Cisco C220 M3 Manual

Server Setup
This chapter provides instructions for setting up the server. It includes the following topics:
•Connect Power Supplies and KVM Adapter, on page 1
•Network Interface Connections Setup, on page 1
•Network Interface Setup Diagram, on page 4
•Firewall Rules, on page 5
•Power On and Boot Up Appliance, on page 8
Connect Power Supplies and KVM Adapter
To begin, connect both power supplies on the back of your appliance. Connect the included KVM adapter to
an external monitor and keyboard, and plug into the KVM port located at the front of the server, as illustrated
in Figure 3.
If CIMC is configured, you can use a remote KVM. See CIMC Configuration.
Refer to the server product documentation for detailed hardware and environmental setup information (See
Product Documentation).
Network Interface Connections Setup
The SFP+ modules must be connected to the chassis before the appliance is powered on for the session in
which the configuration wizard is going to be run. However, wiring the SFP up to the network can be done
between power on and configuration.
For Threat Grid Appliance (version 2.7.2 or later), only the Threat Grid M5 Appliance is supported. Refer to
the Cisco Threat Grid M5 Appliance Hardware Installation Guide for server setup instructions.
Note
C220 M3 Rack Server Setup
The interfaces must be properly connected and configured for the appliance to operate.
Server Setup
1

The details for your appliance may differ from the illustrations. Contact [email protected] if you
have any questions.
Note
Find the two SFP+ ports and three Ethernet ports on the back of the appliance and attach the network cables
as illustrated in Figure 4.
Reserved is the non-Admin SFP+ port that is reserved for future use.
Figure 1: Cisco UCS C220 M3 SFF Rack Server
Figure 2: Cisco UCS C220 M3 Rear View Details
Server Setup
2
Server Setup
C220 M3 Rack Server Setup

For releases 1.0-1.2 a reboot may be needed if an interface was not plugged in at boot time. This is a pre-1.3
issue, except for any interface requiring an SFP, which will still needs to be plugged in at boot time post 1.3.
The network cable plugged into the SFP may be safely hot-plugged.
Note
C220 M4 Rack Server Setup
The interfaces must be properly connected and configured for the appliance to operate.
Use port 3 Slot 2 for the (optional) Clust interface.
The details for your appliance may differ from the illustrations. Contact [email protected] if you
have any questions.
Note
Figure 3: Cisco UCS C220 M4 SFF Rack Server
Server Setup
3
Server Setup
C220 M4 Rack Server Setup

Figure 4: CIsco UCS C220 M4 Rear View Details
Connections:
•1Admin, Clust
•8(left) Clean
•8(right) Dirty
•6CIMC
Network Interface Setup Diagram
This section describes the most logical and recommended setup for a Threat Grid Appliance. However, each
customer's interface setup is different. Depending on your network requirements, you may decide to connect
the Dirty interface to the inside, or the Clean interface to the outside with appropriate network security measures
in place, for example.
Server Setup
4
Server Setup
Network Interface Setup Diagram

Figure 5: Network Interfaces Setup Diagram
In Threat Grid Appliance (v2.7.2 and later), there is also the enable_clean_interface option, which is disabled
by default. This option (after applying configuration and rebooting) enables access to the administrative
interface on port 8443 of the assigned clean IP.
Note
Firewall Rules
This section provides suggested firewall rules.
Implementing a restrictive outgoing policy on the Dirty interface for ports 22 and 19791 requires tracking
updates over time and spending more time maintaining the firewall. See the required destinations in the
configuration sections.
Note
Using IPv4LL address space (168.254.0.16) for the Dirty interface is NOT supported.
Note
Server Setup
5
Server Setup
Firewall Rules

Dirty Interface Outbout
NoteActionPortProtocolDestinationSource
Allow outbound traffic from
samples. (To get accurate
results it is required that
malware be allowed to contact
its command and control
server using whatever port and
protocol it is designed to use.)
AllowANYANYInternetDirty
Interface
Dirty Interface Inbound
NoteActionPortProtocolDestinationSource
Deny all incoming
connections.
DenyANYANYDirty InternetANY
Clean Interface Outbound
NoteActionPortProtocolDestinationSource
The appliance uses the clean
interface to initiate SMTP
connections to the configured
mail server.
Allow25TCPSMTP ServersClean
Interface
Clean Interface Outbound (Optional)
NoteActionPortProtocolDestinationSource
Optional, only required if
Clean DNS is configured.
Allow53TCP/UDPCorporate DNS
Server
Clean
Interface
Optional, only required if
AMP for Endpoints Private
Cloud integration is used.
Allow443TCPAMP Private CloudClean
Interface
Allow connectivity to server
designated to receive Syslog
messages and Threat Grid
notifications.
Allow514UDPSyslog ServersClean
Interface
Optional, only required if
LDAP is configured.
Allow389TCP/UDPLDAP ServersClean
Interface
Optional, only required if
LDAP is configured.
Allow636TCPLDAP ServersCean
Interface
Server Setup
6
Server Setup
Firewall Rules

Clean Interface Inbound
NoteActionPortProtocolDestinationSource
Allow SSH conectivity to the
tgsh-dialog.
Allow22TCPClean InterfaceUser Subnet
Appliance API and Threat
Grid user interface. This will
redirect to HTTPS TCP/443.
Allow80TCPClean InterfaceUser Subnet
Appliance API and Threat
Grid user interface.
Allow443TCPClean InterfaceUser Subnet
Allow connectivity to the
Threat Grid UI Glovebox.
Allow9443TCPClean InterfaceUser Subnet
Admin Interface Outbound (Optional)
The following depends on what services are configured.
NoteActionPortProtocolDestinationSource
Optional, only required if
Threat Grid appliance is
configured to send backups to
an NFSv4 share.
Allow2049TCPNFSv4 ServerAdmin
Interface
Admin Interface Inbound
NoteActionPortProtocolDestinationSource
Allow SSH connectivity to the
TGSH Dialog.
Allow22TCPAdmin InterfaceAdmin
Subnet
Allow Access to the OpAdmin
Portal interface. This will
redirect to HTTPS TCP/443.
Allow80TCPAdmin InterfaceAdmin
Subnet
Allow Access to the OpAdmin
Portal interface.
Allow443TCPAdmin InterfaceAdmin
Subnet
Dirty Interface for Non Cisco-Validated/Recommended Deployment
NoteActionPortProtocolDestinationSource
Update, support snapshot, and
licensing services.
Allow22TCPInternetDirty
Interface
Allow outbound DNS.Allow53TCP/UDPInternetDirty
Interface
Allow outbound NTP.Allow123UDPInternetDirty
Interface
Server Setup
7
Server Setup
Firewall Rules

NoteActionPortProtocolDestinationSource
Allow connectivity to Threat
Grid support.
Allow19791TCPInternetDirty
Interface
Connect with third-party
detection and enrichment
services.
Allow443TCPCisco UmbrellaDirty
Interface
Connect with third-party
detection and enrichment
services.
Allow443TCPVirusTotalDirty
Interface
Connect with third-party
detection and enrichment
services.
Allow443TCPTitaniumCloudDirty
Interface
Power On and Boot Up Appliance
Once you have connected the server peripherals, network interfaces, and power cables, turn on the appliance
and wait for it to boot up. The Cisco screen is briefly displayed.
Figure 6: Cisco Screen During Bootup
If you want to configure this interface, press F8 after the memory check is completed and follow the instructions
in CIMC Configuration.
Note
Server Setup
8
Server Setup
Power On and Boot Up Appliance

The TGSH Dialog is displayed on the console when the server has successfully booted up and connected.
Figure 7: TGSH Dialog
The Admin URL shows as unavailable because the network interface connections are not yet configured and
the OpAdmin Portal cannot be reached yet to perform this task.
The TGSH Dialog displays the initial administrator Password, which will be needed to access and configure
the OpAdmin Portal interface later in the configuration. Make a note of the Password in a separate text file
(copy and paste).
Important
Server Setup
9
Server Setup
Power On and Boot Up Appliance

Server Setup
10
Server Setup
Power On and Boot Up Appliance