McAfee M-3050 User manual

M-3050/M-4050 Sensor Product Guide
Revision B
McAfee® Network Security Platform

COPYRIGHT
Copyright © 2014 McAfee, Inc., 2821 Mission College Boulevard, Santa Clara, CA 95054, 1.888.847.8766, www.intelsecurity.com
TRADEMARK ATTRIBUTIONS
Intel and the Intel logo are registered trademarks of the Intel Corporation in the US and/or other countries. McAfee and the McAfee logo, McAfee Active
Protection, McAfee DeepSAFE, ePolicy Orchestrator, McAfee ePO, McAfee EMM, McAfee Evader, Foundscore, Foundstone, Global Threat Intelligence,
McAfee LiveSafe, Policy Lab, McAfee QuickClean, Safe Eyes, McAfee SECURE, McAfee Shredder, SiteAdvisor, McAfee Stinger, McAfee TechMaster, McAfee
Total Protection, TrustedSource, VirusScan are registered trademarks or trademarks of McAfee, Inc. or its subsidiaries in the US and other countries.
Other marks and brands may be claimed as the property of others.
LICENSE INFORMATION
License Agreement
NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS
FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU
HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR
SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A
FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET
FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF
PURCHASE FOR A FULL REFUND.
2McAfee® Network Security Platform M-3050/M-4050 Sensor Product Guide

Contents
Preface 5
About this guide .................................. 5
Audience .................................. 5
Conventions ................................. 5
What's in this guide ..............................6
Find product documentation ..............................6
1Overview 7
About Network Security Sensors ............................ 7
Functions of a Sensor ................................ 8
Network topology considerations ............................8
M-3050/M-4050 key features ............................. 9
M-3050/M-4050 physical description ..........................10
Ports ....................................10
Front and back panel LEDs ...........................11
2Before you install 15
Usage restrictions ................................. 15
Safety measures ..................................15
About fiber-optic ports ............................... 16
Contents of the box .................................17
Unpack the Sensor ................................. 17
3Setting up the Sensor 19
Setup overview .................................. 19
How to position the Sensor ..............................19
Install the rails and ears on the chassis and rack .................. 20
Mount the Sensor on a rack .......................... 20
Remove a Sensor from the rack .........................20
Redundant power supply ...............................21
Install the power supply ............................21
Remove the power supply ........................... 22
Cable the Sensor ..................................22
Small form-factor pluggable modules ..........................23
SFP modules ................................ 23
XFP modules ................................ 24
Install a module ............................... 24
Remove a module .............................. 25
Power on the Sensor ................................ 25
Power off the Sensor ................................ 25
4Attaching Cables to the Sensor 27
Cable the Console port ............................... 27
Cable the Auxiliary port ............................... 28
Connect the cable to the Response port .........................28
McAfee® Network Security Platform M-3050/M-4050 Sensor Product Guide 3

About the fail-open port ...............................29
Cable the Management port ............................. 29
About connecting cables to the Monitoring ports ..................... 29
How to use peer ports .............................29
Default Monitoring port speed settings ...................... 30
Cable types for routers, switches, hubs, and PCs ..................30
Connect the cables for in-line mode .......................... 30
Connect the cables for tap mode ........................... 31
Connect the cables for SPAN or hub mode ........................31
Cable the fail-over interconnection ports ........................ 31
How does the fail-open function work ......................... 32
5Troubleshooting the Sensor 35
6Sensor technical specifications 37
ARegulatory, compliance, and safety information 39
Index 41
Contents
4McAfee® Network Security Platform M-3050/M-4050 Sensor Product Guide

Preface
This guide provides the information you need to configure, use, and maintain your McAfee product.
Contents
About this guide
Find product documentation
About this guide
This information describes the guide's target audience, the typographical conventions and icons used
in this guide, and how the guide is organized.
Audience
McAfee documentation is carefully researched and written for the target audience.
The information in this guide is intended primarily for:
•Administrators — People who implement and enforce the company's security program.
•Users — People who use the computer where the software is running and can access some or all of
its features.
Conventions
This guide uses these typographical conventions and icons.
Book title, term,
emphasis
Title of a book, chapter, or topic; a new term; emphasis.
Bold Text that is strongly emphasized.
User input, code,
message
Commands and other text that the user types; a code sample; a displayed
message.
Interface text Words from the product interface like options, menus, buttons, and dialog
boxes.
Hypertext blue A link to a topic or to an external website.
Note: Additional information, like an alternate method of accessing an
option.
McAfee® Network Security Platform M-3050/M-4050 Sensor Product Guide 5

Tip: Suggestions and recommendations.
Important/Caution: Valuable advice to protect your computer system,
software installation, network, business, or data.
Warning: Critical advice to prevent bodily harm when using a hardware
product.
What's in this guide
This guide contains information necessary to setup your M-3050/M-4050 Sensor model. This
information includes guiding you through preconfiguring, cabling, and troubleshooting your Sensor.
Find product documentation
McAfee provides the information you need during each phase of product implementation, from
installation to daily use and troubleshooting. After a product is released, information about the product
is entered into the McAfee online KnowledgeBase.
Task
1Go to the McAfee Technical Support ServicePortal at http://mysupport.mcafee.com.
2Under Self Service, access the type of information you need:
To access... Do this...
User documentation 1Click Product Documentation.
2Select a product, then select a version.
3Select a product document.
KnowledgeBase • Click Search the KnowledgeBase for answers to your product questions.
• Click Browse the KnowledgeBase for articles listed by product and version.
Preface
Find product documentation
6McAfee® Network Security Platform M-3050/M-4050 Sensor Product Guide

1
Overview
This chapter provides an overview of McAfee® Network Security Sensors in general and the M-3050/
M-4050 Sensor model in particular.
Contents
About Network Security Sensors
Functions of a Sensor
Network topology considerations
M-3050/M-4050 key features
M-3050/M-4050 physical description
About Network Security Sensors
McAfee Network Security Sensors (Sensors) are high-performance, scalable, and flexible content
processing appliances built for the accurate detection and prevention of:
• network intrusions
• network misuse
• Distributed Denial-of-Service (DDoS) attacks
Sensors are specifically designed to handle traffic at wire speed, efficiently inspect and detect
intrusions with a high degree of accuracy, and flexible enough to adapt to the security needs of any
enterprise environment. When deployed at key network access points, the Sensor provides real-time
traffic monitoring to detect malicious activity and respond to the malicious activity as configured by
the administrator.
After you deploy a Sensor successfully, you configure and manage it using the McAfee® Network
Security Manager (Manager). The process of configuring a Sensor and establishing communication
with the Manager is described in the subsequent chapters of this guide. For the details about the
Manager, see the McAfee Network Security Platform Getting Started Guide.
1
McAfee® Network Security Platform M-3050/M-4050 Sensor Product Guide 7

Functions of a Sensor
The primary function of a McAfee® Network Security Sensor (Sensor) is to analyze traffic on selected
network segments and to respond when an attack is detected. The Sensor examines the header and
data portion of every network packet, looking for patterns and behavior in the network traffic that
indicate malicious activity. The Sensor examines packets according to user-configured policies, or rule
sets, which determine what attacks to watch for, and how to respond with countermeasures if an
attack is detected.
If an attack is detected, a Sensor responds according to its configured policy. Sensor can perform
many types of attack responses, including generating alerts and packet logs, resetting TCP
connections, "scrubbing" malicious packets, and even blocking attack packets entirely before they
reach the intended target.
Network topology considerations
Deployment of a Sensor requires knowledge of your network to help determine the level of
configuration and the number of installed Sensors. You also need to determine the number of McAfee®
ePolicy Orchestrator (McAfee ePO) /McAfee NAC servers required to protect your network. The Sensor
is purpose-built for the monitoring of traffic across one or more network segments. For more
information, see the McAfee Network Security Platform Getting Started Guide.
1Overview
Functions of a Sensor
8McAfee® Network Security Platform M-3050/M-4050 Sensor Product Guide

Following is an example of a network topology using Gigabit Ethernet throughput. In the illustration,
McAfee® Network Security Platform (formerly McAfee® IntruShield®) provides IPS protection to
outsourced servers. High port-density and virtualization provides a highly scalable solution, while
Network Security Platform protects against Web and eCommerce mail server exploits.
Figure 1-1 A sample Network Security Platform deployment
M-3050/M-4050 key features
The M-3050/M-4050 Sensor includes the following features:
M-3050 M-4050
4 -10-GbE XFP 4 -10-GbE XFP
8 SFP ports (10/100/1000 copper or 1 GbE fiber) 8 SFP ports (10/100/1000 copper or 1 GbE fiber)
1 10/100/1000 Base-T Management port 1 10/100/1000 Base-T Management port
1 Response port 1 Response port
Hot-swappable SFP/XFP modules Hot-swappable SFP/XFP modules
Overview
M-3050/M-4050 key features 1
McAfee® Network Security Platform M-3050/M-4050 Sensor Product Guide 9

M-3050 M-4050
Dual power supply Dual power supply
3 Fan units (that are field replaceable) 3 Fan units (that are field replaceable)
It has 2 XLRs (A/B) host entries It has 3 XLRs (A/B/C) host entries
Power slots for fail-open kit Power slots for fail-open kit
M-3050/M-4050 physical description
The high-port density M-3050/M-4050, is designed for high bandwidth links, and is equipped to
support two 10 Gigabit full-duplex Ethernet segments or four 10 Gigabit SPAN ports transmitting
aggregated traffic. Additionally, it supports four 1 Gigabit full-duplex Ethernet segments or eight 1
Gigabit SPAN ports transmitting aggregated traffic.
Ports
The M-3050/M-4050 is a 2RU (2 rack unit) and is equipped with the following components:
Figure 1-2 An M-3050/M-4050 Sensor
Item Description
1 Power Supply A
2 Power Supply B
3 RS-232C Console port
4 RS-232C Auxiliary port
5 RJ-11 Fail-Open Control ports
6 SFP Gigabit Ethernet Monitoring ports
7 XFP 10 Gigabit Ethernet Monitoring ports
8 Compact Flash port
9 RJ-45 Response port
1Overview
M-3050/M-4050 physical description
10 McAfee® Network Security Platform M-3050/M-4050 Sensor Product Guide

Item Description
10 10/100/1000 Management port
11 Back panel LEDs (3)
1Power Supply A. Power supply A is included with each Sensor. The supply uses a standard IEC
port (IEC320-C13). McAfee provides a standard, 2m NEMA 5-15P (US) power cable (3 wire).
International customers must procure a country-appropriate power cable.
2Power Supply B (optional, purchased separately). Power supply B is a hot-swappable, redundant
power supply. This power supply also uses a standard IEC320-C13 port, and you can use
McAfee-provided cable or acquire one that meets your specific needs.
3One RS-232C Console port, which is used to set up and configure the Sensor.
4One RS-232C Auxiliary port, which may be used to dial in remotely to set up and configure the
Sensor.
5Six RJ-11 Fail-Open Control ports, designed for use with the Optical Fail-Open Bypass kit. The
ports are marked X1, X2, X3, X4, X5, X6, (1A-1B to 6A-6B respectively.)
6Eight small form-factor pluggable (SFP) 1 Gigabit Monitoring ports, which enable you to
monitor eight SPAN ports, four full-duplex tapped segments, four segments in-line, or a
combination (that is, for example, two full-duplex segment and four SPAN ports).
7Four 10 Gigabit small form-factor pluggable (XFP) 10 Gigabit Monitoring ports, which
enable you to monitor four SPAN ports, two full-duplex tapped segments, two segments in-line, or
a combination (that is, for example, one full-duplex segment and two SPAN ports).
The Monitoring interfaces of the M-3050/M-4050 work in stealth mode, meaning they have no IP
address and are not visible on the monitored segment.
If you choose to run in failover mode, port 2A is used to interconnect with a standby Sensor.
The gigabit ports of the M-3050/M-4050 when deployed in in-line, fail-close, meaning that if the
Sensor fails, it will interrupt/block data flow. Fail-open functionality requires either the Layer 2
Passthru feature or the hardware Gigabit Fail-Open Bypass kit for Gigabit ports. The Layer 2
Passthru feature is described in detail in the McAfee Network Security Platform Device
Administration Guide.
8One External Compact Flash port. This port is used only for flash recovery purposes. That is,
this port is used in troubleshooting situations where the Sensor's internal flash is corrupted and
you need to reboot the Sensor through the external compact flash. For more information, see the
on-line KnowledgeBase at http://mysupport.mcafee.com/Eservice/. Click Search the KnowledgeBase.
9One RJ-45 Response port, which, when you're operating in SPAN or tap mode, enables you to
inject response packets back through a switch or router.
10 One RJ-45 10/100/1000 Management port, which is used for communication with the
Manager server. You can assign an IP address to this port during installation.
The M-3050/M-4050 does not have internal taps; you must use it with a third-party external tap to
run it in tap mode.
Front and back panel LEDs
The front panel LEDs provide status information for the health of the Sensor and the activity on its
ports. The following table describes the M-3050/M-4050 front panel LEDs.
Overview
M-3050/M-4050 physical description 1
McAfee® Network Security Platform M-3050/M-4050 Sensor Product Guide 11

LED Status Description
Pwr A (Power A)
OK
~AC
Green
Amber
Green
Power Supply A is functioning.
Power Supply A is not functioning.
Power Supply in AC mode.
Pwr B (Power B)
OK
~AC
Green
Amber
Green
Power Supply B is functioning.
Power Supply B is not functioning.
Power Supply in AC mode.
If a power supply is not present, both green and amber LEDs are off.
Management Port Speed Green
Amber
Off
The port speed is 1000 Mbps.
The port speed is 100 Mbps.
The port speed is 10 Mbps.
Management Port Link Green
Off
The link is connected.
The link is disconnected.
Sys Green
Amber
Sensor is operating.
Sensor is booting. (It could also indicate a system failure).
Fan Green
Amber
All three fans are operating.
One or more of the fans has failed.
Temp Green
Amber
Inlet air temperature measured inside chassis is normal.
(Chassis temperature OK).
Inlet air temperature measured inside chassis is too hot.
(Chassis temperature too hot).
Flash Green
Off
Activity on external compact flash.
No activity on external compact flash.
Gigabit Ports (SFP / XFP) Act Amber
Off
Data transferring.
No data transferring.
Gigabit Ports (SFP / XFP)
Link
Green
Off
The link is connected.
The link is disconnected.
Response Port Speed Green
Amber
Off
The port speed is 1000 Mbps.
The port speed is 100 Mbps.
The port speed is 10 Mbps.
Response Port Link Green
Off
The link is connected.
The link is disconnected.
Fail-Open Control FO Green
Off
The Sensor is providing power to the fail-open kit.
The Sensor is not providing power to the fail-open kit.
Fail-Open Control Port Err Amber
Off
The fail-open control cable is disconnected or the Sensor is
operating in bypass mode.
There is no error.
1Overview
M-3050/M-4050 physical description
12 McAfee® Network Security Platform M-3050/M-4050 Sensor Product Guide

The three back panel LEDs provide information regarding the Sensor fans.
LED Status Description
Fan LED OFF The fan is functioning properly.
Amber The fan has malfunctioned.
Overview
M-3050/M-4050 physical description 1
McAfee® Network Security Platform M-3050/M-4050 Sensor Product Guide 13

1Overview
M-3050/M-4050 physical description
14 McAfee® Network Security Platform M-3050/M-4050 Sensor Product Guide

2
Before you install
This chapter describes the best practices for deployment of Sensors in your network. Topics include
the safety considerations for handling the Sensor, usage restrictions that apply to the Sensor model,
and the contents that are shipped along with the Sensor.
Contents
Usage restrictions
Safety measures
About fiber-optic ports
Contents of the box
Unpack the Sensor
Usage restrictions
The following restrictions apply to the use and operation of a Sensor:
• You should not remove the outer shell of the Sensor. Doing so will invalidate your warranty.
• The Sensor appliance is not a general purpose workstation.
• McAfee prohibits the use of the Sensor appliance for anything other than operating Network
Security Platform.
• McAfee prohibits the modification or installation of any hardware or software on the Sensor
appliance that is not part of the normal operation of Network Security Platform.
Safety measures
Please read the following warnings before you install the Sensor. These safety measures apply to all
Sensor models unless otherwise noted. Failure to observe these safety warnings could result in serious
physical injury.
2
McAfee® Network Security Platform M-3050/M-4050 Sensor Product Guide 15

Warnings:
• Read the installation instructions before you connect the system to its power source.
• To remove all power from the Sensor, unplug all power cords, including the redundant power cord.
• Only trained and qualified personnel should be allowed to install, replace, or service this
equipment.
• Before working on the equipment that is connected to power lines, remove all jewelry including
rings, necklaces, and watches. Metal objects will heat up when connected to power and ground,
and can cause serious burns or weld the metal object to the terminals.
• This equipment is intended to be grounded. Ensure that the host is connected to earth ground
during normal use.
• Do not remove the outer shell of the Sensor. Doing so will invalidate your warranty.
• Do not operate the system unless all cards, faceplates, front covers, and rear covers are in place.
Blank faceplates and cover panels prevent exposure to hazardous voltages and currents inside the
chassis, contain electromagnetic interference (EMI) that might disrupt other equipment and direct
the flow of cooling air through the chassis.
• To avoid electric shock, do not connect safety extra-low voltage (SELV) circuits to
telephone-network voltage (TNV) circuits. LAN ports contain SELV circuits, and WAN ports contain
TNV circuits. Some LAN and WAN ports both use RJ-45 connectors. Use caution when connecting
cables.
• This equipment has been tested and found to comply with the limits for a Class A digital device,
pursuant to Part 15 of the FCC Rules. These limits are designed to provide reasonable protection
against harmful interference when the equipment is operated in a commercial environment. This
equipment generates, uses, and can radiate radio frequency energy, and if not installed and used in
accordance with the instruction manual, might cause harmful interference to radio communications.
Operation of this equipment in a residential area is likely to cause harmful interference, in which
case the users will be required to correct the interference at their own expense.
• Refer to the Appendix for information on regulatory, compliance, and other safety requirements.
About fiber-optic ports
The Sensor uses fiber-optic connectors for its Monitoring ports. The connector type is a small
form-factor pluggable (SFP) fiber optic connector that is LC-duplex compatible.
Note the following:
• Fiber-optic ports (for example, SFP/XFP, FDDI, OC-3, OC-12, OC-48, ATM, GBIC, and 100BaseFX)
are considered Class 1 laser or Class 1 LED ports.
• These products have been tested and found to comply with Class 1 limits of IEC 60825-1, IEC
60825-2, EN 60825-1, EN 60825-2, and 21CFR1040.
To avoid exposure to radiation, do not stare into the aperture of a fiber-optic port. Invisible radiation
could be emitted from the aperture of the port when no fiber cable is connected.
• Only FDA registered, EN 60825-1 and IEC 60825-1 certified Class 1 SFP laser transceivers are
acceptable for use with the Sensor.
2Before you install
About fiber-optic ports
16 McAfee® Network Security Platform M-3050/M-4050 Sensor Product Guide

Contents of the box
The following accessories are shipped in the Sensor box:
• One Sensor.
• One power supply.
• Two CD-ROMs containing the Sensor software and on-line documentation.
• Power cords. McAfee provides a standard and international power cables.
• One set of rack mounting rails.
• One set of rack mounting ears.
• One printed Slide Rail Assembly Procedure.
• One printed Quick Start Guide.
• Release Notes.
Unpack the Sensor
Task
1Place the Sensor box as close to the installation site as possible.
2Position the box with the text upright.
3Open the top flaps of the box.
4Remove the accessory box.
5Verify you have received all parts.
These parts are listed on the packing list and in the Contents of box section.
6Pull out the packing material surrounding the Sensor.
7Remove the Sensor from the anti-static bag.
8Save the box and packing materials for later use in case you need to move or ship the Sensor.
See also
Contents of the box on page 17
Before you install
Contents of the box 2
McAfee® Network Security Platform M-3050/M-4050 Sensor Product Guide 17

2Before you install
Unpack the Sensor
18 McAfee® Network Security Platform M-3050/M-4050 Sensor Product Guide

3
Setting up the Sensor
This chapter describes how to set up the Sensor for you to configure it.
Contents
Setup overview
How to position the Sensor
Redundant power supply
Cable the Sensor
Small form-factor pluggable modules
Power on the Sensor
Power off the Sensor
Setup overview
Setting up a Sensor involves the following steps:
1Positioning the Sensor.
2Installing interface modules (SFP and XFP).
3Attaching power, network, and monitoring cables.
4Powering on the Sensor.
5Configuring the Sensor after you have set up and powered it on.
How to position the Sensor
Place the Sensor in a physically secure location, close to the switches or routers it will be monitoring.
Ideally, the Sensor should be located within a standard communications rack. To mount the Sensor on
a rack, you will attach two mounting ears and rails to the Sensor as described in the subsequent
sections of this guide.
Tasks
•Install the rails and ears on the chassis and rack on page 20
3
McAfee® Network Security Platform M-3050/M-4050 Sensor Product Guide 19

Install the rails and ears on the chassis and rack
Before you begin
Before you install the rails and ears on the chassis, make sure that the power is off.
Remove the power cable and all network interface cables from the Sensor.
Each rack-mounting rail and ear has holes that match up with holes in the chassis. You will need a
screwdriver to secure the slotted panhead screws.
Task
1Verify that you have all the parts you will need — two three-in-one rails, two chassis ears, and
fourteen slotted panhead screws.
Each rail includes a rail that mount to the rack, a rail that slides into the mounted rail, and a rail
that is attached to the chassis.
2Disassemble the slide rail by pulling the inner rail out and pushing the side latch in to separate.
3Attach the inner rail to the chassis by fastening it with the screws provided.
4Attach the ear to each side of the chassis.
5Mount the L-shape and external rail to your rack frame.
The adjustable end of the L-shape rail is intended for placement at the back of your rack. Adjust
the rail as needed for length. You are now ready to mount the Sensor on the rack.
Mount the Sensor on a rack
McAfee recommends rack-mounting your Sensor. The rack-mounting hardware included with the
Sensor is suitable for most 19-inch equipment racks and telco-type racks. For maintenance purposes,
you must have access to the front and rear of the Sensor.
Before you mount the Sensor on the rack, make sure that the power is off. Remove the power cable and
all network interface cables from the Sensor.
Due to the weight of the appliance, McAfee recommends that two people place the chassis into the rail
cabinet.
Insert the chassis into the rail cabinet and complete the rack-mounting of the Sensor by securing the
rack mount ears to two posts or mounting strips in the rack. The ears secure the Sensor to two rack
posts. Make sure to fasten the ears securely to the rack.
Optionally, you can also mid-mount the Sensor. For details, refer to the corresponding Sensor McAfee
Network Security Platform Quick Start Guide.
Remove a Sensor from the rack
Review this section if you need to remove a Sensor from the rack.
3Setting up the Sensor
How to position the Sensor
20 McAfee® Network Security Platform M-3050/M-4050 Sensor Product Guide