Nortel 2070 Guide rapide

Nortel TPS Remediation Module

for NVG—Installation and

Configuration

Nortel TPS Remediation Module for Nortel VPN

Gateway—Installation and Configuration

Release 4.7.0.2

Part No. NN47240-103

(324602-A)

This document is protected by copyright and distributed under licenses restricting its use, copying,

distribution, and decompilation. No part of this document may be reproduced in any form by any means

without prior written authorization of Nortel Networks, Inc. Documentation is provided “as is” without

warranty of any kind, either express or implied, including any kind of implied or express warranty of

infringement or the implied warranties of merchantability or fitness for a particular purpose.

U.S. Government End Users

This document is provided with a “commercial item” as defined by FAR 2.101 (Oct 1995) and contains

“commercial technical data” and “commercial software documentation” as those terms are used in FAR

12.211-12.212 (Oct 1995). Government End Users are authorized to use this documentation only in

accordance with those rights and restrictions set forth herein, consistent with FAR 12.211- 12.212 (Oct

1995), DFARS 227.7202 (Jun 1995) and DFARS 252.227-7015 (Nov 1995).

Nortel Networks, Inc. reserves the right to change any products described herein at any time, and without

notice. Nortel Networks, Inc. assumes no responsibility or liability arising from the use of products

described herein, except as expressly agreed to in writing by Nortel Networks, Inc. The use and purchase

of this product does not convey a license under any patent rights, trademark rights, or any other intellectual

property rights of Nortel Networks, Inc.

appearing in this manual are owned by their respective companies.

Export

This product, software and related technology is subject to U.S. export control and may be subject to

export or import regulations in other countries. Purchaser must strictly comply with all such laws and

regulations. A license to export or reexport may be required by the U.S. Department of Commerce.

840712031433

NORTEL TPS REMEDIATION MODULE FOR NVG—INSTALLATION AND CONFIGURATION RELEASE 4.7.0.2 PAGE 3

TABLE OF CONTENTS

Chapter 1: Overview ........................................................................ 4

TPS and the Remediation Module............................................................ 4

Defense Center............................................................................. 5

3D Sensor..................................................................................... 5

TPS Remediation Module for NVG........................................................... 5

Overall function............................................................................. 6

Interface between the DC and Perl script..................................... 7

Perl script functionality.................................................................. 7

Chapter 2: Installation ..................................................................... 8

Installing the remediation module............................................................. 9

Chapter 3: Configuration................................................................ 11

NVG configuration for TPS remediation.................................................. 11

Defense Center and 3D Sensor configuration........................................ 12

Creating remediations for the Defense Center and 3D Sensors 13

Instances on the Defense Center and 3D Sensors .................... 13

....................................................Kick the Client–IP remediation 14

......................................Adding a Kick the Client-IP remediation 14

Delete session remediation ........................................................ 14

Adding a delete session remediation.......................................... 14

Appendix A: Configuration Examples............................................. 16

................................NVG TPS module configuration with NVG-TPS 1.4 16

NORTEL TPS REMEDIATION MODULE FOR NVG—INSTALLATION AND CONFIGURATION RELEASE 4.7.0.2 PAGE 4

CHAPTER 1

OVERVIEW

This chapter describes the Nortel Threat Protection System (TPS) Remediation

Module for Nortel VPN Gateway (NVG) and the products in the Nortel TPS that

use it.

TPS and the Remediation Module

The Nortel TPS is a fully integrated security monitoring system that identifies

network threats, network assets, and known vulnerabilities in those assets.

IMPORTANT! Beginning with Release 4.7 software, 3D Sensors refer to both

Intrusion Sensors and RTI Sensors. A 3D Sensor is able to have Intrusion

Sensing (IPS/IDS) and/or RTI capabilities.

The TPS Remediation Module for Nortel VPN Gateway (NVG) is an interface

module supported on the TPS Defense Center and TPS 3D Sensors. It is

available through the Policy and Response feature.

The Policy and Response feature can be used to build compliance policies.

Compliance policies describe the type of activity that constitutes a policy violation.

The TPS Remediation Module for NVG allows creation and uploading of custom

remediation modules to respond to policy violations.

When a rule within a compliance policy is violated, the Defense Center or 3D

Sensor can launch remediations, such as blocking a host at the firewall or router

when it violates a policy, or send any combination of the following responses: e-

mail alerts, SNMP alerts, or syslog alerts.

NORTEL TPS REMEDIATION MODULE FOR NVG—INSTALLATION AND CONFIGURATION RELEASE 4.7.0.2 PAGE 5

Chapter 1: Overview

TPS Remediation Module for NVG

Defense Center

The Nortel TPS 2070 DC, the Defense Center, is the central management point of

the TPS. The Defense Center provides management of 3D Sensors remotely and

also allows the following:

•reviewing and evaluating of the data from the sensors

•configuring of settings on the sensors

•distributing of software and rules updates to the sensors

•responding to policy violations by launching remediations

3D Sensor

Nortel Real-time Threat Intelligence Sensors provide understanding of network

topology in the following ways by:

•providing an up-to-the-minute mapping of network infrastructure

•generating events when changes are observed

•responding to suspicious activity by sending alerts and launching

remediations

3D Sensors passively discover network hosts by continuously monitoring network

traffic to identify the operating system, protocols, and services running on each

host on the network. The process of continuous network discovery maps each

monitored network segment without interacting with any hosts. Information

gathered by 3D Sensors is provided in a network map and table views.

TPS Remediation Module for NVG

The Nortel TPS Remediation Module for NVG is an interface software module

included on the Defense Center and 3D Sensors to communicate with the NVG. It

is the interface between the TPS System and the NVG.

Administrators can configure responses, in the form of remediations, on the

Defense Center and on the 3D Sensor.

Remediations are programs that the Defense Center or 3DSensor run when a

compliance policy is violated. Remediations use information provided in the event

that triggered the violation to perform a specific action.The Policy and Response

Remediation feature can be configured by administrators to pass specific event

information to the NVG.

When creating each instance, specify the configuration information necessary for

the Defense Center to establish a connection with the NVG.

For each configured instance, add remediations that describe the actions required

for the appliance to perform when a policy is violated.

After they are configured, remediations can be added to response groups or

assigned specifically to rules within compliance policies.

NORTEL TPS REMEDIATION MODULE FOR NVG—INSTALLATION AND CONFIGURATION RELEASE 4.7.0.2 PAGE 6

Chapter 1: Overview

TPS Remediation Module for NVG

When the system executes these remediations, it logs events to the remediation

event view and provides details about the remediation name, the policy and rule

that triggered it, and the exit status message. The following figure describes the

model setup for TPS Remediation module for NVG.

Figure 1: Model setup for TPS Remediation module for NVG

Overall function

Whenever a Netdirect client connected to NVG server creates unwanted traffic to

the back end (clean side), TPS initiates to kick out (forcefully logout) the user. To

log out the user from the session, there is a "kick" command available in the NVG

CLI.

The kick command requires the following two inputs:

•vpnid

•username

The Perl script installed in the DC opens a CLI session in NVG and executes the

kick command. Since DC is connected to Mapped IP (MIP), the perl script can

establish a telnet or SSH connection to the NVG. The choice of session—telnet or

SSH can be configured while installing the perl script in the DC.

If any unwanted traffic, according to the compliance policy, is sensed by the 3D

sensor, then 3D sends the tunnel IP to DC. DC in turn triggers the perl script for

kicking the tunnel IP. Whenever the policy non-compliance occurs, either tunnel IP

or local IP, the script is triggered.

NORTEL TPS REMEDIATION MODULE FOR NVG—INSTALLATION AND CONFIGURATION RELEASE 4.7.0.2 PAGE 7

Chapter 1: Overview

TPS Remediation Module for NVG

Snooze time is the time interval between two consecutive executions of perl

script. This can be configured in DC.

Interface between the DC and Perl script

The DC creates a file named as instance.conf before executing the script that

includes the following:

•NVG MIP

•login name

•password

•communicating protocol information

The XML parser file module.template is used to get the preceding information

from the file instance.conf and store that into variables. These variables can be

used by the perl script by including the module.template file.

Perl script functionality

This script uses Perl-Expect module for establishing the telnet or SSH connection

to the NVG. Using the information given by the module.template script to

establish a connection with the NVG. Provide the login name and the password.

The vpnid and username for the corresponding Netdirect client receives the /info/

users command. Use this information to execute the kick command. View the log

messages according to the action performed by the script at the /tmp directory in

the DC.

NORTEL TPS REMEDIATION MODULE FOR NVG—INSTALLATION AND CONFIGURATION RELEASE 4.7.0.2 PAGE 8

CHAPTER 2

INSTALLATION

This chapter describes the Nortel TPS Remediation Module for NVG remediation

file installation process for the Nortel TPS 2070 DC (Defense Center) and the

Nortel 3D sensors.

The Nortel TPS Remediation Modules for NVG are available for download at

www.nortel.com/support.

Use the following procedure to locate the files on the Nortel Technical Support

page.

1. In your Web browser, navigate to the Nortel Support Web site:

www.nortel.com/support

2. Navigate to the software downloads Web page for the Threat Protection

System 2070 Defense Center.

3. Locate the script file that supports NVG: nvg_tps-1.4.tgz.

4. Follow the instructions on the software downloads Web page to download the

selected file.

Use the following procedure to install the TPS Remediation module for the NVG.

1. Get the latest Release of the TPS remediation module, for example:

nvg_tps-1.4.tgz

from the Nortel Technical Support using the preceding instructions.

2. Check the compatibility of the module with the NVG.

3. Install the file as mentioned in the section “Installing the remediation module”.

NORTEL TPS REMEDIATION MODULE FOR NVG—INSTALLATION AND CONFIGURATION RELEASE 4.7.0.2 PAGE 9

Chapter 2: Installation

Installing the remediation module

Use the following procedure to install a Nortel TPS Remediation Module for

Application Switch on a Defense Center or RTI Sensor.

1. From the TPS GUI main page for the appliance, open the Policy and

Response page.

2. Select Responses.

3. Select Remediations.

4. Select Modules. The remediation module list page for the Defense Center

appears as shown in the following figure:

5. Click Browse to navigate to the location where you saved the file containing

the remediation module.

6. Click Install. The remediation module installation begins. The following figure

describes the module list page after the NVG TPS module is installed.

NORTEL TPS REMEDIATION MODULE FOR NVG—INSTALLATION AND CONFIGURATION RELEASE 4.7.0.2 PAGE 10

Chapter 2: Installation

Installing the remediation module

Figure 2: Module List page after the NVG TPS module installed

Autres manuels pour 2070

Table des matières

Autres manuels Nortel Logiciel

Nortel

Nortel BCM 4.0 Manuel d'installation et d'exploitation

Nortel

Nortel BCM 3.7 Manuel utilisateur

Nortel

Nortel INM 5.0 Manuel technique

Nortel

Nortel Archive Manuel utilisateur

Nortel

Nortel INM 3.1 Mode d’emploi

Nortel

Nortel BCM 4.0 Manuel utilisateur

Nortel

Nortel Voice Mail Guide de démarrage rapide

Nortel

Nortel Express Call Center Manuel utilisateur

Nortel

Nortel Call Pilot A0789401 Manuel utilisateur

Nortel

Nortel Web Center Portal Mode d’emploi

Nortel

Nortel VoIP Gateway Manuel utilisateur

Nortel

Nortel TDM Recorder Manuel utilisateur

Nortel

Nortel Contact Center Manager Manuel du produit

Nortel

Nortel ICS 4.1 Manuel utilisateur

Nortel

Nortel CC MIS Manuel utilisateur

Nortel

Nortel 1000 Con?guration guide Instructions d'utilisation et d'entretien

Nortel

Nortel Attendant PC Guide de sécurité

Nortel

Nortel BEM 10 Mode d’emploi

Nortel

Nortel Business Communications Manager (BCM) &... Manuel utilisateur

Nortel

Nortel NA Manuel d'utilisation

Nortel

Nortel SCS Manuel utilisateur

Nortel

Nortel Wizard Manuel utilisateur

Nortel

Nortel Observe Manuel utilisateur

Nortel

Nortel Alteon OS 40M2420 Manuel d'utilisation

Manuels Logiciel populaires d'autres marques

COMPRO

COMPRO COMPROFM Manuel utilisateur

Muratec

Muratec OFFICEBRIDGE ONLINE Manuel utilisateur

Oracle

Oracle Contact Center Anywhere 8.1 Manuel utilisateur

Adobe

Adobe 65007312 - Photoshop Lightroom Manuel

Avaya

Avaya NULL One-X for RIM Blackberry Manuel utilisateur

HP ProLiant BL420c Manuel utilisateur

PS Audio

PS Audio PowerPlay Manuel du propriétaire

Brady

Brady LOCKOUT PRO 3.0 Manuel de service

Avaya

Avaya Interaction Center Manuel utilisateur

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Manuel

Novell

Novell GROUPWISE 8 - INTERNET AGENT Manuel utilisateur

Oracle

Oracle Application 9i Manuel utilisateur

Acer

Acer RDM Manuel utilisateur

Canon

Canon Vixia HF21 Manuel utilisateur

Canon

Canon ZR950 Manuel utilisateur

Samsung

Samsung Auto Backup Manuel utilisateur

Polycom

Polycom Vortex EF2201 Instructions d'installation et d'utilisation

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Manuel utilisateur