8e6 Technologies Threat Analysis Reporter TAR 1.0 manual

8e6 R QUICK ST ART GUIDE 8e6 R Model: T AR 1.0 T AR "S" (5K02-62) , TAR "H" (5K02-66) , TAR "MSA" (5K02-67) Release 1. 1 .00 / Version No.: 0 6 . 18 .07 Threat Analysis Repor ter[...]

ii 8 e 6 T hrea T a nal ysis r eporTer Q uick s T arT G uide 8 e 6 T hrea T a nal ysis r eporTer Q uick s T arT G uide © 2007 8e6 T echnologies. All rights reserved. This document may not, in whole or in part, be copied, photocopied, reproduced, translated, or reduced to any elec- tronic medium or machine readable form without prior written consen[...]

8 e 6 T hrea T a nal ysis r eporTer Q uick s T arT G uide iii C ontents t hrea t a nal ysis r eporter i ntroduCtion .................................................... 1 About this Document .................................................................................................................... 2 Conventions Used in this Document ......[...]

iv 8 e 6 T hrea T a nal ysis r eporTer Q uick s T arT G uide[...]

8 e 6 T hrea T a nal ysis r eporTer Q uick s T arT G uide 1 t hrea t a nal ysis r eporter i ntroduCtion Thank you for choosing to evaluate the 8e6 T echnologies Threat Analysis Reporter . This product addresses user-generated Web threats such as excessive use of bandwidth and inappropriate Internet usage, and provides network administrators tools t[...]

2 8 e 6 T hrea T a nal ysis r eporTer Q uick s T arT G uide About this Document This document is divided into the following sections: Introduction - This section is comprised of an overview of the Threat Analysis Re- porter product and how to use this document Service Information - This section provides 8e6 T echnologies contact information Prelimi[...]

8 e 6 T hrea T a nal ysis r eporTer Q uick s T arT G uide 3 s er viCe i nforma tion The user should not attempt any maintenance or service on the unit beyond the proce- dures outlined in this document. Any initial hardware setup problem that cannot be resolved at your internal organiza- tion should be referred to an 8e6 T echnologies solutions engi[...]

4 8 e 6 T hrea T a nal ysis r eporTer Q uick s T arT G uide p reliminar y s etup p roCedures Unpack the Unit from the Carton Inspect the packaging container for evidence of mishandling during transit. If the packag- ing container is damaged, photograph it for reference. Carefully unpack the unit from the carton and verify that all accessories are i[...]

8 e 6 T hrea T a nal ysis r eporTer Q uick s T arT G uide 5 Rack Mount the “S” or “MSA” Server Rack Mount Instructions Rack Setup Suggestions Determine the placement of each component in the rack before you install the rails. Install the heaviest server components on the bottom of the rack rst, and then work up. Identify the Sections of [...]

6 8 e 6 T hrea T a nal ysis r eporTer Q uick s T arT G uide Install the Rack Rails Determine where you want to place the server unit in the rack. Position the xed rack rail/sliding rail guide assemblies at the desired location in the rack, keeping the sliding rail guide facing the inside of the rack. Screw the assembly securely to the rack using[...]

8 e 6 T hrea T a nal ysis r eporTer Q uick s T arT G uide 7 Installing the Server into a T elco Rack If you are installing the 8e6 server unit into a T elco type rack, follow the directions given on the previous pages for rack installation. The only dif ference in the installation pro- cedure will be the positioning of the rack brackets to the rack[...]

8 8 e 6 T hrea T a nal ysis r eporTer Q uick s T arT G uide Install the “H” Server Bezel Before rack mounting the “H” unit, the bezel should be installed on the front end of the chassis. This portion of the installation process requires you to unpack the unit and be- zel. NOTE: The bezel has been packaged separately from the unit to prevent[...]

8 e 6 T hrea T a nal ysis r eporTer Q uick s T arT G uide 9 A. Remove the plastic wrapping from the left and right ears. B. On one side of the chassis (left or right), un- screw the inner rail from the chassis. C. Slide the loosened inner rail slightly backwards to release it from the clips at the side of the chassis, and then lay it down beside th[...]

10 8 e 6 T hrea T a nal ysis r eporTer Q uick s T arT G uide F . Return the loosened inner rail to its upright po- sition and insert the bezel pin into the bottom hole of the ear . G. Slide the inner rail forward beneath the clips to lock it in place. H. Screw the inner rail back on the chassis. I. After it is installed, the bezel should drop down [...]

8 e 6 T hrea T a nal ysis r eporTer Q uick s T arT G uide 1 1 Rack Mount the “H” Server Rack Mount Instructions Identify the Sections of the Rack Rails Y ou should have received two rack rail assemblies with the 8e6 server unit. Each of these assemblies consists of two sections: An inner xed chassis rail that secures to the unit (A), and an [...]

12 8 e 6 T hrea T a nal ysis r eporTer Q uick s T arT G uide Install the Server into the Rack Y ou should now have rails attached to both the chassis and the rack unit. The next step is to install the server chassis into the rack. Do this by lining up the rear of the chassis rails with the front of the rack rails. Slide the chassis rails into the r[...]

8 e 6 T hrea T a nal ysis r eporTer Q uick s T arT G uide 13 Installing the Server into a T elco Rack If you are installing the 8e6 server unit into a T elco type rack, follow the directions given on the previous page for rack installation. The only dif ference in the installation proce- dure will be the positioning of the rack brackets to the rack[...]

14 8 e 6 T hrea T a nal ysis r eporTer Q uick s T arT G uide i nst all the s erver Step 1: Initial Setup Procedures This step requires you to link the workstation to the Threat Analysis Reporter . The follow- ing hardware can be used for the initial setup procedures: Threat Analysis Reporter unit with AC power cord either one of two options: PC mon[...]

8 e 6 T hrea T a nal ysis r eporTer Q uick s T arT G uide 15 Link the W orkstation to the Threat Analysis Reporter Monitor and Keyboard Setup A. Connect the PC monitor and keyboard cables to the rear of the chassis. B. T urn on the PC monitor . C. Power on the Threat Analysis Reporter unit by dropping down the face plate and pressing the large butt[...]

16 8 e 6 T hrea T a nal ysis r eporTer Q uick s T arT G uide HyperT erminal Setup Procedures If using a serial console, follow these procedures to create a HyperT erminal session. A. Launch HyperT erminal by going to Start > Programs > Accessories > Communica- tions > HyperT erminal: B. In the Connection Description dialog box, enter an[...]

8 e 6 T hrea T a nal ysis r eporTer Q uick s T arT G uide 17 C. At the Connect using eld, select the COM port assigned to the serial port on the laptop (probably “COM1”), and then click OK to open the Properties dialog box, dis- playing the Port Settings tab: D. Specify the following session settings: Bits per second: 9600 Data bits: 8 Parit[...]

18 8 e 6 T hrea T a nal ysis r eporTer Q uick s T arT G uide F . In the HyperT erminal session window , go to File > Properties to open the Properties dialog box, displaying the Connect T o and Settings tabs: G. Click the Settings tab, and at the Emulation menu select “VT100”. H. Click OK to close the dialog box, and to go to the login scree[...]

8 e 6 T hrea T a nal ysis r eporTer Q uick s T arT G uide 19 Step-by-Step Initial Setup Procedures For these step-by-step procedures, you will need your network administrator to provide you the LAN 1 (Ethernet 0) and LAN 2 (Ethernet 1) IP address and subnet mask, gate- way IP address, DNS server IP address(es), host name of the server , and IP addr[...]

20 8 e 6 T hrea T a nal ysis r eporTer Q uick s T arT G uide E. At the Press the number of your selection prompt, press 2 to display the Adminis- trator Password Entry screen: F . At the Enter the administrator password prompt, re-enter your password: #s3tup#r3k G. Press Enter to display the Administration menu where you can begin the step-by- step[...]

8 e 6 T hrea T a nal ysis r eporTer Q uick s T arT G uide 21 Congure Network Interface screen A. At the Enter interface LAN1 (eth0) IP address eld, enter the IP address for the LAN 1 (Ethernet 0) interface, and then press Enter to go to the next screen. B. At the Enter interface LAN1 (eth0) netmask eld, enter the subnet mask for the LAN 1 [...]

22 8 e 6 T hrea T a nal ysis r eporTer Q uick s T arT G uide C. Press Y for “Y es” to conrm and save your entries for the LAN1 (eth0) interface, and to go to the next screen. D. At the Enter interface LAN2 (eth1) IP address eld, enter the IP address for the LAN 2 (Ethernet 1) interface, and then press Enter to go to the next screen. E. At[...]

8 e 6 T hrea T a nal ysis r eporTer Q uick s T arT G uide 23 Congure default gateway screen A. At the Enter default gateway IP eld, enter the IP address for the default gateway . Press Enter to display the conrmation prompt. B. Press Y for “Y es” to conrm and save your entry for the gateway IP address, and to go to the Congure Do[...]

24 8 e 6 T hrea T a nal ysis r eporTer Q uick s T arT G uide A. At the Enter rst DNS server IP eld, enter the IP address for the primary Domain Name Server . Press Enter to go to the next screen. B. At the Enter (optional) second DNS server IP eld, if you have a secondary Do - main Name Server you wish to use, enter the IP address for that[...]

8 e 6 T hrea T a nal ysis r eporTer Q uick s T arT G uide 25 A. At the Enter host name eld, enter the host name of the server . Press Enter to dis- play the conrmation prompt. B. Press Y for “Y es” to conrm and save your entry for the host name, and to go to the T ime zone regional conguration screen. Time zone regional congurati[...]

26 8 e 6 T hrea T a nal ysis r eporTer Q uick s T arT G uide B. Use the up and down arrows in your keyboard to select your region. After selecting your locality , press Y for “Y es” to conrm and save your regional selection, and to go to the Congure Wizard user screen. Congure Wizard user screen A. At the Enter wizard user name eld,[...]

8 e 6 T hrea T a nal ysis r eporTer Q uick s T arT G uide 27 C. At the Enter wizard password eld, enter the password that will be used to access the setup wizard in the Threat Analysis Reporter interface. Press Y for “Y es” to con- rm and save your entry and to go to the Setup Wizard Conrmation screen. Setup Wizard Conrmation screen[...]

28 8 e 6 T hrea T a nal ysis r eporTer Q uick s T arT G uide System Status Screen The System Status screen contains the following information: LAN1 (eth0) interface for web access and R3000 communications: LAN1 (eth0) IP address and netmask specied in screen 3 (Congure Network Interface), and current status (“Active” or “Inactive”) LA[...]

8 e 6 T hrea T a nal ysis r eporTer Q uick s T arT G uide 29 Step 2: Physically Connect the Unit to the Network After performing initial setup procedures for the Threat Analysis Reporter , the unit should be physically connected to the network. This step requires a standard CA T -5E cable to connect the unit to the network. An additional CA T -5E c[...]

30 8 e 6 T hrea T a nal ysis r eporTer Q uick s T arT G uide Step 3: Wizard Setup Procedures For this step, you will need your network administrator to provide you the following infor- mation: IP range and netmask of machines on the network the Threat Analysis Reporter server will be monitoring R3000 IP address, port number to be used between the R[...]

8 e 6 T hrea T a nal ysis r eporTer Q uick s T arT G uide 31 D. After reading the End User License Agreement, you have the option to do either of the following: Click No to close both the EULA Agreement dialog box and the Threat Analysis Reporter interface. Y ou will not be able to enable the Threat Analysis Reporter for use in your environment. Cl[...]

32 8 e 6 T hrea T a nal ysis r eporTer Q uick s T arT G uide Step 1: Register administrator Step 1 is performed in the left side of the rst screen of the wizard: A. Enter the username the global administrator will use when logging into the Threat Analysis Reporter Administrator console. The global administrator has the highest level of permissio[...]

8 e 6 T hrea T a nal ysis r eporTer Q uick s T arT G uide 33 D. Click the [+] Add tab beow to open the IP Range Information dialog box: E. Enter the IP address range for the bandwidth the Threat Analysis Reporter will moni- tor . F . Enter the Netmask for the IP range to be monitored, using the dotted decimals nota- tion format. G. Click OK to clos[...]

34 8 e 6 T hrea T a nal ysis r eporTer Q uick s T arT G uide NOTE: Additional IP address ranges can be included by clicking the [+] Add tab again and making the entries described in steps E through G above. T o modify an IP address range, double-click the entry in the list box to highlight it and to display the [-] Remove tab to the left of the [+][...]

8 e 6 T hrea T a nal ysis r eporTer Q uick s T arT G uide 35 Step 2: Register R3000 & ER Step 2 is performed in the right side of the rst screen of the wizard. R3000: Specify information for the R3000 to be used with the Threat Analysis Reporter: A. Click the [+] Add tab above the R3000 list box to open the R3000 Information dialog box: B. E[...]

36 8 e 6 T hrea T a nal ysis r eporTer Q uick s T arT G uide E. Click OK to close the dialog box and to display your entries in the list box: NOTE: Additional R3000 servers can be included by clicking the [+] Add tab again and making the entries described in steps A through E above. T o modify an R3000 entry , double-click the R3000 entry in the li[...]

8 e 6 T hrea T a nal ysis r eporTer Q uick s T arT G uide 37 T o modify the IP address and Server Name for the R3000 server , click the [+] Add tab to re-open the R3000 Information dialog box, and edit information as necessary . Click OK to close the dialog box and to display the modied informa - tion in the list box. T o designate an R3000 as t[...]

38 8 e 6 T hrea T a nal ysis r eporTer Q uick s T arT G uide NOTE: T o change your answer from “Y es” to “No,” click the < Back button to re-display the question “Do you have an Enterprise Reporter?” A. Enter the IP address of the ER server to be used with the Threat Analysis Re- porter . In our example, this is: 200.10.101.76 . B. E[...]

8 e 6 T hrea T a nal ysis r eporTer Q uick s T arT G uide 39 Step 3: Register Gauges Step 3 requires you to specify settings for default gauges to be monitored by the Threat Analysis Reporter . These gauges will display in the Threat Analysis Reporter interface upon logging into the Administrator console. NOTE: Return to Step 1 or Step 2 by clickin[...]

iv 8 e 6 T hrea T a nal ysis r eporTer Q uick s T arT G uide View , Edit Gauge Components T o view gauge components for a specied gauge, highlight and double-click the gauge name to populate the the elds to the right of the Gauge Groups list box. The following gauge criteria can be edited: Name : The displayed gauge name to be used in the int[...]

8 e 6 T hrea T a nal ysis r eporTer Q uick s T arT G uide 41 Step 4: Server Settings In Step 4, the following R3000 server information displays: Active Directory Settings, SMTP Server Settings, Patch Server Settings, PROXY Server Settings, NTP Server Set- tings: NOTE: Return to Step 3 by clicking the < BACK button in the lower left corner of thi[...]

iv 8 e 6 T hrea T a nal ysis r eporTer Q uick s T arT G uide C onClusion Congratulations; you have completed the Threat Analysis Reporter quick start proce- dures. Now that the Threat Analysis Reporter is running on your network, the next step is to set up user groups or administrator groups. Y ou will set up and congure gauges thereafter . Obta[...]

8 e 6 T hrea T a nal ysis r eporTer Q uick s T arT G uide 43 s peCifiCa tions Physical Specications Specication “S” V alue “H” V alue “MSA” V alue Height 1.7” (43mm) 1.7” (43mm) 1.7” (43mm) Width 16.8” (426mm) 17.2” (438mm) 16.8” (426mm) Depth 22.6” (574mm) 26.8” (681mm) 14.0” (356mm) Front clearance 2 inches (76[...]

iv 8 e 6 T hrea T a nal ysis r eporTer Q uick s T arT G uide Hardware Component Specications Specication “S” V alue “H” V alue “MSA” V alue Operating temperature range 10° C ~ 35° C (50° F ~ 95° F) 10° C ~ 35° C (50° F ~ 95° F) 10° C ~ 35° C (50° F ~ 95° F) Storage temperature range -40° C ~ +60° C (- 40° F ~ 158° [...]

8 e 6 T hrea T a nal ysis r eporTer Q uick s T arT G uide 45 “S” and “MSA” Front Panel LED Indicators, Buttons Diagrams and Descriptions On “S” and “MSA” units, LED indicators and buttons display on the front panel to the right: E D C B A F G LED indicators alert you to the status of a feature on the unit while buttons let you per- [...]

46 8 e 6 T hrea T a nal ysis r eporTer Q uick s T arT G uide 46 8 e 6 T hrea T a nal ysis r eporTer Q uick s T arT G uide T ap i nsT alla Tion a ppendix : o ptional e thernet t ap i nst alla tion This appendix pertains to the optional installation of the Ethernet T ap unit for bandwidth monitoring. Preliminary Setup Procedures Unpack the Ethernet T[...]

8 e 6 T hrea T a nal ysis r eporTer Q uick s T arT G uide 47 8 e 6 T hrea T a nal ysis r eporTer Q uick s T arT G uide 47 T ap i nsT alla Tion Install the Ethernet T ap Unit Diagram showing T AR Ethernet T ap installation on the network This step is a continuation from Step 2: Physically Connect the Unit to the Network. The procedures outlined in t[...]

48 8 e 6 T hrea T a nal ysis r eporTer Q uick s T arT G uide 48 8 e 6 T hrea T a nal ysis r eporTer Q uick s T arT G uide T ap i nsT alla Tion C. Using a crossover cable, connect one end to the Switch’ s port congured to be the destination port of the Port Mirror . If adding a Threat Analysis Reporter to an existing installation, this port wou[...]

8 e 6 T hrea T a nal ysis r eporTer Q uick s T arT G uide 49 8 e 6 T hrea T a nal ysis r eporTer Q uick s T arT G uide 49 T ap i nsT alla Tion[...]

8e6 Corporate Headquarters (USA): 828 West T aft Avenue Orange, CA 92865-4232 • T el: 714.282.61 1 1 or 888.786.7999 Fax: 714.282.61 16 (Sales/T echnical Support) • 714.282.61 17 (General Ofce) Satellite Ofce: 8e6 T aiwan: RM B2, 13F , No. 49, Sec. 3, Minsheng E. Rd., T aipei 104, T aiwan, R.O.C. T el: 886-2-2501-5285 • Fax: 886-2-2501-[...]