VLAN, the

response port must belong to the same VLAN. In this case, the Appliance

requires a single IP address on that VLAN.

Multiple VLANs: If monitored traffic is from more than one VLAN, the

response port must also be configured with 802.1Q VLAN tagging for the

same VLANs. The Appliance requires an IP address for each monitored VLAN.

Table des matières

Manuels Matériel réseau populaires d'autres marques

Matrix Switch Corporation

Matrix Switch Corporation MSC-HD161DEL Manuel utilisateur

B&B Electronics

B&B Electronics ZXT9-IO-222R2 Manuel utilisateur

Yudor

Yudor YDS-16 Manuel utilisateur

D-Link

D-Link ShareCenter DNS-320L Manuel utilisateur

Samsung

Samsung ES1642dc Instructions d'utilisation

Honeywell Home

Honeywell Home LTEM-PV Instructions de montage

evertz

evertz 7700 Series Manuel utilisateur

D-Link

D-Link ShareCenter DNS-343 Manuel utilisateur

Asante

Asante AsanteBridge 1012 Manuel utilisateur

FireBrick

FireBrick FB2700 Manuel utilisateur

Audiovox Electronics

Audiovox Electronics ARWH2T Manuel utilisateur

ADC

ADC DSX-1 Manuel

NetComm

NetComm NF2 Manuel utilisateur

Alcatel-Lucent

Alcatel-Lucent 5620 Manuel utilisateur

Dell EMC

Dell EMC XC6420 Series Manuel utilisateur

Lanner

Lanner NCA-1020A Manuel utilisateur

Allied Telesis

Allied Telesis AT-TN121-A Manuel utilisateur

Arista

Arista CCA-ETM-Q12 Manuel utilisateur