Internet Security Systems Proventia A604 User manual

TM
A604, A1204, and
A1204F Appliance
User Guide

Internet Security Systems, Inc.
6303 Barfield Road
Atlanta, Georgia 30328-4233
United States
[phone]
http://www.iss.net
© Internet Security Systems, Inc. 2003. All rights reserved worldwide. Customers may make reasonable numbers of copies of
this publication for internal use only. This publication may not otherwise be copied or reproduced, in whole or in part, by any
other person or entity without the express prior written consent of Internet Security Systems, Inc.
Internet Security Systems, the Internet Security Systems logo, System Scanner, Wireless Scanner, SiteProtector, Proventia,
ADDME, AlertCon, ActiveAlert, FireCell, FlexCheck, Secure Steps, SecurePartner, SecureU, X-Force, and X-Press Update are
trademarks and service marks, and SAFEsuite, Internet Scanner, Database Scanner, Online Scanner, and RealSecure registered
trademarks, of Internet Security Systems, Inc. Network ICE, the Network ICE logo, and ICEpac are trademarks, BlackICE a
licensed trademark, and ICEcap a registered trademark, of Network ICE Corporation, a wholly owned subsidiary of Internet
Security Systems, Inc. SilentRunner is a registered trademark of Raytheon Company. Acrobat and Adobe are registered
trademarks of Adobe Systems Incorporated. Certicom is a trademark and Security Builder is a registered trademark of
Certicom Corp. Check Point, FireWall-1, OPSEC, Provider-1, and VPN-1 are registered trademarks of Check Point Software
Technologies Ltd. or its affiliates. Cisco and Cisco IOS are registered trademarks of Cisco Systems, Inc. HP-UX and OpenView
are registered trademarks of Hewlett-Packard Company. IBM and AIX are registered trademarks of IBM Corporation.
InstallShield is a registered trademark and service mark of InstallShield Software Corporation in the United States and/or other
countries. Intel and Pentium are registered trademarks of Intel. Lucent is a trademark of Lucent Technologies, Inc. ActiveX,
Microsoft, Windows, and Windows NT are either registered trademarks or trademarks of Microsoft Corporation. Net8, Oracle,
Oracle8, SQL*Loader, and SQL*Plus are trademarks or registered trademarks of Oracle Corporation. Seagate Crystal Reports,
Seagate Info, Seagate, Seagate Software, and the Seagate logo are trademarks or registered trademarks of Seagate Software
Holdings, Inc. and/or Seagate Technology, Inc. Secure Shell and SSH are trademarks or registered trademarks of SSH
Communications Security. iplanet, Sun, Sun Microsystems, the Sun Logo, Netra, SHIELD, Solaris, SPARC, and UltraSPARC are
trademarks or registered trademarks of Sun Microsystems, Inc. in the United States and other countries. All SPARC trademarks
are used under license and are trademarks or registered trademarks of SPARC International, Inc. in the United States and other
countries. Adaptive Server, SQL, SQL Server, and Sybase are trademarks of Sybase, Inc., its affiliates and licensers. Tivoli is a
registered trademark of Tivoli Systems Inc. UNIX is a registered trademark in the United States and other countries, licensed
exclusively through X/Open Company, Ltd. All other trademarks are the property of their respective owners and are used here
in an editorial context without intent of infringement. Specifications are subject to change without notice.
Copyright © Sax Software (terminal emulation only).
Disclaimer: The information contained in this document may change without notice, and may have been altered or changed if
you have received it from a source other than ISS or the X-Force. Use of this information constitutes acceptance for use in an
“AS IS” condition, without warranties of any kind, and any use of this information is at the user’s own risk. ISS and the X-Force
disclaim all warranties, either expressed or implied, including the warranties of merchantability and fitness for a particular
purpose. In no event shall ISS or the X-Force be liable for any damages whatsoever, including direct, indirect, incidental,
consequential or special damages, arising from the use or dissemination hereof, even if ISS or the X-Force has been advised of
the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental
damages, so the foregoing limitation may not apply.
Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or
otherwise, does not necessarily constitute or imply its endorsement, recommendation, or favoring by Internet Security Systems,
Inc. The views and opinions of authors expressed herein do not necessarily state or reflect those of Internet Security Systems,
Inc., and shall not be used for advertising or product endorsement purposes.
Links and addresses to Internet resources are inspected thoroughly prior to release, but the ever-changing nature of the Internet
prevents Internet Security Systems from guaranteeing the content or existence of the resource. When possible, the reference
contains alternate sites or keywords that could be used to acquire the information by other methods. If you find a broken or
inappropriate link, please send an email with the topic name, link, and its behavior to [e-mail] .
June 18, 2003

iii
Proventia A604, A1204, and A1204F Appliance User Guide
Contents
Preface. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v
About Appliance Documentation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . vi
Conventions Used in this Guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . vii
Getting Technical Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . viii
Chapter 1: Introduction to Proventia A604, A1204, and A1204F Appliances 1
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
About the Proventia™ A604, A1204, and A1204F Appliances . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
Setting Up a Local Configuration Interface and Logging In . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
Chapter 2: Configuring and Viewing Appliance Settings. . . . . . . . . . . . . . . . . . . . . . 5
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Changing the Administrative Password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Changing the Network Configuration Settings. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Changing the Host Configuration Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Changing the Date and Time Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Changing the Time Zone Setting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Viewing Appliance Host, Network Configuration, Date/Time, and Time Zone Settings . . . . . . . . . . . . . 11
Viewing the Status of Appliance Components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Restarting the Agent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Allowing SiteProtector Access to the Appliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
Configuring the RSKILL Response. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Configuring Packet Captures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Customizing the No Packet Alert . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Changing the Port ID Value . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Shutting Down or Rebooting the Appliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Logging Out of the Local Configuration Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Chapter 3: Troubleshooting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
Reinstalling the Appliance Software . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Using Advanced Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

iv
Contents

v
Proventia A604, A1204, and A1204F Appliance User Guide
Preface
Overview
Purpose of this
guide
This guide describes the procedures and requirements for configuring the Proventia
A604, A1204, and A1204F appliances. The guide contains instructions for the following:
●setting up a local configuration interface
●changing configuration settings
●reinstalling the appliance software
Audience This guide is intended for current and new users of the appliances.
First version of this
guide
The Proventia™ A604, A1204, and A1204F User Guide includes information about the
following topics:
●configuring packet captures for Proventia appliances
●configuring the no packet alert for Proventia appliances
●configuring the port ID for Proventia appliances
●reinstalling the appliance software
●configuring an agent name and the RSKILL response

Preface
vi
About Appliance Documentation
Using this guide Use this guide together with the Proventia™A604, A1204, and A1204F Appliance Quick
Start Card.
Related publications For additional information, see the following publications:
●SiteProtector Help
●ISS Response, Policy, and Event Collector Help

Conventions Used in this Guide
vii
Proventia A604, A1204, and A1204F Appliance User Guide
Conventions Used in this Guide
Introduction This topic explains the typographic conventions used in this guide to make information in
procedures and commands easier to recognize.
In procedures The typographic conventions used in procedures are shown in the following table:
Command
conventions
The typographic conventions used for command lines are shown in the following table:
Convention What it Indicates Examples
Bold An element on the graphical
user interface.
Type the computer’s
address in the IP Address
box.
Select the Print check box.
Click OK.
SMALL CAPS A key on the keyboard. Press ENTER.
Press the PLUS SIGN (+).
Constant
width
A file name, folder name,
path name, or other
information that you must
type exactly as shown.
Save the User.txt file in
the
Addresses folder.
Type
IUSR__SMA in the
Username box.
Constant
width
italic
A file name, folder name,
path name, or other
information that you must
supply.
Type Version number in
the Identification
information box.
àA sequence of commands
from the taskbar or menu bar.
From the taskbar, select
StartàRun.
On the File menu, select
UtilitiesàCompare
Documents.
Table 1: Typographic conventions for procedures
Convention What it Indicates Examples
Constant
width bold
Information to type in exactly
as shown.
md ISS
Italic
Information that varies
according to your
circumstances.
md your_folder_name
[ ] Optional information.
dir [drive:][path]
[filename][/P][/W]
[/D]
|Two mutually exclusive
choices.
verify [ON|OFF]
{ } A set of choices from which
you must choose one.
% chmod {ugo
a}=[r][w][x]file
Table 2: Typographic conventions for commands

Preface
viii
Getting Technical Support
Introduction ISS provides technical support through its Web site and by email or telephone.
The ISS Web site The Internet Security Systems (ISS) Resource Center Web site (
http://www.iss.net/
support/ ) provides direct access to much of the information you need. You can find
frequently asked questions (FAQs), white papers, online documentation, current versions
listings, detailed product literature, and the Technical Support Knowledgebase (
http://
www.iss.net/support/knowledgebase/ ).
Hours of support The following table provides hours for Technical Support at the Americas and other
locations:
Contact information The following table provides email addresses and telephone numbers for technical
support requests:
Location Hours
Americas 24 hours a day
All other locations Monday through Friday, 9:00 A.M. to 6:00 P.M. during
their local time, excluding ISS published holidays
Note: If your local support office is located outside the
Americas, you may call or email the Americas office for
help during off-hours.
Table 3: Hours for technical support
Regional Office Email Address Telephone Number
North America and
Latin America
suppor[email protected]
(1) [phone] (toll
free)
(1) [phone]
Europe, Middle
East, and Africa
suppor[email protected]
(44) [phone]
Asia-Pacific and
Philippines
asia-
suppor[email protected]
(63) (2) 886-6014
Japan
suppor[email protected]o.jp
Domestic: (81) (3) 5740-
4065
Overseas (APAC): (81) (3)
5740-4066
Table 4: Contact information for technical support

1
Proventia A604, A1204, and A1204F Appliance User Guide
Chapter 1
Introduction to Proventia A604,
A1204, and A1204F Appliances
Overview
Introduction This chapter describes the Proventia A604, A1204, and A1204F appliances. It also contains
instructions for logging on to the local configuration interface.
In this chapter This chapter contains the following topics:
Topic Page
About the Proventia™ A604, A1204, and A1204F Appliances 2
Setting Up a Local Configuration Interface and Logging In 3

Chapter 1: Introduction to Proventia A604, A1204, and A1204F Appliances
2
About the Proventia™ A604, A1204, and A1204F Appliances
What are Proventia
appliances?
ISS Proventia appliances dynamically protect your network from threats and significantly
reduce your company’s acquisition, deployment, and support costs. Centrally manage
appliances, along with all other ISS network, server, and desktop protection agents, with
one security management platform: SiteProtector™.
Hardware
differences between
models
The A604 and A1204 appliances include gigabit copper detection ports (A/B and C/D).
The A1204F appliance includes gigabit fiber detection ports (A/B and C/D).
Reference: For more information about the appliance hardware, see the following
Internet Security Systems documents:
●Proventia A604, A1204, and A1204F Quick Start Card
●Proventia A Series Specifications
●ISS Proventia Dynamic Threat Protection Appliances Frequently Asked Questions
Installing and
configuring an
appliance
ISS delivers appliances with pre-installed software. See the Quick Start Card that is
provided with the appliance for instructions on installing the appliance in a rack and for
initial configuration.
Note: Installation and configuration procedures for the A1204 and A1204F appliances are
the same as for the A604 appliance.
Managing the
appliance from the
console
After you complete the configuration steps listed on the Quick Start Card, you must
continue to configure the appliance from the management console.
Reference: For instructions on viewing events and managing the appliance from the
SiteProtector management console, see the management console user documentation at
http://www.iss.net/support/documentation/ .
Licensing Proventia A604, A1204, and A1204F appliances require a properly configured license key.
If you have not installed the appropriate license key through the management console,
you will not be able to manage the appliance.
Purchasing a license: To purchase a license for a Proventia A604, A1204, or A1204F
appliance, contact your local sales representative.

Setting Up a Local Configuration Interface and Logging In
3
Proventia A604, A1204, and A1204F Appliance User Guide
Setting Up a Local Configuration Interface and Logging In
Introduction Before you can view or change appliance settings, you must set up a local configuration
interface and log in to the appliance.
Procedure To set up a local configuration interface and log in to the appliance:
1. Do one of the following:
■Connect a keyboard and monitor to the connectors on the rear panel of the
appliance.
■Connect a computer (such as a laptop) to the serial port on the rear panel of the
appliance.
–Specify 8 data bits, no parity, and 1 stop bit (8-N-1).
–Set the computer to VT-100 terminal emulation mode at 9600 bps.
–Set flow control to None.
–Select the com port to which you have connected the appliance.
The appliance displays the login prompt:
<appliance name> login: _
2. Type admin , and then press ENTER.
3. Type the admin password, and then press ENTER.
Note: The default password is admin.
An introductory screen appears.
4. Press ENTER.
The Configuration menu appears.
5. Use the UP and DOWN arrow keys to move from one menu item to another.
6. Press ENTER to select a menu item.
7. Configure the appliance’s settings as described in Chapter 2, “Configuring and
Viewing Appliance Settings”on page 5.

Chapter 1: Introduction to Proventia A604, A1204, and A1204F Appliances
4

5
Proventia A604, A1204, and A1204F Appliance User Guide
Chapter 2
Configuring and Viewing Appliance
Settings
Overview
Introduction This chapter describes how to configure the appliance software and view appliance
settings.
In this chapter This chapter contains the following topics:
Topic Page
Changing the Administrative Password 6
Changing the Network Configuration Settings 7
Changing the Host Configuration Settings 8
Changing the Date and Time Settings 9
Changing the Time Zone Setting 10
Viewing Appliance Host, Network Configuration, Date/Time, and Time Zone Settings 11
Viewing the Status of Appliance Components 12
Restarting the Agent 13
Allowing SiteProtector Access to the Appliance 14
Configuring the RSKILL Response 15
Configuring Packet Captures 16
Customizing the No Packet Alert 18
Changing the Port ID Value 20
Shutting Down or Rebooting the Appliance 22
Logging Out of the Local Configuration Interface 23

Chapter 2: Configuring and Viewing Appliance Settings
6
Changing the Administrative Password
Introduction You can change the administrative password at any time.
Caution: Record and protect this password. If you lose the password, you must reinstall
the appliance.
Procedure To change the administrative password:
1. Set up a local configuration interface and log in, as described in “Setting Up a Local
Configuration Interface and Logging In”on page 3.
2. Select Change Admin Password from the Configuration menu, and then press ENTER.
3. Type the old password, and then press ENTER.
Note: The default password is admin.
4. Type the new password, and then press ENTER.
Note: You must use a minimum of six characters.
5. Retype the new password to confirm it, and then press ENTER.
The appliance displays a confirmation screen.
6. Press ENTER to return to the Configuration menu.

Changing the Network Configuration Settings
7
Proventia A604, A1204, and A1204F Appliance User Guide
Changing the Network Configuration Settings
Introduction You can change the following network configuration settings that you configured when
you installed the appliance:
●IP address
●subnet mask
●gateway
Procedure To change the network configuration settings:
1. Set up a local configuration interface and log in, as described in “Setting Up a Local
Configuration Interface and Logging In”on page 3.
2. On the Configuration menu, select Change Network Configuration, and then press
ENTER.
3. Type the new settings.
4. Press ENTER.
The appliance displays a progress message while it configures the host settings, and
then displays the message
Host configuration has been saved when the
configuration is complete.
5. Press ENTER to return to the Configuration menu.

Chapter 2: Configuring and Viewing Appliance Settings
8
Changing the Host Configuration Settings
Introduction You can change the following host configuration settings that you configured when you
installed the appliance:
●hostname (required)
●domain name (recommended)
●name server (recommended)
Note: The appliance uses domain names and DNS information to send Email and SNMP
responses. If you do not provide this information now, the appliance can still send Email
and SNMP responses. You must specify the IP address of the appliance's mail server when
you define the Email response on the management console. The appliance must have
network access to the mail server. For more information, see the management console's
user documentation.
Procedure To change the host configuration settings:
1. Set up a local configuration interface and log on, as described in “Setting Up a Local
Configuration Interface and Logging In”on page 3.
2. On the Configuration menu, select Change Host Configuration, and then press
ENTER.
3. Type the new settings.
4. Press ENTER.
A confirmation screen appears.
5. Press ENTER to return to the Configuration menu.

Changing the Date and Time Settings
9
Proventia A604, A1204, and A1204F Appliance User Guide
Changing the Date and Time Settings
Introduction You can change the date and time settings for the appliance that you configured when you
installed the appliance.
Procedure To change the date and time settings:
1. Set up a local configuration interface and log in, as described in “Setting Up a Local
Configuration Interface and Logging In”on page 3.
2. On the Configuration menu, select Set Date and Time, and then press ENTER.
3. Type the new date, and then press ENTER.
Note: Use the format [ MM/DD/YYYY ].
4. Type the new time, and then press ENTER.
Note: Use the format [ HH:MM:SS ] and a 24-hour clock.
The appliance displays a confirmation screen.
5. Press ENTER to return to the Configuration menu.

Chapter 2: Configuring and Viewing Appliance Settings
10
Changing the Time Zone Setting
Introduction You can change the time zone settings. The appliance sets the time zone according to your
selections.
Procedure To change the time zone setting:
1. Set up a local configuration interface and log in, as described in “Setting Up a Local
Configuration Interface and Logging In”on page 3.
2. On the Configuration menu, select Set Timezone, and then press ENTER.
3. Select the continent or ocean in which the appliance is located, and then press ENTER.
4. Select the country in which the appliance is located, and then press ENTER.
5. Select the region in which the appliance is located, and then press ENTER.
Note: This screen does not appear if the country you selected contains only one
region (time zone).
6. Type yto confirm.
The appliance displays the Configuration menu.

Viewing Appliance Host, Network Configuration, Date/Time, and Time Zone Settings
11
Proventia A604, A1204, and A1204F Appliance User Guide
Viewing Appliance Host, Network Configuration, Date/Time,
and Time Zone Settings
Introduction You can view the following settings that you configured during the appliance installation:
●the IP address, subnet mask, and gateway of the appliance management interface
●the hostname, domain name, and name server (if provided during initial installation)
of the appliance
●the current date, time, and time zone settings of the appliance
Procedure To view the settings:
1. Set up a local configuration interface and log on, as described in “Setting Up a Local
Configuration Interface and Logging In”on page 3.
2. On the Configuration menu, select Proventia A604 or A1204 Information, and then
press ENTER.
The appliance displays the information.
3. Press ESC to return to the Configuration menu.

Chapter 2: Configuring and Viewing Appliance Settings
12
Viewing the Status of Appliance Components
Introduction You can view the status and version of the agent and daemon components of the
appliance.
Procedure To view the status of the appliance components:
1. Set up a local configuration interface and log in, as described in “Setting Up a Local
Configuration Interface and Logging In”on page 3.
2. On the Configuration menu, select Agent Status, and then press ENTER.
The appliance displays the following items:
■status of the agent
■status of the daemon
■version of the agent
■version of the daemon
3. View the information, and then press ESC to return to the Configuration menu.
The appliance displays a confirmation screen.
4. Press ENTER to return to the Configuration menu.