McAfee DTP-1650-MGRA - Network DLP Manager 1650... User manual

Installation Guide
Revision C
McAfee Data Loss Prevention 9.2.1
For use with ePolicy Orchestrator 4.5.0 and 4.6.0 Software

COPYRIGHT
Copyright © 2012 McAfee, Inc. Do not copy without permission.
TRADEMARK ATTRIBUTIONS
McAfee, the McAfee logo, McAfee Active Protection, McAfee AppPrism, McAfee Artemis, McAfee CleanBoot, McAfee DeepSAFE, ePolicy Orchestrator,
McAfee ePO, McAfee EMM, McAfee Enterprise Mobility Management, Foundscore, Foundstone, McAfee NetPrism, McAfee Policy Enforcer, Policy Lab,
McAfee QuickClean, Safe Eyes, McAfee SECURE, SecureOS, McAfee Shredder, SiteAdvisor, SmartFilter, McAfee Stinger, McAfee Total Protection,
TrustedSource, VirusScan, WaveSecure, WormTraq are trademarks or registered trademarks of McAfee, Inc. or its subsidiaries in the United States and
other countries. Other names and brands may be claimed as the property of others.
LICENSE INFORMATION
License Agreement
NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS
FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU
HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR
SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A
FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET
FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF
PURCHASE FOR A FULL REFUND.
2McAfee Data Loss Prevention 9.2.1 Installation Guide

Contents
Preface 5
About this guide .................................. 5
Audience .................................. 5
Conventions ................................. 5
Find product documentation ..............................6
1Setting up the hardware 7
Adding devices and servers ..............................7
Check the shipment .................................7
Plan your installation ................................ 8
Rack mount the appliances ..............................8
Connect a management console ............................9
Configure McAfee DLP Manager ............................ 10
Select an integration mode for McAfee DLP Monitor ....................11
SPAN port configuration ............................11
Network tap configuration ...........................13
Complete the setup ................................ 14
2Installing or upgrading the software on 4400 appliances 15
Download the 4400 archive ............................. 15
Boot options ................................... 16
Set up the next boot option .......................... 17
Install a fresh image on 4400 appliances ........................ 17
Upgrade the products on 4400 appliances ........................18
Apply a hotfix ...................................20
Convert an installation to another McAfee DLP product .................. 20
Restoring the drives ................................ 21
3Installing or upgrading software on 1650 and 3650 appliances 23
Download the 1650 or 3650 archive .......................... 23
Install a fresh image on 1650 or 3650 appliances .....................24
Upgrade the products on 1650 or 3650 appliances .................... 25
Apply a hotfix ...................................26
4Configuring McAfee DLP appliances and adding servers 29
Configure McAfee DLP appliances using Setup Wizard ...................29
Configure McAfee DLP appliances after installation .................... 35
Add McAfee DLP products to McAfee DLP Manager .................... 35
Configuring McAfee DLP Prevent ........................... 36
MTA requirements for McAfee DLP Prevent .................... 37
Configure McAfee DLP Prevent ......................... 38
Add LDAP servers to McAfee DLP Manager ....................... 39
Add McAfee Logon Collector to McAfee DLP Manager ................... 41
Add syslog servers to McAfee DLP systems ....................... 42
Resynchronize McAfee DLP systems with an NTP server .................. 42
McAfee Data Loss Prevention 9.2.1 Installation Guide 3

Testing the system ................................. 43
5Installing McAfee DLP Endpoint 45
Verify system requirements ............................. 46
Configure the server ................................ 47
Install McAfee ePolicy Orchestrator .......................... 48
Installing McAfee DLP WCF service ...........................49
Install the McAfee DLP WCF service ....................... 50
Repository folders ................................. 55
Creating and configuring repository folders .................... 55
User and permission sets .............................. 57
Create and define McAfee DLP administrators ................... 57
Create and define permission sets ........................58
DLP permission set options ...........................58
Install the McAfee Data Loss Prevention Endpoint extension ................ 59
Initialize the McAfee DLP Endpoint Policy console .....................60
Upgrade the license .................................62
Check in the McAfee DLP Endpoint package to ePolicy Orchestrator ..............63
Deploy McAfee DLP Endpoint .............................63
Define a default rule ............................. 63
Deploy McAfee DLP Endpoint with ePolicy Orchestrator 4.6 ..............64
Verify the installation ............................. 65
Uninstall McAfee DLP Endpoint ............................ 66
6Integrating McAfee DLP Endpoint into a unified policy system 67
Setting up Unified DLP on ePolicy Orchestrator ..................... 68
Install the network extension ......................... 68
Install the UDLP (host) extension ........................68
Configure McAfee Agent on ePolicy Orchestrator .................. 69
Add an evidence folder on ePolicy Orchestrator ...................69
Connecting McAfee DLP Manager and the ePolicy Orchestrator server ............ 70
Gather ePolicy Orchestrator registration information ................ 70
Add an ePolicy Orchestrator database user .................... 70
Register McAfee DLP Manager on ePolicy Orchestrator server .............71
Register ePolicy Orchestrator on McAfee DLP Manager ................71
Checking the connection ........................... 72
Configuring McAfee DLP Endpoint on McAfee DLP Manager ................. 72
Generate a global policy for McAfee DLP Endpoint ..................73
Maintaining compatibility with installed McAfee clients ............... 73
Add an Agent Override Password ........................ 74
Set the manual tagging option ......................... 74
Installation and configuration complete .........................75
Index 77
Contents
4McAfee Data Loss Prevention 9.2.1 Installation Guide

Preface
This guide provides the information you need to install your McAfee product.
It contains all of the necessary information for installing McAfee® Data Loss Prevention software,
including detailed steps and verification of the installation and configuration process in both the new
hardware platform and legacy appliances. It also includes integration with McAfee® ePolicy
Orchestrator® and McAfee® Data Loss Prevention Endpoint to configure a unified policy installation.
When the process is completed, the user will have a fully functional McAfee DLP hardware and
software implementation that is properly configured.
Contents
About this guide
Find product documentation
About this guide
This information describes the guide's target audience, the typographical conventions and icons used
in this guide, and how the guide is organized.
Audience
McAfee documentation is carefully researched and written for the target audience.
The information in this guide is intended primarily for:
•Administrators — People who implement and enforce the company's security program.
•Security officers — People who determine sensitive and confidential data, and define the
corporate policy that protects the company's intellectual property.
Conventions
This guide uses these typographical conventions and icons.
Book title, term,
emphasis
Title of a book, chapter, or topic; a new term; emphasis.
Bold Text that is strongly emphasized.
User input, code,
message
Commands and other text that the user types; a code sample; a displayed
message.
Interface text Words from the product interface like options, menus, buttons, and dialog
boxes.
Hypertext blue A link to a topic or to an external website.
Note: Additional information, like an alternate method of accessing an
option.
McAfee Data Loss Prevention 9.2.1 Installation Guide 5

Tip: Suggestions and recommendations.
Important/Caution: Valuable advice to protect your computer system,
software installation, network, business, or data.
Warning: Critical advice to prevent bodily harm when using a hardware
product.
Find product documentation
McAfee provides the information you need during each phase of product implementation, from
installation to daily use and troubleshooting. After a product is released, information about the product
is entered into the McAfee online KnowledgeBase.
Task
1Go to the McAfee Technical Support ServicePortal at http://mysupport.mcafee.com.
2Under Self Service, access the type of information you need:
To access... Do this...
User documentation 1Click Product Documentation.
2Select a product, then select a version.
3Select a product document.
KnowledgeBase • Click Search the KnowledgeBase for answers to your product questions.
• Click Browse the KnowledgeBase for articles listed by product and version.
Preface
Find product documentation
6McAfee Data Loss Prevention 9.2.1 Installation Guide

1Setting up the hardware
This Quick Start serves as a high‑level road map for setting up your McAfee DLP system. McAfee DLP
Manager is shipped pre‑installed; the other products in the suite (McAfee DLP Monitor, McAfee DLP
Discover, and McAfee DLP Prevent) must be installed on‑site.
McAfee DLP Monitor must be set up to capture network traffic, so it requires additional configuration
steps.
Contents
Adding devices and servers
Check the shipment
Plan your installation
Rack mount the appliances
Connect a management console
Configure McAfee DLP Manager
Select an integration mode for McAfee DLP Monitor
Complete the setup
Adding devices and servers
The final setup for McAfee Total Protection for Data Loss Prevention depends on your protection
strategy. After you complete setup of all of the appliances, go to the System tab on McAfee DLP
Manager to add the products to be managed and the servers needed to complete the system.
For example, depending on your objectives, you might add McAfee DLP Discover or McAfee DLP
Prevent, which require additional configuration.
If you add McAfee DLP Endpoint to the network product suite, you must install it on McAfee® ePolicy
Orchestrator®, and add endpoint, evidence, and directory servers.
Check the shipment
Each product ships with all of the material needed to install it on a network. Check each shipment to
verify that all items on the packing list have been received.
Task
1Refer to your Accessory Kit Content List to ensure that you received the following items:
• Region‑specific power cords ‑ 2
• CAT5 cables ‑ 3
• Serial cable: RJ‑45 to RS‑232 ‑ Cisco console cable
1
McAfee Data Loss Prevention 9.2.1 Installation Guide 7

• Intel Diagnostic Tool (IDT) USB
• Product notes for IDT (CD media)
• Safety document
• Warranty document
• Recovery media
2If an item is missing or damaged, contact your supplier.
Plan your installation
Before installing, survey your environment and collect configuration information.
For the McAfee DLP Monitor appliance, you will also need a network tap (unless you are planning a
SPAN port configuration).
Task
1Collect the following information about the network in which McAfee Total Protection for DLP will be
installed.
• Host name • Secondary DNS server
• IP address • Domain
• Subnet mask • NTP server
• Default gateway • Syslog server
• DNS domain • Email relay server
• Primary DNS server
2Devise a protection strategy by evaluating the type of information you need to protect. Your
objectives will determine which policies you activate.
3Determine who will be the primary administrator of the system.
Rack mount the appliances
Each of the McAfee DLP products is shipped on an Intel® Server System SR2612UR.
For rack mounting instructions, download the Intel® Server System SR2612UR Service Guide from the
Intel download site.
http://download.intel.com/support/motherboards/server/s5520ur/sb/r2612ur_service_guide_14.pdf
For more information, download the Intel® Server System SR2612UR Technical Product Specification.
http://download.intel.com/support/motherboards/server/s5520ur/sb/sr2612ur_tps_13.pdf
1Setting up the hardware
Plan your installation
8McAfee Data Loss Prevention 9.2.1 Installation Guide

Connect a management console
Connect a laptop to the management port of the McAfee DLP appliance so you can reconfigure it
through a directly connected device. Because McAfee DLP Manager requires additional steps,
reconfigure all other products first.
Before you begin
You will need the list of network parameters you prepared when you planned your
installation.
Figure 1-1 Model 1650 appliance port configuration
1 Ethernet port 0
2 Ethernet port 1 — Management port
3 Ethernet port 2 — Capture port 0
4 Ethernet port 3 — Capture port 1
Figure 1-2 Model 3650 appliance port configuration
1 Ethernet port 0
2 Ethernet port 1 — Management port
3 Ethernet port 2 — Capture port 0
4 Ethernet port 3 — Capture port 1
Figure 1-3 Model 4400 appliance port configuration
1 Ethernet port 0
2 Ethernet port 1 — Management port
3 Ethernet port 3 — Capture port 1 — note reversed configuration
4 Ethernet port 2 — Capture port 0 — note reversed configuration
By default, each appliance is configured with the IP address 192.168.1.2, but a new IP address and
other network parameters are required to integrate it into the network.
Setting up the hardware
Connect a management console 1
McAfee Data Loss Prevention 9.2.1 Installation Guide 9

You must connect a laptop to the management port so you can convey this information to the
appliance. Assign the laptop an IP address that is different, but on the same subnet, so it can access
the management port.
Task
1Connect a laptop to the management port of the appliance using the supplied Ethernet cable.
2Change the laptop to an address in the 192.168.1.X/24 IP range — for example, 192.168.1.10.
3Open a web browser and connect to the DLP appliance.
https://192.168.1.2
The DLP user interface starts.
4Log on to the McAfee DLP appliance.
The default logon is admin/mcafee.
The End User License Agreement appears.
5Select the license agreement checkbox and click I Accept.
The Setup Wizard starts.
6On the Network Configuration page, enter all of the IP addresses, and the host and domain names
needed to integrate the appliance into the network.
If you are configuring a McAfee DLP Manager, skip to the next topic.
7Advance through the Setup Wizard pages to the Review page.
The interim pages will be completed only on the McAfee DLP Manager appliance.
8Click Submit, then Exit Wizard.
When this step is complete, the appliance will have a new IP address and will be integrated into the
network. Restarting is not necessary.
If you have configured McAfee DLP Discover or McAfee DLP Prevent appliances, setup is complete. If
you are configuring McAfee DLP Manager, proceed to the next step. If you are configuring McAfee DLP
Monitor, proceed to the following step.
Configure McAfee DLP Manager
When you configure McAfee DLP Manager, you must provide additional information after the network
configuration is completed.
Before you begin
You must have completed the network settings required on the Network Configuration page of
the Setup Wizard.
Task
1On the Time Configuration page, change the time zone.
2Select Manual to set NTP to local time.
On this first configuration, you will not yet be able to set the NTP server because the default IP
address (192.168.1.2) will not allow it to be located. The NTP server can be defined only when the
system is restarted and integrated into the network.
1Setting up the hardware
Configure McAfee DLP Manager
10 McAfee Data Loss Prevention 9.2.1 Installation Guide

3On the Policy Activation page, select the checkboxes of the policies that will generate incidents that
are relevant to your protection strategy.
If you are in a region that is not listed, you will be able to activate policies that are directly relevant
to your location after the system is installed.
4On the Administrator Setup page, enter the email address of the primary administrator and change the
password from the default.
5On the Email and Email Server Setting page, enter the IP address or host name of the email server.
6On the Review page, verify your settings, click Cancel, or click Previous to change them.
7When you have confirmed your settings, click Submit, then Exit Wizard.
At this point, the McAfee DLP Manager setup is almost complete. After all other products are
integrated into the network, sync McAfee DLP Manager to the network by completing the final step
in this document.
Select an integration mode for McAfee DLP Monitor
McAfee DLP Monitor must be physically integrated into the network so it can capture traffic. There are
two integration modes: use of a mirror (SPAN) port on a LAN switch, or placement of a network tap
between the network and the appliance.
SPAN port configuration
A SPAN (Switched Port Analyzer) port configuration enables monitoring by transparently copying traffic
from source ports to the destination port to which McAfee DLP Monitor is connected.
If two capture ports are used, two traffic sources (for example, different subnets) must be used.
Certain switch models permit the use of a “remote SPAN”, or “RSPAN” capability, which allows ports
from multiple switches to be mirrored to the port to which McAfee DLP Monitor is connected. If you
want to mirror multiple ports on multiple switches to your DLP appliance, contact the switch vendor for
details on configuring RSPAN.
Figure 1-4 Span port configuration
1 Capture ports
2 WAN router traffic mirrored to McAfee DLP Monitor port
3 LAN
4 LAN switch
5 WAN
Setting up the hardware
Select an integration mode for McAfee DLP Monitor 1
McAfee Data Loss Prevention 9.2.1 Installation Guide 11

This method requires a change on the LAN switch, but no downtime is required because network
traffic is not disrupted.
With this configuration, some packets might be dropped under heavy loads. As a result, the number of
packets seen by McAfee DLP Monitor might not match the number seen by the ports being monitored.
Integrate the appliance using a SPAN port
Task
1Connect McAfee DLP Monitor to a network switch using a console cable or network connection
(such as Telnet or SSH).
Note the port used to connect the appliance to the LAN switch, and the port used by the WAN
router.
2Apply the appropriate SPAN port configuration.
3Using interface show commands on the switch, verify that traffic is being received on the switch
port to which McAfee DLP Monitor is connected.
4Save the configuration on the switch.
Common configuration
If a SPAN port is configured on a Cisco switch, the WAN router would be connected to
interface "GigabitEthernet1/0/1". The DLP appliance would be connected to interface
"GigabitEthernet1/0/2".
Switch: configure terminal
Switch(config)# interface GigabitEthernet1/0/2
Switch(config‑if)# port monitor GigabitEthernet1/0/1
Switch(config‑if)# end
Switch# show port monitor
Monitor Port Port being monitored
‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑ ‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑
GigabitEthernet1/0/2 GigabitEthernet1/0/1
Switch# write memory
1Setting up the hardware
Select an integration mode for McAfee DLP Monitor
12 McAfee Data Loss Prevention 9.2.1 Installation Guide

Network tap configuration
A network tap configuration enables monitoring by injecting a tap in between two network devices
(generally the LAN switch and the WAN router) using additional cabling, then connecting the tap to
McAfee DLP Monitor.
The network tap captures traffic through a tap that is attached to the LAN switch and WAN router
through two network ports. Traffic from these ports flows directly to the capture ports on McAfee DLP
Monitor.
In environments where there is a firewall or a series of devices separating the LAN switch from the WAN
router, the network tap should be installed between the LAN switch and the first device.
Figure 1-5 Network tap configuration
1 Capture ports
2 Analyzer ports
3 Network tap
4 LAN
5 LAN switch
6 Router
7 WAN
This method requires physical disconnection and reconnection of network cables, so it disrupts traffic.
A service window is required.
With this configuration, full traffic capture is done even under heavy load conditions.
Network tap types
Network taps are available in copper or fiber media.
Regeneration taps for both types can be used to extend monitoring to multiple ports. When these taps
are used, signals are regenerated before sending a copy of the packets to the monitor port.
Table 1-1 Network tap types
Network tap type Description
Copper and copper
regenerative
These taps use twisted pair copper cabling (preferably CAT6 twisted
pair).
Fiber and fiber regenerative These taps use multimode fiber cabling with an LC connector on one
end (which connects to a capture port on the appliance) and an SC
connector on the other (which connects to a port on the tap).
Setting up the hardware
Select an integration mode for McAfee DLP Monitor 1
McAfee Data Loss Prevention 9.2.1 Installation Guide 13

Integrate the appliance using a network tap
Task
1Disconnect the cable between your WAN router and your LAN switch.
2Connect Monitor Port A of the network tap to Capture Port 0 on McAfee DLP Monitor.
3Connect Monitor Port B of the network tap to Capture Port 1 on McAfee DLP Monitor.
4Connect Network Port A of the network tap to a router inside the firewall.
5Connect Network Port B of the network tap to the LAN switch.
Complete the setup
Add the NTP server to sync McAfee DLP Manager to the network.
Task
1Open a web browser and enter the assigned IP address in the address bar to restart McAfee DLP
Manager.
2Click the System tab and select the Configure link.
3Scroll down to the Time section and enter the NTP server.
pool.ntp.org
4Click Time at Server to verify the current time.
5Click Update.
Configuration is complete. If you want to integrate the DLP system into McAfee® ePolicy Orchestrator®
4.5 or 4.6, you can do it now.
1Setting up the hardware
Complete the setup
14 McAfee Data Loss Prevention 9.2.1 Installation Guide

2Installing or upgrading the software on
4400 appliances
A McAfee DLP installation on the 4400 contains two released images, each of which contains an
operating system (except for the kernal) and DLP software.
Primary and secondary images are initially duplicate installations. When the system is upgraded, the
primary and secondary disks can contain different versions of the same product.
The system automatically boots from the latest installed version.
Contents
Download the 4400 archive
Boot options
Install a fresh image on 4400 appliances
Upgrade the products on 4400 appliances
Apply a hotfix
Convert an installation to another McAfee DLP product
Restoring the drives
Download the 4400 archive
To prepare for installation on the 4400, download the software from the Service Portal.
Before you begin
Locate the grant number you received after purchasing the product.
McAfee DLP Manager is pre‑installed on the model 4400 appliance. Install the other McAfee DLP
products as needed.
Downloadable archives all have legacy names preceded by i, although the product names have
changed. In particular, note that McAfee DLP Monitor is also known as iguard.
Task
1Open the McAfee support page by typing support.mcafee.com into the address bar of a web
browser.
2From the Products & Solutions menu, select Product Downloads, or locate and click the link under the
Corporate Support heading.
3In the Download My Products field, enter your grant number.
4Scroll down the page, then select the McAfee Network DLP product.
2
McAfee Data Loss Prevention 9.2.1 Installation Guide 15

5From the product page, select the software version, and confirm acceptance of the license
agreement.
The downloads page appears.
6In the Software Downloads tab, select and save the appropriate *.tgz file to your Windows‑based
computer.
The software is saved in the Downloads folder.
Boot options
Unlike the legacy DLP appliances, the model 4400 hardware platform runs the McAfee Linux Operating
System (MLOS). It contains a boot loader package that allows users to switch between installations.
McAfee DLP uses Gnu GRUB (GRand Unified Bootloader) to install the primary and secondary images
on the model 4400 appliances.
Figure 2-1 GRand Unified Bootloader
The default Disk Boot option is used only to boot the operating system of the appliance.
During the upgrade process, the configuration data in the /data directory and the kernel/boot loader
information in the boot directory are copied over to the new installation.
Table 2-1 Boot options
Option Definition
McAfee NDLP Disk Boot Reboots the system from the operating system disk. Does not reinstall
the operating system or the product software.
McAfee NDLP Primary Image
Install
Loads the primary image to the system. Replaces the existing operating
system and product software, but retains the data in the /data and /
boot directories.
McAfee NDLP Secondary Image
Install
Loads the secondary image to the system. Replaces the existing
operating system and product software, but retains the data in the /data
and /boot directories.
2Installing or upgrading the software on 4400 appliances
Boot options
16 McAfee Data Loss Prevention 9.2.1 Installation Guide

Set up the next boot option
After you install an image, the system automatically assigns the next boot to the image that was
installed. In rare instances, you might want to override that assignment by configuring the next boot
to a different disk.
Using this command has the same effect as changing the boot option using the GRub menu.
Take this step only if you have a specific need that cannot be addressed by the current configuration.
Task
1Log on to the appliance as root.
2Go to the installation directory.
# cd /data/install
3Run the setnextboot script to select one of three boot options: primary, secondary, or boot from
the operating system on the appliance.
# ./setnextboot [reboot_only | pri | sec]
The script sets up the selected option. When the option is set, a message appears stating which
image will boot next.
4Restart the system.
Install a fresh image on 4400 appliances
To install a fresh image, install on both primary and secondary disks.
Before you begin
Download the product archive and copy it to the appliance.
Task
1Log on to the appliance as root.
2Copy the archive to the appliance.
• If you downloaded the archive to a Windows‑based computer, use WinSCP.
• If you are copying the archive from a Linux server, use the SCP command scp ‑rp <package
number> root@<name or ip address>:<directory>
3Make an installation directory.
# mkdir /data/install
4From the directory you downloaded the archive to, extract the contents of the archive, using the ‑C
option to expand it into the /data/install directory.
# tar xvzf ndlp_<product>.tgz ‑C /data/install
5Go to the /data/install directory.
# cd /data/install
Installing or upgrading the software on 4400 appliances
Install a fresh image on 4400 appliances 2
McAfee Data Loss Prevention 9.2.1 Installation Guide 17

6Run the installation script.
Before you type in the command, run pwd to establish that you are in the correct product directory.
You must be sure that you are running the updated scripts in the upgrade archive that you just
downloaded and extracted.
iGuard was the original name of McAfee DLP Monitor, but the archives have not been renamed.
# ./install_new_full <product> .
The product image installs on the primary and secondary disks.
7Restart the system.
# reboot
Restarting the system might take 10–15 minutes.
8Log on to the McAfee DLP device as root, go to the installation directory, and verify the installation
with the command:
# cat /data/stingray/etc/version
If the Release field contains 9.2.1, installation is complete.
Upgrade the products on 4400 appliances
To upgrade a product on the 4400 appliance, you must install the new image on the disk that is not
used by the previous installation. This ensures that the original image can still be accessed after the
upgrade is complete. The system automatically boots from the latest image.
Before you begin
Download the product archive and copy it to the appliance.
Stop all scans and search tasks before upgrading, and wait until they are completely stopped before
upgrading.
If you want to do a backup before upgrading to 9.2.1 on a 4400 appliance that is running McAfee Data
Loss Prevention Manager 9.2.0 or one of the standalone McAfee DLP appliances, you must first apply
Hotfix 754037_45668_01.
Without a backup, the data, settings, and configuration on your 4400 might be lost if there is a system
failure.
The install_to_pri and install_to_sec scripts install the upgrade. After the process runs, the
existing configuration and database are copied to the new image.
If you use the wrong script, you will write over your existing installation.
Task
1Log on as root to the model 4400 appliance.
2Installing or upgrading the software on 4400 appliances
Upgrade the products on 4400 appliances
18 McAfee Data Loss Prevention 9.2.1 Installation Guide

2Copy the archive to the appliance.
• If you downloaded the archive to a Windows‑based computer, use WinSCP.
• If you are copying the archive from a Linux server, use the SCP command scp ‑rp <package
number> root@<name or ip address>:<directory>
3Make an installation directory.
# mkdir /data/install
4Find out which version is currently installed.
# cat /data/stingray/etc/version
5Run the system_info utility to determine whether the system is running the product from the
primary or secondary image, so that you can decide where to install the update.
# /data/stingray/ksh/system_info
Install the update on the disk that is not used. For example, if system_info returns the message
"The system is currently running <product> from the primary image," install the update on the
secondary disk with install_to_sec.
6From the directory you downloaded the archive to, extract the contents of the archive, using the ‑C
option to expand it into the /data/install directory.
# tar xvzf ndlp_<product>.tgz ‑C /data/install
7Go to the /data/install directory.
# cd /data/install
8Run the installation script.
Before you type the command, run pwd to establish that you are in the correct product directory. You
must be sure that you are running the updated scripts in the upgrade archive that you just
downloaded and extracted.
iGuard was the original name of McAfee DLP Monitor, but the archives have not been renamed, and
each product name is preceded by "i" to maintain the original naming convention.
# ./install_to_pri <product> .
or
# ./install_to_sec <product> .
The product image installs on the primary or secondary disk. When the upgrade is complete, a
message appears stating which image will boot next.
9Restart the system.
# reboot
Restarting the system might take 10–15 minutes.
10 Log on to the McAfee DLP device as root, go to the installation directory, and verify the installation
with the command:
# cat /data/stingray/etc/version
If the Release field contains 9.2.1, installation is complete.
11 Install Hotfix 793756_46026 on all devices.
Installing or upgrading the software on 4400 appliances
Upgrade the products on 4400 appliances 2
McAfee Data Loss Prevention 9.2.1 Installation Guide 19

Apply a hotfix
Apply a hotfix by running a script that installs the hotfix.
Before you begin
Download the product hotfix archive and copy it to the appliance.
Task
1Log on to the appliance as root.
2Copy the archive to the appliance.
• If you downloaded the archive to a Windows‑based computer, use WinSCP.
• If you are copying the archive from a Linux server, use the SCP command scp ‑rp <hotfix
_package> root@<name or ip address>:<directory>
3Make an installation directory.
# mkdir /data/hotfix
4From the directory you downloaded the archive to, extract the contents of the archive, using the ‑C
option to expand it into the /data/hotfix directory.
# tar xvzf hotfix_xxxxxx_yyyy_zz.tar.gz ‑C /data/hotfix
5Go to the /data/hotfix directory.
# cd /data/hotfix/xxxxxx
6(Optional) Open the README file to see the hotfix details.
7Run the installation script.
# ./install_hotfix
8Restart the Stingray service.
# service stingray restart
Convert an installation to another McAfee DLP product
The 4400 appliance ships with McAfee DLP Manager, but that installation can be converted to another
Data Loss Prevention product. However, only one product can be installed on the appliance, so the
primary and secondary images must both be installed with that product.
Before you begin
Download the product archive and copy it to the appliance.
Task
1Log on to the appliance as root.
2Go to the installation directory.
# cd /data/install
2Installing or upgrading the software on 4400 appliances
Apply a hotfix
20 McAfee Data Loss Prevention 9.2.1 Installation Guide