McAfee M-3050 User manual

M-3050/M-4050 Sensor Product Guide
Revision B
McAfee® Network Security Platform

COPYRIGHT
Copyright © 2014 McAfee, Inc., 2821 Mission College Boulevard, Santa Clara, CA 95054, 1.888.847.8766, www.intelsecurity.com
TRADEMARK ATTRIBUTIONS
Intel and the Intel logo are registered trademarks of the Intel Corporation in the US and/or other countries. McAfee and the McAfee logo, McAfee Active
Protection, McAfee DeepSAFE, ePolicy Orchestrator, McAfee ePO, McAfee EMM, McAfee Evader, Foundscore, Foundstone, Global Threat Intelligence,
McAfee LiveSafe, Policy Lab, McAfee QuickClean, Safe Eyes, McAfee SECURE, McAfee Shredder, SiteAdvisor, McAfee Stinger, McAfee TechMaster, McAfee
Total Protection, TrustedSource, VirusScan are registered trademarks or trademarks of McAfee, Inc. or its subsidiaries in the US and other countries.
Other marks and brands may be claimed as the property of others.
LICENSE INFORMATION
License Agreement
NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS
FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU
HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR
SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A
FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET
FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF
PURCHASE FOR A FULL REFUND.
2McAfee® Network Security Platform M-3050/M-4050 Sensor Product Guide

Contents
Preface 5
About this guide .................................. 5
Audience .................................. 5
Conventions ................................. 5
What's in this guide ..............................6
Find product documentation ..............................6
1Overview 7
About Network Security Sensors ............................ 7
Functions of a Sensor ................................ 8
Network topology considerations ............................8
M-3050/M-4050 key features ............................. 9
M-3050/M-4050 physical description ..........................10
Ports ....................................10
Front and back panel LEDs ...........................11
2Before you install 15
Usage restrictions ................................. 15
Safety measures ..................................15
About fiber-optic ports ............................... 16
Contents of the box .................................17
Unpack the Sensor ................................. 17
3Setting up the Sensor 19
Setup overview .................................. 19
How to position the Sensor ..............................19
Install the rails and ears on the chassis and rack .................. 20
Mount the Sensor on a rack .......................... 20
Remove a Sensor from the rack .........................20
Redundant power supply ...............................21
Install the power supply ............................21
Remove the power supply ........................... 22
Cable the Sensor ..................................22
Small form-factor pluggable modules ..........................23
SFP modules ................................ 23
XFP modules ................................ 24
Install a module ............................... 24
Remove a module .............................. 25
Power on the Sensor ................................ 25
Power off the Sensor ................................ 25
4Attaching Cables to the Sensor 27
Cable the Console port ............................... 27
Cable the Auxiliary port ............................... 28
Connect the cable to the Response port .........................28
McAfee® Network Security Platform M-3050/M-4050 Sensor Product Guide 3

About the fail-open port ...............................29
Cable the Management port ............................. 29
About connecting cables to the Monitoring ports ..................... 29
How to use peer ports .............................29
Default Monitoring port speed settings ...................... 30
Cable types for routers, switches, hubs, and PCs ..................30
Connect the cables for in-line mode .......................... 30
Connect the cables for tap mode ........................... 31
Connect the cables for SPAN or hub mode ........................31
Cable the fail-over interconnection ports ........................ 31
How does the fail-open function work ......................... 32
5Troubleshooting the Sensor 35
6Sensor technical specifications 37
ARegulatory, compliance, and safety information 39
Index 41
Contents
4McAfee® Network Security Platform M-3050/M-4050 Sensor Product Guide

Preface
This guide provides the information you need to configure, use, and maintain your McAfee product.
Contents
About this guide
Find product documentation
About this guide
This information describes the guide's target audience, the typographical conventions and icons used
in this guide, and how the guide is organized.
Audience
McAfee documentation is carefully researched and written for the target audience.
The information in this guide is intended primarily for:
•Administrators — People who implement and enforce the company's security program.
•Users — People who use the computer where the software is running and can access some or all of
its features.
Conventions
This guide uses these typographical conventions and icons.
Book title, term,
emphasis
Title of a book, chapter, or topic; a new term; emphasis.
Bold Text that is strongly emphasized.
User input, code,
message
Commands and other text that the user types; a code sample; a displayed
message.
Interface text Words from the product interface like options, menus, buttons, and dialog
boxes.
Hypertext blue A link to a topic or to an external website.
Note: Additional information, like an alternate method of accessing an
option.
McAfee® Network Security Platform M-3050/M-4050 Sensor Product Guide 5

Tip: Suggestions and recommendations.
Important/Caution: Valuable advice to protect your computer system,
software installation, network, business, or data.
Warning: Critical advice to prevent bodily harm when using a hardware
product.
What's in this guide
This guide contains information necessary to setup your M-3050/M-4050 Sensor model. This
information includes guiding you through preconfiguring, cabling, and troubleshooting your Sensor.
Find product documentation
McAfee provides the information you need during each phase of product implementation, from
installation to daily use and troubleshooting. After a product is released, information about the product
is entered into the McAfee online KnowledgeBase.
Task
1Go to the McAfee Technical Support ServicePortal at http://mysupport.mcafee.com.
2Under Self Service, access the type of information you need:
To access... Do this...
User documentation 1Click Product Documentation.
2Select a product, then select a version.
3Select a product document.
KnowledgeBase • Click Search the KnowledgeBase for answers to your product questions.
• Click Browse the KnowledgeBase for articles listed by product and version.
Preface
Find product documentation
6McAfee® Network Security Platform M-3050/M-4050 Sensor Product Guide

1
Overview
This chapter provides an overview of McAfee® Network Security Sensors in general and the M-3050/
M-4050 Sensor model in particular.
Contents
About Network Security Sensors
Functions of a Sensor
Network topology considerations
M-3050/M-4050 key features
M-3050/M-4050 physical description
About Network Security Sensors
McAfee Network Security Sensors (Sensors) are high-performance, scalable, and flexible content
processing appliances built for the accurate detection and prevention of:
• network intrusions
• network misuse
• Distributed Denial-of-Service (DDoS) attacks
Sensors are specifically designed to handle traffic at wire speed, efficiently inspect and detect
intrusions with a high degree of accuracy, and flexible enough to adapt to the security needs of any
enterprise environment. When deployed at key network access points, the Sensor provides real-time
traffic monitoring to detect malicious activity and respond to the malicious activity as configured by
the administrator.
After you deploy a Sensor successfully, you configure and manage it using the McAfee® Network
Security Manager (Manager). The process of configuring a Sensor and establishing communication
with the Manager is described in the subsequent chapters of this guide. For the details about the
Manager, see the McAfee Network Security Platform Getting Started Guide.
1
McAfee® Network Security Platform M-3050/M-4050 Sensor Product Guide 7

Functions of a Sensor
The primary function of a McAfee® Network Security Sensor (Sensor) is to analyze traffic on selected
network segments and to respond when an attack is detected. The Sensor examines the header and
data portion of every network packet, looking for patterns and behavior in the network traffic that
indicate malicious activity. The Sensor examines packets according to user-configured policies, or rule
sets, which determine what attacks to watch for, and how to respond with countermeasures if an
attack is detected.
If an attack is detected, a Sensor responds according to its configured policy. Sensor can perform
many types of attack responses, including generating alerts and packet logs, resetting TCP
connections, "scrubbing" malicious packets, and even blocking attack packets entirely before they
reach the intended target.
Network topology considerations
Deployment of a Sensor requires knowledge of your network to help determine the level of
configuration and the number of installed Sensors. You also need to determine the number of McAfee®
ePolicy Orchestrator (McAfee ePO) /McAfee NAC servers required to protect your network. The Sensor
is purpose-built for the monitoring of traffic across one or more network segments. For more
information, see the McAfee Network Security Platform Getting Started Guide.
1Overview
Functions of a Sensor
8McAfee® Network Security Platform M-3050/M-4050 Sensor Product Guide

Following is an example of a network topology using Gigabit Ethernet throughput. In the illustration,
McAfee® Network Security Platform (formerly McAfee® IntruShield®) provides IPS protection to
outsourced servers. High port-density and virtualization provides a highly scalable solution, while
Network Security Platform protects against Web and eCommerce mail server exploits.
Figure 1-1 A sample Network Security Platform deployment
M-3050/M-4050 key features
The M-3050/M-4050 Sensor includes the following features:
M-3050 M-4050
4 -10-GbE XFP 4 -10-GbE XFP
8 SFP ports (10/100/1000 copper or 1 GbE fiber) 8 SFP ports (10/100/1000 copper or 1 GbE fiber)
1 10/100/1000 Base-T Management port 1 10/100/1000 Base-T Management port
1 Response port 1 Response port
Hot-swappable SFP/XFP modules Hot-swappable SFP/XFP modules
Overview
M-3050/M-4050 key features 1
McAfee® Network Security Platform M-3050/M-4050 Sensor Product Guide 9

M-3050 M-4050
Dual power supply Dual power supply
3 Fan units (that are field replaceable) 3 Fan units (that are field replaceable)
It has 2 XLRs (A/B) host entries It has 3 XLRs (A/B/C) host entries
Power slots for fail-open kit Power slots for fail-open kit
M-3050/M-4050 physical description
The high-port density M-3050/M-4050, is designed for high bandwidth links, and is equipped to
support two 10 Gigabit full-duplex Ethernet segments or four 10 Gigabit SPAN ports transmitting
aggregated traffic. Additionally, it supports four 1 Gigabit full-duplex Ethernet segments or eight 1
Gigabit SPAN ports transmitting aggregated traffic.
Ports
The M-3050/M-4050 is a 2RU (2 rack unit) and is equipped with the following components:
Figure 1-2 An M-3050/M-4050 Sensor
Item Description
1 Power Supply A
2 Power Supply B
3 RS-232C Console port
4 RS-232C Auxiliary port
5 RJ-11 Fail-Open Control ports
6 SFP Gigabit Ethernet Monitoring ports
7 XFP 10 Gigabit Ethernet Monitoring ports
8 Compact Flash port
9 RJ-45 Response port
1Overview
M-3050/M-4050 physical description
10 McAfee® Network Security Platform M-3050/M-4050 Sensor Product Guide