Dell MD1400-16TB User manual

NetWitness®Platform XDR
Version 12.1.0.0
PowerVault (Dell MD1400-16TB) Setup Guide

Contact Information
NetWitness Community at https://community.netwitness.com contains a knowledge base that
answers common questions and provides solutions to known problems, product documentation,
community discussions, and case management.
Trademarks
RSA Conference Logo, RSA, and other trademarks, are trademarks of RSA Security LLC or its
affiliates ("RSA"). For a list of RSA trademarks, go to https://www.rsa.com/en-us/company/rsa-
trademarks. Other trademarks are trademarks of their respective owners.
License Agreement
This software and the associated documentation are proprietary and confidential to RSA Security
LLC or its affiliates are furnished under license, and may be used and copied only in accordance
with the terms of such license and with the inclusion of the copyright notice below. This
software and the documentation, and any copies thereof, may not be provided or otherwise made
available to any other person. No title to or ownership of the software or documentation or any
intellectual property rights thereto is hereby transferred. Any unauthorized use or reproduction of
this software and the documentation may be subject to civil and/or criminal liability. This
software is subject to change without notice and should not be construed as a commitment by
RSA.
Third-Party Licenses
This product may include software developed by parties other than RSA. The text of the license
agreements applicable to third-party software in this product may be viewed on the product
documentation page on NetWitness Community. By using this product, a user of this product
agrees to be fully bound by terms of the license agreements.
Note on Encryption Technologies
This product may contain encryption technology. Many countries prohibit or restrict the use,
import, or export of encryption technologies, and current use, import, and export regulations
should be followed when using, importing or exporting this product.
Distribution
Use, copying, and distribution of any RSA Security LLC or its affiliates ("RSA") software
described in this publication requires an applicable software license.
RSA believes the information in this publication is accurate as of its publication date. The
information is subject to change without notice.
THE INFORMATION IN THIS PUBLICATION IS PROVIDED "AS IS." RSA MAKES NO
REPRESENTATIONS OR WARRANTIES OF ANY KIND WITH RESPECT TO THE
INFORMATION IN THIS PUBLICATION, AND SPECIFICALLY DISCLAIMS IMPLIED
WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
© 2020 RSA Security LLC or its affiliates. All Rights Reserved.
October 2022

Contents
About this Document 5
Hardware Description 6
High-Level Capacity Information 6
Enclosure Options 6
PowerVault Storage Enclosures Supported 7
Capability with NetWitness Platform Series 5 or 6 Hosts 8
Package Contents 8
Customer Supplied Materials 8
Front View of the PowerVault 9
PowerVault Front View Showing Drive Numbers 10
Rear View of the PowerVault 11
PowerVault Cable 12
DAC Cables 12
Monitoring PowerVault Through IDRAC 13
PowerVault Support by Host 13
Unencrypted PowerVaults 13
Encrypted PowerVaults 13
Install PowerVault without Encryption 15
Prerequisites 15
Introduction 16
Attach and Configure a PowerVault without Encryption 16
NetWitness Platform 11.5 and Later 16
Connect PowerVaults to a Concentrator, Archiver, Decoder, or Log Decoder Physical Host 17
Connect a PowerVault to a Hybrid 23
Install PowerVault with Encryption on a Series 6 R640 Host 25
Minimum NetWitness Platform Software Versions 25
Attach and Configure New PowerVault with Encryption 26
NetWitness Platform 11.5 and Later 26
Connect PowerVaults to an Archiver, Concentrator, Log Decoder, or (Network) Decoder
Host 26
Install PowerVaults and 15-Drive DACs on a Series 5 or Series 6 Host
(Mixed Mode) 30
Minimum NetWitness Platform Software Versions 30
Introduction 30
High-Level Procedure 31
NetWitness Platform 11.5 and Later 31

PowerVault (Dell MD1400 - 16TB) Setup Guide
Connect External Storage Devices to NetWitness Series 5 or Series 6 Archiver, Decoder, or Log
Decoder Hosts 32
Connect External Storage Devices to Series 5 (R630) 32
Connect External Storage Devices to Series 6 (R640) 34
Install PowerVault on Core Appliance Used as a Hybrid 37
Introduction 38
High-Level Procedure 38
NetWitness Platform 11.5 and Later 38
Connect PowerVaults to a Core Physical Host Used as a Hybrid 39
Revision History 43
4

PowerVault (Dell MD1400 - 16TB) Setup Guide
About this Document
This document provides instructions for installing a PowerVault external storage device on
NetWitnessSeries 5 and Series 6 (Network) Decoder, Log Decoder, Concentrator, Archiver, and
Hybrid hosts.
The hardware setup instructions in this document are for hardware only; they do not apply to a
specific release of NetWitness Platform software. This document is for new hardware only. It is
not intended for PowerVaults with preexisting data.
For NetWitness Platform 11.5 and later, use the hardware connection information in this guide,
but refer to Storage Guide for NetWitness Platform Version 11.5 and later for instructions on
how to allocate storage for your hardware.
Caution: If you are adding a previously used PowerVault and would like to preserve the data,
DO NOT follow the instructions in this guide. Contact Netwitness Customer Support. Running
the script on a previously used PowerVault could erase any existing data.
Note: When viewing a printed guide, be aware that a newer version of the guide may be
available online at NetWitness Link in NetWitness® Platform under Hardware Setup Guides:
https://community.netwitness.com/t5/netwitness-platform-hardware/series-6-hardware-setup-
guide/ta-p/572346
5 About this Document

PowerVault (Dell MD1400 - 16TB) Setup Guide
Hardware Description
The NetWitness PowerVault (Dell MD 1400) high capacity storage device is a drive array
enclosure powered by EMC/Dell. PowerVault is used to extend the usable storage on the
NetWitness Series 5 and Series 6 (Network) Decoder, Log Decoder, Concentrator, Archiver, and
Hybrid hosts.
High-Level Capacity Information
PowerVault:
lStores up to 192 TB for a single enclosure.
lAccommodates up to 12 hot-pluggable 3.5" and 2.5" drives (2.5" available with adapter).
lAllows you to daisy-chain eight PowerVaults (four enclosures per channel).
lProvides improved device monitoring and management.
lIs compatible with Dell OpenManage/iDRAC system management technology.
Enclosure Options
Type Host SKU Specification
High Density Network Decoder, Log Decoder,
Archiver, Log Hybrid, Network
Hybrid
192TB
(NW-
PV-A-N)
Dell Storage MD1400 12 x 16
TB NL-SAS SED
High Density Network Decoder, Log Decoder,
Archiver, Log Hybrid, Network
Hybrid
128TV
(NW-
PV-B-N)
Dell Storage MD 1400 8 x
16TB NL-SAS SED
High
Performance
Concentrator 103TB
(NW-
PV-C-N)
Dell Storage MD 1400 6 x
16TB NL-SAS SED, 2 x
3.8TB SSD SED
High
Performance
Concentrator 155TB
(NW-
PV-D-N)
Dell Storage MD 1400 9 x
16TB NL-SAS SED, 3 x
3.8TB SSD SED
Hardware Description 6

PowerVault (Dell MD1400 - 16TB) Setup Guide
PowerVault Storage Enclosures Supported
SKU
Series 5 &
6 Core
Hosts
(R630
&R640)
Series 5
Hybrid
Host
(R730)
Series 6
Hybrid Host
(R740)
NW-PV-A-N Eight One One
NW-PV-B-N Eight One One
NW-PV-C-N Eight NA NA
NW-PV-D-N Eight NA NA
Mixed Modes Four DACs
and Four
PowerVault
Two, 96TB (NW-
PV-C-N) / 128
TB (NW-PV-B-
N) Power-
Vaults
7 Hardware Description

PowerVault (Dell MD1400 - 16TB) Setup Guide
Capability with NetWitness Platform Series 5 or 6 Hosts
NetWitness Platform Series 5 or 6 hosts are shipped with the software to support a PowerVault
installation. The initial setup of a PowerVault in your network involves these steps:
1. Review site requirements and safety information.
2. Install PowerVault.
Package Contents
Refer to the documentation that is included with the PowerVault. The Dell Storage MD1400
Enclosures Hardware Owner's Manual (https://topics-cdn.dell.com/pdf/md1400om_en-us.pdf)
contains detailed instruction on all the optional setups you can implement with PowerVault to
address the needs of your environment.
Note: The PowerVault comes with two SAS cables. You only need one cable to connect the
PowerVault to a Series 5 or 6 host. Use a cable with the mini-to-mini-SAS connectors to
connect the PowerVault to a Series 5 or 6 host.
Customer Supplied Materials
You do not need to supply any materials.
Hardware Description 8

PowerVault (Dell MD1400 - 16TB) Setup Guide
Front View of the PowerVault
Item numbers 1-3 are indicators located on the front control panel, which indicate the status of
the enclosure. Item numbers 4-5 are hard disk drive indicators. For more detailed information,
see The Dell Storage MD1400 Enclosures Hardware Owner's Manual (https://topics-
cdn.dell.com/pdf/md1400om_en-us.pdf).
Key Description
1Enclosure status LED. The enclosure status LED on the front control panel lights
when the enclosure power is on.
lLights solid blue during normal operation.
lBlinks blue when a host server is identifying the enclosure or when the system
identification button is pressed.
lBlinks amber or remains solid amber for a few seconds and then turns off when
the enclosure management modules (EMMs) are booting or resetting.
lBlinks amber for an extended time when the enclosure is in a warning state.
lRemains solid amber when the enclosure is in the fault state.
2 Power LED. The power LED on the front control panel lights when at least one
power supply unit is supplying power to the enclosure.
3 System identification button. The system identification button on the front control
panel can be used to locate a particular enclosure within a rack. When the button is
pressed, the system status indicators on the control panel blink blue until the button is
pressed again.
9 Hardware Description

PowerVault (Dell MD1400 - 16TB) Setup Guide
Key Description
4 Hard disk drive status indicator.
lBlinks green two times per second: Identify hard disk drive or preparing for
removal
lOff: The hard disk drive is ready for insertion or removal. This can also be an
indicator of a drive failure.
lBlinks green, amber, and off: Hard disk drive predicted failure
lBlinks amber four times per second: Hard disk drive failed
lBlinks green slowly: Hard disk drive rebuilding
lSteady green: Hard disk drive online
lBlinks green for three seconds, amber for three seconds, and turns off in six
seconds: Rebuild aborted
5 Hard disk drive activity indicator (green).
6 Hard disk drives.
High Density: Total - 12 Drives
lSlots 0-11: 3.5 inch SAS hot-swappable hard drives
High Performance: Total - 12 Drives
lSlots 0-2: 2.5 inch SSD (in 3.5 in carrier) hot-swappable solid state drives
lSlots 4-11: 3.5 inch SAS hot-swappable hard drives
7 Hard drives table, which shows the PowerVault drive slot locations.
PowerVault Front View Showing Drive Numbers
The PowerVault drive locations are listed on a table to the right on the front of the PowerVault.
The drive numbers are also labeled in this diagram. For information on how to flash and replace
the hard disk drives, see the Hard Disk Drive Replacement Guide in the Hardware Setup Guides
on NetWitness Link: https://community.netwitness.com/t5/netwitness-platform-hardware/series-
6-hardware-setup-guide/ta-p/572346.
Hardware Description 10

PowerVault (Dell MD1400 - 16TB) Setup Guide
Rear View of the PowerVault
Key Description
1 Primary enclosure management module (EMM 0).
The EMM provides:
la data path between the enclosure and the host server.
lenclosure management functions for your enclosure.
2 Secondary EMM (EMM 1)
3 SAS ports. Each set of ports has a Primary port and an Expansion port. In each set,
the Primary port is closer to the center of the chassis. There are two rows of ports. In
each row, the ports are labeled 1 to 4 from left to right. Start with the upper row port
1. You can daisy chain using the rest of the ports if you have multiple PowerVaults
connected to a Series 5 or 6 host.
4 Power Input Connections
For more detailed information, see The Dell Storage MD1400 Enclosures Hardware Owner's
Manual (https://topics-cdn.dell.com/pdf/md1400om_en-us.pdf).
11 Hardware Description

PowerVault (Dell MD1400 - 16TB) Setup Guide
PowerVault Cable
You receive multiple cables with the PowerVault. Both connectors on PowerVault cables are
square, Mini-SAS (Codename SFF-8088) connectors. You use these cables to connect:
lA PowerVault to a host.
lA PowerVault to another PowerVault in a daisy chain.
The following figures shows a Mini-SAS connector.
Note: You must insert the cable correctly at both ends with the correct side up. If you have
done this correctly, you hear a click and a green light displays on the rear of the PowerVault
and the rear of the Series 5 or Series 6 host indicating a live connection.
DAC Cables
You can Install PowerVaults and 15-Drive DACs on a Series 5 or Series 6 Host (Mixed Mode). The
DAChas two types of cables:
lA cable with a Mini-SAS (Codename SFF-8088) connector at one end of the cable and a
rectangular Mini-SAS HD (Codename SFF-8614) connector at the other end. You connect
the square, Mini-SAS (Codename SFF-8088) connector to the host and the rectangular Mini-
SAS HD (Codename SFF-8614) connector to the first DAC.
lMultiple cables with a rectangular Mini-SAS HD (Codename SFF-8614) at both ends of the
cable to connect a DAC to another DAC in a daisy chain.
The following figure shows a rectangular Mini-SAS HD (Codename SFF-8614) connector.
Hardware Description 12

PowerVault (Dell MD1400 - 16TB) Setup Guide
Monitoring PowerVault Through IDRAC
You can monitor PowerVault MD array communication through the Integrated Dell Remote
Access Controller (IDRAC). Refer to the "Monitoring network devices using web interface" and
"Monitoring network devices using RACADM" sections of the Integrated Dell Remote Access
Controller 8/7 Version 2.60.60.60 User’s Guide (https://topics-cdn.dell.com/pdf/idrac7-8-
lifecycle-controller-v2606060_users-guide_en-us.pdf) for information on how to monitor
network devices through IDRAC.
PowerVault Support by Host
This topic lists the maximum number of PowerVaults you can attach to NetWitness physical
hosts.
Unencrypted PowerVaults
Series 5 - R630 Core (Decoder, Log Decoder, Concentrator, and Archiver) Host supports
the following unencrypted PowerVaults:
lEight unencrypted PowerVaults.
lIn mixed mode, supports up to four unencrypted PowerVaults and four unencrypted DACs for
a total of eight external storage devices.
Series 5 - R730 Hybrid Host supports one, unencrypted, 192TB (NW-PV-A-N) or 128TB
(NW-PV-B-N) PowerVault.
Series 6 - R640 Core Host supports the following unencrypted PowerVaults:
lEight unencrypted PowerVaults.
lIn mixed mode, supports up to four unencrypted PowerVaults and four unencrypted DACs for
a total of six external storage devices.
Series 6 - R740 Hybrid Host supports one, unencrypted, 128TB (NW-PV-B-N) or 192 TB
(NW-PV-A-N) PowerVault.
Encrypted PowerVaults
Series 6 - R640 Core (Decoder, Log Decoder, Concentrator, and Archiver) Host supports up
to four, SED (Self Encrypted Drive) PowerVaults. A Decoder or Archiver installed on a Series 6
R640 requires 192 TB (NW-PV-A-N) or 128 TB (NW-PV-B-N) SED PowerVaults. A
Concentrator installed on a Series 6 R640 requires 103 TB (NW-PV-C-N) or 156 TB (NW-PV-
D-N) SED PowerVaults. NetWitness does not support encrypted PowerVaults for:
13 Hardware Description

PowerVault (Dell MD1400 - 16TB) Setup Guide
lSeries 5 hosts, (that is, R630 core hosts and R730 hybrid hosts).
lSeries 6 R740 hybrid host.
Hardware Description 14

PowerVault (Dell MD1400 - 16TB) Setup Guide
Install PowerVault without Encryption
This topic describes how to install a PowerVault without encryption on NetWitness Series 5 and
Series 6 Decoder, Log Decoder, Concentrator, Archiver, and Hybrid physical hosts.
Prerequisites
Make sure that you have the following required software:
lNetWitness Platform - The recommended versions are 11.5.0.0 and later.
To verify the version, in the Administration Services view (Administration > Services), the
release version is displayed to the right of each service listed. To check the version at the
command line, run the following command:
rpm -qa | grep nw
Results example:
rsa-nw-concentrator-11.5.0.0-11293.5.0c5da3886.el7.x86_64.rpm
Caution: If you are adding a previously used PowerVault and would like to preserve the data,
DO NOT follow the instructions in this guide. Contact NetWitness Customer Support.
Running the script on a previously used PowerVault could erase any existing data.
15 Install PowerVault without Encryption

PowerVault (Dell MD1400 - 16TB) Setup Guide
Introduction
The following table contains the summarized installation instructions for different deployments,
and detailed procedures are in individual subsections. The deployment scenarios are:
lMultiple PowerVaults in a Concentrator, (Network) Decoder, Log Decoder, and Archiver
deployment.
lA single PowerVault in a Hybrid deployment.
Attach and Configure a PowerVault without Encryption
This table summarizes the steps you must complete to attach and configure a PowerVault
without encryption. The scenarios are shown in detail in the topics following immediately the
table.
NetWitness Platform 11.5 and Later
Deployment
Scenario Tasks
Concentrator, Archiver,
Decoder, and Log
Decoder (Multiple
PowerVaults)
1. Connect the PowerVaults to the physical host before powering
on the physical host as described in Connect PowerVaults to a
Concentrator, Archiver, Decoder, or Log Decoder Physical Host .
2. Follow the instructions in the Storage Guide for NetWitness
Platform Version 11.5 and Later to allocate storage for your
hardware.
Hybrid 1. Connect the PowerVault to the physical host before powering
on the physical host as described in Connect a PowerVault to a
Hybrid .
2. Follow the instructions in the Storage Guide for NetWitness
Platform Version 11.5 and Later to allocate storage for your
hardware.
Install PowerVault without Encryption 16

PowerVault (Dell MD1400 - 16TB) Setup Guide
Connect PowerVaults to a Concentrator, Archiver, Decoder, or
Log Decoder Physical Host
You can connect one or more PowerVaults to a NetWitness Series 5 or Series 6 Concentrator,
Archiver, Decoder, or Log Decoder physical hosts. You can only add four PowerVaults per port
for a total of eight PowerVaults per PERC H830 (Series 5) RAID controller or five per PERC
H840 (Series 6) RAID controller.
Note: 1.) If you are attaching more then 3 PowerVaults to a single port you may received the
following Error message:
The total number of enclosures connected to connector 00, has
exceeded the maximum allowable limit of 3 enclosures. Please remove
the extra enclosure and then restart your system. This error was caused by
PERC profile settings. From factory, PERC profile is set to PD64. Setting the profile to PD240
corrects the issue. Profile PD240 is labeled as “default”, however, this is not set from factory.
To set the PD Profile:
1. Enter the DELL PERC 10 Configuration Utility. See Navigating to Dell PERC 10
configuration utility.
2. Click Main Menu > Controller Management > Advanced Controller Properties > Profile
Management. Current profile and profile properties are displayed.
3. Change profile using the Choose Profile option.
4. Select Set Profile. Click Reboot.
2.) The PowerVault comes with two SAS cables. You only need one cable to connect the
PowerVault to the physical host. For NetWitness Series 5 physical hosts, use a cable with the
mini-SAS connector.
1. Ensure that the physical host is powered off.
2. Connect one end of the SAS cable to the left port of the RAID controller on the back of the
Concentrator, Archiver, Decoder, or Log Decoder physical host.
3. Connect the other end of the SAS cable to the PowerVault unit.
When you connect the first PowerVault to the RAID controller, make sure that you insert the
cable into the Primary SAS port on the PowerVault as shown in the following figures.
Series 5 Physical Hosts
Series 5 - R630
The following figure shows an R630 host (port 0 ) connected to a PowerVault (port 1 in top
row of ports) using a mini-to-mini SAS cable.
The PERC830 card for the R630 is installed in slot #3. This means that:
lPort 0 is on the left and port 1 is on the right on the R630.
lYou must attach the cable to the R630 with the connector's blue tab on the top.
17 Install PowerVault without Encryption

PowerVault (Dell MD1400 - 16TB) Setup Guide
lYou must attach the other end the cable to the PowerVault with the connector's blue tab
on the top.
lYou know if the cable is properly connected when you hear a click as the cable locks into
place and see the green port light illuminate on the R630.
Series 5 - R730 (Hybrid)
The following figure shows an R730 host (port 0 ) connected to a PowerVault (port 1 in top
row of ports) using a mini-to-mini SAS cable.
The PERC830 card for the R730 is installed in slot #3. This means that:
lPort 0 is on the left and port 1 is on the right on the R730.
lYou must attach the cable to the R730 with the connector's blue tab on the top.
lYou must attach the other end the cable to the PowerVault with the connector's blue tab
on the top.
lYou know if the cable is properly connected when you hear a click as the cable locks into
place and see the green port light illuminate on the R730.
Install PowerVault without Encryption 18

PowerVault (Dell MD1400 - 16TB) Setup Guide
Series 6 Physical Hosts
Series 6 - R640
The following figure shows Series 6 - R640 host (port 0) connected to PowerVault (port 1 in
top row of ports) using a mini-to-mini SAS cable.
The PERC H840 card for the R640 is installed in slot #1. This means that:
lPort 0 is on the left and port 1 is on the right on the R640.
lYou must attach the cable to the R640 with the connector's blue tab on the top.
lYou must attach the other end the cable to the PowerVault with the connector's blue tab
on the top.
lYou know if the cable is properly connected when you hear a click as the cable locks into
place and see the green port light illuminate on the R640.
19 Install PowerVault without Encryption

PowerVault (Dell MD1400 - 16TB) Setup Guide
Series 6 - R740xd (Hybrid)
The following figure shows Series 6 - R740 hybrid host Port 0 connected to a PowerVault's
Port 1 in top row of ports using a mini-to-mini SAS cable.
The PERC H840 card for the R740 is installed in slot #4 inverted (upside down) in this slot.
This means that:
lPort 0 is on the right and Port 1 is on the left on the R740 Hybrid.
lYou must attach each cable to the R740 with the connector's blue tab on the bottom
as shown in the following picture.
lYou must attach the other end the cable to the PowerVault with the connector's blue tab
on the top.
lYou know if the cable is properly connected when you hear a click as the cable locks into
place and see the green port light illuminate on the R740.
Install PowerVault without Encryption 20