Symantec 10521146 - Network Security 7120 Instruction Manual

Symantec™ Network Security
Administration Guide

2
Symantec Network Security Administration Guide
The software described in this book is furnished under a license agreement and may be used only in
accordance with the terms of the agreement.
Documentation version 4.0
PN: 10268960
Copyright Notice
Copyright © 2004 Symantec Corporation.
All Rights Reserved.
Any technical documentation that is made available by Symantec Corporation is the copyrighted work
of Symantec Corporation and is owned by Symantec Corporation.
NO WARRANTY. The technical documentation is being delivered to you AS-IS, and Symantec
Corporation makes no warranty as to its accuracy or use. Any use of the technical documentation or the
information contained therein is at the risk of the user. Documentation may include technical or other
inaccuracies or typographical errors. Symantec reserves the right to make changes without prior
notice.
No part of this publication may be copied without the express written permission of Symantec
Corporation, 20330 Stevens Creek Blvd., Cupertino, CA 95014.
Trademarks
Symantec, the Symantec logo, LiveUpdate, Network Security, Symantec Decoy Server, and Norton
AntiVirus are U.S. registered trademarks of Symantec Corporation. Symantec AntiVirus, Symantec
Enterprise Security Architecture, and Symantec Security Response are trademarks of Symantec
Corporation.
Other brands and product names mentioned in this manual may be trademarks or registered
trademarks of their respective companies and are hereby acknowledged.
Windows is a registered trademark, and 95, 98, NT and 2002 are trademarks of Microsoft Corporation.
Pentium is a registered trademark of Intel Corporation. Sun is a registered trademark, and Java, Solaris,
Ultra, Enterprise, and SPARC are trademarks of Sun Microsystems. UNIX is a registered trademark of
UNIX System Laboratories, Inc. Cisco and Catalyst are registered trademarks of Cisco Systems, Inc.
Foundry is a registered trademark of Foundry Networks. Juniper is a registered trademark of Juniper
Networks, Inc. iButton is a trademark of Dallas Semiconductor Corp. Dell is a registered trademark of
Dell Computer Corporation. Check Point and OPSEC are trademarks and FireWall-1 is a registered
trademark of Check Point Software Technologies, Ltd. Tripwire is a registered trademark of Tripwire,
Inc.
Symantec Network Security software contains/includes the following Third Party Software from
external sources:
"bzip2" and associated library "libbzip2," Copyright © 1996-1998, Julian R Seward. All rights reserved.
(http://sources.redhat.com/bzip2).
" Castor,"ExoLab Group, Copyright 1999-2001 © 199-2001 Intalio, Inc. All rights reserved.
(http://www.exolab.org).
Printed in the United States of America. 10 9 8 7 6 5 4 3 2 1

3
Technical support
As part of Symantec Security Response, the Symantec global Technical Support
group maintains support centers throughout the world. The Technical Support
group’s primary role is to respond to specific questions on product
feature/function, installation, and configuration, as well as to author content for
our Web-accessible Knowledge Base. The Technical Support group works
collaboratively with the other functional areas within Symantec to answer your
questions in a timely fashion. For example, the Technical Support group works
with Product Engineering as well as Symantec Security Response to provide
Alerting Services and Virus Definition Updates for virus outbreaks and security
alerts.
Symantec technical support offerings include:
■A range of support options that give you the flexibility to select the right
amount of service for any size organization
■Telephone and Web support components that provide rapid response and
up-to-the-minute information
■Upgrade insurance that delivers automatic software upgrade protection
■Content Updates for virus definitions and security signatures that ensure
the highest level of protection
■Global support from Symantec Security Response experts, which is
available 24 hours a day, 7 days a week worldwide in a variety of languages
■Advanced features, such as the Symantec Alerting Service and Technical
Account Manager role, offer enhanced response and proactive security
support
Please visit our Web site for current information on Support Programs. The
specific features available may vary based on the level of support purchased and
the specific product that you are using.
Licensing and registration
If the product that you are implementing requires registration and/or a license
key, the fastest and easiest way to register your service is to access the
Symantec licensing and registration site at www.symantec.com/certificate.
Alternatively, you may go to www.symantec.com/techsupp/ent/enterprise.html,
select the product that you wish to register, and from the Product Home Page,
select the Licensing and Registration link.
Contacting Technical Support
Customers with a current support agreement may contact the Technical
Support group via phone or online at www.symantec.com/techsupp.
Customers with Platinum support agreements may contact Platinum Technical
Support via the Platinum Web site at www-secure.symantec.com/platinum/.

4
When contacting the Technical Support group, please have the following:
■Product release level
■Hardware information
■Available memory, disk space, NIC information
■Operating system
■Version and patch level
■Network topology
■Router, gateway, and IP address information
■Problem description
■Error messages/log files
■Troubleshooting performed prior to contacting Symantec
■Recent software configuration changes and/or network changes
Customer Service
To contact Enterprise Customer Service online, go to www.symantec.com, select
the appropriate Global Site for your country, then choose Service and Support.
Customer Service is available to assist with the following types of issues:
■Questions regarding product licensing or serialization
■Product registration updates such as address or name changes
■General product information (features, language availability, local dealers)
■Latest information on product updates and upgrades
■Information on upgrade insurance and maintenance contracts
■Information on Symantec Value License Program
■Advice on Symantec's technical support options
■Nontechnical presales questions
■Missing or defective CD-ROMs or manuals

Contents
Section 1 Overview
Chapter 1 Introduction
About the Symantec Network Security foundation ....................................... 15
About the Symantec Network Security 7100 Series ............................... 15
About other Symantec Network Security features .................................17
Finding information ............................................................................................ 20
About 7100 Series appliance documentation ..........................................20
About Network Security software documentation .................................21
About the Web sites .....................................................................................22
About this guide ........................................................................................... 23
Chapter 2 Architecture
About Symantec Network Security ...................................................................25
About the core architecture ............................................................................... 25
About detection ............................................................................................ 26
About analysis .............................................................................................. 30
About response ............................................................................................. 31
About management and detection architecture .............................................32
About the Network Security console ........................................................ 32
About the node architecture ...................................................................... 34
About the 7100 Series appliance node ..................................................... 37
Chapter 3 Getting started
Getting started ..................................................................................................... 41
General checklist ................................................................................................. 42
General software and appliance checklist ...............................................42
Additional appliance-specific checklist ................................................... 43
About the management interfaces .................................................................... 44
Using the Network Security console ......................................................... 44
Using the serial console .............................................................................. 49
Using the LCD panel .................................................................................... 51
Managing user access ......................................................................................... 54
Managing user login accounts ................................................................... 55

6Contents
Managing user passphrases ....................................................................... 57
Controlling user access ............................................................................... 59
Planning the deployment ................................................................................... 60
Deploying single nodes ....................................................................................... 61
Deploying a single Network Security software node ............................. 61
Deploying a single 7100 Series appliance node ...................................... 62
Configuring single-node parameters ........................................................ 63
Deploying node clusters ..................................................................................... 64
Deploying software and appliance nodes in a cluster ............................ 65
Monitoring groups within a cluster .......................................................... 66
Section 2 Initial Configuration
Chapter 4 Populating the topology database
About the network topology .............................................................................. 71
About the Devices tab ................................................................................. 72
About topology mapping ............................................................................ 74
Managing the topology tree ............................................................................... 78
Viewing auto-generated objects ................................................................ 79
Viewing node details ................................................................................... 79
Viewing node status .................................................................................... 79
Adding objects for the first time ............................................................... 80
Editing objects .............................................................................................. 81
Deleting objects ............................................................................................ 81
Reverting changes ....................................................................................... 82
Saving changes ............................................................................................. 82
Forcing nodes to synchronize .................................................................... 83
Backing up ..................................................................................................... 83
Adding nodes and objects ................................................................................... 83
About location objects ................................................................................. 83
About nodes and interfaces ........................................................................ 85
About Network Security software nodes ................................................. 86
About 7100 Series appliance nodes .......................................................... 92
About router objects ..................................................................................101
About Smart Agents ..................................................................................104
About managed network segments .........................................................108
Chapter 5 Protection policies
About protection policies .................................................................................111
Responding to malicious or suspicious events .....................................112
Understanding the protection policy work area ...........................................112
Using protection policies .................................................................................113

7Contents
Selecting pre-defined policies ..................................................................114
Setting policies to interfaces ....................................................................115
Applying to save changes .........................................................................115
Overriding blocking rules globally ..........................................................115
Undoing policy settings ............................................................................116
Adjusting the view of event types ...................................................................117
Searching to create a subset of event types ...........................................117
Adjusting the view by columns ................................................................119
Viewing event type details .......................................................................119
Defining new protection policies ....................................................................120
Adding or editing user-defined protection policies ..............................121
Cloning existing protection policies .......................................................121
Enabling or disabling logging rules ........................................................122
Enabling or disabling blocking rules ......................................................123
Deleting user-defined protection policies ..............................................125
Updating policies automatically .....................................................................125
Annotating policies and events .......................................................................126
Backing up protection policies ........................................................................128
Chapter 6 Responding
About response rules .........................................................................................129
About automated responses .............................................................................131
Managing response rules ..................................................................................132
Viewing response rules .............................................................................132
Adding new response rules ......................................................................133
Editing response rules ...............................................................................134
Searching event types ...............................................................................134
Deleting response rules ............................................................................135
Saving or reverting changes ....................................................................135
Backing up response rules ........................................................................135
Setting response parameters ...........................................................................136
Setting event targets .................................................................................136
Setting event types ....................................................................................136
Setting severity levels ...............................................................................137
Setting confidence levels ..........................................................................139
Setting event sources ................................................................................139
Setting response actions ...........................................................................140
Setting next actions ...................................................................................140
Setting response actions ...................................................................................141
Setting no response action .......................................................................142
Setting email notification .........................................................................142
Setting SNMP notification ........................................................................145
Setting TrackBack response action .........................................................147

8Contents
Setting a custom response action ...........................................................147
Setting a TCP reset response action .......................................................150
Setting traffic record response action ....................................................150
Setting a console response action ...........................................................152
Setting export flow response action .......................................................153
Managing flow alert rules ................................................................................154
Viewing flow alert rules ............................................................................155
Adding flow alert rules .............................................................................155
Editing flow alert rules .............................................................................156
Deleting flow alert rules ...........................................................................156
Chapter 7 Detecting
About detection ..................................................................................................159
Configuring sensor detection ..........................................................................160
Configuring sensor parameters ...............................................................161
Restarting or stopping sensors ................................................................161
Basic sensor parameters ...........................................................................162
Data collection parameters ......................................................................163
Threshold parameters ...............................................................................164
Saturation parameters ..............................................................................165
Miscellaneous parameters ........................................................................167
Checksum validation parameters ............................................................168
Advanced sensor parameters ...................................................................169
Interval and flow parameters ..................................................................170
Miscellaneous parameters ........................................................................172
Table element parameters ........................................................................173
Segment parameters .................................................................................175
Configuring port mapping ...............................................................................177
Configuring signature detection .....................................................................179
About Symantec signatures .....................................................................179
About user-defined signatures ................................................................180
Managing signatures .................................................................................180
Managing signature variables .................................................................184
Section 3 Using Symantec Network Security
Chapter 8 Monitoring
About incident and event data .........................................................................189
Viewing incident and event data .............................................................190
Adjusting the view .....................................................................................191
Examining incident and event data ................................................................192
Examining incident data ...........................................................................193

9Contents
Examining event data ...............................................................................196
Managing incident and event data ..................................................................201
Selecting columns ......................................................................................202
Selecting view filters .................................................................................205
Marking and annotating ...........................................................................207
Saving, copying, and printing data .........................................................209
Emailing incident or event data ..............................................................211
Tuning incident parameters ............................................................................213
Setting Incident Idle Time ........................................................................213
Setting Maximum Incidents .....................................................................214
Setting Maximum Active Incident Life ..................................................214
Setting Incident Unique IP Limit ............................................................215
Setting Event Correlation ‘Name’ Weight .............................................215
Event Correlation ‘Source IP’ Weight .....................................................216
Event Correlation ‘Destination IP’ Weight ............................................217
Event Correlation ‘Source Port’ Weight .................................................217
Event Correlation ‘Destination Port’ Weight ........................................218
Monitoring flow statistics ................................................................................219
Enabling flow data collection ...................................................................219
Configuring FlowChaser ...........................................................................220
Chapter 9 Reporting
About reports and queries ................................................................................223
Scheduling reports ............................................................................................224
Adding or editing report schedules .........................................................224
Refreshing the list of reports ...................................................................225
Deleting report schedules .........................................................................226
Managing scheduled reports ....................................................................226
Reporting top-level and drill-down .................................................................228
About report formats ................................................................................228
About report types .....................................................................................229
About incident/event reports ..................................................................229
Printing and saving reports .....................................................................230
About top-level report types ............................................................................230
Reports of top events ................................................................................231
Reports per incident schedule .................................................................232
Reports per event schedule ......................................................................233
Reports by event characteristics .............................................................233
Reports per Network Security device .....................................................235
Drill-down-only reports ............................................................................236
Querying flows ...................................................................................................237
Viewing current flows ...............................................................................238
Viewing Flow Statistics .............................................................................239

10 Contents
Viewing exported flows ............................................................................239
Playing recorded traffic ....................................................................................240
Replaying recorded traffic flow data ......................................................241
Chapter 10 Managing log files
About the log files ..............................................................................................243
About the install log ..................................................................................243
About the operational log .........................................................................244
Managing logs ....................................................................................................244
Viewing log files .........................................................................................244
Viewing live log files .................................................................................245
Archiving log files ......................................................................................246
Copying log files .........................................................................................246
Deleting log files ........................................................................................247
Refreshing the list of log files ..................................................................247
Configuring automatic archiving ....................................................................248
Setting automatic logging levels .............................................................248
Archiving log files ......................................................................................249
Compressing log files ................................................................................252
Exporting data ....................................................................................................254
Exporting to file .........................................................................................254
Exporting to SESA .....................................................................................255
Exporting to SQL ........................................................................................257
Exporting to syslog ....................................................................................260
Transferring via SCP .................................................................................264
Chapter 11 Advanced configuration
About advanced setup .......................................................................................269
Updating Symantec Network Security ...........................................................269
About LiveUpdate ......................................................................................270
Scanning for available updates ...............................................................271
Applying updates .......................................................................................271
Setting the LiveUpdate server .................................................................272
Scheduling live updates ....................................................................................273
Adding or editing automatic updates ....................................................273
Deleting automatic update schedules .....................................................274
Reverting automatic update schedules ..................................................274
Backing up LiveUpdate configurations ..................................................274
Managing node clusters ....................................................................................275
Creating a new cluster ..............................................................................275
Managing an established cluster .............................................................278
Setting a cluster-wide parameter ............................................................281

11Contents
Backup up cluster-wide data ....................................................................282
Integrating third-party events ........................................................................282
Integrating via Smart Agents ..................................................................283
Integrating with Symantec Decoy Server ..............................................285
Establishing high availability failover ...........................................................287
Monitoring node availability ...................................................................287
Configuring availability for single nodes ...............................................288
Configuring availability for multiple nodes ..........................................289
Configuring watchdog processes .............................................................293
Backing up and restoring ..................................................................................297
Backing up and restoring on the Network Security console ...............298
Backing up and restoring on compact flash ..........................................302
Configuring advanced parameters ..................................................................308
About parameters for clusters, nodes, and sensors .............................309
About basic setup and advanced tuning .................................................309
Configuring node parameters ..................................................................310
Configuring basic parameters ..................................................................310
Configuring Network Security console parameters .............................311
Configuring advanced parameters ..........................................................311
Section 4 Appendices
Appendix A User groups reference
About user groups .............................................................................................319
About group permissions .........................................................................319
Permissions by group ................................................................................320
Permissions by task ...................................................................................321
Appendix B SQL reference
About SQL export parameters .........................................................................325
Setting up SQL export ...............................................................................325
Using Oracle tables ............................................................................................326
Oracle incident table .................................................................................326
Oracle event table ......................................................................................328
Using MySQL tables ..........................................................................................332
MySQL incident table ................................................................................332
MySQL event table .....................................................................................334
Glossary
Acronyms

12 Contents
Index

Part I
Overview
Symantec Network Security is a new generation of security software that
provides an unprecedented ability to detect, analyze, and respond to network
intrusions and prevent damage from attacks. Symantec Network Security
contains multiple tools and techniques that work together to gather attack
information, analyze the attacks, and then initiate an appropriate response.
The Symantec Network Security 7100 Series is a family of highly scalable
integrated hardware and software intrusion detection appliances, designed to
detect and prevent attacks across multiple network segments at multi-gigabit
speeds. The 7100 Series combines Symantec Network Security’s powerful
detection capabilities with robust hardware features and the convenience of an
appliance.
This section introduces you to the Symantec Network Security intrusion
detection system, describes the architecture of the core Symantec Network
Security software and the Symantec Network Security 7100 Series appliance,
and outlines how to get started with basic deployment schemes as follows:
■Copyright Notice
■Introduction
■Architecture
■Getting started

14

Chapter 1
Introduction
This chapter includes the following topics:
■About the Symantec Network Security foundation
■Finding information
About the Symantec Network Security foundation
The Symantec™ Network Security software and the Symantec Network Security
7100 Series appliance employ a common core architecture that provides
detection, analysis, storage, and response functionality. Most procedures in this
section apply to both the 7100 Series appliance and the Symantec Network
Security 4.0 software. The 7100 Series appliance also provides additional
functionality that is unique to an appliance. This additional functionality is
described in detail in each section.
This section includes the following topics:
■About the Symantec Network Security 7100 Series
■About other Symantec Network Security features
About the Symantec Network Security 7100 Series
Symantec™ Network Security 7100 Series security appliances provide real-time
network intrusion prevention and detection to protect critical enterprise assets
from the threat of known, unknown (zero-day) and DoS attacks. The 7100 Series
appliances employ the new and innovative Network Threat Mitigation
Architecture that combines anomaly, signature, statistical and vulnerability
detection techniques into an Intrusion Mitigation Unified Network Engine
(IMUNE), that proactively prevents and provides immunity against malicious
attacks including denial of service attempts, intrusions and malicious code,
network infrastructure attacks, application exploits, scans and reconnaissance

16 Introduction
About the Symantec Network Security foundation
activities, backdoors, buffer overflow attempts and blended threats like MS
Blaster and SQL Slammer.
In addition to the features it shares with the Symantec Network Security 4.0
software, the Symantec Network Security 7100 Series appliance offers:
■In-line Operation: The 7100 Series appliance can be deployed in-line as a
transparent bridge to perform real-time monitoring and blocking of
network-based attacks. This ability to prevent attacks before they reach
their targets takes network security to the next level over passive event
identification and alerting. The 7100 Series appliance's One-Click Blocking
feature enables users to automatically enable blocking on all in-line
interfaces with the click of a single button, saving critical time in the event
of worm attacks.
■Policy-based Attack Prevention: Deployed in-line, the 7100 Series appliance
is able to perform session-based blocking against malicious traffic,
preventing attacks from reaching their targets. Predefined and customizable
protection policies enable users to tailor their protection based on their
security policies and business need. Policies can be tuned based on threat
category, severity, intent, reliability and profile of protected resources, and
common or individualized policies can be applied per sensor for both in-line
and passive monitoring.
■Interface Grouping: 7100 Series appliance users can configure up to four
monitoring interfaces as an interface group to perform detection of attacks
for large networks that have asymmetric routed traffic. A single sensor
handles all network traffic seen by the interface group, keeping track of
state even when traffic enters the network on one interface and departs on
another. This feature greatly increases the attack detection capacity of the
7100 Series and allows it to operate more effectively in enterprise network
environments.
■Dedicated Response Ports: The Symantec Network Security 7100 Series
provides special network interfaces for sending anonymous TCP resets to
attackers. With this configuration, network monitoring continues
uninterrupted even when sending resets.
■Reduced Total Cost of Solution: A single 7100 Series appliance can monitor
up to eight network segments or VLANs. The Symantec Network Security
7100 Series reduces the cost of a network security solution by enhancing the
security and reliability of the hardware, simplifying deployment and
management, and providing a single point of service and support.
■Flexible Licensing Options: Each model of the Symantec Network Security
7100 Series offers licensing at multiple bandwidth levels. Whether you

17Introduction
About the Symantec Network Security foundation
deploy the appliance at a slow WAN connection or on your gigabit backbone,
you can select the license that fits your needs.
■Fail-open: When using in-line mode, the Symantec Network Security 7100
Series appliance is placed directly into the network path. The optional
Symantec Network Security In-line Bypass unit provides fail-open capability
to prevent an unexpected hardware failure from causing a loss of network
connectivity. The Symantec In-line Bypass Unit provides a customized
solution that will keep your network connected even if the appliance has a
sudden hardware failure.
See also “About other Symantec Network Security features” on page 17.
About other Symantec Network Security features
Symantec Network Security is highly scalable, and meets a range of needs for
aggregate network bandwidth. Symantec Network Security reduces the total
cost of implementing a complete network security solution through simplified
and rapid deployment, centralized management, and cohesive and streamlined
security content, service, and support.
Symantec Network Security is centrally managed via the Symantec™ Network
Security Management Console, a powerful and scalable security management
system that supports large, distributed enterprise deployments and provides
comprehensive configuration and policy management, real-time threat analysis,
enterprise reporting, and flexible visualization.
The Network Security Management System automates the process of delivering
security and product updates to Symantec Network Security using Symantec™
LiveUpdate to provide real-time detection of the latest threats. In addition, the
Network Security Management System can be used to expand the intrusion
protection umbrella using the Symantec Network Security Smart Agents to
provide enterprise-wide, multi-source intrusion management by aggregating,
correlating, and responding to events from multiple Symantec and third-party
host and network security products.
Symantec Network Security provides the following abilities:
■Multi-Gigabit Detection for High-speed Environments: Symantec Network
Security sets new standards with multi-gigabit, high-speed traffic
monitoring allowing implementation at virtually any level within an
organization, even on gigabit backbones. On a certified platform, Symantec
Network Security can maintain 100% of its detection capability at 2Gbps
across 6 gigabit network interfaces with no packet loss.
■Hybrid Detection Architecture: Symantec Network Security uses an array of
detection methodologies for effective attack detection and accurate attack
identification. It collects evidence of malicious activity with a combination

18 Introduction
About the Symantec Network Security foundation
of protocol anomaly detection, stateful signatures, event refinement, traffic
rate monitoring, IDS evasion handling, flow policy violation, IP
fragmentation reassembly, and user-defined signatures.
■Zero-Day Attack Detection: Symantec Network Security's protocol anomaly
detection helps detect previously unknown and new attacks as they occur.
This capability, dubbed “zero-day” detection, closes the window of
vulnerability inherent in signature-based systems that leave networks
exposed until signatures are published.
■Symantec SecurityUpdates with LiveUpdate: Symantec Network Security
now includes LiveUpdate, allowing users to automated the download and
deployment of regular and rapid response SecurityUpdates from Symantec
Security Response, the world's leading Internet security research and
support organization. Symantec Security Response provides top-tier
security protection and the latest security context information, including
exploit and vulnerability information, event descriptions, and event
refinement rules to protect against ever-increasing threats.
■Real-Time Event Correlation and Analysis: Symantec Network Security's
correlation and analysis engine filters out redundant data and analyzes only
the relevant information, providing threat awareness without data overload.
Symantec Network Security gathers intelligence across the enterprise using
cross-node analysis to quickly spot trends and identify related events and
incidents as they happen. In addition, new user-configurable correlation
rules enable users to tune correlation performance to meet the needs of
their own organization and environment.
■Full packet capture, session playback and flow querying capabilities:
Symantec Network Security can be configured on a per-interface basis to
capture the entire packet when an attack is detected so that you can quickly
determine if the offending packet is a benign event that can be filtered or
flagged for further investigation. Automated response actions can initiate
traffic recording and flow exports, and you can query existing or saved flows
as well as playback saved sessions to further assist in drill-down analysis of
a security event.
■Proactive Response Rules: Contains and controls the attack in real-time and
initiates other actions required for incident response. Customized policies
provide immediate response to intrusions or denial-of-service attacks based
on the type and the location of the event within the network. Symantec
Network Security implements session termination, traffic recording and
playback, flow export and query, TrackBack, and custom responses to be
combined with email and SNMP notifications to protect an enterprise's most
critical assets.

19Introduction
About the Symantec Network Security foundation
■Policy-Based Detection: Predefined policies speed deployment by allowing
users quickly configure immediate response to intrusions or
denial-of-service attacks based on the type and the location of the event
within the network. Independently configurable detection settings make it
easy for users to create granular responses. Using the robust policy editor,
users can quickly create monitoring policies that are customized to the
needs of their particular environment. Policies can applied at the cluster,
node, or interface level for complete, scalable control.
■Role-based Administration: Symantec Network Security provides the ability
to define administrative users and assign them roles to grant them varying
levels of access rights. Administrative users can be assigned roles all the
way from full SuperUser privileges down to RestrictedUser access that only
allows monitoring events without packet inspection capabilities. All
administrative changes made from the Network Security console are logged
for auditing purposes.
■TrackBack and FlowChaser: Symantec Network Security incorporates
sophisticated FlowChaser technology that uses flow information from both
Network Security software nodes and 7100 Series appliance nodes, and from
other network devices to trace attacks to the source.
■Cost-effective Scalable Deployment: A single Network Security software node
or 7100 Series appliance node can monitor multiple segments or VLANs.
Each node can be configured to monitor up to 12 Fast Ethernet ports or 6 to
8 Gigabit Ethernet ports. As the network infrastructure grows, network
interface cards can be added to the same node to support additional
monitoring requirements.
■High Availability Deployment: Network Security software nodes and 7100
Series appliance nodes can be deployed in a High Availability (H/A)
configuration to ensure continuous attack detection without any loss of
traffic or flow data in your mission-critical environment.
■Centralized Cluster Management: A Symantec Network Security deployment
can consist of multiple clusters, each cluster consisting of up to 120 nodes,
and an entire Network Security cluster can be securely and remotely
managed from a centralized management console. The Network Security
console provides complete cluster topology and policy management, node
and sensor management, incident and event monitoring, and drill-down
incident analysis and reporting.
■Enterprise Reporting Capabilities: Symantec Network Security provides
cluster-wide, on-demand, drill-down, console-based reports that can be
generated in text, HTML, and PDF formats and can also be emailed, saved,
or printed. In addition, Symantec Network Security provides cluster-wide

20 Introduction
Finding information
scheduled reports generated on the software and appliance nodes that can
be emailed or archived to a remote computer using secure copy.
■Symantec Network Security Smart Agents Technology: Symantec Network
Security Smart Agents enable enterprise-wide, multi-source intrusion event
collection, helping companies to expand the security umbrella and enhance
the threat detection value of their existing security assets. Third-party
intrusion events are aggregated into a centralized location, leveraging the
power of the Symantec Network Security correlation and analysis
framework, along with the ability to automate responses to intrusions
across the enterprise.
See also “About the Symantec Network Security 7100 Series” on page 15.
Finding information
You can find information about Symantec Network Security software and
Symantec Network Security 7100 Series appliances in the documentation sets,
on the product CDs, and on the Symantec Web sites.
This section includes the following topics:
■About 7100 Series appliance documentation
■About Network Security software documentation
■About the Web sites
■About this guide
About 7100 Series appliance documentation
The documentation set for the Symantec Network Security 7100 Series includes:
■Symantec Network Security 7100 Series Implementation Guide (printed and
PDF). This guide explains how to install, configure, and perform key tasks on
the Symantec Network Security 7100 Series.
■Symantec Network Security Administration Guide (printed and PDF). This
guide provides the main reference material, including detailed descriptions
of the Symantec Network Security features, infrastructure, and how to
configure and manage effectively.
■Depending on your appliance model, one of the following:
■Symantec Network Security 7100 Series: Model 7120 Getting Started
Card
■Symantec Network Security 7100 Series: Models 7160 and 7161 Getting
Started Card