M86 Security SWG User manual

SWG
Setup Guide
Secure Web Gateway
OVF Release 10.2

M86 SECURITY SWG SETUP GUIDE V. 10.2 2
M86 SECURITY: SWG SETUP GUIDE
© 2012 M86 Security
All rights reserved.
8845 Irvine Center Drive, Irvine, CA 92618, USA
Version 10.2 published March 2012 for SWG software release
10.2
This document may not, in whole or in part, be copied, photo-
copied, reproduced, translated, or reduced to any electronic
medium or machine readable form without prior written con-
sent from M86 Security.
Every effort has been made to ensure the accuracy of this
document. However, M86 Security makes no warranties with
respect to this documentation and disclaims any implied war-
ranties of merchantability and fitness for a particular purpose.
M86 Security shall not be liable for any error or for incidental
or consequential damages in connection with the furnishing,
performance, or use of this manual or the examples herein.
Due to future enhancements and modifications of this product,
the information described in this documentation is subject to
change without notice.
Trademarks
Other product names mentioned in this manual may be trade-
marks or registered trademarks of their respective companies
and are the sole property of their respective manufacturers.

TABLE OF CONTENTS
M86 SECURITY SWG SETUP GUIDE OVF V. 10.2 3
Table of Contents
Chapter 1: Before You Begin. . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Chapter 2: Installing the Appliance. . . . . . . . . . . . . . . . . . . . . . 6
Installing a Physical SWG Appliance. . . . . . . . . . . . . . . . . . . . . . . . .6
Requirements Before Installing a Physical Appliance................. 6
Connecting an Appliance Using an Ethernet Cable ....................7
Connecting an Appliance Using a Serial Cable ..........................9
Deploying a Virtual SWG From an OVF File . . . . . . . . . . . . . . . . . .10
Chapter 3: Setting Up the Appliance. . . . . . . . . . . . . . . . . . . . 11
Preparing Values for the Appliance Setup. . . . . . . . . . . . . . . . . . . .11
Setting Up the Appliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .13
Chapter 4: Performing Additional Configuration (Optional). 14
Limited Shell Commands — Summary List . . . . . . . . . . . . . . . . . . . 14
Limited Shell Configuration Commands. . . . . . . . . . . . . . . . . . . . . .19
access_list.................................................................................19
change_password.....................................................................19
config_ ......................................................................................20
disable_ ....................................................................................22
enable_ ..................................................................................... 22
ethconf....................................................................................... 23
flush_dnscache .........................................................................23
reset_config............................................................................... 23
Limited Shell Monitoring Commands. . . . . . . . . . . . . . . . . . . . . . . .24
arp.............................................................................................24
check_connectivity .................................................................... 24
df ...............................................................................................24
ifconfig.......................................................................................24
ip2name.....................................................................................24
iptraf ..........................................................................................24
last.............................................................................................25
name2ip.....................................................................................25
netstat........................................................................................25
ping............................................................................................ 25
poweroff.....................................................................................25
reboot........................................................................................ 25
restart_role ................................................................................25
save_exclude_logs....................................................................26
save_support_logs ....................................................................26
setup.......................................................................................... 26
show_ .......................................................................................26
supersh......................................................................................27
tcpdump.....................................................................................27
top .............................................................................................28
traceroute .................................................................................. 28

TABLE OF CONTENTS
M86 SECURITY SWG SETUP GUIDE OVF V. 10.2 4
uptime........................................................................................28
vmstat........................................................................................28
w................................................................................................28
wget...........................................................................................28

CHAPTER 1: BEFORE YOU BEGIN
M86 SECURITY SWG SETUP GUIDE V. 10.2 5
Chapter 1: Before You Begin
This guide provides the instructions you need to install and setup
your M86 Security SWG appliance.
You should perform the following tasks in the order listed:
1. Install the appliance (see Chapter 2).
2. Set up the appliance (see Chapter 3).
3. Optional appliance configuration (see Chapter 4).
After you have setup the appliance, you can configure the
Management Console according to your needs. Instructions are
provided in a separate guide – the Management Console
Reference Guide.
NOTE: Physical SWG appliances come with the required image
already loaded. Should you need to reload or replace the image,
you can find instructions in the SWG Installation Utility Guide.

INSTALLING APHYSICAL SWG APPLIANCE
M86 SECURITY SWG SETUP GUIDE V. 10.2 6
Chapter 2: Installing the Appliance
This chapter contains the following instructions:
yInstalling a Physical SWG Appliance
yDeploying a Virtual SWG From an OVF File
Installing a Physical SWG Appliance
Installation consists of connecting to the appliance. You can
connect in any of the following ways:
y Using an Ethernet Cable
y Using a Serial Cable (SWG 3000 and SWG 5000 only)
yUsing a keyboard and monitor
Instructions for connecting are provided on the following pages.
Before connecting to the appliance, ensure that the following
requirements are satisfied.
Requirements Before Installing a Physical Appliance
yWorking electric outlet:
1 Outlet for the SWG 3000
2 Outlets for the SWG 5000
4 16 amp Outlets for the SWG 7000, preferably via
PDU
yNetwork connection — cable and switch
yHardware for connecting — ethernet cable, serial cable, or a
keyboard and monitor
yRack space for the appliance
1U Rack space for SWG 3000 or SWG 5000
7U Rack space for SWG 7000
ySwitch port for the internet cable
yAppliance name
yPhysical address
yDNS address

CHAPTER 2: INSTALLING THE APPLIANCE
M86 SECURITY SWG SETUP GUIDE V. 10.2 7
yDNS name
yDefault gateway
Connecting an Appliance Using an Ethernet Cable
For SWG 3000 and SWG 5000 models
1. Plug in the power cable and switch the appliance on.
2. Connect a PC directly to the appliance’s GE0 port or via a switch
(for 5000-SWG, see
5000-SWG Rear Panel) using a standard (8
thread) Ethernet cable. CAT5e cables (or better) are
recommended.
3. The default IP of the GE0 interface is 10.0.0.1, and its default
netmask is 255.255.255.0. Configure the TCP/IP settings of your
PC so that it is on the same logical network subnet as the
appliance’s GE0 interface. For example, configure the IP on the
PC as 10.0.0.101 and the PC’s netmask as255.255.255.0
4. Continue with Initial Setup of your SWG Appliance using Limited
Shell.
For an SWG 7000 appliance
The SWG 7000 model is a chassis containing blade servers, each
of which operates as an appliance. This provides for overall higher
end performance.
Perform the following procedure for each blade regardless of its
intended network role.
1. Plug in the power cables.
2. Configure the network settings of any PC to match those of the
appliance (IP address and subnet mask).
y IP address in the same subnet e.g. 10.0.0.101
ySubnet mask 255.255.255.0
IMPORTANT: Do not set the PC’s IP to 10.0.0.1, as this will result
in an IP conflict with the appliance.

INSTALLING APHYSICAL SWG APPLIANCE
M86 SECURITY SWG SETUP GUIDE V. 10.2 8
3. Connect your PC to one of the ports on the Gigabit Ethernet
switch in I/
O switch module Bay 1 on the appliance using a
ethernet cable.
4. Power up the blades as follows:
Figure 1: Physical Control Panel for a Blade
In the control panel for the blade:
a. Press the KVM Select button so that the VGA screen
attached to the chassis displays output from the blade
being powered up.
b. Press the Power button until the blade turns on. After the
blade finishes booting, a login prompt is displayed.
5. Continue by doing either of the following:
y Repeat Step 1. for each blade, and when done, continue with
initial Setup of your SWG Appliance blades using the Limited
Shell.
or
yContinue with Initial Setup o f this SWG Appliance blade using
the
Limited Shell, and when done repeat Step 1. for each
blade. .
NOTE: For more information on setting up the SWG 7000, contact
your M86 Security representative.

CHAPTER 2: INSTALLING THE APPLIANCE
M86 SECURITY SWG SETUP GUIDE V. 10.2 9
Connecting an Appliance Using a S erial C able
1. Connect the PC to the appliance’s Serial Console, using the
serial cable.
2. Using the Hyper Terminal application, enter the appropriate Port
settings:
yBits per Second (Baud Rate): 19,200
yData Bits (Word): 8
yParity: None
yStop bits:1
NOTE: Connection using a serial cable is applicable only to SWG
3000 and SWG 5000 appliances.

DEPLOYING AVIRTUAL SWG FROM AN OVF FILE
M86 SECURITY SWG SETUP GUIDE V. 10.2 10
Deploying a Virtual SWG From an OVF File
This section explains how to deploy a virtual SWG from an OVF
file. Virtual SWG appliances are certified to work with a VMWare
ESXI version 4.1 server.
1. In the vSphere client, choose File Æ Deploy OVF Template.
2. In the wizard, browse to the OVF file and then complete the
deployment.
When done, it is recommended that you set the attributes for the
virtual machine according to the values indicated in Table 1.
NOTE: Before deploying the virtual appliance, ensure that you
have access to a VMWare vSphere client and that the OVF files
are accessible in your local machine.
Table 1: Recommended Values for the Virtual Machine
Machine Attribute Recommended Value
CPUs At least 2
Memory At least 4GB

CHAPTER 3: SETTING UPTHE APPLIANCE
M86 SECURITY SWG SETUP GUIDE V. 10.2 11
Chapter 3: Setting Up the Appliance
The setup procedure is the same for both physical and virtual SWG
appliances. You perform setup using a setup script that is run in
the Limited Shell.
This chapter contains the following sections:
yPreparing Values for the Appliance Setup
ySetting Up the Appliance
Preparing Values for the Appliance Setup
NOTE: Before setting up the installed appliance, you should
prepare for setup by assembling the detailed information and
values that you will need to supply as part of setup.
Table 2: Appliance Setup Preparation Details
What to Prepare Details
1Decide theroleof
the appliance. You must define a single Policy Server (provides management and reporting services), and at least one
Scanner (provides scanning and authentication
services). You can choose to define both of these
roles in the same appliance or in different appliances:
yAll In One (Default) – Defines the appliance as
both a Policy server and Scanner. This value is
often used for SWG 3000 or 5000 models.
ySWG Scanner – Defines the applianceor blade as
a Scanner only.
ySWG Policy Server – Defines the appliance or
blade as a Policy Server only.

PREPARING VALUES FOR THE APPLIANCE SETUP
M86 SECURITY SWG SETUP GUIDE V. 10.2 12
2Decide what network interface should be used for the appliance.
Network Interfaces Description
GE0 (eth0): 1GB -
Auto- negotiation
enabled -
Recommended!
Allows communication at a speed of up to 1GB with Auto-
Negotiation enabled. Auto- negotiation enables simple, automatic
connection
of appliances by taking control of the cable when a
connection is established to a network device that supports a
variety of modes from a variety of manufacturers. The device is
able
to automatically configure the highest speed.
GE1 (eth1): 1GB -
Auto- negotiation
Allows communication at a speed of up to 1GB with Auto-
Negotiation enabled.
GE2 (eth2): 1GB -
Auto- negotiation
(Available for SWG 5000, and the Policy Server in SWG 7000,
only.) Allows communication at a speed of up to 1GB with Auto-
Negotiation enabled.
GE3 (eth3) 1GB -
Auto- negotiation
(Available for SWG 5000, and the Policy Server in SWG 7000,
only.) Allows communication at a speed of up to 1GB with Auto-
Negotiation enabled.
3Determine the IP address and netmask for the selected interface as IP/
(netmask/prefix), if you will not be using the default settings.
4Determine the Default Gateway IP address.
5Determine the hostname if you will not be accepting the current settings.
6Determine the IP address for the DNS Server if you will not be accepting
the current DNS configuration settings. Note: DNS configuration setting is
mandatory.
7Determine the DNS domain names if you will not be accepting the current
settings.
8Decide on any password changes if required.
Table 2: Appliance Setup Preparation Details (continued)
What to Prepare Details

CHAPTER 3: SETTING UPTHE APPLIANCE
M86 SECURITY SWG SETUP GUIDE V. 10.2 13
Setting Up the Appliance
Perform the setup using the values you prepared.
1. Log in to the Limited Shell. The default user name and password
for the shell (command line) is admin and finjan respectively:
yFor a physical machine, you can connect from a remote
machine using an SSH client, serial cable, or by connecting a
keyboard andmonitorto the appliance.
yFor a virtual appliance, connect through the vSphere client.
2. Enter the setup command. The current configuration is
displayed.
Figure 2: Configuration Status
3. Using the data you prepared, page through the setup script
entering the needed values. This displayed configuration is
updated as you enter values.

LIMITED SHELL COMMANDS — SUMMARY LIST
M86 SECURITY SWG SETUP GUIDE V. 10.2 14
Chapter 4: Performing Additional Configuration
(Optional)
You can optionally use the commands of the Limited Shell to
manage the functionality of the appliance, and to monitor the
appliance
closely.
E ach appliance has differen t con f igura t ion needs, so there is no set
procedure.
I nstead, enter the relevant Limited Shell commands and
values.
Limited Shell commands are divided into two categories:
yConfiguration commands
yMonitoring commands
This chapter contains the following sections:
yLimited Shell Commands — Summary List
yLimited Shell Configuration Commands
yLimited Shell Monitoring Commands
Limited Shell Commands — Summary List
The following monitoring and configuration commands are
available:
NOTE: The C/M column indicates if the command is a
Configuration command (C) or Monitoring command (M).
Command C/M Description
access_list C Enables/disables access list
arp M Displays arp table
change_password C
Change password

CHAPTER 4: PERFORMING ADDITIONAL CONFIGURATION (OPTIONAL)
M86 SECURITY SWG SETUP GUIDE V. 10.2 15
check_connectivity M Checks connectivity to the remote devices
(for Policy server or All-in-One appliances)
config_ ... CNetwork or service configuration. Double tab
to view the config_network, config_time,
config_hardware, config_upgrade,
config_support, config_psweb,
config_exclude, config_bridge,
config_psha, and config_access_log
commands.
df M Displays disk usage
disable_ ... C Disables service. Double tab to view the
disable_service_snmpd and
disable_service_ssh commands.
enable_ ... C Enables service. Double tab to view the
enable_service_snmpd and
enable_service_ssh commands.
ethconf C Menu interface to ethtool
flush_dnscache C Flushes the DNS cache
ifconfig M Displays NIC configuration and statistics
ip2name M Resolve IP to hostname
iptraf M Interactive IP LAN monitor
last M Displays last login
name2ip M Resolve hostname to IP
netstat M Displays Network statistics
ping M Sends ICMP ECHO_REQUES to network
hosts
poweroff M Power off the system
reboot M
Reboots the system
Command C/M Description

LIMITED SHELL COMMANDS — SUMMARY LIST
M86 SECURITY SWG SETUP GUIDE V. 10.2 16
For more information on configuring the system, refer to Limited
Shell Configuration Commands
. For further in-depth analysis and
diagnostics of the system, refer to Limited Shell Monitoring
Commands.
reset_config C Sends full configuration to appliance
restart_role M Restarts the role
save_exclude_logs M
Saves Exclude logs
save_support_logs M
Saves Support logs
setup M
Runs configuration setup
show_ ... M
Shows system or service status.
Double
tab to view the show_bridge ,
show_config , show_network ,
show_service , show_dbsize ,
show_proxy_buffers ,
show_proxy_connections , show_route ,
show_time , and show_version commands
supersh M
Provides access to privileged shell
tcpdump M
Dumps traffic on a network.
Results
files will be under sftp chroot/
tcpdump_captures. Files can be downloaded
using any sftp client
top M
Displays linux tasks
traceroute M
Prints the route packets taken to network
host (traceroute
uptime M
Displays uptime
vmstat M
Reports information about system usage
(usage: vmstat,
wM
Shows who is logged on
wget M
Retrieves files using HTTP, HTTPS and FTP
Command C/M Description

CHAPTER 4: PERFORMING ADDITIONAL CONFIGURATION (OPTIONAL)
M86 SECURITY SWG SETUP GUIDE V. 10.2 17
Limited Shell Configuration Commands
Limited Shell configuration commands enable you to define therole
the appliance takes, the security, accessand time settings, and also
carry out routine maintenance operations. The configuration
commands are also used to define how the network works, and how
the appliance communicates with the network.
access_list
This feature is configured from the Management Console. The
administrator can define a range of IP addresses to access
Management applications on predefined ports (such as the
ManagementConsole, SNMP, SSH) or User applications on
predefined ports (such as HTTP, FTP, ICAP) or System ports
(internal ports). Any IP address not defined in the IP range will then
be blocked from accessing these applications on the ports defined
by M86 Security.
The access_list command is used to enable or disable the Access
List and is useful for situations when due to a mistaken
configuration, or other circumstances, you cannot access the
Management Console, and want to disable the Access List feature.
Enter the access_list command and choose enable or disable.
change_password
Allows system administrators to change the Limited Shell’s
password. For security reasons, it is recommended to choose a
password which contains both characters (higher case and lower
case) and digits. It is also recommended to change the password
frequently.
Enter the change_password command and confirm current and
new passwords.

LIMITED SHELL CONFIGURATION COMMANDS
M86 SECURITY SWG SETUP GUIDE V. 10.2 18
config _ ...
Enables network, service and Policy Server configuration. Press the
tab button twice to display the config_network, config_time,
config_hardware, config_upgrade, config_support, config_psweb,
config_exclude, config_bridge, config_psha, and config_access_log
commands.
config_network
Allowssystem administratorstoconfigurenetworkparameters, such
as the IP address(es), routing information, DNS parameters. Enter
the config_network command.
The current network configuration is displayed (i.e. the DNS Search
Domain, nameserver and Hostname configuration). A Name Server
is a network server that provides a naming, or directory service. A
prompt is displayed asking you if you would like to change the
configuration. Enter y to change the network configuration.
Select an option from the following commands:
y V iew: This command allows you to view the current network
configuration: The IP address assigned to each interface, the
current DNS configuration and the current hostname
configuration.
yInterface: Allows system administrators to modify interface
related parameters such as: Add, Remove or Change an IP
address from a physical interface; Add, Remove or Change
routing information; Enable or Disable a physical interface.
Choose an interface, for example, 1 (eth0). The
editing options are displayed.
Choose an editing action, for example, 1 (Change IP
address). To add a static route, choose 4 (Add
route). The new route must be input as ‘IP/via prefix
IP’. For example, 1.1.1.1/32 via 10.0.3
yGateway: Allows system administrators to set the default
gateway of the appliance. The IP address of the default
gateway must be a local IP address. It is mandatory to
configure a default gateway to the appliance.

CHAPTER 4: PERFORMING ADDITIONAL CONFIGURATION (OPTIONAL)
M86 SECURITY SWG SETUP GUIDE V. 10.2 19
To change the current gateway configuration, enter the IP
address.
yDNS: Allows configuring the DNS servers, which the appliance
uses in order to resolve the hostnames to IP addresses. It is
also possible to configure a search domain under the DNS
settings which allows the appliance to complete the domain
name (according to the configured value) in case the host
name is not completed. For example, if the search is on http://
mize and the search domain is M86 Security.com, the
appliance will try to resolve to http://mize.M86Security.com.
The current DNS configuration is displayed. Select an action,
for example, 1 (change search).
•Hostname: Allows configuring the appliance hostname.
•Hosts: Allows configuring the host files.
config_time
Allows system administrators to set the system date and time, the
time zone and also the NTP Server. To change a setting, type y.
Select an option from the menu, else Q to exit.
config_hardware
This command allows the system administrator to configure an
installed Caching Kit and/or Bypass NIC.
Note: Caching Kit is relevant for both physical and virtual devices.
Bypass NIC is only relevant to physical devices.
When the command is entered, the screen displays the installation
and configuration status of these two pieces of hardware.
To configure an installed piece of hardware, select the hardware
option (Caching Kit or Bypass NIC) from the menu, and then
enter Yto configure it. Select Qto exit.
IMPORTANT: It is mandatory to configure the DNS
Server that has the ability to resolv e exte rnal IP addresses

LIMITED SHELL CONFIGURATION COMMANDS
M86 SECURITY SWG SETUP GUIDE V. 10.2 20
config_upgrade
After upgrading the Policy Server to a new version, running this
command will upgrade the scanners.
config_support
Allows you to install support packages.
c onfig_psweb
Allows you to change the Policy Server management port for
enhanced security. To change the Listening port for the Policy
Server, add the new Port settings.
config_exclude
Defines bypass rules in intercepting proxy mode.
config_bridge
Configures intercepting proxy to work in bridge mode. In Bridge
mode, only traffic that should be scanned will be processed. All
other traffic will flow uninterrupted.
config_psha
Configure high availability.
config_access_log
Enables or disables the access log.
disable_ ...
Disables the service. The disable command includes the
disable_service_snmpd and disable_service_ssh commands.
disable_service_snmpd
Disables the snmpd network service. Enter the
disable_service_snmpd command.