Nortel 2070 User manual

Nortel Threat Protection System
Threat Protection System
Troubleshooting Guide
Release: 4.7
Document Revision: 01.01
www.nortel.com
NN47240-700 324442-A
.

Nortel Threat Protection System
Release: 4.7
Publication: NN47240-700
Document status: Standard
Document release date: 112007
Copyright © 2007 Nortel Networks
All Rights Reserved.
The information in this document is subject to change without notice. The statements, configurations, technical
data, and recommendations in this document are believed to be accurate and reliable, but are presented without
express or implied warranty. Users must take full responsibility for their applications of any products specified in this
document. The information in this document is proprietary to Nortel Networks.
Export
This product, software and related technology is subject to U.S. export control and may be subject to export or
import regulations in other countries. Purchaser must strictly comply with all such laws and regulations. A license to
export or reexport may be required by the U.S. Department of Commerce.
Licensing
This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit
(http://www.openssl.org/).
This product includes cryptographic software written by Eric Young ([email protected]).
This product includes software written by Tim Hudson ([email protected]).
This product includes software developed by the Apache Software Foundation http://www.apache.org/.
This product includes a TAP-Win32 driver derived from the CIPE-Win32 kernel driver, Copyright © Damion K.
Wilson, and is licensed under the GPL.
See Appendix D, "License Information", in the User’s Guide for more information
.

3
.
Contents
New in this release 7
Navigation 7
Introduction 9
Prerequisites 9
Navigation 10
Acronyms 10
Troubleshooting Fundamentals 11
Navigation 11
Log files 11
Issues that require Sourcefire assistance 12
Hardware Troubleshooting 15
Navigation 15
TPS Hardware 15
Ports to open in a firewall 16
Software Troubleshooting 17
Creating a troubleshoot file from a TPS device 18
Obtaining the troubleshoot file following a failed software upgrade 19
Resetting passwords 20
Resetting the root password of a TPS device 20
Resetting the Administrator Password for a TPS device 21
Installing an Old Version of SEU 22
Event handling 22
Troubleshooting TPS Sensor when not receiving events 23
Troubleshooting Defense Center when not receiving events 23
Troubleshooting errors when adding sensor to DC 23
Troubleshooting the SFDataCorrelator 24
Troubleshooting alerting problems 25
Troubleshooting mail alerting problems 25
Troubleshooting SNMP alerting problems 25
Troubleshooting Syslog alerting problems 25
Troubleshooting events that show incorrect time 25
Troubleshooting LDAP authentication 26
Nortel TPS 4.7
Threat Protection System Troubleshooting Guide
NN47240-700 01.01 Standard
112007
Copyright © 2007 Nortel Networks
.

4
RUA 27
Configuring Snort through the User Interface 27
Verifying prohibit packet data on the DC 28
Performing RNA IP/Port Exclusion 28
Scanning the NMAP 29
Remediation Procedures 29
Remediating NAS 29
Troubleshooting Global Faults 31
Navigation 31
Troubleshooting when no white list events are generated 32
Troubleshooting an IS that does not generate events 32
Troubleshooting an SDM IS that could not be added to a DC 32
Troubleshooting an IS that does not block traffic 33
Validating the failopen function 33
Troubleshooting an IS that does not send email 34
Troubleshooting a DC that cannot push a policy to a sensor that it is
managing 34
Troubleshooting a faulty OPSEC 34
Troubleshooting a failed upgrade 35
Troubleshooting a failed automatic SEU Update 35
Troubleshooting when a customer is unable to add a sensor to be managed by a
DC 36
Troubleshooting a system crash 37
Verify the ports to be opened in the firewall for 4.6 37
Troubleshooting Snort 37
Troubleshooting memory problems 38
IPS mode cable Deployment Scenarios 38
Deploying between two endpoints 38
Deploying between two network switches 39
Between a switch and an endpoint 39
Between a switch and a router 39
Between a router and an endpoint 39
Between a firewall and an endpoint 40
Between two firewalls 40
Between a switch and a firewall 40
Between router and a firewall 40
Checking IPv6 configurations on the CLI 41
Verification of Detection Resources on the CLI 41
Viewing the enabled rules on the CLI 41
Viewing remediation log 42
Viewing the LDAP SSL certificate 42
Emergency recovery trees 43
Lost access to the TPS DC/IS device -- recovery tree 43
Nortel TPS 4.7
Threat Protection System Troubleshooting Guide
NN47240-700 01.01 Standard
112007
Copyright © 2007 Nortel Networks
.

Licensing 5
The TPS DC/ IS cannot receive events -- recovery tree 44
Reference to third party Application Guides 47
Contact Nortel technical support 49
Navigation 49
Gathering critical information 49
Getting help from the Nortel Web site 50
Getting help over the phone from a Nortel Solutions Center 50
Getting help from a specialist by using an Express Routing Code 51
Getting help through a Nortel distributor or reseller 51
Glossary 53
Nortel TPS 4.7
Threat Protection System Troubleshooting Guide
NN47240-700 01.01 Standard
112007
Copyright © 2007 Nortel Networks
.

6
Nortel TPS 4.7
Threat Protection System Troubleshooting Guide
NN47240-700 01.01 Standard
112007
Copyright © 2007 Nortel Networks
.

7
.
New in this release
The Nortel Threat Protection System Release. 4.7 Troubleshooting Guide
with Emergency Recovery Tree (NN47240-700) is a new document for
Nortel Threat Protection System Release 4.7.
Navigation
Nortel TPS 4.7
Threat Protection System Troubleshooting Guide
NN47240-700 01.01 Standard
112007
Copyright © 2007 Nortel Networks
.

8New in this release
Nortel TPS 4.7
Threat Protection System Troubleshooting Guide
NN47240-700 01.01 Standard
112007
Copyright © 2007 Nortel Networks
.

9
.
Introduction
The Nortel Threat Protection System is a fully integrated intrusion
detection system that consists of the following:
•TPS 2070 Defense Center, which manages intrusion sensors in the
network environment
•TPS 2050 Intrusion Sensor and TPS 2070 Intrusion Sensor, which
detect and track network intrusions, either independently or under the
management of the TPS 2070 Defense Center
•TPS 2150 Intrusion Sensor and TPS 2170 Intrusion Sensor, which
have fail-open functionality in inline mode
This chapter describes the prerequisites and various tools used to
troubleshoot the Nortel TPS 4.7. Use these troubleshooting tools to
enhance the overall performance, resolve error messages, and increase
response time for a specific feature. Each tool is described by purpose,
usage procedures, and how to interpret the output.
Prerequisites
Nortel recommends you to use one or more of the following commercially
available troubleshooting tools as well as the tools described in this
document.
•Capture and analyze HTTP and HTTPS with the HTTP Analyzer from
IE Inspector http://www.ieinspector.com/
•Capture and analyze HTTP and HTTPS with Tamper Data, a plug-in
available for Mozilla Firefox https://addons.mozilla.org/en-US/firefox/
addon/966
•Display the time to load Web pages with Faster Fox, a plug-in available
for Mozilla Firefox https://addons.mozilla.org/en-US/firefox/addon/1269
•Capture and analyze packets with either Sniffer or Wireshark from
Network General http://www.wireshark.org/ and http://www.networkge
neral.com/
Nortel TPS 4.7
Threat Protection System Troubleshooting Guide
NN47240-700 01.01 Standard
112007
Copyright © 2007 Nortel Networks
.

10 Introduction
Navigation •“Troubleshooting Fundamentals” (page 11)
•“Hardware Troubleshooting” (page 15)
•“Software Troubleshooting” (page 17)
•“Troubleshooting Global Faults” (page 31)
•“Emergency recovery trees” (page 43)
•“Reference to third party Application Guides” (page 47)
•“Contact Nortel technical support” (page 49)
•“Glossary” (page 53)
Acronyms Table 1 "Acronyms" (page 10) lists the acronyms used in this guide.
Table 1
Acronyms
TPS Threat Protection System
CLI Command Line Interface
LED Light Emitting Diode
Nortel TPS 4.7
Threat Protection System Troubleshooting Guide
NN47240-700 01.01 Standard
112007
Copyright © 2007 Nortel Networks
.

11
.
Troubleshooting Fundamentals
This section provides conceptual information about the methods and tools
that you can use to troubleshoot and isolate problems in TPS 4.7
Navigation
Log files View the log files to see the history of system events.
This troubleshooting guide documents only the most common messages
from the ssl.log.
/maint/debug/proxydebug [on|off|once]
on: enable simpleproxy to print out debug message.
off: disable simpleproxy to print out debug message.
once: enable simpleproxy to print out debug message only once.
ATTENTION
Enabling proxydebug will use more CPU resource. Make sure to disable it after
you finish debugging.
Transmit the event log from the Nortel VPN Gateway to a file on a TFTP,
FTP, or SFTP server. Specify the IP address or host name of the server
as well as the file name. The default value is TFTP.
Table 2 "Log file types in a log dump" (page 11) lists the log file types in
a log dump.
Table 2
Log file types in a log dump
Log file
type Description
clierror This log provides information on the CLI engine and is used by
engineering to debug issues while in development.
Nortel TPS 4.7
Threat Protection System Troubleshooting Guide
NN47240-700 01.01 Standard
112007
Copyright © 2007 Nortel Networks
.

12 Troubleshooting Fundamentals
Table 2
Log file types in a log dump (cont’d.)
erlerror This log provides information on the internal Erlang language
engine and SSL acceleration. It is used by Engineers to debug
issues while in development.
erlstart This log provides information on the internal Erstart language
engine and SSL acceleration. It is used by Engineers to debug
issues while in development.
conslog This log contains messages displayed on the console port of the
device. These messages are the one that are generated during
boot sequence. These messages are generated during boot
sequence.
dmesg This log contains messages generated by the kernel.
ssl.log This log contains messages generated by the simpleproxy
features. The user needs to completely logoff and then close the
browser ; login and then active the ssldump.
ikelog IPsec module related messages.
message This log contains standard syslog types of messages and
contains general information such as system-level status and
non-application acceleration errors across the device.
Procomm Kernel panic message with debug information can be captured
from console directly. Use Procomm to capture those messages.
Issues that require Sourcefire assistance
Contact Sourcefire for assistance on the following issues and request
the process that was taken to update customer details and restore the
document.
1. The DC cannot push a policy to the sensors
The customer may have to re-image the box.
2. OPSEC is not working properly
The trust between the DC and the sensors are configured correctly
and the trust is established but the SFReactddoes not seem to trigger
thefw same dynamic rule. The customer may have to re-image the
box.
3. Software upgrade fails
This largely depends on where within the upgrade process, the
upgrade fails. In most cases, the problem will need to be examined on
a case-by-case basis to determine what happened.
If an upgrade has failed, the system may be in a dubious state for
which reverting may exacerbate the problem. Any such problem should
be reported to Sourcefire Support.
There is a process for reverting to the previous version, which
is documented in the User Guides, however that process is only
Nortel TPS 4.7
Threat Protection System Troubleshooting Guide
NN47240-700 01.01 Standard
112007
Copyright © 2007 Nortel Networks
.

Issues that require Sourcefire assistance 13
recommended in cases where the upgrade was successful but for one
reason or another the customer has chosen to revert to the previous
version.
4. Customer is not able to add a sensor to be managed by a DC
Nortel TPS 4.7
Threat Protection System Troubleshooting Guide
NN47240-700 01.01 Standard
112007
Copyright © 2007 Nortel Networks
.

14 Troubleshooting Fundamentals
Nortel TPS 4.7
Threat Protection System Troubleshooting Guide
NN47240-700 01.01 Standard
112007
Copyright © 2007 Nortel Networks
.

15
.
Hardware Troubleshooting
This section describes the feature-specific troubleshooting tools available
at the operating system level.
Navigation •“TPS Hardware” (page 15)
•“Ports to open in a firewall” (page 16)
TPS Hardware
This section provides information to troubleshoot hardware problems
related to the TPS 2050, TPS 2070 and TPS 2150 devices.
The table Front Panel LEDs describes the Front Panel LED indicators on
the TPS device.
Table 3
Front Panel LEDs
LED Indicator (from left to right) Description
Amber system status LED The amber system status LED lights up when
the system needs attention due to a problem
with power supplies, fans, CPU, or system
temperature.
Hard-disk drive activity LED This LED blinks when activity is detected on the
hard-disk drive.
System power LED This LED is green when the power supply is
turned on.
System status LED The system status LED lights up when the
system needs attention due to a problem with
power supplies, fans, system temperature, or
hard drives.
Overheat indicator LED This LED is red when the system overheats.
Nortel TPS 4.7
Threat Protection System Troubleshooting Guide
NN47240-700 01.01 Standard
112007
Copyright © 2007 Nortel Networks
.

16 Hardware Troubleshooting
ATTENTION
Call Nortel for RMA if Amber System status LED can not be cleared.
Ports to open in a firewall
If there are one or more firewalls in between the Defense Center and
Intrusion Sensors, then you will need to open one or more ports on the
firewall, depending on the software version of the TPS devices.
Software release 4.5.x and above
The Defense Center and the Intrusions Sensors communicate on TCP port
8305 only, by default. The administrator can change this port number.
Software release 4.1.x and below
The Defense Center and the Intrusions Sensors communicate on the
following TCP ports.
TCP Port Direction To/From DC Description
22 SSH Outbound from DC to Sensor DC uses this port to push
configurations, updates, & HA
8300 SSL Inbound from Sensor to DC Management functions
8301 SSL Inbound from Third Parties to
DC eStreamer API (event data streams)
8302 SSL Inbound from Sensor to DC eStreamer from Intrusion
Sensors
8303 SSL Inbound from Sensor to DC Heartbeat Protocol
Nortel TPS 4.7
Threat Protection System Troubleshooting Guide
NN47240-700 01.01 Standard
112007
Copyright © 2007 Nortel Networks
.

17
.
Software Troubleshooting
The TPS 2070 Defense Center (DC), TPS 2050 Intrusion Sensor (IS),
TPS 2070 Intrusion Sensor, TPS 2150 Intrusion Sensor, and TPS 2170
Intrusion Sensor products are pre-loaded with version 4.1 of the software.
The software is available on a CD-ROM that is shipped with the hardware
and is also available on the Nortel website, for contracted customers.
The software file names for release 4.1 are as follows:
•Nortel_TPS_Defense_Center_2070_v4.1.0-78-Restore.iso (TPS 2070
Defense Center)
•Nortel_TPS_Intrusion_Sensor-2050-v4.1.0-78-Restore.iso (TPS 2050
Intrusion Sensor)
•Nortel_TPS_Intrusion_Sensor-2150-v4.1.0-78-Restore.iso (TPS 2150
Intrusion Sensor)
•Nortel_TPS_Intrusion_Sensor-2070-v4.1.0-78-Restore.iso (TPS 2070
Intrusion Sensor)
•Nortel_TPS_Intrusion_Sensor-2170-v4.1.0-78-Restore.iso (TPS 2170
Intrusion Sensor)
This chapter describes the various procedures to troubleshoot the software
on the TPS devices.
Navigation •“Creating a troubleshoot file from a TPS device” (page 18)
•“Obtaining the troubleshoot file following a failed software upgrade”
(page 19)
•“Resetting passwords” (page 20)
•“Installing an Old Version of SEU” (page 22)
•“Event handling” (page 22)
•“Troubleshooting the SFDataCorrelator” (page 24)
•“Troubleshooting alerting problems” (page 25)
Nortel TPS 4.7
Threat Protection System Troubleshooting Guide
NN47240-700 01.01 Standard
112007
Copyright © 2007 Nortel Networks
.

18 Software Troubleshooting
•“Troubleshooting events that show incorrect time” (page 25)
•“Troubleshooting LDAP authentication ” (page 26)
•“RUA” (page 27)
•“Configuring Snort through the User Interface” (page 27)
•“Verifying prohibit packet data on the DC” (page 28)
•“Performing RNA IP/Port Exclusion” (page 28)
•“Scanning the NMAP” (page 29)
•“Remediation Procedures” (page 29)
Creating a troubleshoot file from a TPS device
Use this procedure to create a compressed troubleshoot file from a TPS
device to obtain critical information to troubleshoot it.
CAUTION
Only authorized administrators must create a troubleshoot file
from a TPS device.
Procedure 1
Procedure steps
Step Action
1Open a case with Nortel Enterprise Technical Support (NETS).
2Enter the following command to go to the default location.
/usr/local/sf/bin
3Run the script sf_troublshoot.pl
4Enter the following command to obtain the default configuration
filetroubleshoot.conf.
/etc/sf/troubleshoot.conf
5Customize the troublshoot.conf file into a custom.conf file if
necessary.
ATTENTION
Although there is a predefined set of data to collect, defined in
troublshoot.conffile, you can specify acustom.conf file to customize
what data is collected.
6Enter the following command to obtain the default results file.
FTP the SFTP client to obtain the file.
/var/tmp/results
The format of theresults file is:
Nortel TPS 4.7
Threat Protection System Troubleshooting Guide
NN47240-700 01.01 Standard
112007
Copyright © 2007 Nortel Networks
.

Obtaining the troubleshoot file following a failed software upgrade 19
results-mm-dd-yyyy--xxxxxxx.tag.gz
You can use the -toption to allow the case number to be placed
within the name of the results file.
ATTENTION
WINSCP is a freeware SFTP client for windows and can be
downloaded from the location http://www.winscp.com/
--End--
Obtaining the troubleshoot file following a failed software upgrade
Use this procedure to obtain a troubleshoot file from a TPS device in case
of a failed Nortel TPS Defense Center Upgrade. An upgrade on a TPS
device is done by customers or support personnel.
CAUTION
Refer TPS 4.7 Release Notes (part number) for information on
prerequisites, detailed steps and tips on performing a complete
and correct Nortel TPS DC 4.5.1 Upgrade on a TPS device.
Procedure 2
Procedure steps
Step Action
1Enter the following command to obtain the output file that
contains the list of updates pushed to the TPS device.
/var/sf/updates/ls-alshL var-sf-updates.output
2Verify that the correct upgrade script was used to upgrade the
TPS device.
3Enter the following command to obtain the troubleshoot log file.
\results-dd-mm-yyyy--191127\dir-archives\var-log
\sf\Nortel_TPS_DC_Upgrade-4.5.1\main_uograde_scr
ipt.log
This log file is a complete account of the upgrade process.
ATTENTION
The name of the folder in which the troubleshoot log file is extracted,
includes the version of the software you upgrade to.
--End--
Nortel TPS 4.7
Threat Protection System Troubleshooting Guide
NN47240-700 01.01 Standard
112007
Copyright © 2007 Nortel Networks
.

20 Software Troubleshooting
Resetting passwords
This section describes resetting passwords on TPS devices.
Resetting the root password of a TPS device
Use this procedure to reset the root password of a TPS device (2050
model), if it is lost or forgotten.
Procedure 3
Procedure steps
Step Action
1Connect the TPS device (2050 model) to a PC or laptop, using a
console cable.
ATTENTION
Connect the TPS device to a monitor and keyboard, if the device is
a 2070 model.
2Power cycle the TPS device.
3Press any arrow key during the boot sequence at the LILO boot
prompt.
ATTENTION
Press any arrow key during the boot sequence when the LILO boot
menu appears, if the device is a 2070 model.
4Enter the following command at the LILO boot prompt to load the
linux operating system.
linux -s
System response:
Loading linux.....
Linux version 2.4.26st.p4smp-13 ([email protected]
urcefire.com)(gcc version 2.95.320010315 (release)) #1
SMP Fri Aug 12 16:37:04 UTC 2005
5Enter the following command:
LILO 22.2 boot:passwd root
At the prompt, enter the new root password. Reenter to confirm
the root password.
6Enter the following command to reboot the 2050 TPS device.
LILO 22.2 boot:reboot
7Enter the following command to login to the 2050 TPS device:
Nortel TPS 2X50 DC Series v4.1.0 (build 78)
DC2050.ca.nortel.com login: root
Nortel TPS 4.7
Threat Protection System Troubleshooting Guide
NN47240-700 01.01 Standard
112007
Copyright © 2007 Nortel Networks
.