Raritan Computer NOC manual

CommandCenter ® NOC Administrator Guide Release 5.4 Copyright © 2006 Raritan Computer, Inc. CCNOC-0D-E June 2006 255-80-5301-00[...]

This page intentionally left blank.[...]

Copyright and Tradem ark Information This document contains proprietary information that is protected by copyright. All rights reserved. No part of this document may be phot ocopied, reproduced, or tr anslated into another language without express prior written consent of Raritan Computer, Inc. © Copyright 2006 Raritan, CommandCenter, Ra ritanCons[...]

Safety Guidelines To avoid potentially fatal shock hazard a nd possible damage to Raritan equipm ent: • Do not use a 2-wire power cord in any product configuration. • Test AC outlets at your computer and monitor for proper polarity and ground ing. • Use only with grounded outlets at both the com puter and monitor. When using a backup UPS, pow[...]

F IGURES v Content s Chapter 1: Introduct ion .................................................................. 1 Stand-alone A ppliances ......................................................................................................... ........... 1 Distributed 2500 Seri es Appliances........................................................[...]

vi F IGURES Chapter 3: Configuri ng Intrusion De tection ................................. 45 Configure a Spanned or Mirror ed Port ........................................................................................... 45 Ethernet TAP ..............................................................................................................[...]

F IGURES vii Map Us ers ...................................................................................................................... ...................... 101 Appendix A: S pecificat ions ........................................................ 103 V1 Pla tform .............................................................................[...]

viii F IGURES Configuring a Windows 98/ME box for Remote WM I Management ............................................. 129 Configuring a Windo ws Proxy Details .......................................................................................... 130 Registry Changes [configurat ion]: ............................................................[...]

F IGURES ix Figur es Figure 1 Appliance Shutdown/Restart ............................................................................................ .............. 9 Figure 2 Configur e Date and Time ............................................................................................... .............. 10 Figure 3 Configure Ne twork Conn ec[...]

x F IGURES Figure 52 Add a Ne w Network Route .............................................................................................. ........... 41 Figure 53 Prune Unus ed Perform ance Da ta .............................................................................................. 41 Figure 54 Delete Manag ement Settings and Da ta .....[...]

F IGURES xi Figure 105 Modify No tification Paths ........................................................................................... .............. 83 Figure 106 Define Escalation in Notifi cation Path .............................................................................. ........ 84 Figure 107 Configuri ng a User Target for Escala[...]

xii F IGURES[...]

C HAPTER 1: INTRODUCTION 1 Chapter 1: Introduction The primary function of a CommandCenter NOC (CC- NOC) is to manage nodes in your network. Nodes are discovered automatically if their IP address is within the managed range of addresses. In addition to network discovery, a CC-NOC also provides service management, a databa se of network information,[...]

2 COMMANDCENTER NOC ADMINISTRATOR GUIDE User PC Preparation To access CC-SG and any targets managed by CC-SG, the browser must have the correct version of Sun JRE, such as rev 1.4.2.05. See Compatibility Matrix under Firmware Upgrades for CC- SG on www.raritan.com/support for details. For CC-SG, pop-up blockers should be disabled as well as any fir[...]

C HAPTER 1: INTRODUCTION 3 • Vulnerability Scanning • Event Viewing and Searching • Performance Monitoring per category or device • Integration with CC-SG where CC-SG is notified of events within the subscribed discovery range. • Scheduled Outages • User, Views, and Category Configuration • License Upload • Event, Outage Notificatio[...]

4 COMMANDCENTER NOC ADMINISTRATOR GUIDE • ICMP – (Internet Control Management Protocol) IC MP is used by the CC-NOC to discover devices in your network and is documented in RFC 792 . • In-band – going through the TCP/IP network to control a target by accessing the target directly. KVM, Serial, and Generic devices can be accessed via these i[...]

C HAPTER 1: INTRODUCTION 5 • SSO – Single Sign-On. With Single Sign-on ( SSO) access to CC-SG targets, CC-NOC users can connect to targets seamlessly, without having to sign onto CC-SG as long as rem ote authentication has been configured. • System Vulnerabilities – unpatched systems, older known vulnerable server daemons on your system tha[...]

6 COMMANDCENTER NOC ADMINISTRATOR GUIDE Licensing Explained As devices are discovered in your network, data is collected from the device and the device is then assigned a license. License typ es include Infrastructure, Server, Workstation, and Promoted Workstation. Administrators can change a licen se from one type to another. The following explain[...]

C HAPTER 1: INTRODUCTION 7 Workstation A Workstation license can be assigned to any t ype of device, be it a Windows or non-Windows system. For example, a Linux box whic h is discovered as a node and which does not support any of the infrastructure services will be assigned a Workstation license. Similarly, a desktop Windows system will be assigned[...]

8 COMMANDCENTER NOC ADMINISTRATOR GUIDE[...]

C HAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 9 Chapter 2: General and Ad vanced Administration Power Down CC-NOC If running CC-NOC on the V1 platform and if it loses AC power while it is up and running, the V1 unit remembers its last power state. Once AC power is restored, the V1 unit automatically reboots. However, if a V1 unit loses AC power w[...]

10 COMMANDCENTER NOC ADMINISTRATOR GUIDE Configure Date and Time This page allows you to modify the current tim e zone and set the local time or configure a network time protocol (NTP) server with which to synchronize the local time. Note : If a CC-NOC 250 or 2500N is powered down for more than six hours, upon booting back up, you will be asked to [...]

C HAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 11 Configure Network Connection This page allows you to change the fixed IP a ddress associated with this appliance. This IP address was configured when setting up the initial configuration using a serial connection – see Raritan’s CommandCenter NOC Deployment Guide . The CC-NOC mimics the traffic[...]

12 COMMANDCENTER NOC ADMINISTRATOR GUIDE 3. Click Change the ISP Gateway Address . Figure 4 Configure Network Connection 4. Type the IP address of the ISP gateway or type an address of 0.0.0.0 if you do n o t wish to supply an ISP address. 5. Click save changes . Outgoing Email Communication This page provides an interface to change the From: email[...]

C HAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 13 email address is a required field and will be used to send status information on t h e CC-NOC itself. 7. Clicking test SMTP settings sends a test email to the email address specified in the Admin Email Address field using the specified SMTP server. This test verifies that the CC-NOC has the proper [...]

14 COMMANDCENTER NOC ADMINISTRATOR GUIDE WMI management range – see Specifying Windows Management Ranges in Chapter 4: Configuring Windows Management for details. Typically, you woul d want the discovery range specified here to overlap with the WMI management range. Note: A CC-NOC discovers devices in the network using ICMP protocol. Once discove[...]

C HAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 15 Important! Ensure your discovery range is not too wide, for example, entering multiple Class B address ranges. This consumes large amounts of resources and may reduce the performance of CC-NOC. Also, it is recommended to keep the default “Automatically license and manage new devices discovered vi[...]

16 COMMANDCENTER NOC ADMINISTRATOR GUIDE 3. Click Edit the SNMP Ranges . Figure 8 Edit SNMP Ranges 4. Click add new community or edit next to the already defined SNMP range. Figure 9 Defining SNMP Ranges 5. Edit the community string or add a new one. 6. Specify the SNMP version by selecting v1 , v2c , or Not Specified from the SNMP version drop-dow[...]

C HAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 17 3. Click Configure Schedule Outages . Figure 10 Configuring Scheduled Outages 4. Type a name for the scheduled outage and click add new scheduled outage . Figure 11 Edit Scheduled Outages 5. Type a name for the scheduled outage. 6. Select a node label , that is, a DNS hostname or IP address, from t[...]

18 COMMANDCENTER NOC ADMINISTRATOR GUIDE 8. Specify an outage window . For outage windows that are set to Recurring Weekly , you cannot specify outages that start on one day of the w eek and end on a different day. In these cases where the outage spans 12:00 AM (Midnight), you should create two outages, one that ends at 11:59 PM and another that be[...]

C HAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 19 intervals (they were initially set at 5 minutes for a reason), timeouts and/or retries without proper planning or forethought runs the risk of: • Having the pollers get behind • Adding unreasonable amounts of network traffic in th e environment • Misdiagnosis of outages, in the case of low re[...]

20 COMMANDCENTER NOC ADMINISTRATOR GUIDE 3. Click Manage, Unmanage, Rescan, or Delete Devices . Figure 13 Manage, Unmanage, Rescan, or Delete Devices 4. Select the devices from the list by clicking in the check boxes. 5. You can change the license type of the selecte d devices to: Server , Infrastructure , Workstation , Promoted Workstation , or Un[...]

C HAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 21 Configure Perform ance Thresholds This page displays the current values at wh ich SNMP performance metrics ar e considered problematic and events are generated. You have complete control over these thresholds, including their value, their re-arm values, and the numbe r of consecutive data samples, [...]

22 COMMANDCENTER NOC ADMINISTRATOR GUIDE 4. Each time you adjust th e performance thresholds, click save thresholds to commit the changes. 5. You can also click reset to restore the threshold values to their pre-set condition. Configure Outage Report This page allows you to view and m odify the working business hours and days for the Outage Report.[...]

C HAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 23 SNMP Reparenting Exclusion List This page allows you to specify addresses that should be excluded from SNMP reparenting. This feature is useful if you have multi-interface SNMP devices that have identical IP addresses to other multi-interface devices. The most common example of this is if you are m[...]

24 COMMANDCENTER NOC ADMINISTRATOR GUIDE 3. Click add association . Figure 20 Configure a CommandCenter Secu re Gateway 4. Type an IP address or hostname for the CC-SG. This is a required field. If entering a hostname, it can only contain letters, numbers, periods, or hy phens, and it must begin with either a letter or a number. 5. Clicking Active [...]

C HAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 25 Create a CC-SG Peer via a Secure Channel After configuring the CC-SG with CC-NOC information, for example, specifying its IP address, and configuring CC-NOC with CC-SG information, you can create a secure channel between CC- SG and CC-NOC. Configuring CC-SG with CC-NOC information is documented in [...]

26 COMMANDCENTER NOC ADMINISTRATOR GUIDE Important! To successfully connect, you mu st enter the passcodes in CC-NOC within five minutes after they are gener ated on CC-SG. This will min i mize the window of opportunity for intruders to breach the system with a brute-force attack. Avoid transmitting the passcodes over email or other electronic mean[...]

C HAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 27 Important! Configuring these mappings is required in order for remote authentication to work. Although you may have several CC-SG’s connected to this CC-NOC via a secure connection, only one can be the remote authentication and authorization source. If a user is mapped to a CC-NOC user role but t[...]

28 COMMANDCENTER NOC ADMINISTRATOR GUIDE Configure Event Forwarding This page allows you to configure the events, for example, SNMP traps you want forwarded t o external systems. It also allows y ou to configur e the external systems to forward the events to. Within event forwarding, you can: • Configure Event Recipients • Configure Event Sever[...]

C HAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 29 address or a hostname that this appliance can resolve. Example: Protocol=Trap, Host= 192.168.51.1 50, Port=162. 8. Type protocol, host, and port for the Path Back URL which is the IP address or hostname of this CC-NOC. The Host entered is the web address that a user of the ex ternal event recipient[...]

30 COMMANDCENTER NOC ADMINISTRATOR GUIDE 3. Click Configure Trap Relaying . Figure 31 Configure Trap Relaying 4. Click add recipient . Figure 32 Specifying Trap Recipient 5. Specify a hostname that is resolvable from this appliance or an IP address in the Host field. This can be the same platform or appliance that was specified when configuring eve[...]

C HAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 31 Edit Performance Thresholds (Per Device) In addition to configuring perform ance values per category–see section Configure Performance Thresholds earlier in this chapter, you can also conf igure performance thresholds on a per-device basis. Per-device thresholds will override those set per catego[...]

32 COMMANDCENTER NOC ADMINISTRATOR GUIDE Administrator Tools Administrator tools help you diagnose and fix pr oblem s with the CC-NOC. These tools allow you to backup configuration files, download logs, check the disk usage of your CC-NOC, and establish connections to Techni cal Support. Access administrator tools either from the Tools tab or from [...]

C HAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 33 3. Click Check Disk Utilization on Appliance . Figure 37 Check Disk Utilization on Appliance The Disk Usage section lists the current free space p ercentages for different areas of the storag e within the CC-NOC appliance. The disk storage inside this CC-NOC appliance is used to store logs of syste[...]

34 COMMANDCENTER NOC ADMINISTRATOR GUIDE 4. Type a description of the problem you are experiencing in the text box. 5. Type an email address in Confirmation Email: so that when the incident report em ail i s received, you will get a confirmation message. 6. Click send incident email . Generate Diagnostics File If your CC-NOC does not have email acc[...]

C HAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 35 Download Data Archives Every 24 hours, the previous day’s events are pl aced into an event archival file and made accessible. Download this archival file or unzip it to access a comma-separated value (CSV) file, which can be opened with any spreadsheet appli cation to view the events for that day[...]

36 COMMANDCENTER NOC ADMINISTRATOR GUIDE All CC-NOC patches and updates are made availabl e on a web server which can be automatically checked by your CC-NOC applian ce. If new patches/updates are av ailable, they can also be automatically downloaded, and optionally, autom a tically applied. The degree to which this process is performed is in your [...]

C HAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 37 4. Click Install Updates . Figure 44 Install Updates 5. Click install to install any of the updates that are lis ted. If an update is listed as downloading, it will be available for installation once it is fully downloaded. Check for new updates by accessing the Download Updates page – see sectio[...]

38 COMMANDCENTER NOC ADMINISTRATOR GUIDE available, yet do not want them automatically installed, set Auto Download to enable , but l eave Auto Install configured as disabled . 1. Click on the Admin tab in the top navigation bar. 2. Click Advanced Administration . 3. Click System Software & Signature Updates . 4. Click Configure Automatic Downl[...]

C HAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 39 Appliance Database Administration This page allows you to clean out unnecessary or unused infor mation stored in the database, including node information, events, outages, etc. These operations are necessary if you would like to purge some of the data and start over with a clean database. You will [...]

40 COMMANDCENTER NOC ADMINISTRATOR GUIDE 1. Click on the Admin tab in the top navigation bar. 2. Click Advanced Administration . 3. Click Data Backup and Restore. 4. Click Download Backup Files. Figure 49 Download Backup Files 5. Click a file to begin the download. Install a Backup File If restoring a backup file to a new piece of hard ware, contac[...]

C HAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 41 2. Click Advanced Administration . 3. Click Manage Routes. Figure 51 Manage Routes 4. To delete a user-defined static route, click remove in the row of the unwanted route . 5. To change the default gateway route, revisit the Configure Network Connection page – see Configure Network Connection ear[...]

42 COMMANDCENTER NOC ADMINISTRATOR GUIDE Delete Management Settings and Data This page gives you a way to completely reset th e appliance to nearly a "factory default" state, deleting all collected informati on and configuration s ettings. Warning! This action is irreversible. If you download a backup of your data, you can restore it to t[...]

C HAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 43 3. Click Delete Traffic Analysis Performance Information. Figure 55 Delete Traffic Analysis Perform ance Data 4. Choose the appliance on which to delete the performance data . 5. Click delete . Install CC-NOC License This page allows you to upload a new license f ile to the CC-NOC. You were asked t[...]

44 COMMANDCENTER NOC ADMINISTRATOR GUIDE Note: In a distributed environment, to insta ll a license for a CC-NOC 2500M or CC-NOC 2500S, from the CC-NOC 2500N click on the Admin tab, click Upload Appliance Licenses , and click load new appliance license . Installed Appliances List Use this page to change the name or description of a CC-NOC and disabl[...]

C HAPTER 3: CONFIGURING INTRUSI O N DETECTI ON 45 Chapter 3: Configuring Intrusion Detection This chapter describes procedures to configure a CC-NOC so it can monitor and analyze system events for attempts to access system resources in an unauthorized manner. In the event of an attack, real-time alerts can be sen t to specified individuals. Intrusi[...]

46 COMMANDCENTER NOC ADMINISTRATOR GUIDE Deployment Place the Ethernet TAP on the Ethernet cable in the same location where an Ethernet hub would be used. The Ethernet tap has the exact same function as the hub, except that one of the ports is uni-directional and outputs data that is passing over th e wire. This is the port t hat is connected to CC[...]

C HAPTER 3: CONFIGURING INTRUSI O N DETECTI ON 47 4. Choose the appliance that you wish to configure by clicking Configure next to i t. Figure 60 Configuring Home Network for Intrusion Detection Appliance 5. To include an entire subnet in your home network, use the Add Addresses box. Type in the network address and select the subnet mask from the l[...]

48 COMMANDCENTER NOC ADMINISTRATOR GUIDE All of the Intrusion Detection appliances that can communicate with this system are listed in the box. The Last Change field indicates the last tim e that the home network for the appliance was changed. Figure 61 Selecting an Intrusion Detect ion Appliance for Portscan Detection 4. Choose the appliance that [...]

C HAPTER 3: CONFIGURING INTRUSI O N DETECTI ON 49 Determining which ports are open on a target machin e is often the first step towards a successful attack on a network system. Attackers genera lly use port scanning utilities to probe a target system and make a list of all open ports on the devi ce. After they have this list, they will send specifi[...]

50 COMMANDCENTER NOC ADMINISTRATOR GUIDE Select Intrusion Detect ion Appliance(s) All of the Intrusion Detection appliances that can communicate with the system hosting this Web Console are listed in the Intrusion Detection Appliance box. The Last Configuration field indicates the last time that the detection scheme for the Intrusion Detection was [...]

C HAPTER 3: CONFIGURING INTRUSI O N DETECTI ON 51 Select Types of Signatures to Monitor When in doubt, enable detection. There is no di sadvantage to enabling extra detection, except that you may receive extraneous events from your Intr usion Detection applian ces. You should usually never disable detection of General Security on the Network . This[...]

52 COMMANDCENTER NOC ADMINISTRATOR GUIDE Load Default Signatures or Settings from Another Appliance Alternatively, you can quickly configure your I ntrusion Detection appliance by selecting a set of pre-selected signatures appropriate for most ne tworks or by selecting a previously saved appliance’s signature settings. 10. To load the defaults, s[...]

C HAPTER 3: CONFIGURING INTRUSI O N DETECTI ON 53 Advanced Intrusion Detection Administration Advanced administration assists in fine tuning the set of signatures that an intrusion detection application will use to detect intrusion traffic on the network. Manage Signatures The Manage Signatures page allows you to disable specific signatures on a pe[...]

54 COMMANDCENTER NOC ADMINISTRATOR GUIDE Upload Custom Signatures Tool The Upload Custom Signatures page allows you to upload a s pecific set of rules that will be sent to a specified Intrusion Detection appliance. This feature can be used to augment the set of signatures that Raritan provides as part of th e ongoing software updates for the applia[...]

CHAPTER 4: CONFIGURING WI NDOW S MANAGEMENT 55 Chapter 4: Configuring Windows Management This chapter describes procedures to configure a CC-NOC so it can use Microsoft’s WMI (Windows Management Instrum entation) to monitor and manage Windows servers and workstations in your network. WMI informati on is collected from the Windows systems and is u[...]

56 COMMANDCENTER NOC ADMINISTRATOR GUIDE External Proxy Host Requirements For best results, it is recommended to use Window s XP Professional, Service Pack 2 (or later) with auto updates enabled to facilitate co mmunications between CC-NOC and the managed systems. The external proxy needs to meet these requirements: • 1000 MHz CPU or higher • 5[...]

CHAPTER 4: CONFIGURING WI NDOW S MANAGEMENT 57 4. Unzip the ProxyInstaller archive on your Windows machine and move the directory to a location where you would like to keep the pr ogram . For example, a good location could be: C:Program FilesRaritanProxyInstaller 5. Double-click on ProxyInstaller.exe to run the program. 6. Type in either the Rem[...]

58 COMMANDCENTER NOC ADMINISTRATOR GUIDE The Windows Management Configuration Wizard is an interface to specify and configure proxy hosts, which facilitate connectivity between the CC-NOC and your managed Windows servers and workstations. This configuration wizard wa lks you step-by-step through the creation of proxies, association of authenticatio[...]

CHAPTER 4: CONFIGURING WI NDOW S MANAGEMENT 59 6. Type the IP address for the proxy host. This should be the same host that the configuration tool was run – see section Download and Run earlier in this chapter for additional information. Note: Hostname values in this field must be resolvabl e via DNS or must be a numeric IP address. 7. Type value[...]

60 COMMANDCENTER NOC ADMINISTRATOR GUIDE Note: After windows discovery process is complete, you may notice an overlap in devices that were specified in the Discovery Range – please see Edit Discovery Ranges in Chapter 2: General and Advanced Administration for additional information. Therefore, it may be necessary to change the licenses of some d[...]

CHAPTER 4: CONFIGURING WI NDOW S MANAGEMENT 61 Note: Any local user defined must be a member of th e Local Administrators group to authenticate and allow data collection to occur. Trusted Domain-based authentication is used when the target mach ines are part of a domain other than the domain to be used for authentication, ye t there exists a trust [...]

62 COMMANDCENTER NOC ADMINISTRATOR GUIDE Configuring a WINS Se rver or LMHOSTS File If you need to collect WMI data from Windows se rvers that exist in another network and you need to resolve Windows NetBIOS names to IP a ddresses, on the external proxy you can either: • Configure the WINS server. • Edit the lmhosts file. Configure a WINS Serve[...]

CHAPTER 4: CONFIGURING WI NDOW S MANAGEMENT 63 8. Click on the WINS tab. Figure 77Selecting WINS Tab 9. Click the Add… button and specify the address of the WINS server for the remote appliance to use for Windows computer name resolution and click add . Command Line Interface Alternatively, you can issue this command on the command line interface[...]

64 COMMANDCENTER NOC ADMINISTRATOR GUIDE Authenticate Windows Computers This option allows you to change t he authenti cation usernames and passwords for discovered servers and workstations. 1. Click on the Admin tab in the top navigation bar. 2. Click Windows Management Configuration . 3. Click Authenticate Windows Computers . Figure 78 Change Aut[...]

CHAPTER 4: CONFIGURING WI NDOW S MANAGEMENT 65 5. Choose the desired operation, for example, change license type to Promoted Workstation . 6. Click submit . To generate an inventor y report of the current list of devices, select an output format, for example, HTML or XML, and click generate report . XML can be used in Crystal Reports. Note: If an I[...]

66 COMMANDCENTER NOC ADMINISTRATOR GUIDE To edit WINS settings: 1. Click on the Admin tab in the top navigation bar. 2. Click CommandCenter NOC 2500M Configuration . Figure 81 Edit WINS Settings 3. Select the CC-NOC 2500M appliance from the pull-down menu next to edit WINS settings . 4. Click edit WINS settings . Figure 82 WINS Server IP Address 5.[...]

CHAPTER 4: CONFIGURING WI NDOW S MANAGEMENT 67 Edit LMHOSTS File To resolve Windows NetBIOS names to IP addresses, you can edit the lmhosts file if you are using the internal proxy on the CC-NOC 2500M a ppli ance and a WINS server is not available. 1. Click on the Admin tab in the top navigation bar. 2. Click CommandCenter NOC 2500M Configuration .[...]

68 COMMANDCENTER NOC ADMINISTRATOR GUIDE 5. Specify the IP address of each remote Windows server from which you wish t o collect WMI data. 6. You can also delete all of the lmhosts settings for the appliance by clicking delete LMHOSTS file . 7. Click submit changes .[...]

CHAPTER 5: CONFIGURING VULNERABI LI TY SCANNING 69 Chapter 5: Configuring Vulnerability Scanning This chapter describes procedures to configure a CC-NOC so it can scan for vulnerabilities, for example, exploits and thresholds against devices within your network. Scanning for vulnerabilities assists administrators in resolving security concerns. Vul[...]

70 COMMANDCENTER NOC ADMINISTRATOR GUIDE 3. Read the warning and at the bottom of the page, click I Agree. By clicking on I Agree and proceeding to the configuration page, you acknowledge these risks and take responsibility for all potential dam ages and outages. Otherwise, click I Do Not Agree and you will be returned to the Admin page. Contact yo[...]

CHAPTER 5: CONFIGURING VULNERABI LI TY SCANNING 71 Scan Level 4 Scan Level 4 performs all checks of previous levels and also attempts exploits that are known to be directly harmful to target systems. These incl ude vulnerabilities that can alter data on the target or bring down services or the operating system by using denial-of-service techniques.[...]

72 COMMANDCENTER NOC ADMINISTRATOR GUIDE 3. Click add to have the targets added, or excluded, from the scan. 4. Click save settings to save all addresses entered and return to the previous page. 5. Scroll to the bottom of the page and creat e a scanning schedule. Vulnerability scanning can be scheduled to occur when it won't adversely impact y[...]

CHAPTER 6: CONFIGURING NOTIFICATIONS 73 Chapter 6: Configuring Notifications This chapter describes procedures to configure a CC -NOC so it can send and escalate notices through email, pagers, etc. if and when specific CC-NOC events occur. When important events are detected, users may recei ve a notice that is a descripti ve message sent automatica[...]

74 COMMANDCENTER NOC ADMINISTRATOR GUIDE Configure Event Notifications By configuring event notifications, each system event can be configured to send a notific ation whenever that event is triggered. 1. Click on the Admin tab in the top navigation bar. 2. Click Notification Configuration . 3. Click Configure Event Notifications . Figure 90 A Confi[...]

CHAPTER 6: CONFIGURING NOTIFICATIONS 75 Select Event Type The first step when adding or editing a notification is to select one event type to associate with the notification. Notice that if you are adding a new not ice for an existing even t, you will bypass this step. Figure 91 Adding a New Event Notification 4. From the list of all events that ma[...]

76 COMMANDCENTER NOC ADMINISTRATOR GUIDE 6. Click one of the radio buttons: • To NOT build a rule, click Do not constrain notice against interface or service. • To build a rule, click Send notice only if it contains an interface that matches the interface/service rule below. 7. If you selected to build a rule, specify TCP/IP a ddress and servic[...]

CHAPTER 6: CONFIGURING NOTIFICATIONS 77 8. If you do not wish to validate the rule or did not define an interface/service rule, click skip results validation to continue. Otherwise, click validate rule results to provide a visual representation of the rule just built and check that the TCP/IP address(es) and/or service(s) specified returned expecte[...]

78 COMMANDCENTER NOC ADMINISTRATOR GUIDE and will also appear in the Notification Browser as described in Raritan’s CC-NOC User Guide . 15. Type an Email Subject that will appear as the subject of the email sent as a result of this Event Notification. This is optional and a default subject “ Notice #%notice[id]% ” will be used if text is not [...]

CHAPTER 6: CONFIGURING NOTIFICATIONS 79 notification path – please see section Configure Notification Paths later in this chapter for additional information. Note: To assign users to a group, the users mu st be pre-defined – please see section Add a New User in Chapter 8: Creating Users, Categories, Views for additional information. 1. Click on[...]

80 COMMANDCENTER NOC ADMINISTRATOR GUIDE Figure 99 Assigning Users to a Notification Group 5. Type in comments that describe the group. This is optional. 6. Assign users to the group by clicking select all , or Ctrl+click to select more than one user, or hold down the Shift key and click on the opposing end to select a range of users. Select >&g[...]

CHAPTER 6: CONFIGURING NOTIFICATIONS 81 Configure Notification Paths In this section, you will create notification paths that defines the users or groups who will receive notifications, how the notifications will be sent, fo r example, numeric or text pagers, email, and who to notify if escalation is needed. Notificati on paths are selected when co[...]

82 COMMANDCENTER NOC ADMINISTRATOR GUIDE Create New Path Name a nd Specify Targets In this step, you need to specify a new name and select a target, that is, user, group, or email. Figure 101 Configuring a Notification Path To create a new notification path: 4. Type a unique new path name . The name must be alphanumeric and can include “/”, and[...]

CHAPTER 6: CONFIGURING NOTIFICATIONS 83 • For Group Target , select only one group as previously defined, please see section Configure Notification Groups earlier in this chapter for details, and specify an interval, that is, minutes, hour, or da ys, to indicate how long to wait before sending the notification t o users in this group. Then select[...]

84 COMMANDCENTER NOC ADMINISTRATOR GUIDE Define Escalation i n Notification Path In this step, you need to define how l ong the CC-NOC will wait until it sends a subsequent notification after sending out the first one. You als o need to specify who will be receiving this subsequent notification. Figure 106 Define Escalation in Notification Path To [...]

CHAPTER 6: CONFIGURING NOTIFICATIONS 85 • For Group Target , select only one group as previously defined, see section Configure Notification Groups earlier in this chapter for additiona l information, specify an interval, that is, minutes, hour, or da ys, to indicate how long to wait before sending the notification t o users in this group. Then s[...]

86 COMMANDCENTER NOC ADMINISTRATOR GUIDE Configure TAP Paging This section explains configuring the Telocator Alphanumeric Protocol (TAP) for a specific paging service provider. This allows the CC-NOC to send notifications to us ers' pagers if the appliance has its modem connected to a telephone line. TAP is a standard protocol that enables mo[...]

CHAPTER 6: CONFIGURING NOTIFICATIONS 87 Add a new TAP Service In this step, you need to enter the phone numbe r, b aud rate, and other information for a TAP service. Different phone carriers will typically ha ve separate TAP services so if you have pagers from different phone carriers or from different manufacturers, y ou may need to enter settings[...]

88 COMMANDCENTER NOC ADMINISTRATOR GUIDE Edit Modem Parameters In this step, you will set up the m odem paramete rs. If your modem requires special parameters for initialization or dialing prefixes, such as dialing "9 " to get an outside line, you’ll need to enter these parameters. These settings are necessary for the modem to initializ[...]

CHAPTER 7: M ANAGI NG A SSETS 89 Chapter 7: Managing Assets This chapter describes procedures to configure a CC-NOC so it can track and share important information about capital assets in your organizati on. This data, when coupled with information about your network that is obtained by the CC- NOC during network discovery, can be a powerful tool n[...]

90 COMMANDCENTER NOC ADMINISTRATOR GUIDE 3. Click Import Assets . Figure 114 Importing assets 4. Paste your comma-separated values into this text field to import them into the assets database. There is one line per record, and the fields are delimited by commas. A new asset record will be created for each line. 5. Click import . Note: You MUST incl[...]

CHAPTER 7: M ANAGI NG A SSETS 91 Export Assets All the nodes with asset inf ormat ion ca n be e xported to a co mma-separated value file ( CSV), whic h is s uitabl e f or use in a spreadsheet app lication. If you do an import into the CC-NOC with this CSV file , you will be asked to re-map all assets that were previously mapped to a node. 1. Click [...]

92 COMMANDCENTER NOC ADMINISTRATOR GUIDE Clear All Asset Records This allows you to remove all asset records from the CC-NOC. Be sure to export the assets if you ever need to recover this data in the future. If you are rebuilding the asset records from an export via the CC-NOC, you will need to clear the asset ta ble prior to re-importing. Otherwis[...]

C HAPTER 8: C REATING U SERS , C ATEGORIES , V IEWS 93 Chapter 8: Creating Users, Categories, Views This chapter describes procedures to add users, delete and modify users, build views, and create categories. Build your own custom way of looking at your network, called views, and then assign them to your users. Categories allow you to defi ne speci[...]

94 COMMANDCENTER NOC ADMINISTRATOR GUIDE • Operators  have access to every thing on the CC-NOC except administrative configurations. • Executive User  have read-only access to only a few ke y reports that show the network health at a high level. • Admin  have configuration access to the CC-NOC. 7. Click create user . Edit a User When[...]

C HAPTER 8: C REATING U SERS , C ATEGORIES , V IEWS 95 5. Supply a full name and enter comments. This is optional. 6. If desired, provide Executive User Constraints to provide an executive-level user acce ss only to the specified category and appliance that is specified. This user will not be able to see information on nodes outside of the specifie[...]

96 COMMANDCENTER NOC ADMINISTRATOR GUIDE 6. Choose the start time and stop time from the select boxes. If a user works a shift that spans midnight you will have to enter two duty schedules. One from the st art of the shift till midnight, and the second on the next day from midnight till the end of the shift. Then , usi ng the duty schedule fields y[...]

C HAPTER 8: C REATING U SERS , C ATEGORIES , V IEWS 97 Web Servers Includes all managed interfaces which are running an HTTP (web) server on port 80 or other common ports. Categories can then be combined into views , providing you t he ability to focus users on the nodes that are pertinent to their role. You have the ab ility to create, modify, and[...]

98 COMMANDCENTER NOC ADMINISTRATOR GUIDE 7. Specify either IP addresses/ranges or services th at will be included in this category. The category will be populated with those nodes/servi ces that you define here so you can design customized views for your us ers. Fo r exam ple , y ou could create one category for just Exchange servers, and another f[...]

C HAPTER 8: C REATING U SERS , C ATEGORIES , V IEWS 99 Configure Views Configuring views allows y ou to create a ma pping between users and views, or sets of categories, they will see when logging into the CC-NOC. Views are simply the combination of categories that your users will see when logging in. When configuring views, you have the ability to[...]

100 COMMANDCENTER NOC ADMINISTRATOR GUIDE Add/Modify an Existing View In this page, you can add a new view or modify an existing one, including adding or rem oving sections, for example, logical groupi ngs of categories under a common heading, as well as the categories within them. To create or modify the categories, including the filters that popu[...]

C HAPTER 8: C REATING U SERS , C ATEGORIES , V IEWS 101 Map Users After creating views, you c an now ma p user s to a view that will be displayed after they log into the CC-NOC. If users are not mapped to a specific vi ew, then the Default view that was selected in section Configure Views will be displayed. 1. Click on the Admin tab in the top navi[...]

102 COMMANDCENTER NOC ADMINISTRATOR GUIDE[...]

APPENDIX B : TROUBLESHOOTING 103 Appendix A: Specifications V1 Platform General Specifications Form Factor 1U Dimensions (DxWxH) 24.21”x 19.09” x 1.75” 615mm x 485mm x 44 mm Weight 23.80lb (10.80kg) Power Single Supply (1 x 300 watt) Operating Temperature 10 ℃ - 35 ℃ (50 ℉ - 95 ℉ ) Mean Time Between Failure (MTBF) 36,354 hours KVM Adm[...]

104 COMMANDCENTER NOC ADMINISTRATOR GUIDE N ON -O PERATING Temperature -40 - +60 (-40-140) Humidity 5% - 95% RH Altitude Operate properly at any altitude between 0 to 10,000 feet, storage 40,000 feet (Estim ated) Vibration 5-55-5 HZ, 0.38mm,1 minutes per cycle; 30 minutes for each axis (X,Y,Z) Shock N/A Electrical Specifications I NPUT [...]

APPENDIX B : TROUBLESHOOTING 105 Appendix B: Troubleshooting Raritan wants to be involved from the beginning of your deployment and throughout the entire lifetime of your use of Raritan products. We have identified the fol lowing as the three pillars on which the success of your deployment rests: • Your network – Understanding an d maintaining [...]

106 COMMANDCENTER NOC ADMINISTRATOR GUIDE Checking Appliance Database Settings From time to time, you may see this message: It is recommended you contact Technical Support, who can then request SSH access to yo ur appliance. You can allow this access and open an SSH connection by clicking the establish support connection button. Opening the connect[...]

APPENDIX B : TROUBLESHOOTING 107 Capability Scanning The capability scanning service scans individual no des to discover which services are supported on that node. It uses an intelligent service discovery mechanism and relies heavily upon communication over the TCP protocol (and sometimes UDP). In its initial state, the capability scanning service [...]

108 COMMANDCENTER NOC ADMINISTRATOR GUIDE The notifications service does not generate any events; it only react s to them. It does, however, save its history in the database so that you can review past notifications. SNMP Data Collection The SNMP data collection service collects additi onal data from nodes that support SNMP. Just like the pollers, [...]

APPENDIX B : TROUBLESHOOTING 109 Your Network Understanding and maintaining your network is the key to success. The Raritan services will help you understand and troubleshoot yo ur network, as it relates to the CC-NOC. This chapter, however, is about troubleshooting the C C-NOC. Raritan Support Structure Before troubleshooting anything else, you sh[...]

110 COMMANDCENTER NOC ADMINISTRATOR GUIDE If you are confident that the CC-NOC can ping the node in question, the next step is to confirm that the CC-NOC has discovered a device correctly. Check the following things: If the ping was successful, the CC-NOC will generate a suspect node event. The text of the event will look like "A new node ( ho[...]

APPENDIX B : TROUBLESHOOTING 111 the Admin tab, Network Management , and Configure Pollers . For each service that responds during the intelligent service scan, the system will generate a “Node Gained Service” event. The text of this event will look like the following: The X service has been discovered on interface WWW.XXX.YYY.ZZZ Typically, th[...]

112 COMMANDCENTER NOC ADMINISTRATOR GUIDE Why Can’t My CC-NOC Manage X Service? ICMP - If a device respon ds to a "ping", which uses IC MP fo r its transport, the device w ill b e flagged as supporting ICMP and will be tested for ICMP availability on the standard polling interval. Microsoft Exchange - If a device is determined to suppor[...]

APPENDIX B : TROUBLESHOOTING 113 If a service successfully connects, but otherwise "fails", a "service unresponsive" event is generated. An example of this would be a poller sends a TCP connect request… and gets a connecting, but within the “timeout” period there is no response. Thus, the Service is “up”, but it is not[...]

114 COMMANDCENTER NOC ADMINISTRATOR GUIDE The Management group receives notifications for any default notifications sent to the Network/Systems, Windows Management, or Secu rity groups. Any notification sent to these groups is given, by default, a 15 m inute window for acknowledgement. The Reporting group receives the Availability and Ou tage repor[...]

APPENDIX B : TROUBLESHOOTING 115 Of these five, Raritan only uses three: • GET - A message sent from the Manager to the Agent requesting information • GET RESPONSE – The message the Agent sends to the Manager in reply to a GET transaction, and • TRAP – An unsolicited message from an Agen t to the Manager advising the Manager of some abnor[...]

116 COMMANDCENTER NOC ADMINISTRATOR GUIDE In most cases, if the CC-NOC is not col lecting data from a particular device, it’s usually because of a misconfiguration on the rem o te device. Often, incorrect community strings are the culprit, or the SNMP service has not been turn ed on or configured correctly. There are several ways you can test the[...]

APPENDIX B : TROUBLESHOOTING 117 from the CC-NOC to the device and that TC P and UDP are working. If you have already performed the troubleshooting steps for Pollers a nd Capability Scanning on the node in question, you have adequately tested this. If you are ha ving tr ouble with vulnerability scanning, try the troubleshooting steps below: 1. If y[...]

118 COMMANDCENTER NOC ADMINISTRATOR GUIDE SNMP, used for collection performance dat a for re porting, is still considered a service and a s s uch , if a poll fails, it will still generate an outage that is integrated with the notification system. To determine if an interface supports SNMP, ch eck the appropriate Interface page for that node. To fin[...]

APPENDIX B : TROUBLESHOOTING 119 • If you are a reseller seeking technical resources, please send an email to tech@raritan.com . • For technical support, call the number as stated in the front of this document. Note that Technical Support is intended to provide resellers and customers with technical assistance if necessary. All callers will be [...]

120 COMMANDCENTER NOC ADMINISTRATOR GUIDE[...]

APPENDIX C : PERFORMANCE MONITORING 121 Appendix C: Performance Monitoring Overview The CC-NOC is designed to provide you with the information necessary to support critical decisions in your environment. Depending on your role, the nature of those decisions may be different, from a help desk technician analyz ing memory usage on a CC -NOC t o de te[...]

122 COMMANDCENTER NOC ADMINISTRATOR GUIDE Equipment Vendor Device Type Metric(s) Relevance All Any device supporting MIB2 (RF 1213) In/Out Octets In/Out Discards In/Out Errors Provides basic information on the network traffic that an interface has transmitted/received. All Linux or Unix variants running Net-SNMP Drive Size & Utilization (1)Syst[...]

APPENDIX C : PERFORMANCE MONITORING 123 Checkpoint Firewall products State information stored Process Contexts Allocated storage CPU Utilization Packets accepted Packets rejected Packets dropped Packets logged This information is critical for the firewall administrator making sizing or upgrade decisions on firewalls. A device that must maintain bot[...]

124 COMMANDCENTER NOC ADMINISTRATOR GUIDE Cisco Network gear CPU Utilization Free Memory Buffer failures Buffer memory allocation failures Provides insight as to router sizing and performance, especially as augmented by MIB2 data. Bay/Wellfleet Routers/Switches Total kernel tasks Total kernel tasks in queue Free memory Free buffers Provides key siz[...]

APPENDIX C : PERFORMANCE MONITORING 125 Memory In Use Free Physical Memory Total Logical Memory Logical Memory In Use Percent Logical Memory In Use Free Logical Memory Memory Pages per Second 1 underpowered devices. Processor (CPU) Total Processor Time Processor Queue Length 1 Interrupts per Second 1 Microsoft summarizes the usage of all processors[...]

126 COMMANDCENTER NOC ADMINISTRATOR GUIDE on demand. The remaining item is determining when performance metrics have reached a point at which they should be acted upon. And with th e CC-NOC’s capability of managing performance thresholds, that’s easy too! Thresholding An exciting new feature significantly improved with the CC-NOC is threshold a[...]

APPENDIX C : PERFORMANCE MONITORING 127 Example Here’s an example. There is a high thr eshold set with a value of 70, a trigger of 3, and a rearm of 55. A new value is generated every minute. The first reported value is 65, which is less than our high threshold of 70, so no action is taken. The next poll is 72. This is above 70, so t he trigger i[...]

128 COMMANDCENTER NOC ADMINISTRATOR GUIDE Windows Performance Metric Thresholds The following values apply to data reported by Windows boxes. Note that there are separate events for Workstations and Server s – this is due to what data points Microsoft reveals. The event associated with a reported value violating a th reshold is “High Thres hold[...]

APPENDIX D : SETTING UP WMI ON TARGET MACHI NES 129 Appendix D: Setting up WMI on Target Machines Configuring a Windows 98/ ME box for Remote WMI Management The ability of the CC-NOC to manage Windows 98 and Windows ME systems is lim ited by the design of the Windows platform . Windows 98 and ME are consumer operating systems and are not as feature[...]

130 COMMANDCENTER NOC ADMINISTRATOR GUIDE 3. Add the machine to the domain using t he cont rol panel, network settings by doing the following: • Start->Settings->Control Panel->Network. • Select Client for Microsoft Networks from the tab. • Click on the tab named Properties . • Check the box for Log on to Windows NT Domain and spec[...]

APPENDIX D : SETTING UP WMI ON TARGET MACHI NES 131 Note: Using Windows 98/ME, XP Home, or any NT 4. 0 system is not recommended or supported as a proxy system. Additionally, although Servers ar e supported, it is not adv isable to utilize them as your proxy due to error logging issues. To enable a Windows proxy system for the CC-NOC, Raritan provi[...]

132 COMMANDCENTER NOC ADMINISTRATOR GUIDE[...]

APPENDIX E : MANAGING AND RESPONDING TO INT RUSION DETECTION EVENT S 133 Appendix E: Managing and Responding to Intrusion Detection Events This appendix is intende d to provide a little insight as to how Raritan goes about assessing the traffic that the CC-NOC sees, determining what constitutes an event, and in turn, what that event should mean to [...]

134 COMMANDCENTER NOC ADMINISTRATOR GUIDE as to whether or not new signatures should be applied to a given CC-NOC. This reduces your workload, while automating the most difficult part of intrusion detection—keeping it u p-to-date. Responding to Events and Notifications Once you’ve used the Signature Profiler to build a model of your network and[...]

APPENDIX E : MANAGING AND RESPONDING TO INT RUSION DETECTION EVENT S 135 • Are all of your systems at the most recent revision of operating system and patch • level? Patches and hot-fixes are extremel y important for Microsoft platforms. • Have my network platforms been upgraded to avoid unnecessary risks? SNMP, if • leaked to the outside w[...]

136 COMMANDCENTER NOC ADMINISTRATOR GUIDE[...]

APPENDIX F : NOTIFICATION PARAMETERS 137 Appendix F: Notification Parameters Notification Parameter Substitution The notification subsystem is very robust and flexible, allowing the appropriate notification of the appropriate personnel at the appropriate ti me. One feature yo u have control over is the content of the notification message. You can i[...]

138 COMMANDCENTER NOC ADMINISTRATOR GUIDE %event[parm[name]]% replaced by the valu e of the parameter named 'name', if p resen t %event[parm[##]]% replaced by the total number of parameters %event[parm[#]]% replaced by the value of the parameter number '#', if p resen t Assets: The format of an asset para meter is simply %ass et[...]

APPENDIX G : NETWORK TRAFFIC OV ERHEAD : NETWORK MANAGE MENT ’ S NECESSARY EVIL 139 Appendix G: Network Tr affic Overhead: Network Management’s Necessary Evil On five-minute intervals, the CC -NOC polls services on managed nodes using Raritan's 's yn th eti c transactions'. These transactions serve to better t est the service&apo[...]

140 COMMANDCENTER NOC ADMINISTRATOR GUIDE CK-ACK three-way handshake, which when comple ted, indicates that the por t is listening and accepting connections. This handshake is a pre-cu rsor to any TCP session and is also embedde d within most other sy nthetic transaction s, including HTTP, which we'll discuss late r. In the case of this node: [...]

APPENDIX G : NETWORK TRAFFIC OV ERHEAD : NETWORK MANAGE MENT ’ S NECESSARY EVIL 141 host, and an additional five metrics per managed interface. The host used in this example has two interfaces, so the results reflect metrics f or a se cond interface as well as the de facto first interface. The traffic generated by the data collection process, in [...]

142 COMMANDCENTER NOC ADMINISTRATOR GUIDE In addition to polling overhead, our services scan wi ll run less than once a day and gen erate traffi c roughly equivalent to a single po lling interval. If vuln erability scanning is en ab le d, th e CC -N OC will also generate the traffic associated with comp leting those tests. Benchmarks as to those te[...]

APPENDIX G : NETWORK TRAFFIC OV ERHEAD : NETWORK MANAGE MENT ’ S NECESSARY EVIL 143 255-80-5301-00[...]

World Headquarters Raritan Computer, Inc. 400 Cottontail Lane Somerset, NJ 08873 USA Tel. (732) 764-8886 Fax (732) 764-8887 Email: sales@raritan.com www.raritan.com Rari t an OEM Di visio n Peppercon USA, Inc. 111 E. Wacker Dr, Suite 2626 Chicago, IL 60601 Tel. (847) 466-1392 Fax (312) 729-1375 Email: info@ pepperc on.c om www.peppercon.com Asia Pa[...]