McAfee MFO-3400-SWGA - Web Security Appliance 3400... User manual

McAfee Email and Web Security
Appliance 5.1
Installation Guide

COPYRIGHT
Copyright ©2009 McAfee, Inc. All Rights Reserved.
No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language in any form
or by any means without the written permission of McAfee, Inc., or its suppliers or affiliate companies.
TRADEMARK ATTRIBUTIONS
AVERT, EPO, EPOLICY ORCHESTRATOR, FLASHBOX, FOUNDSTONE, GROUPSHIELD, HERCULES, INTRUSHIELD, INTRUSION INTELLIGENCE,
LINUXSHIELD, MANAGED MAIL PROTECTION, MAX (MCAFEE SECURITYALLIANCE EXCHANGE), MCAFEE, MCAFEE.COM, NETSHIELD,
PORTALSHIELD, PREVENTSYS, PROTECTION-IN-DEPTH STRATEGY, PROTECTIONPILOT, SECURE MESSAGING SERVICE, SECURITYALLIANCE,
SITEADVISOR, THREATSCAN, TOTAL PROTECTION, VIREX, VIRUSSCAN, WEBSHIELD are registered trademarks or trademarks of McAfee, Inc.
and/or its affiliates in the US and/or other countries. McAfee Red in connection with security is distinctive of McAfee brand products. All other
registered and unregistered trademarks herein are the sole property of their respective owners.
LICENSE INFORMATION
License Agreement
NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED,
WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH
TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS
THAT ACCOMPANIES YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET,
A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEB SITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU
DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN
THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND.
License Attributions
Refer to the product Release Notes.
McAfee Email and Web Security Appliance 5.1 Installation Guide2

Contents
Preface......................................................................................6
Usingthisguide............................................................................6
Audience.................................................................................6
Graphical conventions.......................................................................7
Documentation............................................................................7
Pre-installation.............................................................................8
What’s in the box..........................................................................8
Plantheinstallation.........................................................................9
Inappropriate use..........................................................................9
Operating conditions........................................................................9
Positioning the appliance....................................................................9
Considerations about Network Modes.........................................................10
Transparent bridge mode............................................................11
Transparent router mode............................................................12
Explicitproxymode.................................................................13
Deployment Strategies for Using the Appliance in a DMZ. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
SMTPconfiguration ina DMZ.........................................................15
Connecting and Configuring the Appliance............................................18
Installationquickreferencetable.............................................................18
Ports and Connections.....................................................................19
3000,3100 panel layout.............................................................19
3200 panel layout..................................................................19
3300and3400panellayout..........................................................20
Panel components: 3000, 3100, 3200, 3300, 3400. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Physically installing the appliance............................................................23
Connect to the network....................................................................23
Port numbers......................................................................23
Using Copper LAN connections.......................................................24
Using Fiber LAN connections.........................................................24
Monitorandkeyboard...............................................................24
Supplying power to the appliance............................................................25
3McAfee Email and Web Security Appliance 5.1 Installation Guide

Installing the software.....................................................................25
Using the Configuration Console.............................................................25
Configurable settings...............................................................25
Configuringtheappliance usingtheSetup Wizard...............................................26
Logging on to the Setup Wizard......................................................26
Welcomepage.....................................................................26
Performing a standard installation.....................................................26
Performing a custom setup..........................................................29
Using the Appliance.......................................................................32
Updatesand HotFixes...............................................................32
After installation...................................................................33
Testing the Configuration...................................................................33
Introducing the user interface........................................................33
Testing the appliance...............................................................34
Exploring the Appliance..................................................................37
Generating reports........................................................................37
Further report information...........................................................37
Using policies to manage message scanning...................................................38
Creating ananti-virusscanning policy..................................................38
Creating an anti-spam scanning policy.................................................39
Creating an email compliance policy...................................................40
Creating a content filtering policy.....................................................40
Troubleshooting...........................................................................42
General problems.........................................................................42
The appliance is not receiving power..................................................42
The appliance is not receiving traffic from the network. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
FAQ....................................................................................43
General issues.....................................................................43
Interface problems.................................................................43
Mail issues........................................................................45
Delivery..........................................................................45
Email attachments.................................................................46
POP3............................................................................46
Physical configuration...............................................................47
System configuration...............................................................47
Systemmaintenance................................................................47
Anti-virus automatic updating........................................................48
McAfee Email and Web Security Appliance 5.1 Installation Guide4
Contents

Anti-spam........................................................................48
Getting more help —thelinksbar............................................................50
5McAfee Email and Web Security Appliance 5.1 Installation Guide
Contents

Preface
This guide provides the necessary information for installing the McAfee®Email and Web Security
Appliance 5.1. It provides steps and verification of the installation process.
This guide demonstrates how to configure Email and Web Security software and when completed
the user will have a fully functional appliance.
Contents
Using this guide
Audience
Graphical conventions
Documentation
Using this guide
This guide helps you to:
• Understand the appliance features and functions.
• Plan and perform the appliance installation and deployment.
• Begin to use the appliance.
• Test the appliance in a laboratory environment (optional).
You can find additional information about McAfee Email and Web Security Appliance scanning
features in the online help. This includes information about:
• Basic concepts
• Policies
• Protocols (SMTP, POP3, FTP, HTTP and ICAP)
• Maintenance
• Monitoring
Audience
The information in this guide is intended primarily for network administrators who are responsible
for their company’s anti-virus and security program.
McAfee Email and Web Security Appliance 5.1 Installation Guide6

Graphical conventions
Figures in this guide use the following symbols.
InternetAppliance
Other server (such as DNS
server)
Mail server
RouterUser or client computer
FirewallSwitch
NetworkNetwork zone (DMZ or
VLAN)
Perceived data pathActual data path
Documentation
This Installation Guide is included with your appliance. Additional information is available in the
online help, and other documentation available from the documentation CD.
Preface
Graphical conventions
7McAfee Email and Web Security Appliance 5.1 Installation Guide

Pre-installation
To ensure the safe operation of the Email and Web Security Appliance, consider the following
before you begin the installation.
• Familiarize yourself with its operational modes and capabilities. It is important that you
choose a valid configuration.
• Decide how to integrate the appliance into your network and determine what information
you need before you start. For example, the name and IP address for the appliance.
• Unpack the appliance as close to its intended location as possible.
• Remove the appliance from any protective packaging and place it on a flat surface.
• Observe all provided safety warnings.
CAUTION: Review and be familiar with all safety information provided.
Contents
What’s in the box
Plan the installation
Inappropriate use
Operating conditions
Positioning the appliance
What’s in the box
To check that all appliance components were delivered, refer to the packing list supplied with
your appliance.
Generally, you should have:
• An appliance
• Power cords
• Network cables
• Secure Messaging Gateway v5.0 installation and recovery CD
• Linux source code CD
• Quarantine Manager v5.0 CD
• Documentation CD
If an item is missing or damaged, contact your supplier.
McAfee Email and Web Security Appliance 5.1 Installation Guide8

Plan the installation
Before unpacking your appliance, it is important to plan the installation and deployment.
Consider the following:
• How you need to prepare your site.
• Environmental requirements.
• Power requirements and considerations.
• Hardware specifications and requirements.
• Configuration scenarios.
• Preparing for installation.
Inappropriate use
The appliance is:
•Not a firewall.
You must use it within your organization behind a correctly configured firewall.
•Not a server for storing extra software and files.
Do not install any software on the appliance or add any extra files to it unless instructed by
the product documentation or your support representative. The appliance cannot handle all
types of traffic. If you use explicit proxy mode, only protocols that are to be scanned should
be sent to the appliance.
Operating conditions
10 to 35°C (50 to 95°F).Temperature
20% to 80% (non-condensing) with a maximum humidity
gradient of 10% per hour.
Relative humidity
0.25 G at 3–200 Hz for 15 minutes.Maximum vibration
One shock pulse in the positive z axis (one pulse on each
side of the unit) of 31 G for up to 2.6 ms.
Maximum shock
-16 to 3,048 m (-50 to 10,000 ft.).Altitude
Positioning the appliance
Install the appliance so that you can control physical access to the unit and access the ports
and connections.
A rack-mounting kit is supplied with the appliance, allowing you to install the appliance in a
19-inch rack — see Mounting the appliance in a rack.
Pre-installation
Plan the installation
9McAfee Email and Web Security Appliance 5.1 Installation Guide

Considerations about Network Modes
Before you install and configure your appliance, you must decide which network mode to use.
The mode you choose determines how you physically connect your appliance to your network.
You can choose from the following network modes.
•Transparent bridge mode
the appliance acts as an Ethernet bridge.
•Transparent router mode
the appliance acts as a router.
•Explicit proxy mode
the appliance acts as a proxy server and a mail relay.
If you are still unsure about the mode to use after reading this and the following sections,
consult your network expert.
Architectural considerations about network modes
The main considerations regarding the network modes are:
• Whether communicating devices are aware of the existence of the appliance. That is, if the
appliance is operating in one of the transparent modes.
• How the appliance physically connects to your network.
• The configuration needed to incorporate the appliance into your network.
• Where the configuration takes place in the network.
Considerations before changing network modes
In explicit proxy and transparent router modes, you can set up the appliance to sit on more
than one network by setting up multiple IP addresses for the LAN1 and LAN2 ports.
If you change to transparent bridge mode from explicit proxy or transparent router mode, only
the enabled IP addresses for each port are carried over.
TIP: After you select an operational mode, McAfee recommends not changing it unless you
move the appliance or restructure your network.
Contents
Transparent bridge mode
Transparent router mode
Explicit proxy mode
Pre-installation
Considerations about Network Modes
McAfee Email and Web Security Appliance 5.1 Installation Guide10

Transparent bridge mode
In transparent bridge mode, the communicating devices are unaware of the appliance — the
appliance’s operation is transparent to the devices.
Figure 1: Transparent communication
In Figure 1: Transparent communication, the external mail server (A) sends email messages
to the internal mail server (C). The external mail server is unaware that the email message is
intercepted and scanned by the appliance (B).
The external mail server seems to communicate directly with the internal mail server — the
path is shown as a dotted line. In reality, traffic might pass through several network devices
and be intercepted and scanned by the appliance before reaching the internal mail server.
What the appliance does
In transparent bridge mode, the appliance connects to your network using the LAN1 and LAN2
ports. The appliance scans the traffic it receives, and acts as a bridge connecting two separate
physical networks, but treats them as a single logical network.
Configuration
Transparent bridge mode requires less configuration than transparent router and explicit proxy
modes. You do not need to reconfigure all your clients, default gateway, MX records, Firewall
NAT or mail servers to send traffic to the appliance. Because the appliance is not a router in
this mode, you do not need to update a routing table.
Where to place the appliance
For security reasons, you must use the appliance inside your organization, behind a firewall.
Figure 2: Single logical network
TIP: In transparent bridge mode, position the appliance between the firewall and your router,
as shown in Figure 2: Single logical network.
In this mode, you physically connect two network segments to the appliance, and the appliance
treats them as one logical network. Because the devices — firewall, appliance, and router —
are on the same logical network, they must all have compatible IP addresses on the same
subnet.
Devices on one side of the bridge (such as a router) that communicate with devices on the
other side of the bridge (such as a firewall) are unaware of the bridge. They are unaware that
Pre-installation
Considerations about Network Modes
11McAfee Email and Web Security Appliance 5.1 Installation Guide

traffic is intercepted and scanned, therefore the appliance is said to operate as a transparent
bridge.
Figure 3: Transparent bridge mode
Transparent router mode
In transparent router mode, the appliance scans email traffic between two networks. The
appliance has one IP address for outgoing scanned traffic, and must have one IP address for
incoming traffic.
The communicating network devices are unaware of the intervention of the appliance — the
appliance’s operation is transparent to the devices.
What the appliance does
In transparent router mode, the appliance connects to your networks using the LAN1 and LAN2
ports. The appliance scans the traffic it receives on one network, and forwards it to the next
network device on a different network. The appliance acts as a router, routing the traffic between
networks, based on the information held in its routing tables.
Configuration
Using transparent router mode, you do not need to explicitly reconfigure your network devices
to send traffic to the appliance. You need only configure the routing table for the appliance,
and modify some routing information for the network devices on either side of it (the devices
connected to its LAN1 and LAN2 ports). For example, you might need to make the appliance
your default gateway.
In transparent router mode, the appliance must join two networks. The appliance must be
positioned inside your organization, behind a firewall.
NOTE: Transparent router mode does not support Multicast IP traffic or non-IP protocols, such
as NETBEUI and IPX.
Pre-installation
Considerations about Network Modes
McAfee Email and Web Security Appliance 5.1 Installation Guide12

Where to place the appliance
Use the appliance in transparent router mode to replace an existing router on your network.
TIP: If you use transparent router mode and you do not replace an existing router, you must
reconfigure part of your network to route traffic correctly through the appliance.
Figure 4: Transparent router mode configuration
You need to:
• Configure your client devices to point to the default gateway.
• Configure the appliance to use the Internet gateway as its default gateway.
• Ensure your client devices can deliver email messages to the mail servers within your
organization.
Explicit proxy mode
In explicit proxy mode, some network devices must be set up explicitly to send traffic to the
appliance. The appliance then works as a proxy or relay, processing traffic on behalf of the
devices.
Explicit proxy mode is best suited to networks where client devices connect to the appliance
through a single upstream and downstream device.
TIP: This might not be the best option if several network devices must be reconfigured to send
traffic to the appliance.
Network and device configuration
If the appliance is set to explicit proxy mode, you must explicitly configure your internal mail
server to relay email traffic to the appliance. The appliance scans the email traffic before
forwarding it, on behalf of the sender, to the external mail server. The external mail server then
forwards the email message to the recipient.
Pre-installation
Considerations about Network Modes
13McAfee Email and Web Security Appliance 5.1 Installation Guide

In a similar way, the network must be configured so that incoming email messages from the
Internet are delivered to the appliance, not the internal mail server.
Figure 5: Relaying email traffic
The appliance scans the traffic before forwarding it, on behalf of the sender, to the internal
mail server for delivery, as shown in Figure 5: Relaying email traffic.
For example, an external mail server can communicate directly with the appliance, although
traffic might pass through several network devices before reaching the appliance. The perceived
path is from the external mail server to the appliance.
Protocols
To scan a supported protocol, you must configure your other network devices or client computers
to route that protocol through the appliance, so that no traffic bypasses the appliance.
Firewall rules
Explicit proxy mode invalidates any firewall rules set up for client access to the Internet. The
firewall sees only the IP address information for the appliance, not the IP addresses of the
clients, so the firewall cannot apply its Internet access rules to the clients.
Where to place the appliance
Configure the network devices so that traffic needing to be scanned is sent to the appliance.
This is more important than the location of the appliance.
The router must allow all users to connect to the appliance.
Figure 6: Explicit proxy configuration
The appliance must be positioned inside your organization, behind a firewall, as shown in Figure
6: Explicit proxy configuration.
Typically, the firewall is configured to block traffic that does not come directly from the appliance.
If you are unsure about your network’s topology and how to integrate the appliance, consult
your network expert.
Pre-installation
Considerations about Network Modes
McAfee Email and Web Security Appliance 5.1 Installation Guide14

Use this configuration if:
• The appliance is operating in explicit proxy mode.
• You are using email (SMTP).
For this configuration, you must:
• Configure the external Domain Name System (DNS) servers or Network Address Translation
(NAT) on the firewall so that the external mail server delivers mail to the appliance, not to
the internal mail server.
• Configure the internal mail servers to send email messages to the appliance. That is, the
internal mail servers must use the appliance as a smart host. Ensure that your client devices
can deliver email messages to the mail servers within your organization.
• Ensure that your firewall rules are updated. The firewall must accept traffic from the
appliance, but must not accept traffic that comes directly from the client devices. Set up
rules to prevent unwanted traffic entering your organization.
Deployment Strategies for Using the Appliance in
a DMZ
A demilitarized zone (DMZ) is a network separated by a firewall from all other networks, including
the Internet and other internal networks. The typical goal behind the implementation of a DMZ
is to lock down access to servers that provide services to the Internet, such as email.
Hackers often gain access to networks by identifying the TCP/UDP ports on which applications
are listening for requests, then exploiting known vulnerabilities in applications. Firewalls
dramatically reduce the risk of such exploits by controlling access to specific ports on specific
servers.
The appliance can be added easily to a DMZ configuration. The way you use the appliance in
a DMZ depends on the protocols you intend to scan.
Contents
SMTP configuration in a DMZ
SMTP configuration in a DMZ
The DMZ is a good location for encrypting mail. By the time the mail traffic reaches the firewall
for the second time (on its way from the DMZ to the internal network), it has been encrypted.
Appliances which scan SMTP traffic in a DMZ are usually configured in explicit proxy mode.
Configuration changes need only be made to the MX records for the mail servers.
NOTE: You can use transparent bridge mode when scanning SMTP within a DMZ. However, if
you do not control the flow of traffic correctly, the appliance scans every message twice, once
in each direction. For this reason, explicit proxy mode is usually used for SMTP scanning.
Pre-installation
Deployment Strategies for Using the Appliance in a DMZ
15McAfee Email and Web Security Appliance 5.1 Installation Guide

Mail relay
Figure 7: Appliance in explicit proxy configuration in a DMZ
If you have a mail relay already set up in your DMZ, you can replace the relay with the appliance.
To use your existing firewall policies, give the appliance the same IP address as the mail relay.
Mail gateway
SMTP does not provide methods to encrypt mail messages — you can use Transport Layer
Security (TLS) to encrypt the link, but not the mail messages. As a result, some companies do
not allow such traffic on their internal network. To overcome this, they often use a proprietary
mail gateway, such as Lotus Notes®or Microsoft®Exchange, to encrypt the mail traffic before
it reaches the internal network.
To implement a DMZ configuration using a proprietary mail gateway, add the appliance to the
DMZ on the SMTP side of the gateway.
Figure 8: Protecting a mail gateway in DMZ
In this situation, configure:
Pre-installation
Deployment Strategies for Using the Appliance in a DMZ
McAfee Email and Web Security Appliance 5.1 Installation Guide16

• The public MX records to instruct external mail servers to send all inbound mail to the
appliance (instead of the gateway).
• The appliance to forward all inbound mail to the mail gateway, and deliver all outbound mail
using DNS or an external relay.
• The mail gateway to forward all inbound mail to the internal mail servers and all other
(outbound) mail to the appliance.
• The firewall to allow inbound mail that is destined for the appliance only.
NOTE: Firewalls configured to use Network Address Translation (NAT), and that redirect inbound
mail to internal mail servers, do not need their public MX records reconfigured. This is because
they are directing traffic to the firewall rather than the mail gateway itself. In this case, the
firewall must instead be reconfigured to direct inbound mail requests to the appliance.
Firewall rules specific to Lotus Notes
By default, Lotus Notes servers communicate over TCP port 1352. The firewall rules typically
used to secure Notes servers in a DMZ allow the following through the firewall:
• Inbound SMTP requests (TCP port 25) originating from the Internet and destined for the
appliance.
• TCP port 1352 requests originating from the Notes gateway and destined for an internal
Notes server.
• TCP port 1352 requests originating from an internal Notes server and destined for the Notes
gateway.
• SMTP requests originating from the appliance and destined for the Internet.
All other SMTP and TCP port 1352 requests are denied.
Firewall rules specific to Microsoft Exchange
A Microsoft Exchange-based mail system requires a significant workaround.
When Exchange servers communicate with each other, they send their initial packets using the
RPC protocol (TCP port 135). However, once the initial communication is established, two ports
are chosen dynamically and used to send all subsequent packets for the remainder of the
communication. You cannot configure a firewall to recognize these dynamically-chosen ports.
Therefore, the firewall does not pass the packets.
The workaround is to modify the registry on each of the Exchange servers communicating
across the firewall to always use the same two “dynamic” ports, then open TCP 135 and these
two ports on the firewall.
We mention this workaround to provide a comprehensive explanation, but we do not recommend
it. The RPC protocol is widespread on Microsoft networks — opening TCP 135 inbound is a red
flag to most security professionals.
If you intend to use this workaround, details can be found in the following Knowledge Base
articles on the Microsoft website:
•Q155831
•Q176466
Pre-installation
Deployment Strategies for Using the Appliance in a DMZ
17McAfee Email and Web Security Appliance 5.1 Installation Guide

Connecting and Configuring the Appliance
We recommend that you consider installing the appliance in the following order:
1Unpack the appliance and confirm no parts are missing (check against parts lists in the
box)
2Rack-mount the appliance.
3Connect the peripherals and power (monitor, keyboard).
4Connect the appliance to the network, noting deployment scenarios and intended network
mode.
5Install the software onto the appliance.
6Use the Configuration Console to carry out the basic configuration (server name, IP
addresses, gateway, and so on).
7Connect to the administration interface.
8Run the Setup Wizard.
9Route test network traffic through the appliance.
10 Test that the network traffic is being scanned.
11 Configure policies and reporting.
12 Route production traffic through the appliance.
CAUTION: Connecting the appliance to your network can disrupt Internet access or other
network services. Ensure that you have arranged network down-time for this, and that you
schedule this during periods of low network usage.
Contents
Installation quick reference table
Physically installing the appliance
Connect to the network
Supplying power to the appliance
Installation quick reference table
To install the appliance, go through the steps in this table:
is described here ...This step ...
What’s in the boxUnpack the pallet and check the contents against the
parts lists in the box.
1.
Mounting the appliance in a rackRack-mount the appliance.2.
Monitor and keyboardConnect the peripherals and power.3.
McAfee Email and Web Security Appliance 5.1 Installation Guide18

is described here ...This step ...
Connect to the networkConnect the appliance to the network.4.
Installing the softwareInstall the software.5.
Using the Configuration ConsolePerform basic configuration.6.
Configuring the appliance using the Setup WizardConnect to the administration interface.7.
Configuring the appliance using the Setup WizardRun the Setup Wizard.8.
Testing the applianceRoute the test network traffic through the appliance.12.
Testing the applianceTest that the network traffic is being scanned.13.
Using policies to manage message scanningConfigure policies and reporting.14.
Configuring the appliance using the Setup WizardConfigure production traffic through the system.15.
Ports and Connections
This chapter shows the panel layouts for each model of appliance.
3000, 3100 panel layout
3200 panel layout
3300 and 3400 panel layout
Panel components: 3000, 3100, 3200, 3300, 3400
3000, 3100 panel layout
3200 panel layout
Connecting and Configuring the Appliance
Ports and Connections
19McAfee Email and Web Security Appliance 5.1 Installation Guide

3300 and 3400 panel layout
Panel components: 3000, 3100, 3200, 3300, 3400
CD-ROM drive
Use the CD-ROM drive only when restoring, upgrading, or diagnosing system faults on the
appliance.
System status and hard disk drive (HDD) LEDs
System status LED
• Lights blue — during normal use.
• Flashes blue — when the System
Identification ( ) button is pressed.
• Flashes amber when there is a system
fault.
HDD LED
• Flashes green when the hard disk drive is
in use.
Power and LED
Turns the appliance on and off.
• Lights green — when the appliance is operational.
• Flashes green — whenthe appliance is in standby mode. It is receiving power through the
power socket, but the power button is off. The network ports remain active but no protocols
or data intended for the appliance can pass through the appliance.
Power socket
Use the correct power cord for your location.
NOTE: 3300 and 3400 appliances only — We recommend you connect both power supplies.
Connecting and Configuring the Appliance
Ports and Connections
McAfee Email and Web Security Appliance 5.1 Installation Guide20