Fidelis Deception Decoy Server FDH-1000-C User manual

www.fidelissecurity.com
About Fidelis Cybersecurity
Fidelis Cybersecurity, the industry innovator in Active XDR and proactive cyber defense solutions, safeguards
modern IT environments with unparalleled detection, deception, response, cloud security, and compliance
capabilities. We offer full visibility across hybrid environments via deep, dynamic asset discovery, multi-faceted
context, and risk assessment. These features help minimize attackable surface areas, automate exposure
prevention, threat detection, and incident response, and provide the context, accuracy, speed, and portability
security professionals need to find and neutralize adversaries earlier in the attack lifecycle. Fidelis Cybersecurity
is dedicated to helping clients become stronger and more secure. Fidelis is trusted by many top commercial,
enterprise, and government agencies worldwide. For more information, please visit www.fidelissecurity.com
Copyright © 2022 Fidelis Cybersecurity®, Inc. All rights reserved.
Fidelis Deception® Decoy Server
Appliance
Quick Start Guide
Rev-K (HPE DL360 Gen10) Platform

2
.
www.fidelissecurity.com
Copyright © 2022 Fidelis Cybersecurity®, Inc. All rights reserved
1. System Overview
Fidelis Deception Decoy Server appliance runs emulated and Real OS decoys. It is connected to Trunk
port and/or multiple flat networks, and it communicates with assets on your networks.
Figure 1: Fidelis Deception – Decoy Server Appliance – Rev-K
The Decoy Server reports deception alerts when attackers access the decoy. The Decoy Server reports
the deception alerts to your on-premises Fidelis CommandPost or to the remote Fidelis Network Cloud.
Your configuration depends on which environment you are using.
Decoy Server Setup Checklist

Fidelis Decoy Server – Appliance Requirements
Appropriate rack space, power, and cooling (Appendix B)
Rack tools, rails, and connectors
Keyboard and video monitor / KVM switch for temporary appliance setup
Power cables – two per appliance, appropriate power source and region
Ethernet cables (cat5e and optical) for Admin, Monitor, and iLO ports (Section 3)
Network switches with enough physical ports (Section 4)
Optical transceivers for switches
Logical network information: IP addresses, hostnames (Section 5, Appendix A)

3
.
www.fidelissecurity.com
Copyright © 2022 Fidelis Cybersecurity®, Inc. All rights reserved
2. Documentation, Passwords, and Technical Support
Product Documentation
You can find Fidelis Network product documentation, appliance specifications, and instructions at
https://support.fidelissecurity.com or through the navigation item in the CommandPost user
interface.
Appliance Default Passwords
System Account Default Password
Appliance Console fidelis fidelispass
CommandPost user interface admin system
iLO administrator (printed on label, top of server)
Technical Support
For all technical support related to this product, check with your site administrator to determine support
contract details. For support of your product, contact your reseller. If you have a direct support contract
with Fidelis Cybersecurity, contact Fidelis Cybersecurity Technical support at:
•Phone: [phone]
•Toll-free in the US and Canada: 1.800.652.4020
•Email: [e-mail]
•Web: https://support.fidelissecurity.com

4
.
www.fidelissecurity.com
Copyright © 2022 Fidelis Cybersecurity®, Inc. All rights reserved
3. Decoy Server: Network Port and Cabling Requirements
You must connect each appliance to the various networks with appropriate cables and in some cases,
SFP+ transceivers. The tables below describe the physical connection and cable type associated with
each port on the appliance.
Decoy Server Appliances with Copper Ports
Port Label Physical Connection Type (default) Cable Type (minimum)
Admin (eth0) GbE Copper RJ45 (copper) Cat 5e patch cable
Decoys (eth1) GbE Copper RJ45 (copper) Cat 5e patch cable
Decoys (eth2) GbE Copper RJ45 (copper) Cat 5e patch cable
Decoys (eth3) GbE Copper RJ45 (copper) Cat 5e patch cable
iLO GbE Copper RJ45 (copper) Cat 5e patch cable
Figure 2: Rear Port Assignments– Decoy Server with Copper Ports (Rev-K)
Decoy Server FDH-1000-C
Decoy Server FDH-3000-
C
DL360
iLO
Admin
(eth0)
Decoys
(eth2)
Decoys
(eth3)
Decoys
(eth1)

5
.
www.fidelissecurity.com
Copyright © 2022 Fidelis Cybersecurity®, Inc. All rights reserved
Decoy Server 10GbE Optical Ports
Port Label Physical Connection Type (default) Cable Type (minimum)
Admin (eth0) GbE Copper RJ45 (copper) Cat 5e patch cable
Decoys (eth1) GbE Copper RJ45 (copper) Cat 5e patch cable
Decoys (eth2) GbE Copper RJ45 (copper) Cat 5e patch cable
Decoys (eth3) GbE Copper RJ45 (copper) Cat 5e patch cable
Decoys (eth4) Duplex LC Connector Multimode Fiber, 850nM, OM2
Decoys (eth5) Duplex LC Connector Multimode Fiber, 850nM, OM2
iLO GbE Copper RJ45 (copper) Cat 5e patch cable
Figure 3: Rear Port Assignments– Decoy Server 10GbE Optical Ports (Rev-K)
Decoy Server FDH-1000-F
Decoy Server FDH-3000-
F
DL360
iLO
Admin
(eth0)
Decoys
(eth2)
Decoys
(eth3)
Decoys
(eth1)
Decoys
(eth4)
Decoys
(eth5)

6
.
www.fidelissecurity.com
Copyright © 2022 Fidelis Cybersecurity®, Inc. All rights reserved
4. Decoy Server Networking Environment
Decoy server appliances can connect to multiple networks to deploy different decoy services. Decoys can
operate whether ports are connected to:
•Trunk ports, which enables communication on multiple subnets from the same port on the
appliance,
and/or
•Ports directly to specific subnets
Admin Network
The Admin network connects Fidelis Decoy server to the CommandPost, and optionally to an
on-premises Fidelis Sandbox. You need one switch port per Decoy server appliance for the Admin
network.
Appliance Switch Port Type Qty
Decoy Server GbE Copper RJ45 port 1
Decoy eth1, Decoy eth2, Decoy eth3
Ports to connect the Decoy server appliance to subnets through network switch directly certain subnets
and/or use trunk port.
Appliance Switch Port Type Qty
Decoy Server GbE Copper RJ45 port 3
Decoy eth4, Decoy eth5, Decoy eth6, Decoy eth7 (additional ports)
Most environments using higher network throughput will use these ports. You can connect the Decoy
server to a trunk port and/or to certain subnets through the switch.
Appliance Switch Port Type Qty
Decoy Server 1GbE GbE Copper RJ45 port 4
Decoy Server 10-GbE Duplex LC Connector, 1GbE or 10GbE 2
iLO Network
Optional network for remote/out-of-band server administration. You will need on additional switch port for
each iLO connection.
Appliance Switch Port Type Qty
Decoy Server GbE Copper RJ45 port 1

7
.
www.fidelissecurity.com
Copyright © 2022 Fidelis Cybersecurity®, Inc. All rights reserved
5. Decoy Server – Logical Network Configuration
Configure the Admin and iLO according to your network configuration. See the table below as a sample.
Appendix A has a worksheet you can use.
Note: The logical configuration for decoys is done as part of the decoys creation process.
Sample Configuration for Decoy Server
Network Setting Assignments
Interface Admin iLO
Hostname (FQDN) DecoyServer1.myorg.int
Static IP Address 10.1.2.3 10.2.3.4
Subnet Mask 255.255.255.0 255.255.255.0
Gateway 10.1.2.1 10.2.3.1
Proxy Server 10.5.6.7
DNS Servers 8.8.4.4, 8.8.8.8
NTP Servers 0.pool1.ntp.org
Time Zone UTC (+0)
6. Appliance Installation
Rack Installation
Install each appliance in an enclosure/location that has necessary power and cooling. Ensure that the
installation environment is within the operating temperature of the appliance. See Appendix B for
appliance operating temperature requirements.
Power
Connect power cables to the power supplies in the back of the appliance. See Appendix B for appliance
power requirements.
Network Cabling
Using the connectors and cables described in sections 3 and 4, begin to connect the appliances to the
networks. Cable the sensor appliance(s) to the switches:
1. Connect the Admin (eth0) port to the ADMIN switch port.
2. Optionally, connect the iLO port to the ADMIN (or iLO) switch port.

8
.
www.fidelissecurity.com
Copyright © 2022 Fidelis Cybersecurity®, Inc. All rights reserved
7. Decoy Server Network Configuration
1. Power on the appliance(s).
2. Connect to the component CLI using one of the following methods:
‒Via KVM Console
‒Via Console or iLO
Via KVM Console
Connect a keyboard and monitor to the appliance. For Fidelis Decoy Server version 9.4 or later,
the following screen is displayed. If you do not see this screen, connect via SSH (see instructions
below).
With Erase & Install deception server selected, press Enter.

9
.
www.fidelissecurity.com
Copyright © 2022 Fidelis Cybersecurity®, Inc. All rights reserved
Press Enter again when you see the screen above to confirm the installation. The software will be
applied, and the appliance rebooted. Continue with step 3.
Via Console or iLO
Login to the system through the console or iLO.
3. Use the following credentials at the login prompt. You will be required to change the password
immediately.
‒user: fidelis
‒default password: fidelispass

10
.
www.fidelissecurity.com
Copyright © 2022 Fidelis Cybersecurity®, Inc. All rights reserved
4. With Setup, select Configure network.
5. Skip the DHCP configuration by selecting No.
Note: It is recommended that you use a static IP address for the interface so that the
connection to the CommandPost/Management is not lost.

11
.
www.fidelissecurity.com
Copyright © 2022 Fidelis Cybersecurity®, Inc. All rights reserved
6. Configure the network parameters for the system management interface.
7. When complete, select Apply and wait for confirmation to exit Setup.
8. To exit, select Quit to finish setup.

12
.
www.fidelissecurity.com
Copyright © 2022 Fidelis Cybersecurity®, Inc. All rights reserved
8. Fidelis Decoy Server Integration
Register Decoy Servers with On-Premises CommandPost
1. From the CommandPost user interface, navigate to: Administration > Components
2. Click Add Component.
3. Fill in the Add New Component popup:
Component Type Select Decoy Server
Name Specify a “friendly” name for the Decoy server. This is not the fully
qualified domain name of the Decoy server.
Description Optionally, specify a description, for example, a location, business unit,
etc.
IP Address Specify the IP address of the Admin interface of the Decoy server
appliance.
4. Click Add Component.
5. To register the sensor, click the and select Register.
Accept the End User License Agreement (EULA). The CommandPost begins communicating with
the Decoy server at the specified IP address.
Register Decoy Servers with Fidelis Network Cloud
Please contact Fidelis Technical Support to connect your Decoy Servers to the Fidelis Network Cloud.
Fidelis Technical Support will work with you to configure the Decoy Servers and enable the Fidelis
Network Cloud for your environment.

13
.
www.fidelissecurity.com
Copyright © 2022 Fidelis Cybersecurity®, Inc. All rights reserved
Appendix A: Network Configuration Worksheet
Network Setting Assignments
Interface Admin iLO
Hostname (FQDN)
Static IP Address
Subnet Mask
Gateway
Proxy Server
DNS Servers
NTP Servers
Time Zone

14
.
www.fidelissecurity.com
Copyright © 2022 Fidelis Cybersecurity®, Inc. All rights reserved
Appendix B: System Specifications
FDH-1000-C (Rev-K)
FDH-1000-F (Rev-K) FDH-3000-C (Rev-K) FDH-3000-F (Rev-K)
Form Factor 1U rack-mount chassis SFF 1U rack-mount chassis SFF
CPU Dual Silver 4214R
12/24-core 2.4Ghz Single 6246R 16-core 3.4Ghz
TPM TPM 2.0 TPM 2.0
Memory 64GB
ECC DDR4 2933Mhz 128GB ECC DDR4 2933Mhz
Storage Capacity &
Configuration 2x HDD 300 GB
RAID-1
(300 GB Effective)
6x HDD 600GB
RAID-5
(3 TB Effective)
Network Adapters
(Default Config) 4x 1GbE FDH-1000-F: 2x 10GbE
FDH-1000-F: 2x SFP+ (Optical, multi-
mode, 1G/10G)
4x 1GbE F
DH-3000-F: 2x 10GbE
FDH-3000-F: 2x SFP+ (Optical, multi-
mode, 1G/10G)
Out-of-Band
Management Integrated Lights Out Management (iLO) Integrated Lights Out Management (iLO)
Power Supply Dual hot-swap 800W High Efficiency AC
power supplies Dual hot-swap 800W High Efficiency AC power supplies
Dimensions H: 4.29 cm ( 1.69 in)
W: 43.46 cm (17.11 in)
D: 70.7 cm (27.83 in)
H: 4.29 cm ( 1.69 in)
W: 43.46 cm (17.11 in)
D: 70.7 cm (27.83 in)
Weight (approx.) 16.27 kg (35.86 lb) 16.27 kg (35.86 lb)
Operating
Temperature 10° to 35°C (50° to 95°F)
at sea level 10° to 35°C (50° to 95°F) at sea level
AC Input
Requirements 100 - 120 VAC
200 - 240 VAC 100 - 120 VAC 200 - 240 VAC
BTU Rating (max) 3067 BTU/hr (100 VAC)
2958 BTU/hr (200 VAC)
2949 BTU/hr (240 VAC)
1902 BTU/hr (100 VAC)
1840 BTU/hr (200 VAC)
1832 BTU/hr (240 VAC)

www.fidelissecurity.com
About Fidelis Cybersecurity
Fidelis Cybersecurity, the industry innovator in Active XDR and proactive cyber defense solutions, safeguards
modern IT environments with unparalleled detection, deception, response, cloud security, and compliance
capabilities. We offer full visibility across hybrid environments via deep, dynamic asset discovery, multi-faceted
context, and risk assessment. These features help minimize attackable surface areas, automate exposure
prevention, threat detection, and incident response, and provide the context, accuracy, speed, and portability
security professionals need to find and neutralize adversaries earlier in the attack lifecycle. Fidelis Cybersecurity
is dedicated to helping clients become stronger and more secure. Fidelis is trusted by many top commercial,
enterprise, and government agencies worldwide. For more information, please visit www.fidelissecurity.com
Copyright © 2022 Fidelis Cybersecurity®, Inc. All rights reserved.
QSG_DecoyServer_Rev-K_20220331
Source: Technical Support