Norman Network Protection User manual

Norman Network Protection
quick setup guide
For the latest setup guide,
please visit www.norman.com
Norman Network Protection
quick setup guide
For the latest setup guide,
please visit www.norman.com
1
2
3
4
5 6
7
8
Introducon to Norman Network Protecon Appliance
The Norman Network Protecon Appliance provides a front-end protecon soluon
for your enre local area network or segment of your internal network.
Norman Network Protecon is powered by Linux and provides addional security by
using the Norman SandBox technology.
Checking the Package Contents
You will nd the following items in your Network Protecon Appliance package:
1. Norman Network Protecon Appliance
2. A quick setup guide (this document)
3. An AC power cable
4. Two (2) category 6 ethernet standard cable (color “Green”)
5. One (1) category 6 ethernet standard cable (color ”Blue”)
6. A bootable USB memory sck containing recovery soware
(Behind the frontbezel)
If an item is missing from the package, contact your reseller immediately.
Appliance Overview
The Norman Network Protecon Appliance consists of three (3) Network Interface
Cards. The NICs (named “Eth1” and “Eth2”) are used for trac inspecon (inside and
outside interfaces). These interfaces do not need any IP-address
The third interface (named “Eth0”) is used as an interface towards the Linux console,
the NNP command line console and the web administraon interface. This interface
needs an IP-address.
Front R210
1. Power-on indicator,
power buon
2. NMI buon
3. USB connectors (2)
1. iDRAC6 Enterprise port
(oponal)
2. VFlash media slot
3. Serial connector
4. PCIe slot 1
Power up your Network Protecon Appliance
1. Connect the power cable from the power source (typically an UPS) to the power
jack (while facing the back of the appliance). The power cable is included with the
appliance packaging.
Basic Conguraon for the Network Protecon Appliance
IMPORTANT: Do not connect the in and out interfaces to your network
before you have completed the conguraon.
1. Connect a monitor and an USB-keyboard to the Network Protecon Appliance.
2. Power up the Network Protecon Appliance.
3. When the device has nished boong up follow the instrucons as described
below. When asked, use the details from your “Network Planning Worksheet” as
described in chapter 4.
If you have been provided a newer NNP version as ISO image or on USB please
follow the instrucons provided.
Press 1 or Enter to start the installaon.
Compleng the Web based Setup Wizard
IMPORTANT: Do not power up the appliance before connecng
it to the network.
1. Connect only the Admin interface to the appropiate switch in your
network. Make sure this is accessible from your network, and that it
is not connected behind the “Eth1” interface.
2. From another computer connect to the IP-address of the appliance
on port 2868.
Example: hp://<Network Protecon Appliance-IP>:2868
3. Your are now prompted for a username and password.
5. Aer nishing the conguraon wizard connect the device to the network as
described in the next chapter
Checking installaon archives
The installer will check the
integrity of the installaon
archive.
Keyboard
layout
Select your
keyboard
layout, then
click Next.
Timezone
Select your mezone
by rst selecng your
connent, then your
country.
Root password
Enter your desired password. This
password is the same for both the web
based admin interface, and the Linux
console, so please don’t lose it.
Conguring the network cards
NNP appliance comes with four NICs, but only three
will be used in this round. To assist you in idenfy-
ing the NICs you can use the Idenfy funcon.
When pressing this buon the LEDs on the corre-
sponding NIC will start blinking, correctly idenfying
the NIC to the ethx.
The default for NNP NIC conguraon is one admin
NIC and two Bridge NICs.
Admin interface setup
To be able to manage your NNP
an IP-address is necessary. Now
it’s me to use your Network
Planning Worksheet. Insert the
details in the appropriate elds.
Installing les from archive
The installaon will resume.
Click Details to see a more
verbose output.
Complete
Congratulaons, your installaon
is done. Click Reboot to nish
and start your NNP.
Norman Network Protection
Back R210
Back R610
Front R610
Network Planning Worksheet
Host name: . . .
Network Protecon Primary IP address: . . .
Network Protecon subnet: . . .
Default Gateway: . . .
DNS Sux: . . .
DNS Server 1: . . .
DNS Server 2: . . .
Network speed: . . .
Duplex (inside NIC): . . .
Duplex (outside NIC): . . .
5. Video connector
6. USB connectors (2)
7. PCIe slot 2
8. Ethernet connectors (4)
4. Video connector
5. LCD menu buons
6. LCD panel
7. System idencaon buon
8. Hard drives (6)
9. Opcal drive (oponal)
10. System idencaon panel
9. System status indicator connector
10. System status indicator
11. System idencaon buon
12. Power supply 1 (PS1)
13. Power supply 2 (PS2)
1 Power-on indicator, power buon
2 NMI buon
3 Video connector
4 Hard drive acvity indicator
5 Diagnosc indicator lights (4)
6 System status indicator
7 System idencaon buon
8 USB connectors (2)
9 System idencaon panel
10 Opcal drive (oponal)
1 iDRAC6 Enterprise port (oponal)
2 VFlash media slot (oponal)
3 Ethernet connectors (2)
4 serial connector
5 video connector
6 eSATA
7 USB connectors (2)
8 Ethernet connectors (2)
9 System status indicator light
10 System idencaon buon
11 System idencaon connector
12 Power supply
13 Retenon clip
The Norman Network Protecon Appliance can be deployed almost anywhere in
your network. If you already know where to place the Norman Network
Protecon Appliance please skip this part, and go on to chapter 6.
If you are uncertain where to deploy the Norman Network Protecon Appliance
please consider one of the below scenarios.
1. Scan trac to/from the Internet
In this deployment scenario Norman Network Protecon scans supported
trac to/from the Internet.
2. Scan trac to/from an DMZ
In this deployment scenario Norman Network Protecon scans supported trac to/
from the DMZ from both the internal LAN and Internet.
3. Scan trac between LANs or segments
In this deployment scenario Norman Network Protecon scans supported trac to/
from the Internet in addion to trac to/from computers from dierent segments.
4. Scan trac in one or
more VLAN(s):
In this deployment scenario
Norman Network Protecon
scans supported trac com-
ming from VLAN computers
marked with red, in addion
to trac going to/from seg-
ments on each side of the
router.
Deployment Strategy

9
Step 7: How to inform users that they have been blocked
Provides opons for how Norman Network Protecon should nofy users that are
blocked from a network path. (This opon applies only to HTTP trac).
• Display the text below.
Insert the text you want to display to the users and use HTML-tags to format the text.
• Redirect to a customized HTML page on a reachable web server.
Provides, for example, the opon of redirecng users to an HTML page on an internal
web server. This enables you to create a very specic HTML page where the design,
layout and text can be customized to your company colors and logo.
Step 8: Handling messages
Provides the opon of sending e-mail messages about selected events.
• Enable e-mail messages
Forward messages as e-mail.
Mail recipients
Enter the e-mail addresses for the nocaon recipients.
• Click Add to enter the e-mail address for a recipient.
• Select an address from the list and click Remove selected to delete an exisng
address
SMTP server sengs
The SMTP server address, name or IP-address, for the e-mail server recipient of the
SMTP message.
Note:
If you insert the SMTP server name make sure that DNS sengs are veried for the
installed operang system. Otherwise please use the IP-address.
Port
The default SMTP port is 25, which is the correct value unless you explicitly have
selected another port.
Reply-to address
Enter the e-mail address that a recipient can reply to, for example the system admin-
istrator.
Mail message body
Subject
The tle of the e-mail, for example “Message from NNP”.
Common appended text
Enter the text to include as the default e-mail footnote text.
Step 9: Seng Internet Update opons
Step 9: Seng Internet Update opons
Norman Internet Update will keep your denion les and sanner engine up to date.
The opons for automac updates are:
Update manually
Norman Internet Update will never run. All updates must be done manually with the
Update now opon.
Automac update at set intervals
Update intervals: 6 hours, 12 hours, 1 day.
Note:
It is recommended to set the Automac update interval to 6 hours.
Step 10: Reviewing the conguraon
Once the setup wizard is done, Norman Network Protecon is ready for use!
Connecng Norman Network Appliance to your network
Connect the interface named “Eth1” to the inside of your network, and the interface
named “Eth2” to the outside of your network, based on the network scenario you
selected in chapter 5.
Note:
Remember to schedule this installaon to a me of day when interrupted network
connecons can be accepted.
Username and password default sengs
User: admin
Password: admin
Step 1: Start the setup wizard
Step 2: Restricng access to the web interface
You can restrict access to the Norman Network Protecon web-interface either to
single IP-addresses or subnets. The syntax for entering IP-addresses is:
192.168.0.4/255.255.255.0
This entry will accept access from the single IP-address 192.168.0.4
192.168.0.0/255.255.255.0
This entry will accept access from the enre subnet 192.168.0.0
Step 3: Providing the license key
The license key enables Network Protecon to be updated with signature and scan-
ner engine updates. The license key is provided to you by your local vendor. If a li-
cense key was not included when you purchased Network Protecon, please contact
your local vendor or your local Norman oce.
Step 4: Conguring Network Protecon operaon mode
These seng will determine how NNP will operate. Please select the preferred
mode.
Log only
This opon will detect and log malware, but will not block it. Please use with cauon.
Bypass
This opon allows all trac to be transferred through Norman Network Protecon
without being scanned. Using this opon will result in no trac or incident stascs.
Block
This opon will eecvely block all trac from being transferred through Norman
Network Protecon. This opon is known as the “Panic buon”.
Note:
Please use this opon with care as absolutely all trac in the segment/network
where Network Protecon Appliance is installed will be blocked.
Scan
This is the most used opon. By selecng this opon all trac on supported proto-
cols will be scanned for malware.
Sites blocked will be blocked for
The period for which a URL is blocked can be changed with this opon. The default
value is 1 week. Select the desired value for the period a blocked URL/Path should
remain blocked.
Note: This value can also be changed individually per blocked URL in the “Blocked
URL” menu.
Max. le size for scanning
This opon allows you to change the default limit for the le sizes Network Protec-
on Appliance should scan. The default value is 32MB. All les larger than the set
value will not be scanned.
Block les larger than max size
Check this opon to block les that are larger than the maximum allowed lesize.
Step 5: Conguring protocol scanning opons
These sengs decides how each protocol is handled. If you are not sure which scan
seng to use for a certain protocol, set it to bypass for now. You can always change
the scan sengs later.
Note: Please set all protocols to “Bypass” before connecng the appliance to the net-
work. When the appliance is connected to your network you can make the necessary
changes for each protocol.
Protocol scanning opons
Bypass Trac on this protocol will pass through without being scanned.
Block Trac on this protocol will not be allowed through NNP.
Minimal Scan Trac will be scanned using tradional signature scanning.
Archive les are not scanned.
Sandbox is not used.
Medium scan Trac will be scanned using tradional signature scanning.
Archive les are scanned.
Sandbox is not used.
Sandbox scan Trac will be scanned using tradional signature scanning.
Archive les are not scanned.
Sandbox is used.
Full Scan Trac will be scanned using tradional signature scanning.
Archive les are scanned.
Sandbox is used.
Step 6: Selecng logging opons
Provides opons for enabling and handling Norman Network Protecon logs. The
main logs are the Trac log and the Incident logs. These log opons only aect the
Trac log.
• Enable logging/stascs
Select this opon to log all trac, meaning all connecons transferred through Nor-
man Network Protecon are logged to a le. If not selected this opon disables all
trac stascs.
• Log only supported protocols
Select this opon to reduce the number of log entries. Only supported protocols
are logged, and all other connecons are disregarded. The supported protocols are:
HTTP, FTP, SMTP, POP3, TFTP, RPC, IRC, CIFS/SMB
Example:
If this opon is selected and a computer creates a connecon to a Citrix server, this
will not be visible in the log because the ICA protocol is not supported for scan.
• Purge logs older than:
Provides an opon to delete logs that are older than the value selected. This func-
onality can prevent your hard drive from being lled up with legacy logs.
Note:
Even though trac logs are purged aer 1 or 60 days, trac stascs will sll be
available in the management interface. Norman Network Protecon stores digests of
all logs, enabling a digest trac stascs, all the way back to the installaon of Nor-
man Network Protecon in your network.