Solida systems SL-1000 Manuel utilisateur

! !

USER!MANUAL!

Version!1.0!

January!2017!

WWW.SOLIDASYSTEMS.COM

SL-1000!Security!Appliance!

©!SOLIDA!SYSTEMS!INTERNATIONAL!2016!

Table!of!Contents!

1.#INTRODUCTION#....................................................................................................................................................#4!

1.1!REPUTATION!BASED!DETECTION!.........................................................................................................................................!4!

1.2!INTRUSION!DETECTION!AND!PREVENTION!.........................................................................................................................!4!

1.3!MONITORING!AND!LOGGING!..................................................................................................................................................!4!

2.#HARDWARE#INSTALLATION#.............................................................................................................................#5!

2.1!TYPICAL!CONFIGURATION!......................................................................................................................................................!6!

3.#ACCESSING#THE#WEB#APPLICATIONS#............................................................................................................#7!

3.1!MANAGEMENT!PORT!...............................................................................................................................................................!7!

3.2!MANAGING!USERS!....................................................................................................................................................................!8!

4.#CONFIGURING#THE#APPLIANCE#.......................................................................................................................#9!

4.1!ETHERNET!PORT!CONFIGURATION!......................................................................................................................................!9!

4.2!APPLIANCE!NAME!....................................................................................................................................................................!9!

4.3!DEEP!PACKET!INSPECTION!CONFIGURATION!..................................................................................................................!10!

4.4!EMAIL!NOTIFICATION!..........................................................................................................................................................!11!

4.4.1$Setting$Up$Email$Notification$..................................................................................................................................$11!

4.4.2$Email$Notification$.........................................................................................................................................................$11!

4.4.3$Instant$Critical$...............................................................................................................................................................$12!

4.4.4$Current$Email$Addr$......................................................................................................................................................$12!

4.4.5$New$Email$Addr$.............................................................................................................................................................$12!

4.4.6$Event$Notification$Emails$..........................................................................................................................................$12!

4.4!REPUTATION!THREAT!LIST!UPDATES!..............................................................................................................................!13!

4.4.1$About$Tor$Exit$Nodes$...................................................................................................................................................$14!

4.5!SET!MOBILE!APPLICATION!PASSWORD!............................................................................................................................!14!

4.5!SETTING!THE!TIME!ZONE!...................................................................................................................................................!15!

5.#REPUTATION#BASED#DETECTION#.................................................................................................................#16!

5.1!OVERVIEW!..............................................................................................................................................................................!16!

5.2!DGA!!LIST!...............................................................................................................................................................................!16!

5.3!LIST!UPDATES!.......................................................................................................................................................................!17!

6.#INTRUSION#DETECTION#AND#PREVENTION#RULES#................................................................................#19!

6.1!RULE!OVERVIEW!...................................................................................................................................................................!19!

6.2!RULE!LIST!...............................................................................................................................................................................!19!

6.3!RULE!SETS!..............................................................................................................................................................................!20!

6.4!ACTIVATING!A!RULE!SET!.....................................................................................................................................................!20!

6.5!OPERATING!MODE!................................................................................................................................................................!21!

6.6!CREATING!CUSTOM!RULES!..................................................................................................................................................!21!

6.7!RULE!ID!...................................................................................................................................................................................!22!

7.#EVENTS#AND#EVENT#SEVERITY#......................................................................................................................#23!

7.1!EVENT!OVERVIEW!................................................................................................................................................................!23!

7.2!EVENT!SEVERITY!...................................................................................................................................................................!23!

7.2.1$Low$severity$(colored$green$in$the$GUI)$.............................................................................................................$24!

7.2.2$Medium$severity$(colored$orange$in$the$GUI)$..................................................................................................$24!

7.2.3$Critical$severity$(colored$red$in$the$GUI)$............................................................................................................$24!

7.3!SOURCE!AND!DESTINATION!IP!ADDRESSES!.....................................................................................................................!24!

8.#RESPONDING#TO#CRITICAL#EVENTS#.............................................................................................................#25!

9.#SYSTEM#SOFTWARE#UPDATES#.......................................................................................................................#26!

©!SOLIDA!SYSTEMS!INTERNATIONAL!2016!

10.#SUPPORT#BUNDLE#GENERATION#...............................................................................................................#28!

10.1!GENERATING!A!SUPPORT!BUNDLE!...................................................................................................................................!28!

10.2!DOWNLOADING!A!SUPPORT!BUNDLE!.............................................................................................................................!28!

11.#DATA#LOGGING#.................................................................................................................................................#30!

11.1!PACKET!LOGGING!...............................................................................................................................................................!30!

11.2!DROPPED!PACKET!LOGGING!............................................................................................................................................!30!

11.3!EVENT!LOGGING!.................................................................................................................................................................!30!

11.4!HTTP!LOGGING!..................................................................................................................................................................!31!

11.5!DOWNLOADING!LOG!FILES!...............................................................................................................................................!31!

11.8!DELETING!LOG!FILES!.........................................................................................................................................................!32!

12.#REMOTE#MONITORING#..................................................................................................................................#33!

12.1!SOLIDA!MULTI!INTRODUCTION!.......................................................................................................................................!33!

12.2!SETTING!UP!REMOTE!MONITORING!...............................................................................................................................!33!

©!SOLIDA!SYSTEMS!INTERNATIONAL!2016!

1.!Introduction!

This!manual!contains!instructions!for!how!to!configure!and!use!the!following!Solida!System!

network!security!appliances:!

!SL-1000! Dual!Gigabit!Ethernet!ports!

! !

The!SL-1000!appliance!represents!the!latest!in!network!security!technology.!It!combines!

functionality!otherwise!requiring!several!different!devices.!This!next!generation!firewalls!offers!

reputation!based!detection,!intrusion!detection!and!prevention,!network!traffic!monitoring!and!

packet!logging.!

The!next!sections!will!describe!what!some!of!these!features!mean!for!your!network.!

1.1!Reputation!Based!Detection!

Solida!Systems!provides!reputational!threat!intelligence!in!the!form!of!a!data!feed!hosted!in!the!

cloud.!This!threat!feed!is!updated!hourly!and!includes!malicious!URLs,!domain!names!and!IP!

addresses.!These!are!harvested!from!various!international!threat!intelligence!sources.!!

The!threat!feed!includes!information!about!current!threats!such!as!ransomware,!phishing!sites,!

trojans!and!many!other!threat!categories.!

1.2!Intrusion!Detection!and!Prevention!

Intrusion!detection!and!prevention!is!implemented!through!a!rule!engine!and!deep!packet!

inspection!(DPI).!Solida!Systems!provide!pre-defined!rules!and!rule!sets!through!the!cloud!based!

threat!feed.!A!simple!and!intuitive!configuration!page!is!provided!for!users!interested!in!writing!

custom!rules.!

1.3!Monitoring!and!Logging!

!!!

Tools!are!available!to!facilitate!monitoring!and!evidence!collection.!Logs!and!evidence!files!are!

written!in!PCAP!format!and!are!compatible!with!most!industry!standard!analysis!tools.!

©!SOLIDA!SYSTEMS!INTERNATIONAL!2016!

2.!Hardware!Installation!

The!appliances!include!a!set!of!four!Gigabit!Ethernet!ports.!They!are!located!at!the!back!of!the!

appliance.!

Figure 2.1 SL-1000 backside view.

The!Ethernet!ports!to!the!right!side!in!the!back!are!the!high-speed!ports!used!for!the!network!

traffic!and!for!the!management.!!The!connectors!to!the!left!(USB,!VGA,!COM)!are!not!used!and!

must!be!left!unplugged.!

The!appliance!includes!a!12!Volt!power!supply.!Connect!this!power!source!to!the!small!circular!

connector!on!the!bottom!left!side.!

The!high-speed!Ethernet!ports!are!named!Port!0!and!Port!1!on!the!SL-1000.!The!management!port!

is!marked!MGNT!!

The!default!factory!configuration!for!the!high-speed!Ethernet!ports!is:!

! Port!0! (WAN)!! WAN!side! Internet!connected!router!

! Port!1! (LAN1)!! LAN!side!LAN!side!network!switch!

! Port!2! (LAN2)!! MGNT!! Configuration!and!monitoring!

! Port!3! (LAN3)!! Unused! !

The!default!factory!settings!can!be!changed!through!the!web!configuration!utility!that!is!accessed!

through!a!browser!over!the!management!port.!The!default!IP!address!for!this!management!port!is!

192.168.1.250.!This!address!can!be!changed!through!the!configuration!application.!!

To!access!the!configuration!tool,!enter!the!following!in!the!browser:!

!192.168.1.250/config!

To!access!the!monitoring!tool!,!enter!only!the!IP!address!in!the!browser:!

!192.168.1.250!

See!chapter!3.!Accessing!the!Web!Applications!below,!for!further!information.!

©!SOLIDA!SYSTEMS!INTERNATIONAL!2016!

2.1!Typical!Configuration!

The!most!common!setup!is!using!the!Solida!appliance!as!an!endpoint!device.!This!allows!for!all!

incoming!and!outgoing!data!packets!to!be!inspected.!This!offers!the!best!protection!against!any!

type!of!malicious!traffic.!The!SL-1000!appliance!operates!in!stealth!mode.!It!does!not!require!any!

IP!addresses!for!its!ports!other!than!for!the!MGNT!(management)!port.!!

Figure 2.2 Typical Installation

For!larger!networks!it!might!be!necessary!to!protect!multiple!sections!of!the!network!with!

dedicated!security!appliances.!For!those!installations!make!sure!that!the!WAN!port!is!connected!

upwards!(towards!the!Internet!router!side).!Conversely!make!sure!the!LAN!side!is!connected!to!

the!sub-partitioned!network.!!

©!SOLIDA!SYSTEMS!INTERNATIONAL!2016!

3.!Accessing!the!Web!Applications!

The!appliance!contains!two!different!applications.!One!application!is!used!for!system!configuration!

and!another!for!monitoring.!Both!applications!are!password!protected!to!prevent!unauthorized!

use.!These!applications!are!both!accessed!through!the!appliance!management!port.!!

3.1!Management!Port!

To!access!the!configuration!and!monitoring!applications,!connect!the!management!port!to!a!

switch!on!the!LAN!side!of!the!network.!Open!a!browser!on!a!computer!connected!to!the!same!

network.!Enter!the!MGNT!port!IP!address!in!the!browser!as!follows:!

!192.168.1.250/config!! for!the!configuration!application!

!192.168.1.250!! ! for!the!monitoring!application!

If!everything!is!configured!correctly,!a!login!page!will!appear!in!the!browser!window.!Enter!the!

supplied!user!name!and!password!to!log!in.!Some!networks!might!use!another!IP!address!range!

other!than!192.168.x.x,!for!example!10.32.x.x.!If!this!is!the!case!it!will!be!required!to!change!the!

management!ports!IP!address!before!the!appliance!is!connected!to!the!LAN!side!switch.!!

To!change!the!default!IP!address,!direct!connect!a!computer!with!the!appliance!through!an!

Ethernet!cable.!Make!sure!the!computers!IP!address!is!set!manually!since!direct!connecting!

bypasses!any!DHCP!server.!Start!the!configuration!utility!by!entering!the!default!IP!address!into!

the!browser!followed!by!/config!(http://192.168.1.250/config)!

Log!into!the!application!and!then!navigate!to!the!page!named!“Configuration”.!Locate!the!box!

called!“Change!Management!Port!IP!Settings”.!Change!the!IP!address,!netmask!and!gateway!fields!

to!match!the!ones!used!in!the!network.!An!example!is!shown!below:!

Figure 3.1 Change management port IP setting box.

©!SOLIDA!SYSTEMS!INTERNATIONAL!2016!

Once!the!“Activate”!button!is!pressed,!the!appliance!will!be!reconfigured!with!this!new!address!

information.!Remove!the!direct!connected!computer!and!connect!the!appliance!to!the!LAN!side!

switch.!

3.2!Managing!Users!

The!first!time!the!user!logs!into!either!Web!application!a!default!factory!username!and!password!

will!be!used.!After!the!first!login!it!is!recommended!to!create!new!users!that!will!be!allowed!to!

Creating!and!managing!the!user!credentials!is!done!through!the!configuration!application.!First!

navigate!to!the!“Configuration”!page!and!then!locate!the!box!named!“Manage!Users”.!To!create!a!

new!user,!press!the!button!named!“Add!User”!and!enter!the!new!credentials!in!the!indicated!

fields.!!

Figure 3.2 Add new user box.

The!drop!down!menu!at!the!top!of!the!“Add!New!User”!window!contains!two!options.!

“Monitoring!Only”!and!“Configuration!&!Monitoring”.!Select!“Monitoring!Only”!for!users!that!are!

only!allowed!to!log!into!the!monitoring!application.!The!monitoring!application!does!not!allow!for!

changing!any!configuration!parameters!or!modifying!the!detection!rules.!

©!SOLIDA!SYSTEMS!INTERNATIONAL!2016!

4.!Configuring!The!Appliance!

The!configuration!page!contains!several!different!user!configurable!areas.!Each!configuration!

window!includes!a!help!button!that!provides!a!detailed!help!for!the!option.!!

4.1!Ethernet!Port!Configuration!

The!two!network!packet!transferring!ports,!port!0!and!1!can!be!configured!to!either!face!the!

Internet!side!or!the!LAN!side.!It!makes!no!technical!difference!how!these!ports!are!configured.!It!is!

recommended!to!keep!the!factory!default!setting.!

Figure'4.1'Ethernet'Port'Configuration'

Operating!Mode!–!The!only!supported!operation!mode!is!Single!LAN/WAN!ports.!

Port!0!usage!–!Selects!if!port!0!should!be!facing!the!Internet!side!or!the!LAN!side.!

Port!1!usage!–!Selects!if!port!0!should!be!facing!the!Internet!side!or!the!LAN!side.!

4.2!Appliance!Name!

An!appliance!should!be!given!a!name.!The!name!can!be!used!as!an!identifier!if!more!than!one!

appliance!is!installed!in!a!network!or!if!Solida!Multi!will!be!used!for!multi!appliance!monitoring.!

The!name!can!refer!to!the!appliance!geographical!location!or!be!a!simple!name!such!as!solida_1.!

The!below!figure!shows!how!to!set!the!application!name:!

Figure'4.2'Setting'the'appliance'name.'

Enter!the!desired!name!and!press!the!Activate!button.!

4.3!Deep!Packet!Inspection!Configuration!

Deep!packet!inspection!(DPI)!refers!to!the!process!that!inspects!all!incoming!and!outgoing!

network!packets.!The!factory!default!setting!applies!DPI!on!all!packets,!including!incoming!and!

outgoing!packets.!Only!under!very!special!circumstances!should!the!factory!default!be!changed.!

Changing!the!factory!default!will!prohibit!the!appliance!from!detecting!all!possible!malwares!and!

other!threats.!

To!change!the!factory!default!setting,!start!the!configuration!utility!and!navigate!to!

“Configuration”.!Locate!the!block!titled!“Deep!Packet!Inspection!Configuration”.!It!will!look!as!

shown!in!the!picture!below.!

Figure 4.3 Deep packet inspection configuration window.

The!following!settings!are!available:!

! Packets!from!the!Internet! -! Inspect!all!packets!(Factory!default)!

-Disable!Inspection!

Table des matières

Manuels Système de sécurité populaires d'autres marques

Inner Range

Inner Range Concept 2000 Manuel utilisateur

Climax

Climax Mobile Lite R32 Instructions de montage

CADDX

CADDX NX-6 Manuel utilisateur

FBII

FBII XL-31 Series Manuel utilisateur

Johnson Controls

Johnson Controls PENN Connected PC10 Manuel utilisateur

Aeotec

Aeotec Siren Gen5 Manuel utilisateur

Blaupunkt

Blaupunkt SA 2700 Manuel utilisateur

IDEAL

IDEAL Accenta Manuel du propriétaire

AJAX

AJAX DoubleButton Manuel utilisateur

Swann

Swann SW-P-MC2 Manuel utilisateur

Ecolink

Ecolink Siren+Chime Manuel utilisateur

Digital Monitoring Products

Digital Monitoring Products XR150 Manuel utilisateur

EDM

EDM Solution 6+6 Wireless-AE Manuel utilisateur

Highway Safety Group

Highway Safety Group EA401 Manuel utilisateur

Siren

Siren LED GSM Manuel utilisateur

Detection Systems

Detection Systems 7090i Instructions de montage

Se-Kure Controls

Se-Kure Controls MicroMini SK-4841 Manuel utilisateur

Siemens

Siemens FDM273 Manuel utilisateur