Force 10 PSeries 100-00055-01 Installation guide

P-Series Installation and
Operation Guide
Version 2.3.1.2 May 27, 2008 PN: 100-00055-01

Copyright 2008 Force10 Networks®
All rights reserved. Printed in the USA. January 2008.
Force10 Networks® reserves the right to change, modify, revise this publication without notice.
Trademarks
Force10 Networks® and E-Series® are registered trademarks of Force10 Networks, Inc. Force10, the Force10 logo, and P-Series are
trademarks of Force10 Networks, Inc. All other brand and product names are registered trademarks or trademarks of their respective holders.
Statement of Conditions
In the interest of improving internal design, operational function, and/or reliability, Force10 Networks reserves the right to make changes to
products described in this document without notice. Force10 Networks does not assume any liability that may occur due to the use or
application of the product(s) described herein.
USA Federal Communications Commission (FCC) Statement
This equipment has been tested and found to comply with the limits for a Class A digital device, pursuant to Part 15 of the FCC rules. These
limits are designated to provide reasonable protection against harmful interference when the equipment is operated in a commercial
environment. This equipment generates, uses, and can radiate radio frequency energy. If it is not installed and used in accordance to the
instructions, it may cause harmful interference to radio communications. Operation of this equipment in a residential area is likely to cause
harmful interference, in which case users will be required to take whatever measures necessary to correct the interference at their own
expense.
Properly shielded and grounded cables and connectors must be used in order to meet FCC emission limits. Force10 Networks is not
responsible for any radio or television interference caused by using other than recommended cables and connectors or by unauthorized
changes or modifications in the equipment. Unauthorized changes or modification could void the user’s authority to operate the equipment.
This device complies with Part 15 of the FCC Rules. Operation is subject to the following two conditions: (1) this device may not cause
harmful interference, and (2) this device must accept any interference received, including interference that may cause undesired operation.
Canadian Department of Communication Statement
The digital apparatus does not exceed the Class A limits for radio noise emissions from digital apparatus set out in the Radio Interference
Regulations of the Canadian Department of Communications.
Attention: Le present appareil numerique n’ emet pas de perturbations radioelectriques depassant les normes applicables aux appareils
numeriques de la Class A prescrites dans le Reglement sur les interferences radioelectriques etabli par le ministere des Communications du
Canada.
European Union EMC Directive Conformance Statement
This product is in conformity with the protection requirements of EU Council Directive 89/336/EEC on the approximation of the laws of the
Member States relating to electromagnetic compatibility. Force 10 Networks can not accept responsibility for any failure to satisfy the
protection requirements resulting from a non-recommended modification of this product, including the fitting of non-Force10 option cards.
This product has been tested and found to comply with the limits for Class A Information Technology Equipment according to CISPR 22/
European Standard EN 55022. The limits for Class A equipment were derived for commercial and industrial environments to provide
reasonable protection against interference with licensed communication equipment.
Warning: This device is a Class A product. In a domestic environment, this device can cause radio interference, in
which case, the user may be required to take appropriate measures.
VCCI Compliance for Class A Equipment (Japan)
This is Class A product based on the standard of the Voluntary Control Council For Interference by Information Technology Equipment
(VCCI). If this equipment is used in a domestic environment, radio disturbance may arise. When such trouble occurs, the user may be
required to take corrective actions.
Danger: AC Power cords are for use with Force10 Networks equipment only, do not use Force10 Networks AC Power
cords with any unauthorized hardware.

P-Series Installation and Operation Guide, version 2.3.1.2 3
Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
Preface
About this Guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Objectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Audience . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Information Symbols . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Related Documents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Additional Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Chapter 1
Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
System Specifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Physical Connections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Booting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Security Check . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Upgrading Software . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Chapter 2
Getting Started. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Returning to the Default Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Chapter 3
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Hardware Architecture Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Types of Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Sample Rules and Firmware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Rule Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Deploying the P-Series . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Inline Deployment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Fail-safe Deployment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Highly-available Deployment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Passive Deployment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Capturing Matched Traffic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Capturing to a Host CPU . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Contents

4Contents
Mirroring to Another Device . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
Chapter 4
Graphical User Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
GUI Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Managing Rules, Policies, and Firmware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Editing Dynamic Rules with the GUI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Managing Capture/Forward Policies with the GUI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
Selecting Firmware with the GUI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
Runtime Statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
Reloading Firmware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Chapter 5
Web-based Management. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
Launching the P-Series Node Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
Web-browser Security Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
Managing the P-Series using Node Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
Monitoring System Performance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
Managing Firmware Images . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
Managing the Network Interface Card . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
Managing Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
Chapter 6
Network Security Monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
Installing the Sguil System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
Installing the Sguil Sensor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
Installing the Sguil Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
Installing the Sguil Client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
Installation Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
Running the Sguil System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
Running the Sguil Sensor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
Running the Sguil Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
Running the Sguil Client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
Chapter 7
Command Line Interface. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
CLI Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
Editing Dynamic Rules with the CLI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
MAC Rewriting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
Removing VLAN Tags . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53

P-Series Installation and Operation Guide, version 2.3.1.2 5
Chapter 8
Compiling Rules. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
Creating Rules Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
Rules Capacity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
Compiling Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
Starting and Stopping the pnic-Compiler . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
Configuration and Generated Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
Firmware Filenames . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
Compiler Errors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
Chapter 9
Writing Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
Snort Rule Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
Snort Rule Headers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
Snort Rule Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66
P-Series Rule Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66
P-Series Supported Snort Keywords . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66
Writing Stateful Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68
Stateful Matching . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68
Stateful Rule Examples . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
The meta.rules File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
Support for Snort's flow Keyword . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
Handling Segmentation Evasion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
Support for Snort's within Keyword . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72
Anomalous TCP Flags . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
Chapter 10
Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
Deploying the P-Series as a Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
Enabling the Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76
Allowing Traffic through the Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
Writing Rules for a Firewall Deployment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
Appendix A
Command Line Reference. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79
Appendix B
Snort Keywords . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119
Appendix C
Meta and Evasion Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123
Appendix D
Basic Unix Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125

6Contents
Unix Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125
vi Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126
Appendix E
Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127
Appendix F
Technical Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129
Manual Pages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129
The iSupport Website . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129
Accessing iSupport Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129
Contacting the Technical Assistance Center . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130
Locating P-Series Serial Numbers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130
Requesting a Hardware Replacement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131

P-Series Installation and Operation Guide, version 2.3.1.2 7
Objectives
This document provides installation and operation instructions for the P-Series P10 appliance.
Audience
This guide is intended to be used by network engineers. The P10 is a Unix-based product that runs rule
management software based on Linux and FreeBSD. As such, understanding how to operate the appliance
requires a basic knowledge of Unix, including the vi editor.
Conventions
This document uses the following conventions to describe command syntax:
Preface About this Guide
Convention Description
keyword Keywords are in bold and should be entered at the command prompt as listed.
parameter Parameters are in italics and require a number or word to be entered at the command prompt.
{X} Keywords and parameters within braces must be entered at the command prompt.
[X] Keywords and parameters within brackets are optional.
x|y Keywords and parameters separated by a bar require you to choose one.

8About this Guide
Information Symbols
Related Documents
Additional P-Series documentation is available on the software CD that came with the appliance and in the
documentation section of the Force10 website, www.force10networks.com.
• P-Series Release Notes
Additional Resources
• Cox, Kerry and Gerg, Christopher. 2004. Managing Security with Snort and IDS Tools. Sebastopol,
California: O’reilly Media, Inc.
•Snort.org.http://www.snort.org/
Symbol Warning Description
Danger This symbol warns you that improper handling and installation could result in bodily injury.
Before you work on this equipment, be aware of electrical hazards, and take appropriate
safety precautions.
Caution This symbol informs you that improper handling and installation could result in equipment
damage or loss of data.
Warning This symbol informs you that improper handling could reduce your component or system
performance.
Note This symbol informs you of important operational information.

P-Series Installation and Operation Guide, version 2.3.1.2 9
Figure 1 P-Series P10 Appliance (Front View)
IDENTIFY
LAN 2 LAN 1
VGA
SERIAL
USB x2KEYBOARD
MOUSE
POWER
RJ-45 SERIAL
E0 & E1 IP ADDRESS
MANAGEMENT
PORTS
LEDs
POWER
DISPLAY
(E0)(E1)
MIRROR
PORT 1(P1) PORT 0 (P0)
PORT 0 (M0)
MIRROR
PORT 1 (M1)
HARD
DISK
fn9000007
Figure 2 P-Series P10 Appliance (Rear View)
AC POWER RECEPTACLE
MAIN POWER
fn9000009
01234567
SERIAL NUMBER
Chapter 1 Installation
Label Description
(LCD screen) The LCD screen displays the IP address of the appliance next to either “e0:” or “e1:”,
which represent LAN ports 1 and 2, respectively.
Port 1, Port 0 These two ports are sensing ports through which traffic is forwarded. They accept 10G
XFP modules.
(unlabeled RJ-45 serial
port next to IDENTIFY) This port is not used.
IDENTIFY This LED is not used.
HDD This LED is blue when the hard disk is accessed.
PWR This LED is green when the power is on.

10 Installation
System Specifications
The specifications in Table 1 apply to the P-Series P10 appliance, Force10 catalog number
PB-10GE-2P.
Physical Connections
(Power Button) This button turns the appliance on and off. Press and hold the button to turn off the
appliance.
(Laser Warning) This label in the bottom right corner of the appliance indicates that the appliance is a
Class 1 laser product that emits invisible laser radiation. This product complies with
CDRH, 21 CFR 1040.
Table 1 System Specifications
Power AC Power Supply Power Consumption: 400W maximum, 260W nominal
Current: 3.6 A @ 120V, 2.0 A @ 240V
Voltage: 100-240V, 47-63Hz, 8A maximum input current
Heat Dissipation: 1360 BTU/hr maximum, 888 BTU/hr nominal
Battery 3V CR2032 coin cell
Physical Dimensions Height: 1.75 in
Width: 17.6 in
Depth: 15.5 in (1RU half depth)
Weight 20 lbs (9.07 kg)
Environmental Temperature Operating: 41° to 104°F (5° to 40°C)
Storage: -40° to 149°F (-40° to 65°C)
Relative humidity: 20-80% (non-condensing)
Altitude Operating:-50 to 10,000 ft (-16 to 3048 m)
Storage: -50 to 35,000 ft (-16 to 10,600 m)
Note: Connections to the sensing, mirroring, and management ports require straight-through CAT5 cables.
Warning: Do not hot-swap XFPs. If they are accidentally removed, turn off the appliance, replace the
XFPs, and then turn the appliance back on.
Label Description
FN00048A

P-Series Installation and Operation Guide, version 2.3.1.2 11
Step Task
1 Review the system specifications and ensure that your operating and storage conditions meet the
stated requirements.
2 Connect the power cable, a keyboard, and a monitor to the appliance.
3 Connect the LAN 1 port on the appliance to the local area network where DHCP is available. If a
DHCP server is not available, an IP address can be assigned manually; see “Configuration” on
page 12.
4 Install XFPs in the ports that will be used.
5 Connect the sensing ports to the devices from which the appliance will receive traffic.
• Traffic originating from the device connected to Port 0 has Channel 0’s rules applied to it.
• Traffic originating from the device connected to Port 1 has Channel 1’s rules applied to it.
6 (Optional) Connect the mirroring ports to the devices that will receive mirrored traffic.
• Mirror Port 0 mirrors matched traffic from Channel 0.
• Mirror Port 1 mirrors matched traffic from Channel 1.
7 Connect the power cable to a power source, and switch on the main power on the back of the
appliance.
8 Press the power button on the front of the appliance to turn on the device.

12 Installation
Booting
During booting you can select the OS of your choice.
The management ports are configured for DHCP and probe for an IP address, gateway, and name server.
The IP address is displayed on the LCD screen.
When the appliance is powered up, all packets are forwarded between its ports by default until the
firmware and device drivers are loaded. Once they have been loaded, the DPI generates interrupts to the
host processor and offers the captured packets in the same way as a standard network interface card in
promiscuous mode.
Configuration
Once the appliance is booted:
Security Check
The P10 is remotely accessible only via Secure Shell Daemon (SSHv1 or SSHv2). However, inspect the
configuration, and make sure it meets the security policy requirements of your network before deploying
the appliance.
Upgrading Software
Upgrading software requires a boot firmware (PROM) upgrade. This upgrade must be done during a
maintenance window. During this period, stop all traffic from flowing through the appliance, and
disconnect all cables from the XFPs.
Step Task
1 Log in as root with the password plogin.
2 Change the password, if desired, with the command passwd.
3 Set the clock for the appropriate timezone using the command tzsetup. This command calls a
graphical user interface that instructs you on how to select the appropriate timezone.
Note: You must be logged in as root to upgrade software.

P-Series Installation and Operation Guide, version 2.3.1.2 13
Warning: Stop all traffic from flowing through the appliance, and disconnect all cables from the XFPs
before proceeding.
Step Task Command
1 Save earlier configuration files and firmware by
copying the directory /usr/local/pnic to the home
directory.
cp -Rf /usr/local/pnic/ /home
2 Create a new sub-directory in the home directory for
the upgrade package. mkdir ~/upgrade_directory
3 From the root directory, secure copy the file filename
from a server to the upgrade directory you created.
Note: In Unix, the tilde symbolizes the home directory,
and can be used in place of the absolute path to the
home directory. The upgrade file is a Unix tarball, the
file extension of which is .tar.gz.
scp username@server:absolute_path/
filename ~/upgrade_directory
4 Change directory to upgrade directory you created. cd upgrade_directory
5 Untar the file PTPS-P_MAIN.tar xvzf PTPS-P_MAIN
6 Change directory to SW.cd SW
7 Enter the command gmake erase followed by
gmake.gmake erase
gmake
8 Enter the command gmake install.gmake install
9 Verify that the new software version is installed. pnic cardstatus
Warning: The remainder of this procedure is for upgrading the boot firmware. The boot firmware
upgrade process takes up to 30 minutes and must not be interrupted. If the process is interrupted, the
boot firmware must be reloaded via JTAG, which requires an RMA.
10 Enter the command pnic loadeproms to upgrade the
boot firmware. Answer “yes” to the confirmation
question.
Note: This process takes up to 30 minutes.
pnic loadeproms
11 Reboot the appliance.
Note: Reboot the appliance only after pnic
loadeproms has successfully finished.
shutdown -r now
12 Log into the appliance and enter the command pnic
cardstatus. Verify that there is an output for this
command. This indicates that the upgrade process has
been completed successfully.
Note: See Appendix A , on page 79 for an example
output for this command.
pnic cardstatus

14 Installation
13 Re-compile all rules firmware with the new compiler
located in the directory pnic-compiler. cd upgrade_directory/pnic-compiler
gmake
14 Install pre-compiled firmware if needed. cd upgrade_directory/firmware
gmake install
Step Task Command

P-Series Installation and Operation Guide, version 2.3.1.2 15
To begin inspecting and filtering traffic you must:
1. Select firmware and dynamic rules
2. Set capture/forward policies
3. Check for proper operation by generating traffic across the appliance.
Step Task
1As root, enter the command pnic gui from the Unix command line to invoke a graphical user
interface (GUI).
2Enter the command m from the GUI command line.
3Select Manage Firmware from the Rule Management GUI, then select “null” firmware and confirm.
The sample firmware and rules files are testing examples only. Force 10 recommends not employing
the sample firmware for production IDS/IPS use.
4Select Edit Rules from the Rule Management GUI.
5Uncomment the rule alert on all icmp any any -> any any (msg:"@icmp";) by removing the #
symbol before the rule.
• Enter the command ito enter insert mode.
• Navigate to the character using the arrow keys, and delete the character.
6Enter the command :wq to exit the vi editor, and confirm your changes.
7Confirm to reload the Forward/Block settings.
8Run a packet sniffer such as tcpdump on the network interface associated with the appliance.
9Generate some ICMP traffic to be exchanged between endpoints.
•Endpoints are two network nodes on opposite sides of the appliance such that traffic between
those nodes passes through the appliance.
• For example, enter ping destaddress, where destaddress is the IP address of the endpoint on
the opposite end of the appliance.
10 If you are using tcpdump, enter the command tcpdump -i pnic0 -n from the Unix command line.
• This prints to standard output all of the packets captured by the DPI.
• If the appliance is operating correctly, you will see the ICMP packets.
Returning to the Default Configuration
Return to the factory default settings using the command pnic resetconf. See the Command Line
Reference, on page 79.
Chapter 2 Getting Started

16 Getting Started

P-Series Installation and Operation Guide, version 2.3.1.2 17
The P-Series P10 Intrusion Detection and Prevention System (IDS/IPS) appliance employs Dynamic
Parallel Inspection (DPI) technology. It uses a Multiple Instruction Single Data (MISD) massively parallel
processor that executes thousands of security policies or traffic capture operations on the same data stream
at the same time.
DPI synthesizes individual security policies and packet analysis algorithms and maps them directly into
silicon hardware "gates." Through this design it is able to deliver full packet inspection and protection at
line rate for 1-Gigabit and 10-Gigabit links whether the traffic load or security policy is 1% or 100%.
The policies can be derived from public domain signatures, or they can be completely user-defined. For
each policy, you can direct the DPI to:
• Capture packets for the host (capture is defined as both DMA to host and copying to the mirror port)
• Forward packets (with negligible delay)
• Block packets
As a result, the P10 can be used as both an IDS accelerator and a stateful content filter for IPS applications.
In an active configuration, it can be inserted inline into the network; this alleviates the need for a SPAN
port or tap and enables filtering applications. In passive configurations, it can merely listen to the network
via a mirroring port or tap.
Hardware Architecture Overview
The P10 is a 1-RU appliance provisioned with one DPI processing system, and has at minimum: an AMD
Dual Core Opteron 280 processor, a 400-GB hard drive, 8 GB of RAM.
Figure 3 shows packet flow in the DPI, which is a two-port device. Packets are forwarded from the receive
side of the first port (Rx0) to the transmit side of the second port (Tx1). Likewise, Rx1 forwards packets to
Tx0 of the first port.
As the packets are being forwarded they are also processed in real time by two independent processing
channels, each with its own set of policies. If there is a match in a processing channel, the DPI can block
the packet, capture it, and send it to the host through the PCI-X bus. The two processing channels are
completely independent, and thus they can be used to process two asymmetric links, or both directions of a
full-duplex connection.
In addition to two sensing interfaces, the P10 includes two 1-Gigabit Ethernet mirroring ports. These ports
can copy and forward matched traffic to another device. It is also possible to disable the PCI-X DMA
capture, and let the matched traffic bypass the host entirely for applications in which host capture is not
desired.
Chapter 3 Introduction

18 Introduction
Figure 3 illustrates how all matched packets are copied and transmitted by mirror ports.
Figure 3
Forwarding Engine
Detection Engine
Packet Data
PCI-X Module
Packet Data
Device Access
Config Commands
Packet Data
State Table
Rx1
Tx1
Rx0
Tx0
Mirror 1
Mirror 0
Match Result
figindex 006
Logic Diagram of Traffic Flow in the P10 DPI
Types of Rules
Two types of rules can be uploaded to the FPGA:
•Static rules: Static rules are compiled to become part of the firmware and are mapped directly into
logic gates. Static rules can be set to capture/not capture and block/not block individually, but they
cannot be changed once they have been loaded into the FPGA.
•Dynamic rules: Dynamic rules are programmed at runtime in the DPI hardware registers and can be
configured without changing the firmware. These rules (like static rules) can be disabled/enabled
individually.
Sample Rules and Firmware
The P10 includes sample rules files in the pnic-compiler/rules directory. You can browse these files in
order to become more familiar with Snort syntax or creating rules files; you can also generate firmware
from these files at your discretion.
Note: Mirroring is automatically enabled when the mirroring port is connected to another network device.
Mirroring is not controlled through the CLI.

P-Series Installation and Operation Guide, version 2.3.1.2 19
Firmware is a set of rules that has been transformed—using a compiler—from Snort syntax into a form
suitable for uploading to the FPGA. Two sets of sample rules files have been compiled into firmware and
are available to be uploaded to the FPGA using either of two firmware management methods (see “Rule
Management” on page 19). Table 2 describes each sample rules file.
The firmware based on the sample rules files follow the naming convention described in “Selecting
Firmware with the GUI” on page 30.
Rule Management
The P-Series software provides three methods by which you can manage the rules and functionality of the
appliance:
•Graphical User Interface: The graphical user interface (GUI) is a menu-based method for managing
the appliance.
• Web-based GUI: Manage the appliance and graphically plot performance online.
• Command Line Interface: The command line interface (CLI) uses a script called pnic through which
you can manually perform the same management tasks as the GUI by entering commands at the
command prompt.
Force10 recommends using the GUI or web-based GUI if no programmatic interface is required.
Deploying the P-Series
The flexible architecture of the P-Series lends itself to various deployments.
Table 2 Sample Rules Files
Rule Set Description
evasion.rules The rules in this file help detect attacks which are using strategic TCP segmentation to avoid
detection.
fw.rules This file contains rules written in Snort syntax for a firewall application (see “Writing Rules for a
Firewall Deployment” on page 77).
meta.rules The rules in this file report on flow information and provide compatibility with Snort.
null.rules This file contains no rules; the firmware created from these files are empty images that maximize
the dynamic rule capacity (see “Rules Capacity” on page 55).
sample.rules This file contains rules written in Snort syntax that were derived from publicly available IDS rules.
Note: Force 10 recommends not using the sample firmware for production IDS/IPS use. The sample
firmware requires considerable site-specific customization in order to be effective; they are included only
for you to become more familiar with the functionality of the appliance.

20 Introduction
Inline Deployment
Use the P-Series for inline traffic inspection in IPS or firewall applications at 10-Gigabit line rate
(Figure 4).
• For IPS deployment, no special configuration is needed; the P-Series is in inline IPS mode by default.
• For a firewall deployment, enable drop mode (see Command Line Reference on page 79).
Figure 4
10Gig 10Gig DataCenter
PB-10GE-2P
PB-10GE-2P
P-Series P10
10-Gigabit 10-Gigabit
Internet LAN Core
P-Series P10
10-Gigabit 10-Gigabit
Campus Core/
Backbone
fn90029m
p
Data Center
P-Series Inline Deployment
Fail-safe Deployment
The P-Series hardware is fail-safe. In the event of a software exception or reboot, the card continues to
function as it did before the event. In the event of a power failure, the hardware stops functioning, and
traffic is dropped. When the appliance powers up again, all the traffic is allowed by default, and the card
functions as before. Use an optical bypass switch in an inline deployment so that traffic continues to flow
in the event of a power failure, as shown in Figure 5.
Figure 5 Optical Bypass
10-Gigabit
10-Gigabit
P0 P1
P-Series P10
fn90030m
p
Fail-safe Behavior with Optical Bypass