RSA NetWitness 6 Series User manual

Series 6 Hardware Setup Guide

Contact Information
NetWitness Community at https://community.netwitness.com contains a knowledge base that
answers common questions and provides solutions to known problems, product documentation,
community discussions, and case management.
Trademarks
RSA Conference Logo, RSA, and other trademarks, are trademarks of RSA Security LLC or its
affiliates ("RSA"). For a list of RSA trademarks, go to https://www.rsa.com/en-us/company/rsa-
trademarks. Other trademarks are trademarks of their respective owners.
License Agreement
This software and the associated documentation are proprietary and confidential to RSA Security
LLC or its affiliates are furnished under license, and may be used and copied only in accordance
with the terms of such license and with the inclusion of the copyright notice below. This
software and the documentation, and any copies thereof, may not be provided or otherwise made
available to any other person. No title to or ownership of the software or documentation or any
intellectual property rights thereto is hereby transferred. Any unauthorized use or reproduction of
this software and the documentation may be subject to civil and/or criminal liability. This
software is subject to change without notice and should not be construed as a commitment by
RSA.
Third-Party Licenses
This product may include software developed by parties other than RSA. The text of the license
agreements applicable to third-party software in this product may be viewed on the product
documentation page on NetWitness Community. By using this product, a user of this product
agrees to be fully bound by terms of the license agreements.
Note on Encryption Technologies
This product may contain encryption technology. Many countries prohibit or restrict the use,
import, or export of encryption technologies, and current use, import, and export regulations
should be followed when using, importing or exporting this product.
Distribution
Use, copying, and distribution of any RSA Security LLC or its affiliates ("RSA") software
described in this publication requires an applicable software license.
RSA believes the information in this publication is accurate as of its publication date. The
information is subject to change without notice.
THE INFORMATION IN THIS PUBLICATION IS PROVIDED "AS IS." RSA MAKES NO
REPRESENTATIONS OR WARRANTIES OF ANY KIND WITH RESPECT TO THE
INFORMATION IN THIS PUBLICATION, AND SPECIFICALLY DISCLAIMS IMPLIED
WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
© 2020 RSA Security LLC or its affiliates. All Rights Reserved.
June 2022

Contents
About this Document 4
S6 R640 Hardware Description 5
Package Contents 6
Customer Supplied Materials 6
Front View of the Series 6 Hardware (Except Hybrid) 7
Rear View of the Series 6 Hardware (Except Hybrid) 9
Series 6 Hardware Specifications 10
Install a Deep-Rack Adapter for R640 Hardware 13
S6 R740xd Hybrid Hardware Description 16
Package Contents 17
Customer Supplied Materials 17
Front View of the Series 6 Hybrid Hardware 18
Rear View of the Series 6 Hybrid Hardware 20
Series 6 R740xd Hybrid Hardware Specifications 21
Install a Deep-Rack Adapter for an R740xd Hybrid 22
Connect to the Series 6 Hardware Console 25
10.6.5.2 and Later 10.6.x.x Versions Installation Tasks 27
Configure Network Parameters 27
Specify the Network Clock Source 28
Best Practices 29
Set Time on the Security Analytics Server Host using the NwConsole Utility 29
Finish Host Setup in NetWitness Platform 30
Log On to NetWitness Platform 30
Open the Online Help 30
11.1.0.2 and Later Installation Tasks 32
NIC Bonding 33
Example for Bonding em3 or em4 (10G fiber interfaces) 37
Revision History 42

Series 6 Hardware Setup Guide
About this Document
This document provides instructions for setting up RSA NetWitness® Platform Series 6 (S6)
physical hosts and connecting them to your network.
This document applies to both Series 6 and Series 6E hardware. Series 6E hardware uses self-
encrypting drives (SEDs).
The hardware setup instructions in this document are for hardware only; they do not apply to a
specific release of NetWitness Platform software. After completing the hardware setup, continue
setup and configuration of the NetWitness Platform Series 6 physical hosts as described in the
RSA NetWitness® Platform online documentation at RSA Link
(https://community.rsa.com/docs/DOC-40370).
This document is not a replacement for the original manufacturer's documentation; it contains
information specifically for the NetWitness Platform Series 6 hardware.
Note: When viewing a printed guide, be aware that a newer version of the guide may be
available online at RSA Link in RSA NetWitness Platform under Hardware Setup Guides:
https://community.rsa.com/community/products/netwitness/hardware-setup-guides
About this Document 4

Series 6 Hardware Setup Guide
S6 R640 Hardware Description
All but one of the RSA NetWitness® Platform Series 6 (S6) physical hosts are based on the Dell
PowerEdge R640 chassis. The exception is the Hybrid host, which is based on the Dell
PowerEdge R740xd chassis. The Series 6 hosts are shipped with NetWitness Platform software
installed.
In NetWitness Platform 11.3 and later, the R640 can also support Hybrid host software, but
additional external storage is required. For more information on Hybrids, see S6 R740xd Hybrid
Hardware Description.
This section describes the Series 6 hosts that are based on the Dell PowerEdge R640 chassis:
lNetwork Decoder and Log Decoder
lConcentrator, Broker, and Archiver
lNetWitness Server
lMalware Analysis
lEvent Stream Analysis (ESA)
lUser and Entity Behavior Analytics (UEBA)
Except for the Analytics hardware used for ESA and UEBA, all Dell PowerEdge R640-based
hosts have the same components and physical specifications. The Analytics hardware has
additional hard drives, memory, and a different CPU. Series 6 Hardware Specifications provides
details.
The initial setup of a Series 6 host in your network involves these steps:
1. Review site requirements and safety information in the Deployment Guide for your
NetWitness Platform software version. To locate this document, go to the RSA NetWitness®
Platform online documentation at RSA Link (https://community.rsa.com/docs/DOC-40370)
and for your software version, click the Documentation link. The Deployment Guide is
located in the Administration section.
2. Mount or place the host hardware securely in accordance with your site requirements.
3. Connect the RSA physical host (appliance) to your network. See Connect to the Series 6
Hardware Console.
4. Finish the host setup in one of the following sections, depending on your NetWitness
Platform version:
l10.6.5.2 and Later 10.6.x.x Versions Installation Tasks
l11.1.0.2 and Later Installation Tasks
5 S6 R640 Hardware Description

Series 6 Hardware Setup Guide
Caution: To avoid damaging NetWitness servers, hosts, and JBODs, remove them from the
rack and dismantle the rack before transporting them to another location. Follow the
recommendations of the server manufacturer and rack manufacturer for packaging, transport,
and installation.
RSA does not support re-shipping of racked servers. The customer assumes all risk and
liability for transporting NetWitness servers and hosts mounted in a rack.
Package Contents
Verify the contents of the packing box to ensure that you have received all items necessary to
install and configure the RSA physical host.
lRSA NetWitness® Platform Series 6 physical host (Decoder, Concentrator, Broker, Archiver,
NetWitness Server, Malware Analysis, or ESA)
lStatic Ready Rails 1U (1 set)
lLeft Rail Adapter for EMC deep rack (1)
lRSA Bezel (1) - Keys are taped to the bezel.
lPower Cord (2)
lShort Range (SR) SFP Optical Transceivers (2)
lSafety Environment and Regulatory Information booklet (1)
lRSA Documentation Folder (1)
lRSA EULA (1)
Customer Supplied Materials
To complete the setup procedure, you will need:
lOne Ethernet connection (application)
lOne Ethernet connection (iDRAC)
lCables to connect a monitor or KVM adapter to the VGA port and a keyboard or KVM
adapter to the USB port
lFiber cables if using SR SFP fiber connections
lStandard tools
S6 R640 Hardware Description 6

Series 6 Hardware Setup Guide
Front View of the Series 6 Hardware (Except Hybrid)
Item numbers 1-5 are status LED indicators, which indicate the status of the system. The status
LED indicators are always off and only turn on to a solid amber if any error occurs.
Key Description
1 Drive indicator. This turns solid amber if there is a drive error.
2 Temperature indicator. This turns sold amber if the system experiences a thermal
error, such as the ambient temperature is out of range or there is a fan failure.
3 Electrical indicator. This turns solid amber if the system experiences an electrical
error, such as voltage out of range, a failed power supply unit (PSU), or a failed
voltage regulator.
4 Memory indicator. This turns solid amber if a memory error occurs.
5 PCIe indicator. This turns solid amber if a PCIe card experiences an error.
7 S6 R640 Hardware Description

Series 6 Hardware Setup Guide
Key Description
6System health and system ID indicators:
lSolid blue: Indicates that the system is turned on, the system is healthy, and
system ID mode is not active. Press the system health and system ID button to
switch to system ID mode.
lBlinking blue: Indicates that the system ID mode is active. Press the system health
and system ID button to switch to system health mode.
lSolid amber: Indicates that the system is in fail-safe mode.
lBlinking amber: Indicates that the system is experiencing a fault. Check the
System Event Log or the LCD panel, if available on the bezel, for the specific
error message.
7 Power button
8 USB port
9 iDRAC Direct LED indicator and iDRAC Direct port. The indicator lights up to
indicate that the iDRAC Direct port is actively connected to a device. The iDRAC
Direct port is micro USB 2.0-compliant. This port enables you to access the iDRAC
Direct features. For more information, see the iDRAC User's Guide at Dell.com.
10 VGA Port. Enables you to connect a display device to the system.
11 Ten 2.5-inch hard drive bays (field replaceable). The specifications below identify the
number and types of hard drives installed on the hosts.
For more information, refer to the Dell documentation, the Dell EMC PowerEdge R640
Installation and Service Manual, and the Dell Event and Error Messages Reference Guide.
S6 R640 Hardware Description 8

Series 6 Hardware Setup Guide
Rear View of the Series 6 Hardware (Except Hybrid)
Key Description
1 System identification connector
2PERC H840 RAID controller. It is in PCIe slot 1. The PERC H840 is the the RAID
controller for the storage expansion JBOD. It requires a cable with a Mini-SAS port
to connect to the JBOD.
3PCIe expansion slots 2 and 3. The Decoder may use a PCIe slot for an optional Intel
i350 Quad RJ-45 port network interface card. These slots can also be used for an
Emulex HBA card to connect to a SAN and for an Intel 520 based dual port 10G NIC
Fiber card.
4 Hot Swappable Power Supply 1 and 2 (field replaceable)
5Secondary Network 1000BASE-T port: em2
6 Primary Network 1000BASE-T management port: em1
7 Fiber ports em3 and em4 (This is where the Short Range (SR) SFP Optical
Transceivers that were included with the shipment need to be installed.)
8 USB Ports (Keyboard, mouse, USB thumb drive, and so on)
9 VGA Video Port (monitor)
10 RS232 Serial Port (serial connection to laptop via DB9 or serial server)
11 iDRAC port. The default IP is 192.168.0.120 and the default authentication
is root/themaster01
12 System identification button
Note: The PERC H840 RAID controller requires a cable with a Mini-SAS port to connect to
the JBOD. The cables are included with the storage.
9 S6 R640 Hardware Description

Series 6 Hardware Setup Guide
Series 6 Hardware Specifications
Item Core ESA/Analytics Hybrid
Host Type NW Server, Log
Decoder, Network
Decoder (Packets),
Concentrator,
Broker, Archiver,
Malware Analysis
ESA
UEBA
Log Decoder Hybrid,
Network Decoder Hybrid
(Packets), Endpoint Log
Hybrid
Model Dell PowerEdge R640 Dell PowerEdge
R640
Dell PowerEdge R740
Processor
Type Intel Xeon Gold
6134
Intel Xeon Gold 6126 Intel Xeon Gold 6132
Processor Speed 3.2Ghz 2.6Ghz 2.6Ghz
Cache 24.75M 1 Cache 19.25M Cache 19M Cache
# of Processors 2 2 2
# of Cores 8 Cores per
Processor
12 Cores per
Processor
14 Cores per Processor
# of Threads 16 Threads per
Processor
24 Threads per
Processor
28 Threads per Processor
Series 6
Hard Drives
Field replaceable
Hot swappable
2 X 1TB NL-SAS
7.2K
2 X 2TB NL-SAS
7.2K
Total - 4 Drives
Slots 0-1: 1TB
Slots 2-3: 2TB
2 X 1TB NL-SAS
7.2K
4 X 2.4TB SAS 10K
Total - 6 Drives
Slots 0-1: 1TB
Slots 2-5: 2.4TB
4 X 2TB NL-SAS 7.2K
8 X 8TB NL-SAS 7.2K
2 x 1.6TB SSD
Total - 14 Drives
Slots 0-3 (Front): 2TB
Slots 4-11 (Front): 8TB
Slots 12-13 (Rear):
1.6TB SSD
Series 6 Hardware Specifications 10

Series 6 Hardware Setup Guide
Item Core ESA/Analytics Hybrid
Series 6E
Self-Encrypting
Drives (SEDs)
FIPS140 Certified
Field replaceable
Hot swappable
2 X 1.2TB SAS
10K SED
2 X 2.4TB SAS
10K SED
Total - 4 Drives
Slots 0-1: 1.2TB
Slots 2-3: 2.4TB
2 X 1.2TB SAS 10K
SED
4 X 2.4TB SAS 10K
SED
Total - 6 Drives
Slots 0-1: 1.2TB
Slots 2-5: 2.4TB
2 X 2.4TB SAS 10K
SED
10 X 8TB NL-SAS 7.2K
SED
2 x 1.92TB SSD SED
Total - 14 Drives
Slots 0-1 (Front): 2.4TB
Slots 2-11 (Front): 8TB
Slots 12-13 (Rear):
1.92TB SSD
Memory 128GB
4 * 32GB RDIMM
2666MT/s Dual
Rank
256GB
8 * 32GB RDIMM
2133MT/s
128GB
4 * 32GB RDIMM
2666MT/s Dual Rank
Storage Controllers External PERC H840, Internal PERC H740P
Network Interface
Card
Intel X710 DP 10Gb DA/SFP+, + 1350 DP 1Gb Ethernet, Network
Daughter Card
Power
PSU Dual, Hot-plug, Redundant Power Supply (1+1), 1100 W AC
BTU/hr 4100 BTU/hr (Maximum)
Voltage 100-240 V AC, autoaranging
Current 12 A - 6.5 A
Form Factor 1U, full depth 2U, full depth
Weight
(approximate)
21.9 kg (48.28 lbs) 33.1 kg (72.91 lb)
Dimensions
(approximate)
With bezel: 482.0 mm (18.97 in) [w] x
808.51 mm (31.83 in) [d] x 42.8 mm (1.68
in) [h]
Without bezel: 482.0 mm (18.97 in) [w] x
794.67 mm (31.29 in) [d] x 42.8 mm (1.68
in) [h]
With bezel: 482.0 mm
(18.98 in) [w] x
751.34 mm (29.58 in)
[d] x 86.8 mm (3.42 in)
[h]
Without bezel: 482.0 mm
(18.98 in) [w] x
737.50 mm (29.04 in) [d]
x 86.8 mm (3.42 in) [h]
11 Series 6 Hardware Specifications

Series 6 Hardware Setup Guide
Item Core ESA/Analytics Hybrid
Shipping
Dimensions
Server boxed for shipping
(includes rail kit)
Height: 30.48 cm (12 inch)
Width: 104.14 cm (41 inch)
Depth: 64.14 cm (25.25 inch)
Weight: 25.85 kg (57 lb)
Server boxed for
shipping (includes rail
kit)
Height: 32.39 cm (12.75
inch)
Width: 95.25 cm (37.50
inch)
Depth: 66.04 cm (26.00
inch)
Weight: 35 kg (81.86 lb)
Throughput / EPS Network: 2-10
Gbps
Logs: 30K EPS
N/A Network: 1 Gbps
Logs: 20K EPS
Supported SFPs &
Add-On Cards
Add-On Cards
1G QP Intel Copper Adapter
10G DP Intel Copper Adapter
10G DP Intel Optical Adapter
External PERC H840
16G DP Emulex HBA
SFPs
1G SFP Intel Copper
10G SFP Short Range Intel Optical (standard)
10G SFP Long Range Intel Optical
Series 6 Hardware Specifications 12

Series 6 Hardware Setup Guide
Install a Deep-Rack Adapter for R640 Hardware
Note: This procedure is only applicable if you are installing the RSA S6 R640 physical host in
the EMC Titan D Ultra Rack.
When installing the RSA S6 R640 physical host into the EMC Titan D Ultra Rack, a 1U deep-
rack adapter is required. Follow this procedure to install a new bracket on the server rails.
Caution: Pay attention to rail markings. They are marked left and right. Be sure to place them
on the correct side.
1. Locate the alternate rail bracket in the accessory box in the R640 host carton.
2. Remove the left side rail from the rail carton.
13 Install a Deep-Rack Adapter for R640 Hardware

Series 6 Hardware Setup Guide
Each rail is marked.
3. Use a Phillips screwdriver to remove the two mounting screws.
Install a Deep-Rack Adapter for R640 Hardware 14

Series 6 Hardware Setup Guide
4. Remove the bracket and replace it with the new bracket.
5. Re-use the screws to fasten the new bracket in place.
The rail is now ready for the R640 host installation.
15 Install a Deep-Rack Adapter for R640 Hardware

Series 6 Hardware Setup Guide
S6 R740xd Hybrid Hardware Description
The RSA NetWitness® Platform Series 6 Hybrid physical host is based on the Dell PowerEdge
R740xd chassis. The Series 6 Hybrid host is shipped with NetWitness Platform Hybrid host
software installed. Hybrid host software includes Concentrator and Decoder (log or packet, not
both).
This section describes the Series 6 Hybrid hosts that are based on Dell PowerEdge R740xd
chassis:
lNetwork Decoder Hybrid (Packets)
lLog Decoder Hybrid
lEndpoint Log Hybrid (Includes Endpoint Server and Log Collector service)
The initial setup of a Series 6 host in your network involves these steps:
1. Review site requirements and safety information in the Deployment Guide for your
NetWitness Platform software version. To locate this document, go to the RSA NetWitness®
Platform online documentation at RSA Link (https://community.rsa.com/docs/DOC-40370)
and for your software version, click the Documentation link. The Deployment Guide is
located in the Administration section.
2. Mount or place the host hardware securely in accordance with your site requirements.
3. Connect the RSA physical host (appliance) to your network. See Connect to the Series 6
Hardware Console.
4. Finish the host setup in one of the following sections, depending on your NetWitness
Platform version:
l10.6.5.2 and Later 10.6.x.x Versions Installation Tasks
l11.1.0.2 and Later Installation Tasks
Caution: To avoid damaging NetWitness servers, hosts, and JBODs, remove them from the
rack and dismantle the rack before transporting them to another location. Follow the
recommendations of the server manufacturer and rack manufacturer for packaging, transport,
and installation.
RSA does not support re-shipping of racked servers. The customer assumes all risk and
liability for transporting NetWitness servers and hosts mounted in a rack.
S6 R740xd Hybrid Hardware Description 16

Series 6 Hardware Setup Guide
Package Contents
Verify the contents of the packing box to ensure that you have received all items necessary to
install and configure your RSA Hybrid physical host.
lRSA NetWitness® Platform Series 6 Hybrid physical host
lStatic Ready Rails 2U (1 set)
lLeft Rail 2U Adapter for EMC deep rack (1)
l2U RSA Bezel (1) - Keys are taped to the bezel
lPower Cord (2)
lShort Range (SR) SFP Optical Transceivers (2)
lSafety Environment and Regulatory Information booklet (1)
lRSA Documentation Folder (1)
lRSA EULA (1)
Customer Supplied Materials
To complete the setup procedure, you will need:
lOne Ethernet connection (application)
lOne Ethernet connection (iDRAC)
lCables to connect a monitor or KVM adapter to the VGA port and a keyboard or KVM
adapter to the USB port
lFiber cables if using SR SFP fiber connections
lStandard tools
17 S6 R740xd Hybrid Hardware Description

Series 6 Hardware Setup Guide
Front View of the Series 6 Hybrid Hardware
Item numbers 1-5 are status LED indicators, which indicate the status of the system. The status
LED indicators are always off and only turn on to a solid amber if any error occurs.
Key Description
1Drive indicator. This turns solid amber if there is a drive error.
2 Temperature indicator. This turns sold amber if the system experiences a thermal
error, such as the ambient temperature is out of range or there is a fan failure.
3Electrical indicator. This turns solid amber if the system experiences an electrical
error, such as voltage out of range, a failed power supply unit (PSU), or a failed
voltage regulator.
4 Memory indicator. This turns solid amber if a memory error occurs.
5PCIe indicator. This turns solid amber if a PCIe card experiences an error.
S6 R740xd Hybrid Hardware Description 18

Series 6 Hardware Setup Guide
Key Description
6System health and system ID indicators:
lSolid blue: Indicates that the system is turned on, the system is healthy, and
system ID mode is not active. Press the system health and system ID button to
switch to system ID mode.
lBlinking blue: Indicates that the system ID mode is active. Press the system health
and system ID button to switch to system health mode.
lSolid amber: Indicates that the system is in fail-safe mode.
lBlinking amber: Indicates that the system is experiencing a fault. Check the
System Event Log or the LCD panel, if available on the bezel, for the specific
error message.
7 Power button
8 VGA Port. Enables you to connect a display device to the system.
92 USB ports. The USB ports are 4-pin, 2.0-compliant.
10 iDRAC Direct port. The iDRAC Direct port is micro USB 2.0-compliant. This port
enables you to access the iDRAC Direct features. For more information, see the
iDRAC User's Guide at Dell.com.
11 iDRAC Direct LED indicator. The indicator lights up to indicate that the iDRAC
Direct port is actively connected to a device.
12 Information tag location
13 12 3.5-inch hard drives (HDDs) (field replaceable). The NetWitness Platform Hybrid
host has a total of 14 disks. There are 12 HDDs on the front and 2 solid state disks
(SSDs) on the back. See the host specifications below for additional details.
For more information, refer to the Dell documentation, the Dell EMC PowerEdge R740xd
Installation and Service Manual, and the Dell Event and Error Messages Reference Guide.
19 S6 R740xd Hybrid Hardware Description

Series 6 Hardware Setup Guide
Rear View of the Series 6 Hybrid Hardware
Key Description
1 Full-height PCIe expansion card slots (3). The Decoder may use a PCIe slot for an
optional Intel i350 Quad RJ-45 port network interface card. These slots can also be
used for an Emulex HBA card to connect to a SAN and for an Intel 520 based dual
port 10G NIC Fiber card.
2 PERC H840 RAID controller. It is shown in the half-height PCIe expansion card slot.
The PERC H840 is the RAID controller for the storage expansion JBOD. It requires a
cable with a Mini-SAS port to connect to the JBOD. The PERC H840 card is
installed inverted (upside down) in slot 4, which means that port 0 is on the right and
port 1 is on the left on the R740xd Hybrid. You must attach cables to the R740xd
with the connector's blue tab on the bottom.
3 Rear handle
4 Four 2.5-inch hard drive bays (field replaceable). The specifications below identify
the number and types of hard drives installed on the hybrid host.
5 Hot swappable power supply 1 and 2 (field replaceable)
6 Secondary Network 1000BASE-T Port: em2
7 Primary Network 1000BASE-T Management Port: em1
8 Fiber Ports: em3 and em4 (This is where the Short Range (SR) SFP Optical
Transceivers that were included with the shipment need to be installed.)
9 The USB ports are 9-pin and 3.0 compliant (Keyboard, mouse, USB thumb drive, and
so on)
10 VGA video port (monitor)
11 RS232 Serial port (serial connection to laptop via DB9 or serial server)
12 iDRAC9 dedicated port. The default IP is 192.168.0.120 and the default
authentication
is root/themaster01
S6 R740xd Hybrid Hardware Description 20