Nortel 2070 Manuel utilisateur

Nortel Threat Protection System

Threat Protection System

Troubleshooting Guide

Release: 4.7

Document Revision: 01.01

www.nortel.com

NN47240-700 324442-A

Nortel Threat Protection System

Release: 4.7

Publication: NN47240-700

Document status: Standard

Document release date: 112007

The information in this document is subject to change without notice. The statements, configurations, technical

data, and recommendations in this document are believed to be accurate and reliable, but are presented without

express or implied warranty. Users must take full responsibility for their applications of any products specified in this

document. The information in this document is proprietary to Nortel Networks.

Export

This product, software and related technology is subject to U.S. export control and may be subject to export or

import regulations in other countries. Purchaser must strictly comply with all such laws and regulations. A license to

export or reexport may be required by the U.S. Department of Commerce.

Licensing

This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit

(http://www.openssl.org/).

This product includes cryptographic software written by Eric Young ([email protected]).

This product includes software written by Tim Hudson ([email protected]).

This product includes software developed by the Apache Software Foundation http://www.apache.org/.

Wilson, and is licensed under the GPL.

See Appendix D, "License Information", in the User’s Guide for more information

Contents

New in this release 7

Navigation 7

Introduction 9

Prerequisites 9

Navigation 10

Acronyms 10

Troubleshooting Fundamentals 11

Navigation 11

Log files 11

Issues that require Sourcefire assistance 12

Hardware Troubleshooting 15

Navigation 15

TPS Hardware 15

Ports to open in a firewall 16

Software Troubleshooting 17

Creating a troubleshoot file from a TPS device 18

Obtaining the troubleshoot file following a failed software upgrade 19

Resetting passwords 20

Resetting the root password of a TPS device 20

Resetting the Administrator Password for a TPS device 21

Installing an Old Version of SEU 22

Event handling 22

Troubleshooting TPS Sensor when not receiving events 23

Troubleshooting Defense Center when not receiving events 23

Troubleshooting errors when adding sensor to DC 23

Troubleshooting the SFDataCorrelator 24

Troubleshooting alerting problems 25

Troubleshooting mail alerting problems 25

Troubleshooting SNMP alerting problems 25

Troubleshooting Syslog alerting problems 25

Troubleshooting events that show incorrect time 25

Troubleshooting LDAP authentication 26

Nortel TPS 4.7

Threat Protection System Troubleshooting Guide

NN47240-700 01.01 Standard

112007

RUA 27

Configuring Snort through the User Interface 27

Verifying prohibit packet data on the DC 28

Performing RNA IP/Port Exclusion 28

Scanning the NMAP 29

Remediation Procedures 29

Remediating NAS 29

Troubleshooting Global Faults 31

Navigation 31

Troubleshooting when no white list events are generated 32

Troubleshooting an IS that does not generate events 32

Troubleshooting an SDM IS that could not be added to a DC 32

Troubleshooting an IS that does not block traffic 33

Validating the failopen function 33

Troubleshooting an IS that does not send email 34

Troubleshooting a DC that cannot push a policy to a sensor that it is

managing 34

Troubleshooting a faulty OPSEC 34

Troubleshooting a failed upgrade 35

Troubleshooting a failed automatic SEU Update 35

Troubleshooting when a customer is unable to add a sensor to be managed by a

DC 36

Troubleshooting a system crash 37

Verify the ports to be opened in the firewall for 4.6 37

Troubleshooting Snort 37

Troubleshooting memory problems 38

IPS mode cable Deployment Scenarios 38

Deploying between two endpoints 38

Deploying between two network switches 39

Between a switch and an endpoint 39

Between a switch and a router 39

Between a router and an endpoint 39

Between a firewall and an endpoint 40

Between two firewalls 40

Between a switch and a firewall 40

Between router and a firewall 40

Checking IPv6 configurations on the CLI 41

Verification of Detection Resources on the CLI 41

Viewing the enabled rules on the CLI 41

Viewing remediation log 42

Viewing the LDAP SSL certificate 42

Emergency recovery trees 43

Lost access to the TPS DC/IS device -- recovery tree 43

Nortel TPS 4.7

Threat Protection System Troubleshooting Guide

NN47240-700 01.01 Standard

112007

Licensing 5

The TPS DC/ IS cannot receive events -- recovery tree 44

Reference to third party Application Guides 47

Contact Nortel technical support 49

Navigation 49

Gathering critical information 49

Getting help from the Nortel Web site 50

Getting help over the phone from a Nortel Solutions Center 50

Getting help from a specialist by using an Express Routing Code 51

Getting help through a Nortel distributor or reseller 51

Glossary 53

Nortel TPS 4.7

Threat Protection System Troubleshooting Guide

NN47240-700 01.01 Standard

112007

Nortel TPS 4.7

Threat Protection System Troubleshooting Guide

NN47240-700 01.01 Standard

112007

New in this release

The Nortel Threat Protection System Release. 4.7 Troubleshooting Guide

with Emergency Recovery Tree (NN47240-700) is a new document for

Nortel Threat Protection System Release 4.7.

Navigation

Nortel TPS 4.7

Threat Protection System Troubleshooting Guide

NN47240-700 01.01 Standard

112007

8New in this release

Nortel TPS 4.7

Threat Protection System Troubleshooting Guide

NN47240-700 01.01 Standard

112007

Introduction

The Nortel Threat Protection System is a fully integrated intrusion

detection system that consists of the following:

•TPS 2070 Defense Center, which manages intrusion sensors in the

network environment

•TPS 2050 Intrusion Sensor and TPS 2070 Intrusion Sensor, which

detect and track network intrusions, either independently or under the

management of the TPS 2070 Defense Center

•TPS 2150 Intrusion Sensor and TPS 2170 Intrusion Sensor, which

have fail-open functionality in inline mode

This chapter describes the prerequisites and various tools used to

troubleshoot the Nortel TPS 4.7. Use these troubleshooting tools to

enhance the overall performance, resolve error messages, and increase

response time for a specific feature. Each tool is described by purpose,

usage procedures, and how to interpret the output.

Prerequisites

Nortel recommends you to use one or more of the following commercially

available troubleshooting tools as well as the tools described in this

document.

•Capture and analyze HTTP and HTTPS with the HTTP Analyzer from

IE Inspector http://www.ieinspector.com/

•Capture and analyze HTTP and HTTPS with Tamper Data, a plug-in

available for Mozilla Firefox https://addons.mozilla.org/en-US/firefox/

addon/966

•Display the time to load Web pages with Faster Fox, a plug-in available

for Mozilla Firefox https://addons.mozilla.org/en-US/firefox/addon/1269

•Capture and analyze packets with either Sniffer or Wireshark from

Network General http://www.wireshark.org/ and http://www.networkge

neral.com/

Nortel TPS 4.7

Threat Protection System Troubleshooting Guide

NN47240-700 01.01 Standard

112007

10 Introduction

Navigation •“Troubleshooting Fundamentals” (page 11)

•“Hardware Troubleshooting” (page 15)

•“Software Troubleshooting” (page 17)

•“Troubleshooting Global Faults” (page 31)

•“Emergency recovery trees” (page 43)

•“Reference to third party Application Guides” (page 47)

•“Contact Nortel technical support” (page 49)

•“Glossary” (page 53)

Acronyms Table 1 "Acronyms" (page 10) lists the acronyms used in this guide.

Table 1

Acronyms

TPS Threat Protection System

CLI Command Line Interface

LED Light Emitting Diode

Nortel TPS 4.7

Threat Protection System Troubleshooting Guide

NN47240-700 01.01 Standard

112007

Autres manuels pour 2070

Ce manuel convient aux modèles suivants

Table des matières

Autres manuels Nortel Logiciel

Nortel

Nortel 3100 Series Manuel utilisateur

Nortel

Nortel INM 5.0 Manuel utilisateur

Nortel

Nortel Message Registration Instructions d'utilisation et d'installation

Nortel

Nortel Web OS Switch Software Guide de l'utilisateur

Nortel

Nortel Express Manuel utilisateur

Nortel

Nortel BEM 10 Mode d’emploi

Nortel

Nortel LinkPlexer Manuel de l'opérateur

Nortel

Nortel Business Communications Manager (BCM) &... Manuel utilisateur

Nortel

Nortel Norstar ICS Remote Tools 11 Manuel utilisateur

Nortel

Nortel m3900 series Manuel utilisateur

Nortel

Nortel Symposium Agent Manuel utilisateur

Nortel

Nortel Attendant Console Manuel utilisateur

Nortel

Nortel PPS Manuel utilisateur

Nortel

Nortel TAPI Manuel utilisateur

Nortel

Nortel CallPilot Mini Manuel utilisateur

Nortel

Nortel Contact Center Manager Manuel utilisateur

Nortel

Nortel CC MIS Manuel utilisateur

Nortel

Nortel ICB Manuel utilisateur

Nortel

Nortel 2350 Manuel utilisateur

Nortel

Nortel Express Call Center Manuel utilisateur

Nortel

Nortel VoIP Gateway Manuel utilisateur

Nortel

Nortel ICB Manuel de service

Nortel

Nortel Alteon OS 42C4911 Guide de l'utilisateur

Nortel

Nortel Contact Recording Manuel utilisateur

Manuels Logiciel populaires d'autres marques

COMPRO

COMPRO COMPROFM Manuel utilisateur

Muratec

Muratec OFFICEBRIDGE ONLINE Manuel utilisateur

Oracle

Oracle Contact Center Anywhere 8.1 Manuel utilisateur

Adobe

Adobe 65007312 - Photoshop Lightroom Manuel

Avaya

Avaya NULL One-X for RIM Blackberry Manuel utilisateur

HP ProLiant BL420c Manuel utilisateur

PS Audio

PS Audio PowerPlay Manuel du propriétaire

Brady

Brady LOCKOUT PRO 3.0 Manuel de service

Avaya

Avaya Interaction Center Manuel utilisateur

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Manuel

Novell

Novell GROUPWISE 8 - INTERNET AGENT Manuel utilisateur

Oracle

Oracle Application 9i Manuel utilisateur

Acer

Acer RDM Manuel utilisateur

Canon

Canon Vixia HF21 Manuel utilisateur

Canon

Canon ZR950 Manuel utilisateur

Samsung

Samsung Auto Backup Manuel utilisateur

Polycom

Polycom Vortex EF2201 Instructions d'installation et d'utilisation

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Manuel utilisateur