Dell PowerEdge R640XL User manual

Security Analytics Gen14 Dell Hardware
Configuration Guide
18 Dec 2020

Broadcom, the pulse logo, Connecting everything, and Symantec are among the trademarks of Broadcom.
Copyright © 2020 Broadcom. All Rights Reserved.
The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. For more information, please visit www.broadcom.com.
Broadcom reserves the right to make changes without further notice to any products or data herein to improve reliability,
function, or design. Information furnished by Broadcom is believed to be accurate and reliable. However, Broadcom does
not assume any liability arising out of the application or use of this information, nor the application or use of any product or
circuit described herein, neither does it convey any license under its patent rights nor the rights of others.
Security Analytics Gen14 Dell Hardware
Configuration Guide
18 Dec 2020
2

Gen14 Dell Hardware
3
Security Analytics
Configuration Guide
Table of Contents
Chapter 1: Introduction ...................................................................................................................... 4
About This Guide .............................................................................................................................................................4
Requirements ...................................................................................................................................................................4
Prerequisites (Before Using This Configuration Guide) ..............................................................................................5
Where to Go for Help .......................................................................................................................................................5
Server I/O Configuration..................................................................................................................................................6
Storage Array I/O Configuration .....................................................................................................................................6
Security Analytics Systems ............................................................................................................................................8
Chapter 2: Connect the Storage Arrays ........................................................................................... 9
Cabling for Small Sensor Systems.................................................................................................................................9
Cabling for Large Sensor Systems ..............................................................................................................................12
Chapter 3: First-time Power On and Initialization .......................................................................... 18
Powering On Sensor Systems ......................................................................................................................................18
Configure the Server’s iDRAC Port ..............................................................................................................................18
Initialize and License the Server...................................................................................................................................19
Configure Network Settings for the Storage Array .....................................................................................................20
Chapter 4: Disk Array Configuration .............................................................................................. 21
Clear Disk Arrays on the Storage Array.......................................................................................................................21
Configure Capture and Indexing Filesystems .............................................................................................................24

Gen14 Dell Hardware
4
Security Analytics
Configuration Guide
Chapter 1: Introduction
About This Guide
This guide documents how to install Security Analytics on Gen14 Dell hardware—to a SA-SRVG8-20 or SA-SRVG8-40
server as a standalone Central Manager (CM), or as a Sensor connected to SA-STAG8-2U144 or SA-STAG8-5U840 storage
arrays and SA-STXG8-2X144 expansion enclosures.
For other hardware configurations, consult the appropriate configuration guide, available from techdocs.broadcom.com:
Security Analytics Configuration Guide for SA-S500 Series
Security Analytics Configuration Guide for Gen13 Dell Hardware
Security Analytics Configuration Guide for Gen12 Dell Hardware
WARNING! You cannot combine Gen14 Dell hardware with Gen12 or Gen13 Dell hardware, or with SA-S500 Series servers.
The Gen14 Dell hardware documented in this guide should only be used as indicated with the specified Symantec models.
Requirements
The Security Analytics systems documented in this guide require the following:
Server
– Symantec SA-SRVG8-20 (Dell PowerEdge R640XL)
– Symantec SA-SRVG8-40 (Dell PowerEdge R640XL)
Optional storage:
– SA-STAG8-2U144 storage array (Dell PowerVault ME4012)
– SA-STAG8-5U840 storage array (Dell PowerVault ME4084)
– SA-STXG8-2X144 expansion enclosure (Dell PowerVault ME412)
Security Analytics 8.1.3 or later with license key
VGA or serial monitor and cable
USB keyboard
Category 6A network cables for 10GBase-T operation
Management workstation with Ethernet connectivity

Gen14 Dell Hardware
5
Security Analytics
Configuration Guide
Prerequisites (Before Using This Configuration Guide)
Before attempting to configure a Security Analytics system with Gen14 Dell hardware, make sure to first complete the
following quick start guides for your server and storage array.
1. Complete the following steps to install the SA-SRVG8-20 or SA-SRVG8-20 server, per the instructions in the
SA Gen14 Dell Server Quick Start Guide, available at: techdocs.broadcom.com
Unpack the server.
Rackmount the server.
Install the Cable Management Arm (CMA).
Connect cables.
Perform the initial configuration.
License the server.
2. Complete the following steps to install the SA-STAG8-2U144 or SA-STAG8-5U840 storage array, per the instructions in
the SA Gen14 Dell Storage Quick Start Guide, available at: techdocs.broadcom.com
Unpack the storage array.modu
Rackmount the storage array.
Install drives in the SA-STAG8-5U840storage array.
Connect cables.
Power on the system.
Configure network settings for the storage array.
Where to Go for Help
Symantec Technical Support
For Symantec Technical Support, case management, licenses, and product downloads, go to:
support.broadcom.com/security
Security Analytics Help and Documentation
For Security Analytics help, in the web UI, select Settings > Help > [language].
For Security Analytics software documentation, go to techdocs.broadcom.com and type “Security” in the search field,
then click Security Analytics.
Appliance Documentation
For Symantec server and storage array documentation, go to techdocs.broadcom.com and type “Appliances” in the
search field, then click Hardware Appliances.
For Dell PowerEdge server documentation, go to dell.com/poweredgemanuals and navigate to your server model
(PowerEdge R640).
For Dell PowerVault storage documentation, go to dell.com/storagemanuals and navigate to your storage array model
(PowerVault ME4012, ME4084, or ME412).

Gen14 Dell Hardware
6
Security Analytics
Configuration Guide
Server I/O Configuration
The following servers can be used as a standalone Central Manager (CM) or as a Sensor connected to storage arrays. They
include the following iDRAC, MGMT, Ethernet (LAN), and RAID controller (SAS) ports.
Storage Array I/O Configuration
The following storage arrays can be used in Sensor Systems. They include the following MGMT and SAS ports.
SA-SRVG8-20 Server Rear Panel
SA-SRVG8-40 Server Rear Panel
SA-STAG8-2U144 Storage Array Rear Panel

Gen14 Dell Hardware
7
Security Analytics
Configuration Guide
SA-STAG8-5U840 Storage Array Rear Panel
SA-STXG8-2X144 Expansion Enclosure Rear Panel

Gen14 Dell Hardware
8
Security Analytics
Configuration Guide
Security Analytics Systems
The following Security Analytics systems (8.1.3 or later) are supported with the specified Gen14 Dell hardware.
NOTE: Central Manager (CM) servers do not require external storage.
CM or Sensor / Space Storage Array / Space Expansion Enclosure / Space Network
Central
Manager
1(1) SA-SRVG8-20 12TB – – – – 10/1GbE
2(1) SA-SRVG8-40 12TB – – – – 10/1GbE,
25/10/1GbE
Small
Sensor
1(1) SA-SRVG8-20 12TB (1) SA-STAG8-2U144 144TB – – 10/1GbE
2(1) SA-SRVG8-20 12TB (1) SA-STAG8-2U144 144TB (1–3) SA-STXG8-2X144 144TB–
432TB
10/1GbE
3(1) SA-SRVG8-20 12TB (1) SA-STAG8-5U840 840TB – – 10/1GbE
Large
Sensor
1(1) SA-SRVG8-40 12TB (1) SA-STAG8-2U144 144TB – – 10/1GbE,
25/10/1GbE
2(1) SA-SRVG8-40 12TB (1) SA-STAG8-2U144 144TB (1–3) SA-STXG8-2X144 144TB-
432TB
10/1GbE,
25/10/1GbE
3(1) SA-SRVG8-40 12TB (1) SA-STAG8-5U840 840TB – – 10/1GbE,
25/10/1GbE
4(1) SA-SRVG8-40 12TB (2) SA-STAG8-2U144 288TB – – 10/1GbE,
25/10/1GbE
5(1) SA-SRVG8-40 12TB (2) SA-STAG8-2U144 288TB (1–3) SA-STXG8-2X144 144TB-
432TB
10/1GbE,
25/10/1GbE
6(1) SA-SRVG8-40 12TB (2) SA-STAG8-5U840 1680TB – – 10/1GbE,
25/10/1GbE
Security Analytics Systems for Dell Gen14 Hardware

Gen14 Dell Hardware
9
Security Analytics
Configuration Guide
Chapter 2: Connect the Storage Arrays
If you are configuring a Sensor System, all servers, storage arrays, and expansion enclosures must be connected before
powering on the system and configuring disk arrays. Before connecting cables, make sure that all severs, storage arrays,
and expansion enclosures have been rackmounted and powered off. For SAS connections, use the 12Gb HD-Mini to HD-
Mini SAS cables included with the storage array, or equivalent.
Cabling for Small Sensor Systems
Security Analytics Small Sensor Systems include the following.
Small Sensor System #1—(1) SA-SRVG8-20, (1) SA-STAG8-2U144.
Small Sensor System #2—(1) SA-SRVG8-20, (1) SA-STAG8-2U144, (1–3) SA-STXG8-2X144.
Small Sensor System #3—(1) SA-SRVG8-20, (1) SA-STAG8-5U840.
Small Sensor System #1
SAS cabling for the Small Sensor System #1 is as follows:
(1) SA-SRVG8-20 + (1) SA-STAG8-2U144
Server SA-SRVG8-20 Sensor SA-STAG8-2U144 Storage Array
RAID Controller Port Controller Module Port
Slot 1 SAS 0 A (Top) SAS 0
Slot 1 SAS 1 B (Btm) SAS 0
Cabling Guide for Small Sensor System #1

Gen14 Dell Hardware
10
Security Analytics
Configuration Guide
Small Sensor System #2
SAS cabling for the Small Sensor System #2 is as follows:
(1) SA-SRVG8-20 + (1) SA-STAG8-2U144 + (1–3) SA-STXG8-2X144
SA-SRVG8-20 Sensor
SA-STAG8-2U144
Storage Array
SA-STXG8-2X144
Expansion Enclosure (Up to 3)
RAID Cont Port Cont Mod Port Cont Mod Port Cont Mod Port Cont Mod Port
Slot 1 SAS 0 A (Top) SAS 0
Slot 1 SAS 1 B (Btm) SAS 0
A (Top) SAS Exp A (Top) SAS A
B (Btm) SAS Exp B (Btm) SAS C
A (Top) SAS C A (Top) SAS A
B (Btm) SAS C B (Btm) SAS A
A (Top) SAS C A (Top) SAS A
B (Btm) SAS C B (Btm) SAS A
Cabling Guide for Small Sensor System #2

Gen14 Dell Hardware
11
Security Analytics
Configuration Guide
Small Sensor System #3
SAS cabling for the Small Sensor System #3 is as follows:
(1) SA-SRVG8-20 + (1) SA-STAG8-5U840
Server SA-SRVG8-20 Sensor SA-STAG8-5U840 Storage Array
RAID Controller Port Controller Module Port
Slot 1 SAS 0 A (Left) SAS 0
Slot 1 SAS 1 B (Right) SAS 0
Cabling Guide for Small Sensor System #3

Gen14 Dell Hardware
12
Security Analytics
Configuration Guide
Cabling for Large Sensor Systems
The Security Analytics Large Sensor Systems include the following.
Large Sensor System #1—(1) SA-SRVG8-40, (1) SA-STAG8-2U144.
Large Sensor System #2—(1) SA-SRVG8-40, (1) SA-STAG8-2U144, (1–3) SA-STAG8-2U144.
Large Sensor System #3—(1) SA-SRVG8-40, (1) SA-STAG8-5U840.
Large Sensor System #4—(1) SA-SRVG8-40, (2) SA-STAG8-2U144.
Large Sensor System #5—(1) SA-SRVG8-40, (2) SA-STAG8-2U144, (1–3) SA-STXG8-2X144.
Large Sensor System #6—(1) SA-SRVG8-40, (2) SA-STAG8-5U840.
Large Sensor System #1
SAS cabling for the Large Sensor System #1 is as follows:
(1) SA-SRVG8-40 + (1) SA-STAG8-2U144
SA-SRVG8-40 Sensor SA-STAG8-2U144 Storage Array
RAID Controller Port Controller Module Port
Slot 1 SAS 0 A (Left) SAS 0
Slot 1 SAS 1 B (Right) SAS 0
Slot 3 SAS 0 A (Left) SAS 1
Slot 3 SAS 1 B (Right) SAS 1
Cabling Guide for Large Sensor System #1

Gen14 Dell Hardware
13
Security Analytics
Configuration Guide
Large Sensor System #2
SAS cabling for the Large Sensor System #2 is as follows:
(1) SA-SRVG8-40 + (1) SA-STAG8-2U144 + (1–3) SA-STXG8-2X144
SA-SRVG8-40 Sensor
SA-STAG8-2U144
Storage Array
SA-STXG8-2X144
Expansion Enclosures (Up to 3)
RAID Cont Port Cont Mod Port Cont Mod Port Cont Mod Port Cont Mod Port
Slot 1 SAS 0 A (Top) SAS 0
Slot 1 SAS 1 B (Btm) SAS 0
Slot 3 SAS 0 A (Top) SAS 1
Slot 3 SAS 1 B (Btm) SAS 1
A (Top) SAS EXP A (Top) SAS A
B (Btm) SAS EXP B (Btm) SAS C
A (Top) SAS C A (Top) SAS A
B (Btm) SAS C B (Btm) SAS A
A (Top) SAS C A (Top) SAS A
B (Btm) SAS C B (Btm) SAS A
Cabling Guide for Large Sensor System #2

Gen14 Dell Hardware
14
Security Analytics
Configuration Guide
Large Sensor System #3
SAS cabling for the Large Sensor System #3 is as follows:
(1) SA-SRVG8-40 + (1) SA-STAG8-5U840
Server SA-SRVG8-40 Sensor SA-STAG8-5U840 Storage Array
RAID Controller Port Controller Module Port
Slot 1 SAS 0 A (Left) SAS 0
Slot 1 SAS 1 B (Right) SAS 0
Slot 3 SAS 0 A (Left) SAS 1
Slot 3 SAS 1 B (Right) SAS 1
Cabling Guide for Large Sensor System #3

Gen14 Dell Hardware
15
Security Analytics
Configuration Guide
Large Sensor System #4
SAS cabling for the Large Sensor System #4 is as follows:
(1) SA-SRVG8-40 + (2) SA-STAG8-2U144
SA-SRVG8-40 Sensor
SA-STAG8-2U144
Storage Array
SA-STAG8-2U144
Expansion Enclosure
RAID Cont Port Cont Mod Port Cont Mod Port
Slot 1 SAS 0 A (Top) SAS 0
Slot 1 SAS 1 B (Btm) SAS 0
Slot 3 SAS 0 A (Top) SAS 0
Slot 3 SAS 1 B (Btm) SAS 0
Cabling Guide for Large Sensor System #4

Gen14 Dell Hardware
16
Security Analytics
Configuration Guide
Large Sensor System #5
SAS cabling for the Large Sensor System #5 is as follows:
(1) SA-SRVG8-40 + (2) SA-STAG8-2U144 + (1–3) SA-STXG8-2X144
SA-SRVG8-40
Sensor
SA-STAG8-2U144
Storage Array
SA-STAG8-2U144
Storage Array
SA-STXG8-2X144
Expansion Enclosure (Up to 3)
RAID Cont Port Cont Mod Port Cont Mod Port Cont Mod Port Cont Mod Port Cont Mod Port
Slot 1 SAS 0 A (Top) SAS 0
Slot 1 SAS 1 B (Btm) SAS 0
A (Top) SAS EXP A (Top) SAS A
B (Btm) SAS EXP B (Btm) SAS C
A (Top) SAS C A (Top) SAS A
B (Btm) SAS C B (Btm) SAS A
Slot 3 SAS 0 A (Top) SAS 0
Slot 3 SAS 1 B (Btm) SAS 0
A (Top) SAS EXP A (Top) SAS A
B (Btm) SAS EXP B (Btm) SAS C
Cabling Guide for Large Sensor System #5

Gen14 Dell Hardware
17
Security Analytics
Configuration Guide
Large Sensor System #6
SAS cabling for the Large Sensor System #6 is as follows:
(1) SA-SRVG8-40 + (2) SA-STAG8-5U840
SA-SRVG8-40 Sensor SA-STAG8-5U840 Storage Array SA-STAG8-5U840 Storage Array
RAID Cont Port Cont Module Port Cont Module Port
Slot 1 SAS 0 A (Left) SAS 0
Slot 1 SAS 1 B (Right) SAS 0
Slot 3 SAS 0 A (Left) SAS 0
Slot 3 SAS 1 B (Right) SAS 0
Cabling Guide for Large Sensor System #6

Gen14 Dell Hardware
18
Security Analytics
Configuration Guide
Chapter 3: First-time Power On and Initialization
NOTE: Security Analytics 8.1.3 or later is required when using Gen14 Dell servers and storage arrays.
Powering On Sensor Systems
When powering on Sensor Systems, make sure that components are powered on in the following order:
3. Power on any expansion enclosures ( SA-STXG8-2X144) . Wait until the expansion enclosures’ drive lights are lit (solid)
before proceeding.
4. Power on the storage arrays ( SA-STAG8-2U144 or SA-STAG8-5U840) . Wait until storage arrays’ drive lights the are lit (solid)
before proceeding.
5. Power on the Sensor ( SA-SRVG8-20 or SA-SRVG8-40).
6. Once all components are powered on, verify the following:
For the SA-STAG8-2U144 and SA-STXG8-2X144, the System Power LED turns green.
For the SA-STAG8-5U840, the Power On/Standby LED turns green.
Configure the Server’s iDRAC Port
The iDRAC port alerts administrators about issues with the server appliance (SA-SRVG8-20 and SA-SRVG8-40) and
provides remote management, thereby reducing the need for physical access to the server. The iDRAC port should be
configured when first booting the server.
To configure the server’s iDRAC port:
1. When the server boots, look for following menu screen:
F2 = System Setup
F10 = Lifecycle Controller
F11 = BIOS Boot Manager
F12 = PXE Boot
2. Press F2 to enter the system setup.
3. On the System Setup Main Menu, select iDRAC Settings.On the System Setup Main Menu, select iDRAC Settings.
4. Configure the following iDRAC settings:
Page Attribute Value
Network Settings Enable NIC Enabled
NIC Selection Dedicated
Failover Network None
Enable DHCP (as desired)
IP Address (as desired)
Gateway (as desired)

Gen14 Dell Hardware
19
Security Analytics
Configuration Guide
NOTE: If you choose to enable DHCP, it is recommended that you use the DHCP reservation feature of your DHCP server
to statically map the MAC address of the iDRAC interface to an IP address.
5. In the lower right, click Finish and follow the on-screen prompts to save and exit the System Setup page.
Initialize and License the Server
The server appliance ( SA-SRVG8-20 or SA-SRVG8-40), as Central Manager (CM) or Sensor, must be initialized and licensed
before it can be used in a Security Analytics system. If this has already been done per the instructions on the Security
Analytics Gen14 Dell Server Quick Start Guide, it need not be done again.
Initialize the Server
If the server appliance ( SA-SRVG8-20 or SA-SRVG8-40) has not yet been initialized, perform the following steps:
1. Power on the server (if it is not already powered on). After several minutes, you are prompted to log in to the command-
line interface (CLI).
2. Using the connected USB keyboard, enter default credentials: admin | Solera
NOTE: You can also log in by connecting to the appliance’s MGMT 0:0 port with a laptop running SSH (via IP address
192.168.20.20).
3. Configure the management IP address, netmask, and gateway with the following CLI command, specifying the netmask
in dotted-decimal format (255.255.255.0):
sudo cfg_bond_interface.py -i eth0 -n <IP>/<netmask> -g <gateway>
4. When prompted, enter the sudo password: Solera
5. Open a browser, navigate to the address just specified, and log in with default credentials: admin | Solera
6. When prompted, accept the EULA.
7. Configure the Initial Settings page. For installation instructions, select Settings > Help.
8. Click Save. You are prompted to license the server.
License the Server
If the server ( SA-SRVG8-20 or SA-SRVG8-40) has not yet been licensed, perform the following steps:
1. After completing the initial configuration, you are prompted with the License Details dialog.
NOTE: You can also update or change an existing license. To do so, select Menu > Settings > About and then click
License Details.
2. Retrieve your license key from the Broadcom Support Portal (support.broadcom.com/security), as instructed in the
eFulfillment message from Broadcom.
3. If your server has Internet access, do the following:
User Configuration User Name (as desired)
Change Password (as desired)
Lifecycle Controller Collect System Inventory on Restart Disabled
Page Attribute Value

Gen14 Dell Hardware
20
Security Analytics
Configuration Guide
Under Retrieve License, enter the License Key and click Send Request.
If applicable, select the license type.
The server sends the license key and license seed file to the Symantec license server, which generates the license file
(license.tgz) and returns it to the server, which automatically reboots.
4. If your server does not have Internet access, do the following:
Click Download DS Seed to download the seed file (dsseed.tgz) to your workstation.
On a workstation with Internet access, go to: license.soleranetworks.com
Type the server’s license key, upload dsseed.tgz, and click Submit.
If applicable, select the license type and click Submit.
Save the license file (license.tgz) to the workstation.
Return to the License Details dialog, click Browse, and select license.tgz. The license is uploaded and the server
automatically reboots.
5. Once the server has rebooted, select About > License Details to verify the license.
6. Click Download to save an archive copy of the license file (license.tgz). Store this file in a secure location that is not on
the server.
Configure Network Settings for the Storage Array
Network settings for storage arrays must be configured before they can communicate with Sensors. If this has already been
done per the instructions on the Security Analytics Gen14 Dell Storage Quick Start Guide, it need not be done again. Network
settings for expansion enclosures do not need to be configured.
1. Connect an Ethernet cable to the storage array’s Network port on Controller A. Connect the other end of the cable to
a laptop with an IP address of 10.0.0.1/24 and a default gateway address of 10.0.0.2.
2. Open a browser and go to: https://10.0.0.2
3. Select the User Language and click Get Started.
4. Enter a Username and Password and click Apply and Continue. The Username will be required when configuring the
storage array’s disk and filesystem for Capture and Indexing.
5. When prompted with the Welcome screen, click System Settings.
6. Configure the Controller A settings for IP Address, IP Mask, and Gateway.
7. Configure the Controller B settings for IP Address, IP Mask, and Gateway.
8. Click Apply and Close and proceed to configuring the storage array from the Security Analytics server’s CLI.