Gen12 Security Analytics Software Installation Guide for Dell HW

Copyright 2015 Blue Coat Systems, Inc. All rights reserved worldwide. No part of this document may be reproduced by any means nor translated to any electronic medium without the written consent of Blue Coat Systems, Inc. Blue Coat, ProxySG, PacketShaper, CacheFlow, IntelligenceCenter and BlueTouch are registered trademarks of Blue Coat Systems, Inc. in the U.S. and worldwide. All other trademarks mentioned in this document are the property of their respective owners.

Security Analytics Software Installation Guide for Gen12 Dell Hardware

16 March 2015

2015 Blue Coat Systems, Inc. 2 of 28 Updated 16 Mar 2015

This document is intended to help you install Security Analytics Software on a Dell PowerEdge R720xd or R620 Rack Server, either as a standalone appliance or connected to Dell PowerVault MD1200 Direct Attached Storage arrays.

For the Dell PowerEdge R730xd or R630 Rack Server or the PowerVault MD1400 Direct Attached Storage, see the Security Analytics Software Installation Guide for Gen13 Dell Hardware.

This document is not intended as a guide to policies or procedures for network security or network forensics.

This document attempts to provide the best information possible; however, this information is provided AS-IS and without warranty of any kind for accuracy, completeness, or currency. All references and links to Web sites are valid as of the date of publication, but the content and nature of those Web sites and pages is subject to change without our knowledge or control.

Copyrights, Trademarks, and Intellectual Property

A trademark symbol () denotes a trademark of Blue Coat Systems, Inc. A degree sign () denotes a third-party trademark. All third-party trademarks are the property of their respective owners. All other marks referenced herein are the property of their respective owners.

Copyright 2015 Blue Coat Systems, Inc. All rights reserved. No portion may be copied or reproduced without express written consent.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

GNU General Public License Source Code Requests

Blue Coat Systems will provide a machine-readable copy of the GPL open-source code on a CD. To obtain a copy, send a written request, along with a certified check or money order in the amount of U.S. $25.00, payable to Blue Coat Systems, Inc. to: ATTN: Customer Support GPL Source Code Request, Security Analytics Blue Coat Systems Suite 400 25 E Scenic Pointe Drive Draper, UT 84020 USA


This guide describes the installation and initial configuration of Security Analytics Software on a Dell PowerEdge R720xd or R620 Rack Server, with or without additional storage modules (Dell PowerVault MD1200 Direct Attached Storage arrays).

This document assumes that you have purchased the Dell hardware off the rack rather than through Blue Coat Systems, Inc., and therefore that the initial server configuration has not been performed.

For assistance with the installation of this software:

Blue Coat Support: bluecoat.com/support/technical-support/contact-service-support

BlueTouch Online: bto.bluecoat.com

Requirements


Table of Contents 1 Requirements ...............................................................................................................................................................5

1.1 Server I/O Configuration.................................................................................................................................................................................................. 6 1.2 Storage Module I/O Configuration .................................................................................................................................................................................. 7

2 Installation ...................................................................................................................................................................8 2.1 Cable the Attached Storage Arrays................................................................................................................................................................................ 8

One-RAID-Controller Setup .......................................................................................................................................................................................................... 8 Two-RAID-Controller Setup .......................................................................................................................................................................................................... 8

2.2 Establish a Connection to the Server ............................................................................................................................................................................. 9 2.3 OptionalConfigure the iDRAC Interface ..................................................................................................................................................................... 9 2.4 Set Up the RAID Arrays ................................................................................................................................................................................................ 10

Configure the System Disk ........................................................................................................................................................................................................ 12 Configure the Indexing Arrays ................................................................................................................................................................................................... 13 Configure the Capture Arrays .................................................................................................................................................................................................... 14

2.5 Configure BIOS .............................................................................................................................................................................................................. 16 2.6 Install the Image ............................................................................................................................................................................................................. 16 2.7 Configure Initial Settings ............................................................................................................................................................................................... 18 2.8 Next Steps ...................................................................................................................................................................................................................... 18

3 Appendix A: RAID Array Configurations ...................................................................................................................... 18 3.1 R620 Standalone Setups .............................................................................................................................................................................................. 19

R620 Central Manager Console ................................................................................................................................................................................................ 19 R620 Standalone ....................................................................................................................................................................................................................... 19

3.2 R620 Setups with MD1200s of 12 x 2TB Drives ......................................................................................................................................................... 20 R620 plus 1 MD1200 with 12 x 2TB Drives ............................................................................................................................................................................... 20 R620 plus 2 MD1200s with 12 x 2TB Drives ............................................................................................................................................................................. 20 R620 plus 3 MD1200s with 12 x 2TB Drives ............................................................................................................................................................................. 20

3.3 R620 Setups with MD1200s of 12 x 4TB Drives ......................................................................................................................................................... 21 R620 plus 1 MD1200 with 12 x 4TB Drives ............................................................................................................................................................................... 21

3.4 R720xd Standalone Setup ............................................................................................................................................................................................ 21 R720xd Standalone.................................................................................................................................................................................................................... 21

3.5 R720xd Setups with MD1200s of 12 x 2TB Drives ..................................................................................................................................................... 22 R720xd plus 1 MD1200 with 12 x 2TB Drives ........................................................................................................................................................................... 22 R720xd plus 2 MD1200s with 12 x 2TB Drives ......................................................................................................................................................................... 22 R720xd plus 3 MD1200s with 12 x 2TB Drives ......................................................................................................................................................................... 23 R720xd plus 4 MD1200s with 12 x 2TB Drives ......................................................................................................................................................................... 23 R720xd plus 5 MD1200s with 12 x 2TB Drives ......................................................................................................................................................................... 23 R720xd plus 6 MD1200s with 12 x 2TB Drives ......................................................................................................................................................................... 24

3.6 R720xd Setups with MD1200s of 12 x 4TB Drives ..................................................................................................................................................... 25 R720xd plus 1 MD1200 with 12 x 4TB Drives ........................................................................................................................................................................... 25 R720xd plus 2 MD1200s with 12 x 4TB Drives ......................................................................................................................................................................... 25 R720xd plus 3 MD1200s with 12 x 4TB Drives ......................................................................................................................................................................... 26 R720xd plus 4 MD1200s with 12 x 4TB Drives ......................................................................................................................................................................... 26 R720xd plus 5 MD1200s with 12 x 4TB Drives ......................................................................................................................................................................... 26 R720xd plus 6 MD1200s with 12 x 4TB Drives ......................................................................................................................................................................... 27

4 Appendix B: Power, Thermal, and Acoustic Summary .................................................................................................. 28

Requirements


1 Requirements This installation requires the following:

Dell PowerEdge R620 or R720xd Rack Server

OptionalFor attached-storage configurations:

o Two SFF-8088 SAS cables for each array o R620 only

1 RAID controller 13 Dell PowerVault MD1200 (12 x 2TB) Direct Attached Storage arrays 1 Dell PowerVault MD1200 (12 x 4TB) Direct Attached Storage arrays

o R720xd only 2 RAID controllers 16 Dell PowerVault MD1200 (12 x 2TB or 12 x 4TB) Direct Attached Storage arrays

Security Analytics Platform ISO image

Blue Coat Systems-provided license key

Serial or VGA monitor

USB keyboard

Null-modem or VGA cable

Cat5 cable

Workstation with Ethernet port and one of the following supported browsers:

o Microsoft Internet Explorer (IE) 8+ o Firefox 18+ o Safari 5+ o Chrome 24+

Requirements


1.1 Server I/O Configuration

IMPORTANT The location of the management port in the figures below is valid only after Security Analytics Software has been installed. Generally, the software will enumerate the copper ports from right to left and the fiber ports from left to right.

Dell PowerEdge R620 Rack ServerCentral Manager Console Rear View

Dell PowerEdge R620 Rack ServerHost Controller Rear View

Dell PowerEdge R720xd Rack ServerRear View4-Port Ethernet Card in Slot 1

Requirements


Note The 4-port Ethernet card may be located in slot 1 or slot 3 without affecting port enumeration. The fiber ports are always eth8 and eth9, and the rightmost port on the Ethernet card is always eth4.

1.2 Storage Module I/O Configuration

Dell PowerVault MD1200 Attached Storage ArrayRear View

Installation


2 Installation 2.1 Cable the Attached Storage Arrays

If you will be attaching storage arrays, cable all of the units together as shown.

IMPORTANT You must connect the storage arrays to the host controller BEFORE continuing to the next step.

One-RAID-Controller Setup Two-RAID-Controller Setup

Installation


2.2 Establish a Connection to the Server 2.2.1. With the null-modem or VGA cable, connect your monitor to the server.

2.2.2. Plug in the USB keyboard to the server.

IMPORTANT If you have attached storage modules, power them on first, then power on the host controller.

2.3 OptionalConfigure the iDRAC Interface The Integrated Dell Remote Access Control (iDRAC) interface is Dells version of the Intelligent Platform Management Interface (IPMI).

2.3.1. While the host controller boots, watch for the following menu items:

F2 = System Setup F10 = Lifecycle Controller F11 = BIOS Boot Manager F12 = PXE Boot

2.3.2. When the menu items are displayed, press F2 to enter the system setup.

2.3.3. From the System Setup Main Menu, select iDRAC Settings and configure the settings as follows:

Page Attribute Value

Network Settings Enable NIC Enabled

NIC Selection LOM4

Failover Network LOM3

Enable DHCP [as desired]

IP Address [as desired]

Gateway [as desired]

User Configuration User Name [as desired]

Change Password [as desired]

Lifecycle Controller Collect System Inventory on Restart Disabled

Note If you choose to enable DHCP, it is recommended that you use the DHCP reservation feature of your DHCP server to statically map the MAC address of the iDRAC interface to an IP address.

2.3.4. Click Finish at the lower-right of the screen and follow the prompts to save and exit.

Installation


2.4 Set Up the RAID Arrays

Note Consult the tables in Appendix A: RAID Array Configurations to see how to configure each type of setup.

2.4.1. Boot or reboot the server by pressing the power button or by pressing Ctrl+Alt+Delete.

F2 = System Setup F10 = Lifecycle Controller F11 = BIOS Boot Manager F12 = PXE Boot Two 2.6 GHz Eight-core Processors, Bus Speed:8.00GT/s, L2/L3 Cache:2 MB/20 MB System running at 2.6 GHz System Memory Size: 96.0 GB, System Memory Speed: 1600 MHz, Voltage: 1.5V Initializing Intel(R) Boot Agent XE v.2.1.93 PXE 2.1 Build 090 (WfM 2.0) PowerEdge Expandable RAID Controller BIOS Copyright (c) 2011 LSI Corporation Press to run Configuration Utility HA -0 (Bus 2 Dev 0) PERC H810 Mini FW package: 21.0.1-0132

2.4.2. When you see this screen, press Ctrl+R to enter the RAID configuration utility.

2.4.3. If you have external RAID controllers installed, you see a menu of RAID controllers similar to the following:

PERC BIOS Configuration Utility 4.00-0014

Controller 0:PERC H710 Mini Bus 0x02 Dev 0x00 Fn 0x00 Slot 0x00 Controller 1:PERC H810 Adapter Bus 0x04 Dev 0x00 Fn 0x00 Slot 0x06 Controller 2:PERC H810 Adapter Bus 0x42 Dev 0x00 Fn 0x00 Slot 0x04

Notes Controller 0 always refers to the internal RAID controller. All other RAID controllers are connected to the external storage arrays.

The internal RAID controller for the R620 and the R720xd is configured using the PERC H710 Mini BIOS Configuration Utility.

The external RAID controllers for all host controllers are configured using the PERC H810 Adapter BIOS Configuration Utility.

The screen shots that follow are from the PERC H710; the steps for the H810 are the same.

Installation


2.4.4. Select Controller 0 and press Enter.

2.4.5. On the Virtual Disk Management screen, select PERC H710 Mini (Bus 0x02, Dev 0x00) > Clear Config and press Enter.

2.4.6. When you return to the Virtual Disk Management screen, select PERC H710 Mini (Bus 0x02, Dev 0x00) > Create New VD and press Enter.

Installation


Configure the System Disk 2.4.7. In the Create New VD dialog, configure the settings as follows:

RAID LevelSelect one of the following: R620 or R720xd StandaloneRAID-1

CMC or Appliance with Attached StorageRAID-5 Physical DisksScroll down and select the Disk IDs for the system arrays.

Notes Physical disk 0 is designated 00:01:00; disk N is designated 00:01:N. Virtual Disk Group 0 on RAID Controller 0 must be configured as the system disk or the software

installation will fail. Consult Appendix A: RAID Array Configurations for your configuration type to see how many virtual disk

groups to assign to the system disk.

Advanced SettingsUnder Write Policy, select Force WB with no battery and Initialize.

2.4.8. Select OK. Are you configuring a Central Manager Console (CMC)?

YesGo to step 2.4.15. NoContinue the procedure.

Installation


Configure the Indexing Arrays 2.4.9. Follow the prompts to return to the Virtual Disk Management screen.

2.4.10. Are you configuring an R720xd with 4, 5, or 6 MD1200s of 12x4TB Drives?

YesConfigure disks 021 as a RAID-5 array.

Exit the PERC H710 utility and launch the PERC H810 utility for Controller 1.

Go to step 2.4.12.

NoContinue the procedure.

2.4.11. On the Virtual Disk Management screen, select PERC H710 Mini (Bus 0x02, Dev 0x00) > Create New VD and press Enter.

2.4.12. In the Create New VD dialog, configure the settings as follows:

RAID LevelSelect RAID-5 Physical DisksScroll down and select the Disk IDs for the indexing arrays. Consult

Appendix A: RAID Array Configurations for your configuration type to see which virtual disk groups to assign to the indexing array

Advanced SettingsUnder Write Policy, select Force WB with no battery and Initialize.

Installation


Configure the Capture Arrays 2.4.13. Select OK and follow the prompts to return to the Virtual Disk Management screen.

2.4.14. Are you configuring a standalone device, or did you configure your indexing array on Controller 1?

YesContinue the procedure.

NoExit the PERC H710 utility and launch the PERC H810 utility for Controller 1.

2.4.15. In the Create New VD dialog, configure the settings as follows:

RAID LevelSelect RAID-5 Physical DisksScroll down and select the Disk IDs for the capture arrays. Advanced SettingsUnder Write Policy, select Force WB with no battery and Initialize.

2.4.16. Repeat step 2.4.15 for each capture array. Consult Appendix A: RAID Array Configurations for your configuration type to see which virtual disk groups to configure for each RAID controller. Where applicable, select the PERC H810 utility for Controller 2 and configure accordingly.

2.4.17. Select OK and follow the prompts to return to the Virtual Disk Management screen.

Installation


2.4.18. The initialization progress is displayed in the upper-right quadrant of the screen.

Note Before disk initialization is complete, you can perform the rest of the configuration tasks. However, it is not recommended that you begin capture until after initialization is complete. In most cases, initialization time for all disks will be in the 56 hour range.

2.4.19. Press ESC to save the settings and exit the RAID configuration utility.

Installation


2.5 Configure BIOS 2.5.1. Reboot the host controller by pressing the power button or by pressing Ctrl+Alt+Delete.

F2 = System Setup F10 = Lifecycle Controller F11 = BIOS Boot Manager F12 = PXE Boot

2.5.2. When these menu items are displayed, press F2 to enter the system setup and configure the settings as follows:

Page Attribute Value

Memory Settings Memory Operating Mode Optimizer Mode

Processor Settings Virtualization Technology Disabled

System Profile Settings System Profile Performance

Serial Communication Serial Port Address Serial Device1=COM1,Serial Device 2=COM2

2.5.3. Press ESC to return to the main menu, then save and exit.

2.6 Install the Image 2.6.1. Boot the host controller by pressing the power button.

2.6.2. When the menu items are displayed, press F11 to enter the BIOS boot manager.

2.6.3. Attach the ISO to the server (USB or DVD drive).

2.6.4. From the BIOS Boot Menu, select Hard Drive C: > [USB/DVD drive]. The server begins to load the ISO from the drive.

Installation


2.6.5. When the Welcome screen is displayed, select Install Solera and press Enter. The installation begins.

2.6.6. When the Complete screen is displayed, remove the drive and press Enter to reboot. Now that the Security Analytics Software has been installed on your server, it will now be called Security Analytics Appliance or appliance in the documentation.

Note On a Dell server, selecting an external driver in the BIOS Boot Manager affects one boot event only; it is therefore not essential that you remove the drive at this point, because by default, the server will boot from its internal drive.

Installation


2.7 Configure Initial Settings By default, the management interface (eth0) is set to 192.168.20.20. Follow these steps to assign a temporary IP address:

HOW TO

Assign a temporary IP

address

a. Log in to the CLI using the following credentials: admin | Solera

b. Use ifconfig to temporarily assign an IP address to the management interface (eth0) that is accessible by your management workstation. This IP address will be valid for one login event only:

sudo ifconfig eth0 netmask

c. As necessary, assign a default route: sudo route add default gw

Use the web interface to configure the initial settings.

HOW TO

Launch the web interface

a. Launch a Web browser and navigate to the IP address for eth0. You can use either HTTP or HTTPS. b. At the Login page, type the default username and password, both of which are case-sensitive:

Username: admin Password: Solera

c. Click Log In.

d. The Solera Networks End User License Agreement (EULA) for this appliance is displayed. Select I accept these terms to accept the Solera Networks EULA and click Submit. The Initial Configuration page is displayed.

e. Select Settings ( ) > About > Help > English.

f. Consult the "Initial Setup" page for instructions on initial appliance configuration.

2.8 Next Steps After your Security Analytics Appliance is set up, use the web interface to configure the appliance to start capturing network traffic. For instructions, select Settings > About > Help > English.

For assistance with your appliance, contact:

Blue Coat Support: bluecoat.com/support/technical-support/contact-service-support

BlueTouch Online: bto.bluecoat.com

Appendix A: RAID Array Configurations


3 Appendix A: RAID Array Configurations 3.1 R620 Standalone Setups

R620 Central Manager Console

RAID Cont. Disk Gp. Disk ID RAID Purpose Device Model Position Useable Space (TB)

0 0 03 5 System Central Manager R620 n/a 3

R620 Standalone


0 0 01 1 System Appliance R620 n/a 1

0 1 23 1 Index Appliance R620 n/a 1

0 2 49 5 Capture Appliance R620 n/a 5

Total Index 1

Total Capture 5

Index-to-Capture Ratio 0.20



3.2 R620 Setups with MD1200s of 12 x 2TB Drives The following setups are valid for MD1200s that contain twelve 2TB drives.

R620 plus 1 MD1200 with 12 x 2TB Drives


0 0 01 1 System Host Controller R620 0 1

0 1 29 5 Index Host Controller R620 0 7

1 0 011 5 Capture Storage Module MD1200 1 20

Total Index 7

Total Capture 20


R620 plus 2 MD1200s with 12 x 2TB Drives






Total Index 7

Total Capture 40


R620 plus 3 MD1200s with 12 x 2TB Drives







Total Index 7

Total Capture 60




3.3 R620 Setups with MD1200s of 12 x 4TB Drives The following setup is valid for MD1200s that contain twelve 4TB drives.

R620 plus 1 MD1200 with 12 x 4TB Drives





Total Index 7

Total Capture 40


3.4 R720xd Standalone Setup

R720xd Standalone


0 0 2425 1 System Appliance R720xd n/a 1

0 1 04 5 Index Appliance R720xd n/a 4

0 2 523 5 Capture Appliance R720xd n/a 18

Total Index 4

Total Capture 18




3.5 R720xd Setups with MD1200s of 12 x 2TB Drives The following setups are valid for MD1200s that contain twelve 2TB drives.

R720xd plus 1 MD1200 with 12 x 2TB Drives


0 0 2225 5 System Host Controller R720xd 0 3

0 1 021 5 Index Host Controller R720xd 0 21


Total Index 21

Total Capture 20


R720xd plus 2 MD1200s with 12 x 2TB Drives






Total Index 21

Total Capture 40











Total Index 21

Total Capture 60










Total Index 21

Total Capture 80











Total Index 21

Total Capture 100














Total Index 21

Total Capture 120




3.6 R720xd Setups with MD1200s of 12 x 4TB Drives The following setups are valid for MD1200s that contain twelve 4TB drives.

R720xd plus 1 MD1200 with 12 x 4TB Drives





Total Index 21

Total Capture 40








Total Index 21

Total Capture 80











Total Index 21

Total Capture 120






1 0 011 5 [variable]* Storage Module MD1200 1 40




Total Index 21/61

Total Capture 160/120

Index-to-Capture Ratio 0.13/0.50

*The purpose of the storage module in Position 1 should be decided in conjunction with professional services. The index-to-capture ratio should be customized according to your organization's needs.







1 0 05 5 Index Storage Module MD1200 1 20






Total Index 61

Total Capture 160













Total Index 61

Total Capture 200


Appendix B: Power, Thermal, and Acoustic Summary


4 Appendix B: Power, Thermal, and Acoustic Summary Configuration totals for 110V AC at 25C.

Central Manager 2 GB Appliance 10 GB Appliance 20 TB Storage

Kilowatt Hour Cost $0.14 kWh $0.14 kWh $0.14 kWh $0.14 kWh

Solution Btu, watts 1013.4 Btu/h 297 W 1211.3 Btu/h 355 W 2200.8 Btu/h 645 W 1003.5 Btu/h 294.1 W

Sound Power 6 bels 6.5 bels 6.5 bels 7 bels

Current 2.7 amps 3.2 amps 5.9 amps 2.7 amps

Air Flow 10.2 l/s 21.5 CFM 9 l/s 19.2 CFM 18.7 l/s 39.6 CFM 13.7 l/s 29.1 CFM

Total Weight 19.8 kg 43.6 lbs 19.8 kg 43.6 lbs 29.2 kg 64.4 lbs 28.4 kg 62.6 lbs

Air Temperature Rise 24.8 C 44.7 C 33.4 C 60 F 29.3 C 52.8 F 18.2 C 32.7 F

Copyrights, Trademarks, and Intellectual PropertyGNU General Public License Source Code Requests1 Requirements1.1 Server I/O Configuration1.2 Storage Module I/O Configuration

2 Installation2.1 Cable the Attached Storage Arrays2.2 Establish a Connection to the Server2.3 OptionalConfigure the iDRAC Interface2.4 Set Up the RAID ArraysConfigure the System DiskConfigure the Indexing ArraysConfigure the Capture Arrays

2.5 Configure BIOS2.6 Install the Image2.7 Configure Initial Settings2.8 Next Steps

Two-RAID-Controller SetupAssign a temporary IP addressLaunch the web interface

One-RAID-Controller Setup3 Appendix A: RAID Array Configurations3.1 R620 Standalone SetupsR620 Central Manager ConsoleR620 Standalone

3.2 R620 Setups with MD1200s of 12 x 2TB DrivesR620 plus 1 MD1200 with 12 x 2TB DrivesR620 plus 2 MD1200s with 12 x 2TB DrivesR620 plus 3 MD1200s with 12 x 2TB Drives

3.3 R620 Setups with MD1200s of 12 x 4TB DrivesR620 plus 1 MD1200 with 12 x 4TB Drives

3.4 R720xd Standalone SetupR720xd Standalone

3.5 R720xd Setups with MD1200s of 12 x 2TB DrivesR720xd plus 1 MD1200 with 12 x 2TB DrivesR720xd plus 2 MD1200s with 12 x 2TB DrivesR720xd plus 3 MD1200s with 12 x 2TB DrivesR720xd plus 4 MD1200s with 12 x 2TB DrivesR720xd plus 5 MD1200s with 12 x 2TB DrivesR720xd plus 6 MD1200s with 12 x 2TB Drives

3.6 R720xd Setups with MD1200s of 12 x 4TB DrivesR720xd plus 1 MD1200 with 12 x 4TB DrivesR720xd plus 2 MD1200s with 12 x 4TB DrivesR720xd plus 3 MD1200s with 12 x 4TB DrivesR720xd plus 4 MD1200s with 12 x 4TB DrivesR720xd plus 5 MD1200s with 12 x 4TB DrivesR720xd plus 6 MD1200s with 12 x 4TB Drives

4 Appendix B: Power, Thermal, and Acoustic Summary4.1

Date post:	06-Jan-2016
Category:	Documents
Upload:	huongpham
View:	221 times
Download:	0 times

Gen12 Security Analytics Software Installation Guide for Dell HW

Documents