McAfee Data Loss Prevention Prevent User manual

This quick start guide provides high-level instructions for setting up a McAfee® Data Loss Prevention Prevent (McAfee
DLP Prevent) or McAfee® Data Loss Prevention Monitor (McAfee DLP Monitor) hardware appliance.
For complete details, or if you are setting up a virtual appliance, see the McAfee Data Loss Prevention Product Guide.
For setting up a McAfee DLP appliance at version 9.3.x, see the product guide for your version.
1 Check your shipment
Each product ships with all the items needed to install the appliance on a network. Check the contents list to
verify that you received all these items.
2 Download product documentation
aGo to the ServicePortal at https://support.mcafee.com and click the Knowledge Center tab.
bIn the Knowledge Base pane under Content Source, click Product Documentation.
cSelect a product and version, then click Search to display a list of documents.
dDownload these documents.
•McAfee Data Loss Prevention Product Guide — Information about conguration, maintenance, and
troubleshooting
•McAfee Data Loss Prevention Hardware Guide — Information about replacing hardware components
and re-imaging an appliance
3 Plan your conguration
Use the deployment information in the product guide to plan the integration of McAfee DLP products in your
network.
aFamiliarize yourself with the McAfee DLP deployment options.
bComplete the deployment checklist.
Quick Start Guide
Revision A
McAfee Data Loss Prevention Appliances
version 11.0
1

4 Identify network ports
Locate the network ports on your appliance. Unlabeled ports are not used.
Figure 1 Model 4400 appliance port conguration
1Serial port
2OOB port
3LAN1 port
4Remote access port (RMM)
5Ethernet port or ber port *
• McAfee DLP Prevent — Unused
• McAfee DLP Monitor — Capture port 1
6Ethernet port — Unused
* If the appliance has a ber NIC:
• For McAfee DLP Prevent, the ber port becomes LAN1.
• For McAfee DLP Monitor, the ber port becomes Capture port 1.
On some 4400 models, the capture ports might be on a slotted NIC instead of on the motherboard.
In this case, these two ports are swapped over.
Figure 2 Model 5500 appliance port conguration
1Ethernet port or ber port — Unused
2Ethernet port or ber port *
• McAfee DLP Prevent — Unused
• McAfee DLP Monitor — Capture port 1
2

3OOB port
4LAN1 *
5Serial port
6Remote access port (RMM)
* If the appliance has a ber NIC:
• For McAfee DLP Prevent, this ber port (callout 2) becomes the LAN1 port.
• For McAfee DLP Monitor, this ber port (callout 2) becomes Capture port 1.
Figure 3 Model 6600 appliance port conguration
1LAN1
2McAfee DLP Prevent — Unused
McAfee DLP Monitor — Capture port 1
3OOB port
4Serial port
5Remote access port (RMM)
5 Install the extensions
Prepare the McAfee ePO server for integration with McAfee DLP Appliance Management.
For information about manually installing the extensions, see the product guide.
For details about product features, usage, and best practices, click ? or Help.
aIn McAfee ePO, select Menu | Software | Software Manager.
bIn the left pane, expand Software (by Label) and select Data Loss Prevention.
cSelect the entry for McAfee Network Data Loss Prevention.
These extensions are included:
• McAfee DLP
• Common UI
• Appliance Management Extension
• McAfee DLP Appliance Management
3

dClick Check In.
eSelect the checkbox to accept the agreement, then click OK.
6Congure network information
For McAfee DLP appliances, congure the DNS server and NTP server. For McAfee DLP Prevent, you must also
congure a Smart Host.
For details about product features, usage, and best practices, click ? or Help.
aIn McAfee ePO, select Menu | Policy | Policy Catalog.
bFrom the Product drop-down list, select Common Appliance Management.
cSelect the My Default policy.
dAdd the DNS server and the NTP server, then click Save.
eFrom the Product drop-down list, select DLP Appliance Management.
fSelect the My Default policy for McAfee DLP Prevent Email Settings.
gEnter the IP address of the Smart Host, then click Save.
7 Set up the appliance
Prepare the appliance for network integration.
The appliance power supply units and the hard disk can be replaced. Instructions are available in the
hardware guide.
By default, each appliance is congured with these IP addresses after installation:
•McAfee DLP Prevent LAN1 — 10.1.1.108/24
Use the LAN1 network for SMTP or ICAP trac. You can also use it for management trac.
•McAfee DLP Monitor LAN1 — 10.1.1.108/24
Use the LAN1 network for management trac.
•OOB — 10.1.3.108/24
(Optional) Use the out-of-band (OOB) network for management trac including McAfee ePO
communication.
McAfee DLP Monitor Capture port 1 is used for analysis trac. It is not congured with any IP address.
If your network uses DHCP, the rst IP address that the DHCP server assigns to the McAfee DLP
appliance is used instead. You can manually congure the IP address with the Setup Wizard. The
appliance does not support using a continuous DHCP conguration.
The default gateway for the appliance must be on the LAN1 subnet. Congure any routing required on the
OOB interface using static routes.
aInstall the appliance in a rack.
bConnect a monitor, keyboard, and mouse to the appliance.
4

cConnect the appliance to the network:
1) McAfee DLP Prevent and McAfee DLP Monitor — Connect the LAN1 interface of the appliance to
your network.
2) McAfee DLP Monitor — Connect the Capture port 1 interface to your network tap or SPAN port.
d(Optional) Connect the OOB interface to another network.
This is required for McAfee DLP Monitor if you are not using LAN1 for your management trac.
8 Install the appliance
Install the software and run the Setup Wizard.
aPrepare the appliance for installation.
•6600 appliances — Turn on the appliance.
•4400 and 5500 appliances
1Using the installation ISO le, create or set up the external imaging media. You can perform the
initial installation using these methods:
• USB drive
Use image writing software, such as Launchpad Image Writer, to write the image
to the USB drive. For more information, see KB87321.
• USB CD drive
• (4400 appliances only) Integrated CD drive
• Virtual CD drive using the remote management module (RMM)
2Insert or connect the media to the appliance.
3Turn on the appliance.
4Before the operating system starts, press F6 for the boot menu and select the external media.
R3c0n3x is the BIOS password for 4400 appliances.
bFollow the on-screen prompts.
When the installation completes, the appliance restarts.
cComplete the Setup Wizard using the information in the on-screen Help.
dIf the installation fails:
1Verify the network connection is working and any congured static routes are correct.
2Ping the default gateway and McAfee ePO from the appliance console.
3If the problem persists, contact technical support for assistance. Do not perform the installation
again.
When you contact technical support, make sure you know the appliance primary serial number. You
can nd the serial number on the product name sticker on the delivery packaging, the sticker on the
bottom-left of the top panel, or the sticker on the pull-out tray on the front panel.
5

The McAfee DLP appliance is installed and registered to McAfee ePO.
9 Post-setup tasks
For more information on these tasks, see the product guide.
McAfee DLP appliances
1Congure an evidence server to store the les that trigger a rule.
2Congure one or more syslog servers if required.
3Enable relevant predened policies and rules.
4Create additional classications, policies, and rules to detect potential data loss incidents.
5Conrm that incidents are recorded in the DLP Incident Manager.
McAfee DLP Prevent appliances
For McAfee DLP Prevent appliances that analyze email trac:
1Verify connectivity and mail ow between the mail transfer agent (MTA) server and the McAfee DLP
Prevent appliance.
2Conrm that the X-RCIS-Action: Allow header is added to received email.
For McAfee DLP Prevent appliances that analyze web trac, verify connectivity between the web proxy server
and the appliance.
McAfee DLP Monitor appliances
• Generate some trac that the congured network tap or SPAN can see.
6

7

Copyright © 2017 McAfee LLC
McAfee and the McAfee logo are trademarks or registered trademarks of McAfee LLC or its subsidiaries in the US and other countries. Other
marks and brands may be claimed as the property of others.
8700-4558A00