Nortel 2070 User manual

Nortel Threat Protection System
Threat Protection System
Troubleshooting Guide
Release: 4.7
Document Revision: 01.01
www.nortel.com
NN47240-700 324442-A
.

Nortel Threat Protection System
Release: 4.7
Publication: NN47240-700
Document status: Standard
Document release date: 112007
Copyright © 2007 Nortel Networks
All Rights Reserved.
The information in this document is subject to change without notice. The statements, configurations, technical
data, and recommendations in this document are believed to be accurate and reliable, but are presented without
express or implied warranty. Users must take full responsibility for their applications of any products specified in this
document. The information in this document is proprietary to Nortel Networks.
Export
This product, software and related technology is subject to U.S. export control and may be subject to export or
import regulations in other countries. Purchaser must strictly comply with all such laws and regulations. A license to
export or reexport may be required by the U.S. Department of Commerce.
Licensing
This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit
(http://www.openssl.org/).
This product includes cryptographic software written by Eric Young ([email protected]).
This product includes software written by Tim Hudson ([email protected]).
This product includes software developed by the Apache Software Foundation http://www.apache.org/.
This product includes a TAP-Win32 driver derived from the CIPE-Win32 kernel driver, Copyright © Damion K.
Wilson, and is licensed under the GPL.
See Appendix D, "License Information", in the User’s Guide for more information
.

3
.
Contents
New in this release 7
Navigation 7
Introduction 9
Prerequisites 9
Navigation 10
Acronyms 10
Troubleshooting Fundamentals 11
Navigation 11
Log files 11
Issues that require Sourcefire assistance 12
Hardware Troubleshooting 15
Navigation 15
TPS Hardware 15
Ports to open in a firewall 16
Software Troubleshooting 17
Creating a troubleshoot file from a TPS device 18
Obtaining the troubleshoot file following a failed software upgrade 19
Resetting passwords 20
Resetting the root password of a TPS device 20
Resetting the Administrator Password for a TPS device 21
Installing an Old Version of SEU 22
Event handling 22
Troubleshooting TPS Sensor when not receiving events 23
Troubleshooting Defense Center when not receiving events 23
Troubleshooting errors when adding sensor to DC 23
Troubleshooting the SFDataCorrelator 24
Troubleshooting alerting problems 25
Troubleshooting mail alerting problems 25
Troubleshooting SNMP alerting problems 25
Troubleshooting Syslog alerting problems 25
Troubleshooting events that show incorrect time 25
Troubleshooting LDAP authentication 26
Nortel TPS 4.7
Threat Protection System Troubleshooting Guide
NN47240-700 01.01 Standard
112007
Copyright © 2007 Nortel Networks
.

4
RUA 27
Configuring Snort through the User Interface 27
Verifying prohibit packet data on the DC 28
Performing RNA IP/Port Exclusion 28
Scanning the NMAP 29
Remediation Procedures 29
Remediating NAS 29
Troubleshooting Global Faults 31
Navigation 31
Troubleshooting when no white list events are generated 32
Troubleshooting an IS that does not generate events 32
Troubleshooting an SDM IS that could not be added to a DC 32
Troubleshooting an IS that does not block traffic 33
Validating the failopen function 33
Troubleshooting an IS that does not send email 34
Troubleshooting a DC that cannot push a policy to a sensor that it is
managing 34
Troubleshooting a faulty OPSEC 34
Troubleshooting a failed upgrade 35
Troubleshooting a failed automatic SEU Update 35
Troubleshooting when a customer is unable to add a sensor to be managed by a
DC 36
Troubleshooting a system crash 37
Verify the ports to be opened in the firewall for 4.6 37
Troubleshooting Snort 37
Troubleshooting memory problems 38
IPS mode cable Deployment Scenarios 38
Deploying between two endpoints 38
Deploying between two network switches 39
Between a switch and an endpoint 39
Between a switch and a router 39
Between a router and an endpoint 39
Between a firewall and an endpoint 40
Between two firewalls 40
Between a switch and a firewall 40
Between router and a firewall 40
Checking IPv6 configurations on the CLI 41
Verification of Detection Resources on the CLI 41
Viewing the enabled rules on the CLI 41
Viewing remediation log 42
Viewing the LDAP SSL certificate 42
Emergency recovery trees 43
Lost access to the TPS DC/IS device -- recovery tree 43
Nortel TPS 4.7
Threat Protection System Troubleshooting Guide
NN47240-700 01.01 Standard
112007
Copyright © 2007 Nortel Networks
.

Licensing 5
The TPS DC/ IS cannot receive events -- recovery tree 44
Reference to third party Application Guides 47
Contact Nortel technical support 49
Navigation 49
Gathering critical information 49
Getting help from the Nortel Web site 50
Getting help over the phone from a Nortel Solutions Center 50
Getting help from a specialist by using an Express Routing Code 51
Getting help through a Nortel distributor or reseller 51
Glossary 53
Nortel TPS 4.7
Threat Protection System Troubleshooting Guide
NN47240-700 01.01 Standard
112007
Copyright © 2007 Nortel Networks
.

6
Nortel TPS 4.7
Threat Protection System Troubleshooting Guide
NN47240-700 01.01 Standard
112007
Copyright © 2007 Nortel Networks
.

7
.
New in this release
The Nortel Threat Protection System Release. 4.7 Troubleshooting Guide
with Emergency Recovery Tree (NN47240-700) is a new document for
Nortel Threat Protection System Release 4.7.
Navigation
Nortel TPS 4.7
Threat Protection System Troubleshooting Guide
NN47240-700 01.01 Standard
112007
Copyright © 2007 Nortel Networks
.

8New in this release
Nortel TPS 4.7
Threat Protection System Troubleshooting Guide
NN47240-700 01.01 Standard
112007
Copyright © 2007 Nortel Networks
.

9
.
Introduction
The Nortel Threat Protection System is a fully integrated intrusion
detection system that consists of the following:
•TPS 2070 Defense Center, which manages intrusion sensors in the
network environment
•TPS 2050 Intrusion Sensor and TPS 2070 Intrusion Sensor, which
detect and track network intrusions, either independently or under the
management of the TPS 2070 Defense Center
•TPS 2150 Intrusion Sensor and TPS 2170 Intrusion Sensor, which
have fail-open functionality in inline mode
This chapter describes the prerequisites and various tools used to
troubleshoot the Nortel TPS 4.7. Use these troubleshooting tools to
enhance the overall performance, resolve error messages, and increase
response time for a specific feature. Each tool is described by purpose,
usage procedures, and how to interpret the output.
Prerequisites
Nortel recommends you to use one or more of the following commercially
available troubleshooting tools as well as the tools described in this
document.
•Capture and analyze HTTP and HTTPS with the HTTP Analyzer from
IE Inspector http://www.ieinspector.com/
•Capture and analyze HTTP and HTTPS with Tamper Data, a plug-in
available for Mozilla Firefox https://addons.mozilla.org/en-US/firefox/
addon/966
•Display the time to load Web pages with Faster Fox, a plug-in available
for Mozilla Firefox https://addons.mozilla.org/en-US/firefox/addon/1269
•Capture and analyze packets with either Sniffer or Wireshark from
Network General http://www.wireshark.org/ and http://www.networkge
neral.com/
Nortel TPS 4.7
Threat Protection System Troubleshooting Guide
NN47240-700 01.01 Standard
112007
Copyright © 2007 Nortel Networks
.

10 Introduction
Navigation •“Troubleshooting Fundamentals” (page 11)
•“Hardware Troubleshooting” (page 15)
•“Software Troubleshooting” (page 17)
•“Troubleshooting Global Faults” (page 31)
•“Emergency recovery trees” (page 43)
•“Reference to third party Application Guides” (page 47)
•“Contact Nortel technical support” (page 49)
•“Glossary” (page 53)
Acronyms Table 1 "Acronyms" (page 10) lists the acronyms used in this guide.
Table 1
Acronyms
TPS Threat Protection System
CLI Command Line Interface
LED Light Emitting Diode
Nortel TPS 4.7
Threat Protection System Troubleshooting Guide
NN47240-700 01.01 Standard
112007
Copyright © 2007 Nortel Networks
.