McAfee NS Series User manual

Revision A
McAfee Network Security Platform
(NS9500 Sensor Product Guide)

COPYRIGHT
Copyright © 2019 McAfee, LLC
TRADEMARK ATTRIBUTIONS
McAfee and the McAfee logo, McAfee Active Protection, ePolicy Orchestrator, McAfee ePO, McAfee EMM, Foundstone, McAfee LiveSafe, McAfee QuickClean, Safe Eyes,
McAfee SECURE, SecureOS, McAfee Shredder, SiteAdvisor, McAfee Stinger, True Key, TrustedSource, VirusScan are trademarks or registered trademarks of McAfee,
LLC or its subsidiaries in the US and other countries. Other marks and brands may be claimed as the property of others.
LICENSE INFORMATION
License Agreement
NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE
GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE
CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE
RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU
DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF
APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND.
2McAfee Network Security Platform

Contents
1About Network Security Sensors 5
Functions of an NS-series Sensor .............................5
Deployment of an NS-series Sensor ............................ 6
2NS-series physical description 7
Components of an NS-series Sensor ............................7
Sensor LEDs .....................................8
3Before you install 11
Usage restrictions .................................. 11
Safety measures ...................................11
About ber-optic ports ................................ 12
Contents of the box ................................. 12
Unpack the Sensor ..................................13
4Setting up the Sensor 15
Setup overview ...................................15
How to position the Sensor ...............................15
Install the slide rails and rack mount the Sensor ....................... 16
5NS-series interface modules 19
2-port QSFP28 100 Gigabit Network Interface Module .....................19
2-port QSFP+ 40 Gigabit Network Interface Module ......................20
4-port QSFP+ 40 Gigabit Network Interface Module ......................20
4-port 10/1 GigE SM 8.5 µm with internal fail-open Network Interface Module ............ 21
4-port 10/1 GigE MM 50 µm with internal fail-open Network Interface Module ............21
4-port 10/1 GigE MM 62.5 µm with internal fail-open Network Interface Module ........... 22
4-port RJ-45 10 Gbps/1 Gbps/100 Mbps Network Interface Module ................ 22
6-port RJ-45 10/100/1000 Mbps Network Interface module ................... 22
8-port SFP/SFP+ 1/10 Gigabit Network Interface Module ....................23
Installation of the interface module ............................23
Install the interface module during a fresh installation of the Sensor ............ 23
Install the interface module on an up and running Sensor ................ 24
Remove an interface module .............................. 24
6Small form-factor pluggable transceiver modules 25
SFP transceiver modules ................................26
SFP+ transceiver modules ............................... 26
QSFP+ transceiver modules .............................. 27
QSFP28 transceiver modules ..............................27
Install a transceiver module .............................. 27
Remove a transceiver module ..............................28
7Attaching cables to the Sensor 29
Connect the cable to the Console port ...........................29
McAfee Network Security Platform 3

Connect the cable to the Response port ..........................29
Connect the cable to the Management port ........................ 30
About connecting cables to the Monitoring ports ...................... 30
How to use peer ports ............................. 30
Cable types for routers, switches, hubs, and computers .................31
Connect the cables for in-line mode ........................ 31
Connect the cables for tap mode ......................... 32
Connect the cables for SPAN or hub mode ......................32
Connect the cable for Sensor failover ........................32
Connect the cables for Sensor Fail-Open .......................33
Turning the Sensor on and o ..............................34
Managing licenses for NS9500 Sensors .......................... 34
Add license to the Manager ............................35
Assign a license to a Sensor ........................... 35
Unassign a license from a Sensor ......................... 36
Remove a license from the Manager ........................ 36
8Troubleshooting the Sensor 37
9Sensor technical specications 39
Contents
4McAfee Network Security Platform

1About Network Security Sensors
McAfee Network Security Sensors (Sensors) are high-performance, scalable, and exible content processing
appliances built for the accurate detection and prevention of:
• Network intrusions
• Network misuse
• Distributed Denial-of-Service (DDoS) attacks
Sensors are specically designed to handle trac at wire speed, eciently inspect and detect intrusions with a
high degree of accuracy, and exible enough to adapt to the security needs of any enterprise environment.
When deployed at key network access points, the Sensor provides real-time trac monitoring to detect
malicious activity and respond to the malicious activity as congured by the administrator.
After you deploy a Sensor successfully, you congure and manage it using the McAfee® Network Security
Manager (Manager). The process of conguring a Sensor and establishing communication with the Manager is
described in subsequent chapters of this guide. For the details about the Manager, see the McAfee Network
Security Platform Manager Administration Guide.
Contents
Functions of an NS-series Sensor
Deployment of an NS-series Sensor
Functions of an NS-series Sensor
The NS-series Sensors are a third-generation hardware platform for McAfee® Network Security Sensor (Sensor)
designed for high bandwidth links, to provide Next Generation IPS (NGIPS) capability, providing high aggregate
throughput across various Sensor models. The NS9500 Sensor is a 1RU unit providing an aggregate throughput
up to 30 Gbps.
The primary function of a Sensor is to analyze trac on selected network segments and to respond when an
attack is detected. The Sensor examines the header and data portion of every network packet, looking for
patterns and behavior in the network trac that indicate malicious activity. The Sensor examines packets
according to user-congured policies, or rule sets, which determine what attacks to watch for, and how to
respond with countermeasures if an attack is detected.
If an attack is detected, a Sensor responds according to its congured policy. Sensor can perform many types of
attack responses, including generating alerts and packet logs, resetting TCP connections, "scrubbing" malicious
packets, and even blocking attack packets entirely before they reach the intended target.
1
McAfee Network Security Platform 5

Deployment of an NS-series Sensor
Deployment of a Sensor requires knowledge of your network to help determine the level of conguration and
the number of installed Sensors. You also need to determine the number of McAfee® ePolicy Orchestrator®
(McAfee® ePO™) servers required to protect your network. The Sensor is purpose-built for the monitoring of
trac across one or more network segments.
Following is an example of a network topology using Gigabit Ethernet throughput. In the illustration, McAfee®
Network Security Platform (formerly McAfee® IntruShield®) provides IPS protection to outsourced servers. High
port-density and virtualization provides a highly scalable solution, while Network Security Platform protects
against Web and eCommerce mail server exploits.
Figure 1-1 A sample Network Security Platform deployment
1About Network Security Sensors
Deployment of an NS-series Sensor
6McAfee Network Security Platform

2NS-series physical description
The high-port density NS-series Sensor is designed for high bandwidth links. This section gives a physical
description of the NS-series Sensor.
Contents
Components of an NS-series Sensor
Sensor LEDs
Components of an NS-series Sensor
Correlate the pictures with the information following it to understand the components of an NS-series Sensor.
Figure 2-1 Sensor front panel
1Console port (1)
2QSFP28 100/QSFP+ 40 Gigabit Ethernet ports (2)
3Two slots for I/O modules (Any combination of the interface modules can be used)
• QSFP28 100/QSFP+ 40 Gigabit Ethernet ports (2)
• QSFP+ 40 Gigabit Ethernet ports (4)
• QSFP+ 40 Gigabit Ethernet ports (2)
• SFP/SFP+ 1/10 Gigabit Ethernet Monitoring ports (8)
• RJ-45 10/100/1000 Mbps Ethernet Monitoring ports (6)
• RJ-45 100/1000/10000 Gigabit Ethernet Monitoring ports (4)
• 1/10 Gigabit Ethernet Monitoring ports (4)
4RJ-45 100/1000/10000 Mbps Ethernet Monitoring ports (4)
2
McAfee Network Security Platform 7

The supported transceiver modules are QSFP28, QSFP+, SFP+ (MM and SM), SFP Fiber (MM and SM) and SFP
Copper.
Figure 2-2 Sensor rear panel
1Power supply A/B (Pwr A/Pwr B)
2USB ports (2)
3RJ-45 1000/10000 Management port (Mgmt) (1)
4RJ-45 1000/10000 Response port (R1) (1)
Sensor LEDs
The front and rear panel LEDs provide status information for the health of the Sensor and the activity on its
ports. The following table describes the NS-series LEDs.
Front panel LEDs
LED Status Description
Status Green
Amber
Sensor is operating in good health.
Sensor is booting up. Also indicates system bad health if the LED is on for longer
duration.
Fan Green
Amber
All ve fans are operating.
One or more of the fans has failed.
Temp Green
Amber
Inlet air temperature measured inside the chassis is normal. (Chassis
temperature OK.)
Inlet air temperature measured inside the chassis is too high. (Chassis
temperature too hot.)
Gigabit Ports
Speed
Green
Amber
O
The port speed is 10000 Mbps.
The port speed is 1000 Mbps.
The port speed is 100 Mbps.
Gigabit Ports Link Green
O
The link is up.
The link is down.
RJ45 FailOpen/
Bypass
Green
O
The port pair is in Inline Fail-Open/Inline Fail-Close/Span/Tap Mode.
The Port Pair is in the Bypass Mode.
2NS-series physical description
Sensor LEDs
8McAfee Network Security Platform

Rear panel LEDs
LED Status Description
Pwr A (Power A) Solid Green
Blinking Green
Solid Amber
Power Supply A is functioning.
Power Supply A is stand-by.
Power Supply A is not functioning or the unit has no power feed.
Pwr B (Power B) Solid Green
Blinking Green
Solid Amber
Power Supply B is functioning.
Power Supply B is stand-by.
Power Supply B is not functioning or the unit has no power feed.
Management Port Speed Green
Amber
O
The port speed is 10000 Mbps.
The port speed is 1000 Mbps.
Management Port Link/Act Green
Blinking Green
O
The link is up.
Data is received or transmitted.
The link is down.
Response Port Speed Green
Amber
O
The port speed is 10000 Mbps.
The port speed is 1000 Mbps.
Response Port Link/Act Green
Blinking Green
O
The link is up.
Data is received or transmitted.
The link is down.
NS-series physical description
Sensor LEDs 2
McAfee Network Security Platform 9

2NS-series physical description
Sensor LEDs
10 McAfee Network Security Platform

3Before you install
This chapter describes the best practices for deployment of Sensors in your network. Topics include the safety
considerations for handling the Sensor, usage restrictions that apply to the Sensor model, and the contents that
are shipped along with the Sensor.
Contents
Usage restrictions
Safety measures
About ber-optic ports
Contents of the box
Unpack the Sensor
Usage restrictions
The following restrictions apply to the use and operation of a Sensor:
• You should not remove the outer shell of the Sensor. Doing so will invalidate your warranty.
• The Sensor appliance is not a general purpose workstation.
• McAfee prohibits the use of the Sensor appliance for anything other than operating Network Security
Platform.
• McAfee prohibits the modication or installation of any hardware or software on the Sensor appliance that
is not part of the normal operation of Network Security Platform.
Safety measures
Please read the following warnings before you install the Sensor. These safety measures apply to all Sensor
models unless otherwise noted. Failure to observe these safety warnings could result in serious physical injury.
Warnings:
• Read the installation instructions before you connect the system to its power source.
• To remove all power from the Sensor, unplug all power cords, including the redundant power cord.
• Only trained and qualied personnel should be allowed to install, replace, or service this equipment.
• Before working on the equipment that is connected to power lines, remove all jewelry including rings,
necklaces, and watches. Metal objects will heat up when connected to power and ground, and can cause
serious burns or weld the metal object to the terminals.
• This equipment is intended to be grounded. Ensure that the host is connected to earth ground during
normal use.
3
McAfee Network Security Platform 11

• Do not remove the outer shell of the Sensor. Doing so will invalidate your warranty.
• Do not operate the system unless all cards, faceplates, front covers, and rear covers are in place. Blank
faceplates and cover panels prevent exposure to hazardous voltages and currents inside the chassis, contain
electromagnetic interference (EMI) that might disrupt other equipment and direct the ow of cooling air
through the chassis.
• To avoid electric shock, do not connect safety extra-low voltage (SELV) circuits to telephone-network voltage
(TNV) circuits. LAN ports contain SELV circuits, and WAN ports contain TNV circuits. Some LAN and WAN
ports both use RJ-45 connectors. Use caution when connecting cables.
• This equipment has been tested and found to comply with the limits for a Class A digital device, pursuant to
Part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful
interference when the equipment is operated in a commercial environment. This equipment generates,
uses, and can radiate radio frequency energy, and if not installed and used in accordance with the
instruction manual, might cause harmful interference to radio communications. Operation of this
equipment in a residential area is likely to cause harmful interference, in which case the users will be
required to correct the interference at their own expense.
• Refer to the Appendix for information on regulatory, compliance, and other safety requirements.
About ber-optic ports
The Sensor uses ber-optic connectors for its Monitoring ports. The connector and compatible cable types are
below:
Connector Cable
QSFP28 MPO/MTP and LC
QSFP+ LC-duplex and MPO/MTP
SFP/SFP+ LC-duplex
Note the following:
• Fiber-optic ports (for example, SFP/SFP+/QSFP+/ QSFP28, FDDI, OC-3, OC-12, OC-48, ATM, GBIC, and
100BaseFX) are considered Class 1 laser or Class 1 LED ports.
• These products have been tested and found to comply with Class 1 limits of IEC 60825-1, IEC 60825-2, EN
60825-1, EN 60825-2, and 21CFR1040.
To avoid exposure to radiation, do not stare into the aperture of a ber-optic port. Invisible radiation could be
emitted from the aperture of the port when no ber cable is connected.
• Only FDA registered, EN 60825-1 and IEC 60825-1 certied Class 1 SFP/SFP+/QSFP+/QSFP28 laser
transceivers are acceptable for use with the Sensor.
Contents of the box
The following accessories are shipped in the NS-series Sensor crate:
• Sensor
• Power supply (x2)
• Power cords. McAfee provides a standard and international power cables.
3Before you install
About ber-optic ports
12 McAfee Network Security Platform

• Set of rack mounting rails
• Printed Quick Start Guide
• Serial Console Cable (DB9-DB9)
• QSFP28 Direct Attach Copper (DAC) cable
Unpack the Sensor
1Open the crate.
2Remove the rst accessory box.
3Verify you have received all parts.
These parts are listed on the packing list and in the section, Contents of the box.
4Remove the Sensor.
5Place the Sensor box as close to the installation site as possible.
6Position the box with the text upright.
7Open the top aps of the box.
8Remove the accessory box within the Sensor box.
9Verify you have received all parts.
These parts are listed on the packing list and in the section, Contents of the box.
10 Remove the Slide Rail Kit.
11 Pull out the packing material surrounding the Sensor.
12 Remove the Sensor from the antistatic bag.
13 Save the box and packing materials for later use in case you need to move or ship the Sensor.
Before you install
Unpack the Sensor 3
McAfee Network Security Platform 13

3Before you install
Unpack the Sensor
14 McAfee Network Security Platform

4Setting up the Sensor
This chapter describes how to set up the Sensor for you to congure it.
Contents
Setup overview
How to position the Sensor
Install the slide rails and rack mount the Sensor
Setup overview
Setting up a Sensor involves these steps:
1Position the Sensor.
2Install the supported interface modules as per your requirement.
3Attach power, network, and monitoring cables.
4Turn on the Sensor.
5Congure the Sensor after you have set up and turned it on.
How to position the Sensor
Place the Sensor in a physically secure location, close to the switches or routers it will be monitoring. Ideally, the
Sensor should be located within a standard communications rack. To mount the Sensor on a rack, you will
attach two mounting rails to the Sensor as described in the subsequent sections of this guide.
4
McAfee Network Security Platform 15

Install the slide rails and rack mount the Sensor
Follow this procedure to assemble the slide rails and position the Sensor on it.
Task
1Disassemble inner slide rail members from cabinet sections.
aPull inner member out until it comes to a lock position.
bDepress the QD latch to fully disconnect inner members.
2Mount inner members to the chassis unit.
aPlace each inner member on both sides of the chassis unit. Position the bottom mounting holes of the
inner member with matching mounting holes on chassis unit.
bUse screws to secure inner members in place. Apply to both sides of chassis unit.
3Mount slide cabinet sections to the rack.
aInstall the front end of each slide cabinet section to rack using the slide tool-less features. The tool-less
latch rotates when the bracket is pressed up against the rack rails.
bAlign, adjust, and attach the rear brackets to the rack rail.
4Setting up the Sensor
Install the slide rails and rack mount the Sensor
16 McAfee Network Security Platform

4Mount chassis unit into mounted cabinet sections.
aGuide the chassis unit into the pre-installed cabinet sections. Allow the pre-installed inner members to
slide into the outer members until they lock in place.
bDepress the QD latch on both sides and continue to push the chassis unit in until fully closed.
5Secure the chassis unit through the rack rails.
aWith the chassis unit in fully closed position, secure using two truss head screws.
bDrive the screws through the inner member ange and through the rack rails. The screws thread directly
to the cabinet slide members. Tighten the screws.
Setting up the Sensor
Install the slide rails and rack mount the Sensor 4
McAfee Network Security Platform 17

4Setting up the Sensor
Install the slide rails and rack mount the Sensor
18 McAfee Network Security Platform

5NS-series interface modules
The NS9500 Sensors support the 2-port, 4-port, 6-port, and 8-port Network Interface Modules. These modules
need to be installed in the respective slots on the Sensor.
For more information, see the Network Security Platform NS-series Interface Modules Reference Guide.
Contents
2-port QSFP28 100 Gigabit Network Interface Module
2-port QSFP+ 40 Gigabit Network Interface Module
4-port QSFP+ 40 Gigabit Network Interface Module
4-port 10/1 GigE SM 8.5 µm with internal fail-open Network Interface Module
4-port 10/1 GigE MM 50 µm with internal fail-open Network Interface Module
4-port 10/1 GigE MM 62.5 µm with internal fail-open Network Interface Module
4-port RJ-45 10 Gbps/1 Gbps/100 Mbps Network Interface Module
6-port RJ-45 10/100/1000 Mbps Network Interface module
8-port SFP/SFP+ 1/10 Gigabit Network Interface Module
Installation of the interface module
Remove an interface module
2-port QSFP28 100 Gigabit Network Interface Module
The 2-port QSFP28 (Quad Small Form-Factor Pluggable 28) Network Interface Module provides 100 Gigabit
Ethernet performance on each port.
Figure 5-1 2-port QSFP28 100 Gigabit interface module
5
McAfee Network Security Platform 19

2-port QSFP+ 40 Gigabit Network Interface Module
The 2‑Port QSFP+ (Quad Small Form‑Factor Pluggable Plus) Network Interface Module provides 40 Gigabit
Ethernet performance on each port.
Figure 5-2 2-Port QSFP+ 40 Gigabit interface module
4-port QSFP+ 40 Gigabit Network Interface Module
The 4-port QSFP+ (Quad Small Form-Factor Pluggable Plus) Network Interface Module provides 40 Gigabit
Ethernet performance on each port.
Figure 5-3 4-port QSFP+ 40 Gigabit interface module
5NS-series interface modules
2-port QSFP+ 40 Gigabit Network Interface Module
20 McAfee Network Security Platform