McAfee IIP-M65K-ISAA Product Manual

McAfee IIP-M65K-ISAA - Network Security Platform M-6050 Manual

Get McAfee IIP-M65K-ISAA - Network Security Platform M-6050 PDF manuals and user guides View all McAfee IIP-M65K-ISAA manuals
Add to My Manuals
Save this manual to your list of manuals

McAfee IIP-M65K-ISAA manual content summary:

  • McAfee IIP-M65K-ISAA | Product Manual - Page 1
    M-6050 Sensor Product Guide revision 2.0 McAfee® IntruShield® IPS IntruShield M-6050 Sensor version 4.1 McAfee® Network Protection Industry-leading intrusion prevention solutions
  • McAfee IIP-M65K-ISAA | Product Manual - Page 2
    IntruShield, INTRUSION PREVENTION THROUGH INNOVATION, McAfee, McAfee (AND IN KATAKANA), McAfee AND DESIGN, McAfee.COM, McAfee (C) 1997-2000 University of Notre Dame. * Software copyrighted by Simone Software copyrighted by Thomas Jacob, (C) 2003 6050 Sensor Product Guide 700-1703-00/ 2.0 - English
  • McAfee IIP-M65K-ISAA | Product Manual - Page 3
    Preface ...v Introducing McAfee IntruShield IPS v About this guide...v Audience ...v Contents of this guide...v Contacting Technical Support ...vi Related documentation ...vi Conventions used in this guide ...vii Overview ...1 About IntruShield sensors ...1 Sensor functionality ...1 Network
  • McAfee IIP-M65K-ISAA | Product Manual - Page 4
    Cabling for in-line ...20 Cabling for TAP mode ...21 Cabling for SPAN or hub mode 21 Cabling the Failover interconnection ports 21 Using Fail-Open hardware ...22 Troubleshooting 23 Sensor Technical Specifications 24 Regulatory, Compliance, and Safety Information 25 Sensor Capacity 27 iv
  • McAfee IIP-M65K-ISAA | Product Manual - Page 5
    more about McAfee IntruShield components. • Learn how to get started. • Learn about the Home page and interaction with the Manager interface. About this guide This guide contains information necessary to setup your M-6050 sensor model. This information includes guiding you through preconfiguring
  • McAfee IIP-M65K-ISAA | Product Manual - Page 6
    McAfee® IntruShield® IPS 4.1 M-6050 Sensor Product Guide Preface Contacting Technical Support • Chapter 2: Before You Install contains system specifications, and the safety and usage requirements for the sensors. • Chapter 3: Setting up an M-6050 describes the preliminary steps you must follow
  • McAfee IIP-M65K-ISAA | Product Manual - Page 7
    McAfee® IntruShield® IPS 4.1 M-6050 Sensor Product Guide Preface Conventions used in this guide • Special Topics Guide • Database Tuning • Best Practices • Denial-of-Service • Sensor High Availability • Custom Roles Creation • In-line Sensor Deployment • Virtualization • Troubleshooting Guide •
  • McAfee IIP-M65K-ISAA | Product Manual - Page 8
    McAfee® IntruShield® IPS 4.1 M-6050 Sensor Product Guide Convention Information that you must read to prevent injury, accidents from contact with electricity, or other , but non-critical, information are denoted using this notation. Note: Preface Conventions used in this guide Example viii
  • McAfee IIP-M65K-ISAA | Product Manual - Page 9
    , misuse, and distributed denial of service (DDoS) attacks. IntruShield sensors are specifically designed to handle traffic at wire speed guide. The IntruShield ISM server is described in detail in the Getting Started Guide. Sensor functionality The primary function of an IntruShield sensor
  • McAfee IIP-M65K-ISAA | Product Manual - Page 10
    McAfee® IntruShield® IPS 4.1 M-6050 Sensor Product Guide Overview M-6050 key features The IntruShield sensor is purpose-built for the monitoring of traffic across one or more network segments. For more information on IntruShield, see the Getting Started Guide. Following is an example of a network
  • McAfee IIP-M65K-ISAA | Product Manual - Page 11
    McAfee® IntruShield® IPS 4.1 M-6050 Sensor Product Guide Overview M-6050 physical description dull-duplex Ethernet segments or eight 1 Gigabit SPAN ports transmitting aggregated traffic. Ports The M-6050 is a 2RU unit and is equipped with the following components: Figure 2: M-6050 sensor Name 1
  • McAfee IIP-M65K-ISAA | Product Manual - Page 12
    McAfee® IntruShield® IPS 4.1 M-6050 Sensor Product Guide Overview M-6050 Quick Guide. It is also used in troubleshooting situations where the sensor's internal flash is corrupted and you must reboot the sensor the McAfee-provided cable or acquire one that meets your specific needs. The M-6050 does
  • McAfee IIP-M65K-ISAA | Product Manual - Page 13
    McAfee® IntruShield® IPS 4.1 M-6050 Sensor Product Guide Overview M-6050 physical description LED Status Description Pwr A (Power Amber Off Green Off The link is connected. The link is disconnected. Sensor is operating. Sensor is booting. (It could also indicate a system failure.) All three
  • McAfee IIP-M65K-ISAA | Product Manual - Page 14
    McAfee® IntruShield® IPS 4.1 M-6050 Sensor Product Guide Overview M-6050 physical description LED Fail-Open Control Port Speed Fail-Open Control Port Link Status Green Off Amber Off Description The link is enabled. The link is disabled. There is an error. There is no error. 6
  • McAfee IIP-M65K-ISAA | Product Manual - Page 15
    than operating the IntruShield IPS. • McAfee prohibits the modification or installation of any hardware or software in the sensor appliance that is not part of the normal operation of the IntruShield IPS. Safety measures Please read the following warnings before you install the product. These safety
  • McAfee IIP-M65K-ISAA | Product Manual - Page 16
    McAfee® IntruShield® IPS 4.1 M-6050 Sensor Product Guide Before You Install Working with Fiber-Optic ports • To radio frequency energy and, if not installed and used in accordance with the instruction manual, may cause harmful interference to radio communications. Operation of this equipment in
  • McAfee IIP-M65K-ISAA | Product Manual - Page 17
    McAfee® IntruShield® IPS 4.1 M-6050 Sensor Product Guide Before You Install Unpacking the sensor Unpacking the sensor To unpack the sensor: 1 Place the sensor box as close to the installation site as possible. 2 Position the box with the text upright. 3 Open the top flaps of the box. 4 Remove the
  • McAfee IIP-M65K-ISAA | Product Manual - Page 18
    monitoring cables. (See Attaching Cables to the M-6050 sensor.) 4 Powering on the sensor. (See Powering on the sensor.) Once you have set up and powered on the sensor, you can proceed with configuration. Positioning the sensor Place the sensor in a physically secure location, close to the switches
  • McAfee IIP-M65K-ISAA | Product Manual - Page 19
    McAfee® IntruShield® IPS 4.1 M-6050 Sensor Product Guide Setting up an M-6050 Positioning the sensor 2 Disassemble the slide the Sensor (optional). For details, refer to M-6050 Quick Start Guide. Removing a sensor from the rack Note: Because of the weight of the appliance, McAfee recommends that
  • McAfee IIP-M65K-ISAA | Product Manual - Page 20
    McAfee® IntruShield® IPS 4.1 M-6050 Sensor Product Guide Setting up an M-6050 Using the redundant power supply Using the redundant power supply A basic configuration of the M-6050 includes one hot swappable supply. You may install a second hot-swappable power supply (purchased separately from
  • McAfee IIP-M65K-ISAA | Product Manual - Page 21
    McAfee® IntruShield® IPS 4.1 M-6050 Sensor Product Guide Setting up an M-6050 Cabling the sensor Removing the power supply To remove a power supply from the M-6050 (Optional-the power supplies are hotswappable): 1 Unplug the power cable from its power source and remove the power cable from the
  • McAfee IIP-M65K-ISAA | Product Manual - Page 22
    McAfee® IntruShield® IPS 4.1 M-6050 Sensor Product Guide Setting up an M-6050 Using Small Form-factor Pluggable modules module may be slightly different. Check the module manufacturer's installation instructions for more details. For ease of installation, insert the module in the sensor supported
  • McAfee IIP-M65K-ISAA | Product Manual - Page 23
    McAfee® IntruShield® IPS 4.1 M-6050 Sensor Product Guide Setting up an M-6050 Power-on the sensor Installing a module To install a module with a bail clasp, follow these steps: 1 Remove the module from its protective packaging. 2 Ensure the module is the correct model
  • McAfee IIP-M65K-ISAA | Product Manual - Page 24
    McAfee® IntruShield® IPS 4.1 M-6050 Sensor Product Guide Setting up an M-6050 Powering off the sensor Note: If you are installing a redundant power supply, you should install it as described in Installing a power supply. For true redundant operation with the optional redundant power supply, McAfee
  • McAfee IIP-M65K-ISAA | Product Manual - Page 25
    to the M-6050 Follow the steps outlined in this chapter to connect cables to the various ports on your sensor. Cabling the Console port The Console port is used for setup and configuration of the sensor. 1 For console connections, plug the DB9 Console cable supplied by McAfee into the Console
  • McAfee IIP-M65K-ISAA | Product Manual - Page 26
    McAfee® IntruShield® IPS 4.1 M-6050 Sensor Product Guide Name Baud rate Number of bits Parity Stop bits Flow Control Setting 38400 8 None 1 None Attaching Cables to the M-6050 Cabling the Response port Cabling the Response port The sensors' Response ports are used to send responses to attacks;
  • McAfee IIP-M65K-ISAA | Product Manual - Page 27
    McAfee® IntruShield® IPS 4.1 M-6050 Sensor Product Guide Attaching Cables to the M-6050 sensor Monitoring ports. You can deploy sensors in the operating modes shown in the following table. Cabling instructions for the sensor Monitoring ports are shown on the pages indicated. To cable the M-6050
  • McAfee IIP-M65K-ISAA | Product Manual - Page 28
    McAfee® IntruShield® IPS 4.1 M-6050 Sensor Product Guide Attaching Cables to the M-6050 Cabling for in-line Note: You ON Auto-negotiation is ON Cable types for routers, switches, hubs, and PCs The cabling instructions in this chapter • Use a crossover Ethernet RJ-45 cable to connect a router port
  • McAfee IIP-M65K-ISAA | Product Manual - Page 29
    McAfee® IntruShield® IPS 4.1 M-6050 Sensor Product Guide Attaching Cables to the M-6050 Cabling for TAP mode 1 Plug the cable appropriate for use with your Gigabit Ethernet into one of the ports labeled xA (for example, 1A). 2 Plug
  • McAfee IIP-M65K-ISAA | Product Manual - Page 30
    McAfee® IntruShield® IPS 4.1 M-6050 Sensor Product Guide Attaching Cables to the M-6050 Using Fail-Open hardware To connect two M-6050s for failover: 1 Plug the cable appropriate for use with your XFP module into port 4A of the active sensor. 2 Connect the other end of the cable to port 4A of the
  • McAfee IIP-M65K-ISAA | Product Manual - Page 31
    CHAPTER 5 Troubleshooting This section lists some common installation problems and their solutions. Problem LED is off. Possible Cause The control cable has been disconnected. Solution Check the control cable and ensure it is properly connected to both the sensor and the Bypass Switch. LED is
  • McAfee IIP-M65K-ISAA | Product Manual - Page 32
    The following table lists the specifications of the M-6050 sensor. Sensor Specifics Dimensions Description Without mounting ears/ 1.05 g 450W Ambient Temperature Range (Non-condensing) Relative Humidity (Noncondensing) Sensor Specifics Operating 0C(32F) to 35C(95F) Non-operating -40C(-40F) to
  • McAfee IIP-M65K-ISAA | Product Manual - Page 33
    APPENDIX B Regulatory, Compliance, and Safety Information The M-6050 meets the following standards: Regulatory Sensor Regulatory, Safety, and Compliance Products with the CE Marking are compliant with the 89/336/EEC and 73/23/EEC directives, which include the safety and EMC standards listed.
  • McAfee IIP-M65K-ISAA | Product Manual - Page 34
    McAfee® IntruShield® IPS 4.1 M-6050 Sensor Product Guide Regulatory, Compliance, and Safety Information Using Fail-Open hardware Sensor Regulatory, Safety, and Compliance SS IEC CISPR22: 1993, Singapore IDA Class A EN 55024: 1998 + A1:2001 + A2: 2003 - Emissions: • Radiated Emissions • Conducted
  • McAfee IIP-M65K-ISAA | Product Manual - Page 35
    later) Number of SSL keys that can be stored on the sensor Virtual IDS sessions Virtual Interfaces (VIDS) VLANS / CIDR Blocks CIDR Blocks per Physical Port Customized attacks Alert filters Default number of supported UDP Flows Supported UDP Flows DoS Profiles SYN rate (64-byte packets per second)
  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
M-6050 Sensor Product Guide
revision 2.0
McAfee
®
Network Protection
Industry-leading intrusion prevention solutions
McAfee® IntruShield® IPS
IntruShield M-6050 Sensor
version 4.1