McAfee M-1250 - Network Security Platform User manual

M-1250/M-1450 Sensor Product Guide
Revision D
McAfee® Network Security Platform

COPYRIGHT
Copyright © 2017 McAfee, LLC
TRADEMARK ATTRIBUTIONS
McAfee and the McAfee logo, McAfee Active Protection, ePolicy Orchestrator, McAfee ePO, McAfee EMM, Foundstone, McAfee LiveSafe, McAfee QuickClean, Safe Eyes,
McAfee SECURE, SecureOS, McAfee Shredder, SiteAdvisor, McAfee Stinger, True Key, TrustedSource, VirusScan are trademarks or registered trademarks of McAfee,
LLC or its subsidiaries in the US and other countries. Other marks and brands may be claimed as the property of others.
LICENSE INFORMATION
License Agreement
NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE
GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE
CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE
RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU
DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF
APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND.
2McAfee® Network Security Platform M-1250/M-1450 Sensor Product Guide

Contents
Preface 5
About this guide ................................... 5
Audience ...................................5
Conventions ..................................5
What's in this guide ...............................6
Find product documentation ...............................6
1Introducing Network Security Sensors 7
About the M-1250/M-1450 Sensor ............................ 7
Physical description of the M-1250/M-1450 Sensor ...................... 8
Ports on the Sensor ...............................8
Front panel LEDs on M-1250/M-1450 Sensor ......................9
2Before you install 11
Usage restrictions .................................. 11
Safety measures ...................................11
Contents of the Sensor box ...............................12
Unpack the Sensor ..................................12
3Setting up the Sensor 15
Setup overview ................................... 15
Position the Sensor ..................................15
Install the ears on the chassis ...........................15
Mount the Sensor on a rack ........................... 16
Cable the Sensor .................................. 17
Power on the Sensor ................................. 17
Power o the Sensor ..............................17
4Attaching cables to the Sensor 19
Cable the Console port ................................ 19
Cable the Auxiliary port ................................ 20
Connect the cable to the Response port ..........................20
Cable the Management port .............................. 21
Cable Monitoring ports ................................ 21
How to use peer ports ............................. 21
Default Monitoring port speed settings ....................... 22
Cable types for routers, switches, hubs, and PCs ....................22
Cable the Sensor to monitor in in-line mode ........................ 23
Cable the Sensor to monitor in SPAN or hub mode ......................23
About connecting Sensors for fail-over .......................... 23
Cable M-1250/M-1450 Sensor for failover ...................... 24
AM-1250/M-1450 Sensor specications 25
McAfee® Network Security Platform M-1250/M-1450 Sensor Product Guide 3

BRegulatory, compliance, and safety information 27
Index 29
Contents
4McAfee® Network Security Platform M-1250/M-1450 Sensor Product Guide

Preface
This guide provides the information you need to congure, use, and maintain your McAfee product.
Contents
About this guide
Find product documentation
About this guide
This information describes the guide's target audience, the typographical conventions and icons used in this
guide, and how the guide is organized.
Audience
McAfee documentation is carefully researched and written for the target audience.
The information in this guide is intended primarily for:
•Administrators — People who implement and enforce the company's security program.
•Users — People who use the computer where the software is running and can access some or all of its
features.
Conventions
This guide uses these typographical conventions and icons.
Italic Title of a book, chapter, or topic; a new term; emphasis
Bold Text that is emphasized
Monospace Commands and other text that the user types; a code sample; a displayed message
Narrow Bold Words from the product interface like options, menus, buttons, and dialog boxes
Hypertext blue A link to a topic or to an external website
Note: Extra information to emphasize a point, remind the reader of something, or provide an
alternative method
Tip: Best practice information
Caution: Important advice to protect your computer system, software installation, network,
business, or data
Warning: Critical advice to prevent bodily harm when using a hardware product
McAfee® Network Security Platform M-1250/M-1450 Sensor Product Guide 5

What's in this guide
This guide contains information necessary to setup your M-1250/M-1450 Sensor model. This information
includes guiding you through preconguring, cabling, and troubleshooting your Sensor.
Find product documentation
On the ServicePortal, you can nd information about a released product, including product documentation,
technical articles, and more.
Task
1Go to the ServicePortal at https://support.mcafee.com and click the Knowledge Center tab.
2In the Knowledge Base pane under Content Source, click Product Documentation.
3Select a product and version, then click Search to display a list of documents.
Preface
Find product documentation
6McAfee® Network Security Platform M-1250/M-1450 Sensor Product Guide

1Introducing Network Security Sensors
This section describes the McAfee® Network Security Sensors at a high-level and also describes the McAfee®
M-1250/M-1450 Network Security Sensor (Sensor) in detail.
Sensors are high-performance, scalable, and exible content processing appliances built for the accurate
detection and prevention of intrusions, misuse, distributed denial of service (DDoS) attacks, and network access
control(NAC) of hosts. When deployed at key access points, a Sensor provides real-time trac monitoring to
detect malicious activity, and respond to the malicious activity as congured by the administrator.
After the Sensor is deployed and communication established, Sensors are congured and managed using the
McAfee Network Security Manager (Manager) server.
The process of conguring a Sensor and establishing communication with the Manager is described in the later
chapters of this guide. The Manager server is described in detail in the McAfee Network Security Platform Manager
Administration Guide.
Contents
About the M-1250/M-1450 Sensor
Physical description of the M-1250/M-1450 Sensor
About the M-1250/M-1450 Sensor
The M-1250 or the M-1450 Sensor provides eective network IPS functionality as well as Network Access
Control (NAC) of hosts.
The IPS functionality involves real-time detection and prevention of threats and known, zero-day, or encrypted
attacks. The Sensor can perform many types of attack responses, including generating alerts and packet logs,
resetting TCP connections, "scrubbing" malicious packets, and even blocking attack packets entirely before they
reach the intended target.
Network Access Control of hosts is regulating access to network resources based on host System Health level
(Standard/ DHCP NAC), identity of the user logged into the host (IBAC), or both. The Sensor also provides the
Hybrid NAC functionality where a host is rst subjected to DHCP-NAC and then Standard NAC at dierent ports
of the same Sensor. For more information on the NAC functionality and congurations of the Manager, see the
NAC Administration Guide.
Throughout this guide the terms, 'Sensor' and 'M-1250/M-1450' refer to the M-1250 or the M-1450
Sensor in general.
1
McAfee® Network Security Platform M-1250/M-1450 Sensor Product Guide 7

Physical description of the M-1250/M-1450 Sensor
The M-1250/M-1450 Sensor is equipped with eight Fast Ethernet ports (or interfaces). M-1250 can monitor up to
100 Mbps, and M-1450 can monitor upto 200 Mbps of aggregated trac respectively. The M-1250/M-1450
Sensor can monitor four 10/100/1000 Mbps Ethernet segments in full-duplex mode (tap or in-line), and eight
segments in half-duplex mode (monitoring SPAN ports or hubs).
Ports on the Sensor
The M-1250/M-1450 Sensor is a one rack-unit (1RU) box equipped with the following ports:
Figure 1-1 M-1450 Sensor Front Panel
Item Description
1 RJ-45 10/100/1000 Management port (1)
2 RJ-45 Response port (1)
3 RS-232C Console port (1)
4 RS-232C Auxiliary port (1)
5 RJ-45 10/100/1000 Ethernet Monitoring ports (8)
6 External Compact Flash port (1)
7 Power supply A (1)
Figure 1-2 M 1450 Sensor back panel
1One 10/100/1000 Management port, which is used for secure communication with the Manager server.
Communication between the Sensor and the Manager server uses secure channels; these channels provide
link privacy using encryption and mutual authentication between Sensors and the Manager using public key
authentication. You assign an IP address to this Ethernet port during installation.
2One Response port, which, when you are operating in the SPAN mode, enable you to inject response
packets back into your network, for example, through a switch or router. The Response port is also used in
the tap mode.
3One RS-232C Console port, which is used to set up and congure the Sensor.
4One RS-232C Auxiliary port, which may be used to dial in remotely to set up and congure the Sensor.
5Eight 10/100/1000 Monitoring ports, which enable you to monitor eight SPAN ports or four full-duplex
tapped segments or four segments in-line. When the Sensor operates in the IPS mode, these ports operate
in stealth mode; that is, they have no IP addresses nor even a TCP/IP stack to respond to IPS detection
techniques. This renders them completely invisible to intruders. When operating in the NAC mode, the
monitoring ports can be assigned IP addresses. The monitoring ports for M-1250/M-1450 Sensor are 1A/1B,
2A/2B, 3A/3B and 4A/4B.
1Introducing Network Security Sensors
Physical description of the M-1250/M-1450 Sensor
8McAfee® Network Security Platform M-1250/M-1450 Sensor Product Guide

6One External Compact Flash port. This port is used for two purposes. It is used to control optional
fail-open hardware as described in the Gigabit Optical Fail-Open Bypass Kit Guide. It is also used in
troubleshooting situations where the Sensor's internal ash is corrupted and you must reboot the Sensor
using the external compact ash. For more information, see the on-line KnowledgeBase at http://
mysupport.mcafee.com/Eservice/. Click Search the KnowledgeBase.
7Power supply. The Sensor power supply port is located on the front side of the Sensor. The supply uses a
standard IEC port (IEC320-C13). McAfee provides a standard, 2m NEMA 5-15P (US) power cable (3 wire).
International customers are provided with a country-appropriate power cable.
Front panel LEDs on M-1250/M-1450 Sensor
The front panel LEDs provide status information for the health of the Sensor and the activity on its ports.
The image and table that follows describe the operational M-1250/M-1450 front panel LEDs.
Figure 1-3 LEDs on the front panel that are used during normal operating conditions
Region in the image LEDs represented here
1 Pwr, Sys, Temp, Fan, Management Port Speed, Management Port Link, Response Port
Speed, Response Port Link
2 10/100/1000 Monitoring Ports Speed, 10/100/1000 Monitoring Ports Link
3 Flash
LED Status Description
Pwr Green
O
The Sensor is powered on and functioning.
The Sensor is powered o.
Sys Green
Amber
Sensor is operating.
Sensor is booting. (It could also indicate a system failure.)
Temp Green
Amber
Inlet air temperature measured inside chassis is normal. (Chassis
temperature OK.)
Inlet air temperature measured inside chassis is too hot. (Chassis
temperature too hot.)
Fan Green
Amber
Fan is operating.
The fan has failed.
Management Port Speed Green
Amber
O
The port speed is 1000 Mbps.
The port speed is 100 Mbps.
The port speed is 10 Mbps.
Management Port Link Green
O
The link is connected.
The link is disconnected.
Introducing Network Security Sensors
Physical description of the M-1250/M-1450 Sensor 1
McAfee® Network Security Platform M-1250/M-1450 Sensor Product Guide 9

LED Status Description
Response Port Speed Green
Amber
O
The port speed is 1000 Mbps.
The port speed is 100 Mbps.
The port speed is 10 Mbps.
Response Port Link Green
O
The link is connected.
The link is disconnected.
10/100/1000 Monitoring
Ports Speed
Green
Amber
O
The port speed is 1000 Mbps.
The port speed is 100 Mbps.
The port speed is 10 Mbps.
10/100/1000 Monitoring
Ports Link
Green
O
The link is connected.
The link is disconnected.
Flash Green
O
Activity on external compact ash.
No activity on external compact ash.
The image and table that follows describe the front panel LEDs that indicate normal or bypass modes on the
M-1250/M-1450.
Figure 1-4 LEDs on the front panel that indicate normal / bypass status
These LEDs are used during both Inline/Fail-open and Inline/Fail-close modes of operation. However, they also
remain green when the Sensor is used in tap or SPAN modes, regardless of whether trac passes through the
Sensor or gets dropped.
Status Operation Description
Green In-line, Fail-open The Sensor port pair is in-line, receiving normal trac.
In-line, Fail-close The Sensor port pair is in-line, receiving normal trac.
Tap or SPAN The Sensor port receives normal trac.
Tap or SPAN The Sensor port receives normal trac. Trac is dropped.
OFF Bypass The Sensor port pair is not in-line and trac is bypassed.
1Introducing Network Security Sensors
Physical description of the M-1250/M-1450 Sensor
10 McAfee® Network Security Platform M-1250/M-1450 Sensor Product Guide

2Before you install
This chapter describes the best practices for deployment of Sensors on your network. Topics include system
requirements, site planning, safety considerations for handling the Sensor, and usage restrictions that apply to
the Sensor.
Contents
Usage restrictions
Safety measures
Contents of the Sensor box
Unpack the Sensor
Usage restrictions
The following restrictions apply to the use and operation of a Sensor:
• You may not remove the outer shell of the Sensor. Doing so will invalidate your warranty.
• The Sensor appliance is not a general purpose workstation.
• McAfee prohibits the use of the Sensor appliance for anything other than operating McAfee® Network
Security Platform (formerly McAfee® IntruShield®).
• McAfee prohibits the modication or installation of any hardware or software in the Sensor appliance that is
not part of the normal operation of McAfee Network Security Platform.
Safety measures
Please read the following warnings before you install the product. These safety measures apply to all Sensor
models unless otherwise specied.
Failure to observe these safety warnings could result in serious physical injury.
Warnings:
• Read the installation instructions before you connect the system to its power source.
• To remove all power from the Sensor, unplug all power cords, including the redundant power cord.
• Only trained and qualied personnel should be allowed to install, replace, or service this equipment.
• Before working on an equipment that is connected to power lines, remove jewelry (including rings,
necklaces, and watches). Metal objects will heat up when connected to power and ground, and can cause
serious burns or weld the metal object to the terminals.
2
McAfee® Network Security Platform M-1250/M-1450 Sensor Product Guide 11

• This equipment is intended to be grounded. Ensure that the host is connected to earth ground during
normal use.
• Do not remove the outer shell of the Sensor. Doing so will invalidate your warranty.
• Do not operate the system unless all cards, faceplates, front covers, and rear covers are in place. Blank
faceplates and cover panels prevent exposure to hazardous voltages and currents inside the chassis, contain
electromagnetic interference (EMI) that might disrupt other equipment, and direct the ow of cooling air
through the chassis.
• To avoid electric shock, do not connect safety extra-low voltage (SELV) circuits to telephone-network voltage
(TNV) circuits. LAN ports contain SELV circuits, and WAN ports contain TNV circuits. Some LAN and WAN
ports both use RJ-45 connectors. Use caution when connecting cables.
• This equipment has been tested and found to comply with the limits for a Class A digital device, pursuant to
Part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful
interference when the equipment is operated in a commercial environment. This equipment generates,
uses, and can radiate radio frequency energy and, if not installed and used in accordance with the
instruction manual, may cause harmful interference to radio communications.
• Operation of this equipment in a residential area is likely to cause harmful interference in which case users
will be required to correct the interference at their own expense.
Contents of the Sensor box
The following accessories are shipped in the Sensor box:
• One Sensor.
• One power cord. McAfee provides a standard, 2m NEMA 5-15P (US) power cable (3 wire). International
customers are provided a country-appropriate power cable with specic V/A ratings.
• One set of rack mounting ears.
• One printed Quick Start Guide.
• Release Notes.
Unpack the Sensor
Task
1Place the Sensor box as close to the installation site as possible.
2Position the box with the text upright.
3Open the top aps of the box.
4Remove the accessory box within the Sensor box.
5Verify you have received all parts.
These parts are listed on the packing list and in Contents of the Sensor box.
6Remove the Slide Rail Kit.
7Pull out the packing material surrounding the Sensor.
2Before you install
Contents of the Sensor box
12 McAfee® Network Security Platform M-1250/M-1450 Sensor Product Guide

8Remove the Sensor from the anti-static bag.
9Save the box and packing materials for later use in case you need to move or ship the Sensor.
If any of the contents from the preceding list are missing or damaged, contact McAfee support.
See also
Contents of the Sensor box on page 12
Before you install
Unpack the Sensor 2
McAfee® Network Security Platform M-1250/M-1450 Sensor Product Guide 13

2Before you install
Unpack the Sensor
14 McAfee® Network Security Platform M-1250/M-1450 Sensor Product Guide

3Setting up the Sensor
This chapter describes the process of setting up a Sensor to prepare it for conguration.
Contents
Setup overview
Position the Sensor
Cable the Sensor
Power on the Sensor
Setup overview
Setting up a Sensor involves the following steps:
Task
1Positioning the Sensor.
2Attaching power, network, and monitoring cables.
3Powering on the Sensor.
Once you have set up and powered on the Sensor, you can proceed with the conguration.
See also
Position the Sensor on page 15
Cable Monitoring ports on page 21
Power on the Sensor on page 17
Position the Sensor
Place the Sensor in a physically secure location, close to the switches or routers it will be monitoring. Ideally, the
Sensor should be located within a standard communications rack.
To mount the Sensor on a rack, you will attach two mounting ears to the Sensor, then mount the ears to the
rack. The Sensor ears attach to either the front or the middle of the chassis.
The illustrations in the sub-sections show the M-1250/M-1450 Sensor.
Install the ears on the chassis
Before you begin
Before you install the ears on the chassis, make sure that power is OFF. Remove the power cable
and all network interface cables from the Sensor.
3
McAfee® Network Security Platform M-1250/M-1450 Sensor Product Guide 15

Each rack-mounting ear has holes that match up with holes in the chassis.
Task
1Verify that you have all the parts you will need: two chassis ears and twelve Phillips athead screws.
2Attach the rst chassis ear to the right side of the chassis.
Use a Phillips screwdriver to secure the Phillips athead screws to the chassis.
Figure 3-1 Installing ears on the chassis
3Attach the second chassis ear to the left side of the chassis.
Mount the Sensor on a rack
McAfee recommends rack-mounting your Sensors. The rack-mounting hardware included with the Sensors is
suitable for most 19-inch equipment racks and telco-type racks. For maintenance purposes, you should have
access to the front and rear of the Sensor.
Before you mount the Sensor in the rack, make sure that power is OFF. Remove the power cable and all network
interface cables from the Sensor.
Rack-mount the Sensor by securing the rack mount ears to two posts or mounting strips in the rack. The ears
secure the Sensor to two rack posts, and the rest of the Sensor is cantilevered o the ears.
You need two people to install the Sensor in the rack—one person to hold the Sensor and one person to secure it
to the rack.
Mount the Sensor by securing the ears to two posts or mounting strips in the rack. Because the ears bear the
weight of the entire Sensor, be sure to fasten the ears securely to the rack.
Figure 3-2 Sensor mounted on a rack
3Setting up the Sensor
Position the Sensor
16 McAfee® Network Security Platform M-1250/M-1450 Sensor Product Guide

Cable the Sensor
Follow the steps outlined in Attaching Cables to the Sensor to connect cables to the monitoring, response,
console, and management ports on your Sensor.
See also
Cable Monitoring ports on page 21
Power on the Sensor
Before you begin
Do not attempt to power on the Sensor until you have installed the Sensor in a rack, made all
necessary network connections, and connected the power cable to the power supply.
If you are installing a redundant power supply, you should install it as described in Installing a power supply. For
true redundant operation with the optional redundant power supply, McAfee recommends that you plug each
supply into a dierent power circuit.
Task
1Connect the power cable to the Sensor power supply.
2Connect the power cable to a power source.
The Sensor has no power switch. It powers on as soon as one of its power cable is connected to a power
source.
Power o the Sensor
McAfee recommends that you use the shutdown CLI command to halt the Sensor before powering it down. For
more information on CLI commands, see McAfee Network Security Platform CLI Guide.
Setting up the Sensor
Cable the Sensor 3
McAfee® Network Security Platform M-1250/M-1450 Sensor Product Guide 17

3Setting up the Sensor
Power on the Sensor
18 McAfee® Network Security Platform M-1250/M-1450 Sensor Product Guide

4Attaching cables to the Sensor
Follow the steps outlined in this chapter to connect cables to the various ports on your M-1250/M-1450
Network Security Sensor.
Note the following cabling specications for the Sensor:
• Category 5 Enhanced (Cat 5e) cable is required for transmission speeds up to 1 Gigabit per second (Gigabit
Ethernet).
• For Ethernet networks running at 10 or 100 Mbps, Category 5 (Cat 5) OR Cat 5e cable can be used.
Throughout this guide, cabling specications is mentioned as Cat 5/Cat 5e.
Contents
Cable the Console port
Cable the Auxiliary port
Connect the cable to the Response port
Cable the Management port
Cable Monitoring ports
Cable the Sensor to monitor in in-line mode
Cable the Sensor to monitor in SPAN or hub mode
About connecting Sensors for fail-over
Cable the Console port
The Console port on the Sensor is used for setup and conguration of the Sensor.
Task
1For console connections, plug the DB9 Console cable supplied by McAfee into the Console port on the
Sensor.
This port is labeled as Console on the Sensor front panel.
4
McAfee® Network Security Platform M-1250/M-1450 Sensor Product Guide 19

2Connect the other end of the Console port cable directly to a COM port of the PC or terminal server you will
use to congure the Sensor, for example, a PC running correctly congured Windows HyperTerminal
software.
You must connect directly to the console for initial conguration.
Required settings for HyperTerminal are:
Name Setting
Baud rate 38400
Number of bits 8
Parity None
Stop bits 1
Flow Control None
3Power on the Sensor.
Cable the Auxiliary port
The Auxiliary port is used for modem access to the Sensor for setup and conguration.
You cannot use a modem the rst time you congure a Sensor.
Task
1For modem connections, plug a straight-through modem cable into the Auxiliary port on the Sensor.
This port is labeled as Aux on the Sensor front panel.
2Connect a modem to the Aux port.
3Connect a telephone line to the modem.
Required settings for the Aux port are:
Name Setting
Baud rate 38400
Number of bits 8
Parity None
Stop bits 1
Flow Control None
Connect the cable to the Response port
When operating in tap or SPAN mode, the Sensor uses its Response port to respond to attacks. When deployed
in tap mode, the Sensor does not inject response packets through the tap but uses the Response port.
Task
1Plug a Cat-5e Ethernet cable into the Response port.
This port is labeled Rx on the Sensor front panel.
4Attaching cables to the Sensor
Cable the Auxiliary port
20 McAfee® Network Security Platform M-1250/M-1450 Sensor Product Guide