McAfee DTP-1650-MGRA - Network DLP Manager 1650... User manual

Installation Guide
Revision C
McAfee Data Loss Prevention 9.2.1
For use with ePolicy Orchestrator 4.5.0 and 4.6.0 Software

COPYRIGHT
Copyright © 2012 McAfee, Inc. Do not copy without permission.
TRADEMARK ATTRIBUTIONS
McAfee, the McAfee logo, McAfee Active Protection, McAfee AppPrism, McAfee Artemis, McAfee CleanBoot, McAfee DeepSAFE, ePolicy Orchestrator,
McAfee ePO, McAfee EMM, McAfee Enterprise Mobility Management, Foundscore, Foundstone, McAfee NetPrism, McAfee Policy Enforcer, Policy Lab,
McAfee QuickClean, Safe Eyes, McAfee SECURE, SecureOS, McAfee Shredder, SiteAdvisor, SmartFilter, McAfee Stinger, McAfee Total Protection,
TrustedSource, VirusScan, WaveSecure, WormTraq are trademarks or registered trademarks of McAfee, Inc. or its subsidiaries in the United States and
other countries. Other names and brands may be claimed as the property of others.
LICENSE INFORMATION
License Agreement
NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS
FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU
HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR
SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A
FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET
FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF
PURCHASE FOR A FULL REFUND.
2McAfee Data Loss Prevention 9.2.1 Installation Guide

Contents
Preface 5
About this guide .................................. 5
Audience .................................. 5
Conventions ................................. 5
Find product documentation ..............................6
1Setting up the hardware 7
Adding devices and servers ..............................7
Check the shipment .................................7
Plan your installation ................................ 8
Rack mount the appliances ..............................8
Connect a management console ............................9
Configure McAfee DLP Manager ............................ 10
Select an integration mode for McAfee DLP Monitor ....................11
SPAN port configuration ............................11
Network tap configuration ...........................13
Complete the setup ................................ 14
2Installing or upgrading the software on 4400 appliances 15
Download the 4400 archive ............................. 15
Boot options ................................... 16
Set up the next boot option .......................... 17
Install a fresh image on 4400 appliances ........................ 17
Upgrade the products on 4400 appliances ........................18
Apply a hotfix ...................................20
Convert an installation to another McAfee DLP product .................. 20
Restoring the drives ................................ 21
3Installing or upgrading software on 1650 and 3650 appliances 23
Download the 1650 or 3650 archive .......................... 23
Install a fresh image on 1650 or 3650 appliances .....................24
Upgrade the products on 1650 or 3650 appliances .................... 25
Apply a hotfix ...................................26
4Configuring McAfee DLP appliances and adding servers 29
Configure McAfee DLP appliances using Setup Wizard ...................29
Configure McAfee DLP appliances after installation .................... 35
Add McAfee DLP products to McAfee DLP Manager .................... 35
Configuring McAfee DLP Prevent ........................... 36
MTA requirements for McAfee DLP Prevent .................... 37
Configure McAfee DLP Prevent ......................... 38
Add LDAP servers to McAfee DLP Manager ....................... 39
Add McAfee Logon Collector to McAfee DLP Manager ................... 41
Add syslog servers to McAfee DLP systems ....................... 42
Resynchronize McAfee DLP systems with an NTP server .................. 42
McAfee Data Loss Prevention 9.2.1 Installation Guide 3

Testing the system ................................. 43
5Installing McAfee DLP Endpoint 45
Verify system requirements ............................. 46
Configure the server ................................ 47
Install McAfee ePolicy Orchestrator .......................... 48
Installing McAfee DLP WCF service ...........................49
Install the McAfee DLP WCF service ....................... 50
Repository folders ................................. 55
Creating and configuring repository folders .................... 55
User and permission sets .............................. 57
Create and define McAfee DLP administrators ................... 57
Create and define permission sets ........................58
DLP permission set options ...........................58
Install the McAfee Data Loss Prevention Endpoint extension ................ 59
Initialize the McAfee DLP Endpoint Policy console .....................60
Upgrade the license .................................62
Check in the McAfee DLP Endpoint package to ePolicy Orchestrator ..............63
Deploy McAfee DLP Endpoint .............................63
Define a default rule ............................. 63
Deploy McAfee DLP Endpoint with ePolicy Orchestrator 4.6 ..............64
Verify the installation ............................. 65
Uninstall McAfee DLP Endpoint ............................ 66
6Integrating McAfee DLP Endpoint into a unified policy system 67
Setting up Unified DLP on ePolicy Orchestrator ..................... 68
Install the network extension ......................... 68
Install the UDLP (host) extension ........................68
Configure McAfee Agent on ePolicy Orchestrator .................. 69
Add an evidence folder on ePolicy Orchestrator ...................69
Connecting McAfee DLP Manager and the ePolicy Orchestrator server ............ 70
Gather ePolicy Orchestrator registration information ................ 70
Add an ePolicy Orchestrator database user .................... 70
Register McAfee DLP Manager on ePolicy Orchestrator server .............71
Register ePolicy Orchestrator on McAfee DLP Manager ................71
Checking the connection ........................... 72
Configuring McAfee DLP Endpoint on McAfee DLP Manager ................. 72
Generate a global policy for McAfee DLP Endpoint ..................73
Maintaining compatibility with installed McAfee clients ............... 73
Add an Agent Override Password ........................ 74
Set the manual tagging option ......................... 74
Installation and configuration complete .........................75
Index 77
Contents
4McAfee Data Loss Prevention 9.2.1 Installation Guide

Preface
This guide provides the information you need to install your McAfee product.
It contains all of the necessary information for installing McAfee® Data Loss Prevention software,
including detailed steps and verification of the installation and configuration process in both the new
hardware platform and legacy appliances. It also includes integration with McAfee® ePolicy
Orchestrator® and McAfee® Data Loss Prevention Endpoint to configure a unified policy installation.
When the process is completed, the user will have a fully functional McAfee DLP hardware and
software implementation that is properly configured.
Contents
About this guide
Find product documentation
About this guide
This information describes the guide's target audience, the typographical conventions and icons used
in this guide, and how the guide is organized.
Audience
McAfee documentation is carefully researched and written for the target audience.
The information in this guide is intended primarily for:
•Administrators — People who implement and enforce the company's security program.
•Security officers — People who determine sensitive and confidential data, and define the
corporate policy that protects the company's intellectual property.
Conventions
This guide uses these typographical conventions and icons.
Book title, term,
emphasis
Title of a book, chapter, or topic; a new term; emphasis.
Bold Text that is strongly emphasized.
User input, code,
message
Commands and other text that the user types; a code sample; a displayed
message.
Interface text Words from the product interface like options, menus, buttons, and dialog
boxes.
Hypertext blue A link to a topic or to an external website.
Note: Additional information, like an alternate method of accessing an
option.
McAfee Data Loss Prevention 9.2.1 Installation Guide 5

Tip: Suggestions and recommendations.
Important/Caution: Valuable advice to protect your computer system,
software installation, network, business, or data.
Warning: Critical advice to prevent bodily harm when using a hardware
product.
Find product documentation
McAfee provides the information you need during each phase of product implementation, from
installation to daily use and troubleshooting. After a product is released, information about the product
is entered into the McAfee online KnowledgeBase.
Task
1Go to the McAfee Technical Support ServicePortal at http://mysupport.mcafee.com.
2Under Self Service, access the type of information you need:
To access... Do this...
User documentation 1Click Product Documentation.
2Select a product, then select a version.
3Select a product document.
KnowledgeBase • Click Search the KnowledgeBase for answers to your product questions.
• Click Browse the KnowledgeBase for articles listed by product and version.
Preface
Find product documentation
6McAfee Data Loss Prevention 9.2.1 Installation Guide

1Setting up the hardware
This Quick Start serves as a high‑level road map for setting up your McAfee DLP system. McAfee DLP
Manager is shipped pre‑installed; the other products in the suite (McAfee DLP Monitor, McAfee DLP
Discover, and McAfee DLP Prevent) must be installed on‑site.
McAfee DLP Monitor must be set up to capture network traffic, so it requires additional configuration
steps.
Contents
Adding devices and servers
Check the shipment
Plan your installation
Rack mount the appliances
Connect a management console
Configure McAfee DLP Manager
Select an integration mode for McAfee DLP Monitor
Complete the setup
Adding devices and servers
The final setup for McAfee Total Protection for Data Loss Prevention depends on your protection
strategy. After you complete setup of all of the appliances, go to the System tab on McAfee DLP
Manager to add the products to be managed and the servers needed to complete the system.
For example, depending on your objectives, you might add McAfee DLP Discover or McAfee DLP
Prevent, which require additional configuration.
If you add McAfee DLP Endpoint to the network product suite, you must install it on McAfee® ePolicy
Orchestrator®, and add endpoint, evidence, and directory servers.
Check the shipment
Each product ships with all of the material needed to install it on a network. Check each shipment to
verify that all items on the packing list have been received.
Task
1Refer to your Accessory Kit Content List to ensure that you received the following items:
• Region‑specific power cords ‑ 2
• CAT5 cables ‑ 3
• Serial cable: RJ‑45 to RS‑232 ‑ Cisco console cable
1
McAfee Data Loss Prevention 9.2.1 Installation Guide 7

• Intel Diagnostic Tool (IDT) USB
• Product notes for IDT (CD media)
• Safety document
• Warranty document
• Recovery media
2If an item is missing or damaged, contact your supplier.
Plan your installation
Before installing, survey your environment and collect configuration information.
For the McAfee DLP Monitor appliance, you will also need a network tap (unless you are planning a
SPAN port configuration).
Task
1Collect the following information about the network in which McAfee Total Protection for DLP will be
installed.
• Host name • Secondary DNS server
• IP address • Domain
• Subnet mask • NTP server
• Default gateway • Syslog server
• DNS domain • Email relay server
• Primary DNS server
2Devise a protection strategy by evaluating the type of information you need to protect. Your
objectives will determine which policies you activate.
3Determine who will be the primary administrator of the system.
Rack mount the appliances
Each of the McAfee DLP products is shipped on an Intel® Server System SR2612UR.
For rack mounting instructions, download the Intel® Server System SR2612UR Service Guide from the
Intel download site.
http://download.intel.com/support/motherboards/server/s5520ur/sb/r2612ur_service_guide_14.pdf
For more information, download the Intel® Server System SR2612UR Technical Product Specification.
http://download.intel.com/support/motherboards/server/s5520ur/sb/sr2612ur_tps_13.pdf
1Setting up the hardware
Plan your installation
8McAfee Data Loss Prevention 9.2.1 Installation Guide

Connect a management console
Connect a laptop to the management port of the McAfee DLP appliance so you can reconfigure it
through a directly connected device. Because McAfee DLP Manager requires additional steps,
reconfigure all other products first.
Before you begin
You will need the list of network parameters you prepared when you planned your
installation.
Figure 1-1 Model 1650 appliance port configuration
1 Ethernet port 0
2 Ethernet port 1 — Management port
3 Ethernet port 2 — Capture port 0
4 Ethernet port 3 — Capture port 1
Figure 1-2 Model 3650 appliance port configuration
1 Ethernet port 0
2 Ethernet port 1 — Management port
3 Ethernet port 2 — Capture port 0
4 Ethernet port 3 — Capture port 1
Figure 1-3 Model 4400 appliance port configuration
1 Ethernet port 0
2 Ethernet port 1 — Management port
3 Ethernet port 3 — Capture port 1 — note reversed configuration
4 Ethernet port 2 — Capture port 0 — note reversed configuration
By default, each appliance is configured with the IP address 192.168.1.2, but a new IP address and
other network parameters are required to integrate it into the network.
Setting up the hardware
Connect a management console 1
McAfee Data Loss Prevention 9.2.1 Installation Guide 9

You must connect a laptop to the management port so you can convey this information to the
appliance. Assign the laptop an IP address that is different, but on the same subnet, so it can access
the management port.
Task
1Connect a laptop to the management port of the appliance using the supplied Ethernet cable.
2Change the laptop to an address in the 192.168.1.X/24 IP range — for example, 192.168.1.10.
3Open a web browser and connect to the DLP appliance.
https://192.168.1.2
The DLP user interface starts.
4Log on to the McAfee DLP appliance.
The default logon is admin/mcafee.
The End User License Agreement appears.
5Select the license agreement checkbox and click I Accept.
The Setup Wizard starts.
6On the Network Configuration page, enter all of the IP addresses, and the host and domain names
needed to integrate the appliance into the network.
If you are configuring a McAfee DLP Manager, skip to the next topic.
7Advance through the Setup Wizard pages to the Review page.
The interim pages will be completed only on the McAfee DLP Manager appliance.
8Click Submit, then Exit Wizard.
When this step is complete, the appliance will have a new IP address and will be integrated into the
network. Restarting is not necessary.
If you have configured McAfee DLP Discover or McAfee DLP Prevent appliances, setup is complete. If
you are configuring McAfee DLP Manager, proceed to the next step. If you are configuring McAfee DLP
Monitor, proceed to the following step.
Configure McAfee DLP Manager
When you configure McAfee DLP Manager, you must provide additional information after the network
configuration is completed.
Before you begin
You must have completed the network settings required on the Network Configuration page of
the Setup Wizard.
Task
1On the Time Configuration page, change the time zone.
2Select Manual to set NTP to local time.
On this first configuration, you will not yet be able to set the NTP server because the default IP
address (192.168.1.2) will not allow it to be located. The NTP server can be defined only when the
system is restarted and integrated into the network.
1Setting up the hardware
Configure McAfee DLP Manager
10 McAfee Data Loss Prevention 9.2.1 Installation Guide