McAfee NS Series Manuel utilisateur
Revision A
McAfee Network Security Platform
(NS9500 Sensor Product Guide)
COPYRIGHT
Copyright © 2019 McAfee, LLC
TRADEMARK ATTRIBUTIONS
McAfee and the McAfee logo, McAfee Active Protection, ePolicy Orchestrator, McAfee ePO, McAfee EMM, Foundstone, McAfee LiveSafe, McAfee QuickClean, Safe Eyes,
McAfee SECURE, SecureOS, McAfee Shredder, SiteAdvisor, McAfee Stinger, True Key, TrustedSource, VirusScan are trademarks or registered trademarks of McAfee,
LLC or its subsidiaries in the US and other countries. Other marks and brands may be claimed as the property of others.
LICENSE INFORMATION
License Agreement
NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE
GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE
CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE
RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU
DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF
APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND.
2McAfee Network Security Platform
Contents
1About Network Security Sensors 5
Functions of an NS-series Sensor .............................5
Deployment of an NS-series Sensor ............................ 6
2NS-series physical description 7
Components of an NS-series Sensor ............................7
Sensor LEDs .....................................8
3Before you install 11
Usage restrictions .................................. 11
Safety measures ...................................11
About ber-optic ports ................................ 12
Contents of the box ................................. 12
Unpack the Sensor ..................................13
4Setting up the Sensor 15
Setup overview ...................................15
How to position the Sensor ...............................15
Install the slide rails and rack mount the Sensor ....................... 16
5NS-series interface modules 19
2-port QSFP28 100 Gigabit Network Interface Module .....................19
2-port QSFP+ 40 Gigabit Network Interface Module ......................20
4-port QSFP+ 40 Gigabit Network Interface Module ......................20
4-port 10/1 GigE SM 8.5 µm with internal fail-open Network Interface Module ............ 21
4-port 10/1 GigE MM 50 µm with internal fail-open Network Interface Module ............21
4-port 10/1 GigE MM 62.5 µm with internal fail-open Network Interface Module ........... 22
4-port RJ-45 10 Gbps/1 Gbps/100 Mbps Network Interface Module ................ 22
6-port RJ-45 10/100/1000 Mbps Network Interface module ................... 22
8-port SFP/SFP+ 1/10 Gigabit Network Interface Module ....................23
Installation of the interface module ............................23
Install the interface module during a fresh installation of the Sensor ............ 23
Install the interface module on an up and running Sensor ................ 24
Remove an interface module .............................. 24
6Small form-factor pluggable transceiver modules 25
SFP transceiver modules ................................26
SFP+ transceiver modules ............................... 26
QSFP+ transceiver modules .............................. 27
QSFP28 transceiver modules ..............................27
Install a transceiver module .............................. 27
Remove a transceiver module ..............................28
7Attaching cables to the Sensor 29
Connect the cable to the Console port ...........................29
McAfee Network Security Platform 3
Connect the cable to the Response port ..........................29
Connect the cable to the Management port ........................ 30
About connecting cables to the Monitoring ports ...................... 30
How to use peer ports ............................. 30
Cable types for routers, switches, hubs, and computers .................31
Connect the cables for in-line mode ........................ 31
Connect the cables for tap mode ......................... 32
Connect the cables for SPAN or hub mode ......................32
Connect the cable for Sensor failover ........................32
Connect the cables for Sensor Fail-Open .......................33
Turning the Sensor on and o ..............................34
Managing licenses for NS9500 Sensors .......................... 34
Add license to the Manager ............................35
Assign a license to a Sensor ........................... 35
Unassign a license from a Sensor ......................... 36
Remove a license from the Manager ........................ 36
8Troubleshooting the Sensor 37
9Sensor technical specications 39
Contents
4McAfee Network Security Platform
1About Network Security Sensors
McAfee Network Security Sensors (Sensors) are high-performance, scalable, and exible content processing
appliances built for the accurate detection and prevention of:
• Network intrusions
• Network misuse
• Distributed Denial-of-Service (DDoS) attacks
Sensors are specically designed to handle trac at wire speed, eciently inspect and detect intrusions with a
high degree of accuracy, and exible enough to adapt to the security needs of any enterprise environment.
When deployed at key network access points, the Sensor provides real-time trac monitoring to detect
malicious activity and respond to the malicious activity as congured by the administrator.
After you deploy a Sensor successfully, you congure and manage it using the McAfee® Network Security
Manager (Manager). The process of conguring a Sensor and establishing communication with the Manager is
described in subsequent chapters of this guide. For the details about the Manager, see the McAfee Network
Security Platform Manager Administration Guide.
Contents
Functions of an NS-series Sensor
Deployment of an NS-series Sensor
Functions of an NS-series Sensor
The NS-series Sensors are a third-generation hardware platform for McAfee® Network Security Sensor (Sensor)
designed for high bandwidth links, to provide Next Generation IPS (NGIPS) capability, providing high aggregate
throughput across various Sensor models. The NS9500 Sensor is a 1RU unit providing an aggregate throughput
up to 30 Gbps.
The primary function of a Sensor is to analyze trac on selected network segments and to respond when an
attack is detected. The Sensor examines the header and data portion of every network packet, looking for
patterns and behavior in the network trac that indicate malicious activity. The Sensor examines packets
according to user-congured policies, or rule sets, which determine what attacks to watch for, and how to
respond with countermeasures if an attack is detected.
If an attack is detected, a Sensor responds according to its congured policy. Sensor can perform many types of
attack responses, including generating alerts and packet logs, resetting TCP connections, "scrubbing" malicious
packets, and even blocking attack packets entirely before they reach the intended target.
1
McAfee Network Security Platform 5
Deployment of an NS-series Sensor
Deployment of a Sensor requires knowledge of your network to help determine the level of conguration and
the number of installed Sensors. You also need to determine the number of McAfee® ePolicy Orchestrator®
(McAfee® ePO™) servers required to protect your network. The Sensor is purpose-built for the monitoring of
trac across one or more network segments.
Following is an example of a network topology using Gigabit Ethernet throughput. In the illustration, McAfee®
Network Security Platform (formerly McAfee® IntruShield®) provides IPS protection to outsourced servers. High
port-density and virtualization provides a highly scalable solution, while Network Security Platform protects
against Web and eCommerce mail server exploits.
Figure 1-1 A sample Network Security Platform deployment
1About Network Security Sensors
Deployment of an NS-series Sensor
6McAfee Network Security Platform
2NS-series physical description
The high-port density NS-series Sensor is designed for high bandwidth links. This section gives a physical
description of the NS-series Sensor.
Contents
Components of an NS-series Sensor
Sensor LEDs
Components of an NS-series Sensor
Correlate the pictures with the information following it to understand the components of an NS-series Sensor.
Figure 2-1 Sensor front panel
1Console port (1)
2QSFP28 100/QSFP+ 40 Gigabit Ethernet ports (2)
3Two slots for I/O modules (Any combination of the interface modules can be used)
• QSFP28 100/QSFP+ 40 Gigabit Ethernet ports (2)
• QSFP+ 40 Gigabit Ethernet ports (4)
• QSFP+ 40 Gigabit Ethernet ports (2)
• SFP/SFP+ 1/10 Gigabit Ethernet Monitoring ports (8)
• RJ-45 10/100/1000 Mbps Ethernet Monitoring ports (6)
• RJ-45 100/1000/10000 Gigabit Ethernet Monitoring ports (4)
• 1/10 Gigabit Ethernet Monitoring ports (4)
4RJ-45 100/1000/10000 Mbps Ethernet Monitoring ports (4)
2
McAfee Network Security Platform 7
The supported transceiver modules are QSFP28, QSFP+, SFP+ (MM and SM), SFP Fiber (MM and SM) and SFP
Copper.
Figure 2-2 Sensor rear panel
1Power supply A/B (Pwr A/Pwr B)
2USB ports (2)
3RJ-45 1000/10000 Management port (Mgmt) (1)
4RJ-45 1000/10000 Response port (R1) (1)
Sensor LEDs
The front and rear panel LEDs provide status information for the health of the Sensor and the activity on its
ports. The following table describes the NS-series LEDs.
Front panel LEDs
LED Status Description
Status Green
Amber
Sensor is operating in good health.
Sensor is booting up. Also indicates system bad health if the LED is on for longer
duration.
Fan Green
Amber
All ve fans are operating.
One or more of the fans has failed.
Temp Green
Amber
Inlet air temperature measured inside the chassis is normal. (Chassis
temperature OK.)
Inlet air temperature measured inside the chassis is too high. (Chassis
temperature too hot.)
Gigabit Ports
Speed
Green
Amber
O
The port speed is 10000 Mbps.
The port speed is 1000 Mbps.
The port speed is 100 Mbps.
Gigabit Ports Link Green
O
The link is up.
The link is down.
RJ45 FailOpen/
Bypass
Green
O
The port pair is in Inline Fail-Open/Inline Fail-Close/Span/Tap Mode.
The Port Pair is in the Bypass Mode.
2NS-series physical description
Sensor LEDs
8McAfee Network Security Platform
Rear panel LEDs
LED Status Description
Pwr A (Power A) Solid Green
Blinking Green
Solid Amber
Power Supply A is functioning.
Power Supply A is stand-by.
Power Supply A is not functioning or the unit has no power feed.
Pwr B (Power B) Solid Green
Blinking Green
Solid Amber
Power Supply B is functioning.
Power Supply B is stand-by.
Power Supply B is not functioning or the unit has no power feed.
Management Port Speed Green
Amber
O
The port speed is 10000 Mbps.
The port speed is 1000 Mbps.
Management Port Link/Act Green
Blinking Green
O
The link is up.
Data is received or transmitted.
The link is down.
Response Port Speed Green
Amber
O
The port speed is 10000 Mbps.
The port speed is 1000 Mbps.
Response Port Link/Act Green
Blinking Green
O
The link is up.
Data is received or transmitted.
The link is down.
NS-series physical description
Sensor LEDs 2
McAfee Network Security Platform 9
2NS-series physical description
Sensor LEDs
10 McAfee Network Security Platform
Ce manuel convient aux modèles suivants
1
Table des matières
Autres manuels McAfee Pare-feu
McAfee
McAfee M-1250 - Network Security Platform Guide de référence rapide
McAfee
McAfee NS9100 Manuel utilisateur
McAfee
McAfee MSA-3400-SWGI - Web Security Appliance 3400 Manuel utilisateur
McAfee
McAfee NS7200 Manuel utilisateur
McAfee
McAfee M-1250 - Network Security Platform Manuel utilisateur
McAfee
McAfee INTRUSHIELD 1400 Manuel utilisateur
McAfee
McAfee Data Loss Prevention Prevent Manuel utilisateur
McAfee
McAfee M-1250 - Network Security Platform Manuel utilisateur
McAfee
McAfee SG720 Manuel utilisateur
McAfee
McAfee NS3500 Manuel utilisateur
McAfee
McAfee M-3050 Manuel utilisateur
McAfee
McAfee M-3050 Manuel utilisateur
McAfee
McAfee Manager Appliance Manuel utilisateur
McAfee
McAfee IIP-M65K-ISAA - Network Security Platform... Manuel utilisateur
McAfee
McAfee M4050 - Network Security Platform Manuel utilisateur
McAfee
McAfee MFO-3400-SWGA - Web Security Appliance 3400... Manuel utilisateur
McAfee
McAfee IIP-M80K-ISAA - Network Security Platform... Manuel utilisateur
McAfee
McAfee MAP-3300-SWG - Web Security Appliance 3300 Manuel utilisateur
McAfee
McAfee NS5100 Manuel utilisateur
McAfee
McAfee SG310 Mode d’emploi
