tufin T-1100 User manual

T-1100/1100XL Quick Start Guide
Version 11.5

Table of Contents
Table of Contents 2
Chapter 1: Introduction 3
Welcome 3
Overview 3
Chapter 2: The T-1100 Front and Rear Panels 4
Front Panel 4
Front Panel LEDs and Buttons 4
Rear Panel 6
Chapter 3: Setting Up The T-1100 7
Power up and Connect to the Network 7
Advanced CLI Configuration 7
Chapter 4: Installing and Configuring Tufin Orchestration Suite Classic 8
Install Tufin Orchestration Suite Classic 8
Configure SecureTrack 8
Configure SecureChange 11
Chapter 5: Installing and Configuring Tufin Orchestration Suite Aurora 13
Network Requirements for Tufin Orchestration Suite Aurora 13
Install Tufin Orchestration Suite Aurora 13
Configure SecureTrack 15
Configure SecureChange 16
Chapter 6: Setting up the Remote Management Module 18
Prerequisites for Remote Computer 18
Ports 18
Configure RMM Using BIOS 18
Configure RMM Using SSH or a Console 21
Installing TufinOS 22
Chapter 7: Restoring Factory Defaults 23
The Next Step 24
Support 24
Tufin at a Glance 24
Trademarks 24
T-1100/1100XL Quick Start Guide
Table of Contents
Copyright 2003-2021, Tufin Software Technologies Ltd. 2

Chapter 1: Introduction
Welcome
Congratulations on choosing the T-1100 Appliance from Tufin Technologies, the industry’s most comprehensive firewall operations management
solution.Our worldwide technical services team is available to you through the web, email, or telephone. See http://www.tufin.com/support for your
preferred mode of communication. We look forward to supporting all of your current and future firewall operation’s needs.
Overview
Information in this guide applies to both the T-1100 and the T-1100XL. (All references to T-1100 include T-1100XL as well.)
The Tufin T-1100 appliance is designed to simplify integration and use of Tufin Orchestration Suite (TOS) by providing a unified hardware and
software solution. The T-1100 is preinstalled with TufinOS, a proprietary hardened Linux operating system, and the Tufin Orchestration Suite,
which includes these software solutions: SecureTrack™, SecureChange™ and SecureApp™. By default, all TOS products are enabled. You can
modify these settings according to your needs.
The T-Series Appliances come pre-installed with TufinOS and are designed to support both Tufin Orchestration Suite Classic (default) and Aurora.
You will need to choose the desired Tufin Orchestration Suite product and install it using the instructions provided in this document.
When setting up the appliance, we recommend that you also configure the Remote Management Module (RMM). With this module you can install
newer versions of TufinOS on the appliance without having to physically access the server.
All Tufin Appliances are rigorously lab-tested by our network security experts.
This document provides:
lShipping container contents, and descriptions of the appliance panels
lA step by step guide to getting the appliance and software up and running
lInstructions for restoring factory defaults
To set up device monitoring by SecureTrack, to configure SecureChange, or for more information about the Tufin Orchestration Suite, see the
Tufin Knowledge Center at https://forum.tufin.com/support/kc/latest (for Classic) or https://forum.tufin.com/support/kc/aurora (for Aurora).
Shipping Container Contents
Item Description
Appliance T-1100 appliance
Cables 2 power cables
1 RJ-45 (CAT 5e) network cable
1 DB9 console cable
USB flash drive USB flash drive for appliance recovery
Documentation This Quick Start Guide
Other hardware Rack mounting kit
Appliance front bezel
T-1100/1100XL Quick Start Guide
Chapter 1: Introduction
Copyright 2003-2021, Tufin Software Technologies Ltd. 3

Chapter 2: The T-1100 Front and Rear Panels
These sections describe the different elements in the front and rear panels.
Front Panel
Item Description
A VGA port
B 2 USB 3.0 ports
C Front panel LEDs and buttons
D Hard drive bay 0
E Hard drive bay 1
F Hard drive bay 2
G Hard drive bay 3
H Hard drive bay 4
I Hard drive bay 5
J Hard drive bay 6
K Hard drive bay 7
Front Panel LEDs and Buttons
All control buttons and status LEDs are located on the front of the appliance.
Item Feature Description
A System ID button
with integrated LED
(green)
When pressed, it toggles the ID LEDs on the front and back of the appliance.
B Halt button When pressed, it puts the server in a halt state so that the memory can be downloaded for diagnostics.
C Onboard LAN LED
(green)
Indicates NIC activity for each of the two onboard network interfaces.
D System cold-reset
button
When pressed, it reboots the appliance.
E HDD activity/ fault
LED (green/red)
Indicates HDD activity when green, or an HDD fault when red. This is an aggregated indication for all hard
disk drives in the system. Each hard disk contains its own activity and fault indicators.
F System status
(green/red)
Indicates system status as follows:
lSteady green indicates system in standby or ready for operation.
T-1100/1100XL Quick Start Guide
Chapter 2: The T-1100 Front and Rear Panels
Copyright 2003-2021, Tufin Software Technologies Ltd. 4

Item Feature Description
lBlinking green indicates degraded operation (e.g., power supply nonredundancy, part of system
memory mapped out by BIOS).
lBlinking red indicates one or more non-critical fault conditions.
lSteady red indicates one or more critical fault conditions.
G Power button with
integrated LED
(green)
When pressed, it toggles the system power. When continuously lit, indicates the presence of power supply
output power in the appliance. The LED turns off when the power supply is turned off or the power source
is disrupted.
T-1100/1100XL Quick Start Guide
Chapter 2: The T-1100 Front and Rear Panels
Copyright 2003-2021, Tufin Software Technologies Ltd. 5

Rear Panel
Item Description Notes
A Power supply 1
B Power supply 2
C Onboard LAN (eth0)
D Onboard LAN (eth1)
E Video connector
F RJ45 serial port
G 3 USB 3.0 ports
H RJ45 Remote Management Module
(RMM)
For more about this interface, see Chapter 6: Setting up the Remote Management
Module.
I External NIC (eth3)
J External NIC (eth2)
T-1100/1100XL Quick Start Guide
Chapter 2: The T-1100 Front and Rear Panels
Copyright 2003-2021, Tufin Software Technologies Ltd. 6

Chapter 3: Setting Up The T-1100
Power up and Connect to the Network
Note: The appliances have a predefined IP address. Before racking the appliances, make sure to change the IP address either
in the first-time wizard (as described Chapter 4: Configure SecureTrack), or using a console connection (see Advanced CLI
Configuration) in CLI. For CLI instructions, see https://forum.tufin.com/support/kc/latest/Content/Suite/1584.htm.
To power up the appliance and connect it to the network:
1. Connect the power cable.
2. Boot up the appliance by pressing the Power button on the front panel.
3. Connect a network cable to the eth0 port (Chapter 2: Rear Panel, item C) and to a PC (with a crossover cable), or to a local network that is
in the same subnet as the eth0 port. If you have not changed it, the default is 192.168.1.100/24.
Advanced CLI Configuration
You can achieve CLI access using a console connection or SSH access. To use a console connection, configure the terminal to match the
following appliance console port settings:
l57600 bits per second
l8 Data bits
lParity: None
lStop bit: 1
lFlow Control: None
T-1100/1100XL Quick Start Guide
Chapter 3: Setting Up The T-1100
Copyright 2003-2021, Tufin Software Technologies Ltd. 7

Chapter 4: Installing and Configuring Tufin Orchestration
Suite Classic
This section includes instructions to install and configure Tufin Orchestration Suite Classic R21-1 and above running on TufinOS 3.60.
Install Tufin Orchestration Suite Classic
1. Install Tufin Orchestration Suite Classic (SecureTrack and SecureChange/SecureApp):
a. Open a command line via SSH to the IP address of eth0 (if you have not changed it: 192.168.1.100).
b. Log in as tufin-admin with password admin.
You are prompted to change the default password when you first log in.
c. To install Tufin Orchestration Suite Classic, run the following commands:
screen -S install
sudo su –
cd /opt/tufin/data/classic
sh <filename>
The installation file is in /opt/tufin/data/classic.
d. Follow the installation instructions in the command line.
If you disabled SecureTrack and will not be using it on this appliance, skip to Configure SecureChange.
2. (SecureTrack only) Log into SecureTrack:
a. To access SecureTrack with Mozilla Firefox or Google Chrome, browse with HTTPS to the IP address of eth0. If you have not
changed the IP address, browse to: https://192.168.1.100.
b. Accept the certificate.
The login window appears.
c. Log in with these credentials (admin/admin) and click Login.
Configure SecureTrack
After logging into SecureTrack for the first time, the SecureTrack Setup Wizard opens. The wizard includes the following pages:
T-1100/1100XL Quick Start Guide
Chapter 4: Installing and Configuring Tufin Orchestration Suite Classic
Copyright 2003-2021, Tufin Software Technologies Ltd. 8

lLogin: For security reasons, change the admin password.
lEULA: Read and accept the End User License Agreement.
lPassword: Type system for the Old Password of the TufinOS root user, and change the password.
T-1100/1100XL Quick Start Guide
Chapter 4: Installing and Configuring Tufin Orchestration Suite Classic
Copyright 2003-2021, Tufin Software Technologies Ltd. 9

lNetworking (optional): Configure networking (DNS settings can also be configured later from SecureTrack's web interface)
lTime: Configure date and time settings.
lUser Details: Configure the admin user’s details. Username and password cannot be changed in this page.
T-1100/1100XL Quick Start Guide
Chapter 4: Installing and Configuring Tufin Orchestration Suite Classic
Copyright 2003-2021, Tufin Software Technologies Ltd. 10

lNotifications: Configure the SMTP settings for SecureTrack email notifications.
lLicense: Installing a license is optional at this stage. To receive a license, please contact your Tufin reseller.
lFinish: Click Save to complete the installation wizard:
Configure SecureChange
1. Configure SecureChange for the first time:
If SecureTrack is disabled, and you have not gone through the SecureTrack Setup Wizard, use standard Linux commands in TufinOS to
do the following:
lConfigure interface settings according to your networking needs (eth0 may still have the preconfigured IP address of
192.168.1.100). For instructions, see https://forum.tufin.com/support/kc/latest/Content/Suite/1584.htm.
lChange the root password. For instructions, see https://forum.tufin.com/support/kc/latest/Content/Suite/1585.htm.
lSet the time, time zone, and date. For instructions, see https://forum.tufin.com/support/kc/latest/Content/Suite/1024.htm.
l(Optional) Configure NTP. For instructions, see https://forum.tufin.com/support/kc/latest/Content/Suite/chrony.htm.
2. Log into SecureChange:
T-1100/1100XL Quick Start Guide
Chapter 4: Installing and Configuring Tufin Orchestration Suite Classic
Copyright 2003-2021, Tufin Software Technologies Ltd. 11

a. To access the SecureChange Administration Console, browse to https://<host>/securechangeworkflow
where <host> is the IP address or resolvable name of the T-series appliance.
b. Log in as tufin-admin, with password admin.
To further configure SecureChange, see the https://forum.tufin.com/support/kc/latest/Content/Suite/2353.htm.
To add devices to be monitored, see the https://forum.tufin.com/support/kc/latest/Content/Suite/4034.htm.
To add SecureTrack on this appliance to a distributed deployment, see https://forum.tufin.com/support/kc/latest/Content/Suite/2456.htm.
T-1100/1100XL Quick Start Guide
Chapter 4: Installing and Configuring Tufin Orchestration Suite Classic
Copyright 2003-2021, Tufin Software Technologies Ltd. 12

Chapter 5: Installing and Configuring Tufin Orchestration
Suite Aurora
This section includes instructions to install and configure Tufin Orchestration Suite Aurora R21-1 and above running on TufinOS 3.60.
Note: After you install Tufin Orchestration Aurora on the appliance, you will be unable to revert it to Tufin Orchestration Suite
Classic.
Network Requirements for Tufin Orchestration Suite Aurora
If you are installing Tufin Orchestration Suite Aurora on the appliance, you need to do the following:
lAllow access to the requiredports and services. For more information, see
https://forum.tufin.com/support/kc/aurora/Content/ST2/ManagingTOS/PortsAndServices.htm.
lDedicate a 24-bit CIDR subnet on your network to Tufin Orchestration Suite Aurorafor internal use. It must not overlap with
CIDR10.244.0.0/16or with the physical and VIP (Virtual IP) network addresses of yourSecureTrack Auroraservers.
lDedicate two different IP addresses to Tufin Orchestration Suite Aurora:
lThe virtual IP(VIP) that will serve as the external IPaddress used to accessTufin Orchestration Suite Aurorafrom your browser
and from devices that send it data. The VIP will not be needed in the installation, except in the last step - the installation
command.
lThe physical network IP that will serve as the internal IPaddress used by the administrator for CLI commands and this is the one
you will use in all other steps of the installation.
lIf additional nodes are subsequently added to the cluster, each node will require an additional dedicated physical network IP. The
VIP and all the physical network IPs must be on the same subnet.
Install Tufin Orchestration Suite Aurora
1. Reconfigure TufinOS
a. Open a command line via SSH to the IP address of eth0 (if you have not changed it: 192.168.1.100).
b. Log in as tufin-admin with password admin
You are prompted to change the default password when you first log in.
c. Run the following commands:
screen -S switch
switch-tos-mainstream
d. When prompted to reconfigure TufinOS, select yes. This process can run about five minutes.
e. Reboot the appliance.
f. Reconnect to the appliance (steps 2-3).
g. To install Tufin Orchestration Suite Aurora, run the following commands:
screen -S install
cd /opt/tufin/data/aurora
sudo sh <filename>
The installation file is in /opt/tufin/data/aurora.
2. Configure the appliance for Tufin Orchestration Suite Aurora
a. To access the appliance with Mozilla Firefox or Google Chrome, browse with https to the IP address of eth0. If you have not
changed the IP address, browse to https://192.168.1.100.
b. Accept the certificate.
T-1100/1100XL Quick Start Guide
Chapter 5: Installing and Configuring Tufin Orchestration Suite Aurora
Copyright 2003-2021, Tufin Software Technologies Ltd. 13

c. The login window appears. Log in as admin with password admin, and click Login.
You are prompted to set a new password.
d. Configure the IP address and DNS, where <Interface Name> is the name of the interface you are using. For example: ens33.
e. Do one of the following:
l(Recommended) Run the commandsudo nmtui edit <Interface Name>.
In the window, set the parameters as follows:
lSet IPv4 CONFIGURATION to Manual.
lSet Addresses to the internal machine IP together with the chosen subnet.
lSet Gateway and DNS Servers to the IPs used by your organization.
l(or) Edit the configuration files directly:
1. Edit the file /etc/sysconfig/network-scripts/ifcfg-eno1.
2. Change line BOOTPROTO=dhcp to BOOTPROTO=static.
3. Add entries at the end of the file:
IPADDR=<NEWIP>
NETMASK=<MyNetmask>
GATEWAY=<MyGateway>
DNS1=<DNS_IP1>
DNS2=<DNS_IP2>
where
<NEWIP> is the internal machine IP.
<MyNetmask> ,<MyGateway>,<DNS_IP1>,<DNS_IP2> are the appropriate values for your network.
f. Restart the network service.
service network restart
3. Installing Tufin Orchestration Suite Aurora
T-1100/1100XL Quick Start Guide
Chapter 5: Installing and Configuring Tufin Orchestration Suite Aurora
Copyright 2003-2021, Tufin Software Technologies Ltd. 14

a. Run the screen command:
screen -S install
b. Run the install command, replacing the parameters:
l<VIP>with the external IP that you will use to accessTOS Aurora
l<SERVICE-CIDR>with the CIDR that you wantTOS Aurorato use
l<MODULE-TYPE>with one of the following values:
lSTforSecureTrackonly
lST,SCfor bothSecureTrackandSecureChange
lRCfor a remote collector
sudo tos install --modules=<MODULE-TYPE> --loadbalancer-ip=<VIP> --services-
network=<SERVICE-CIDR>
Example:
sudo tos install --modules=ST,SC --loadbalancer-ip=192.168.1.2--services-
network=10.10.10.0/24
The End User License Agreement (EULA) appears.
c. After reading, enter qto exit the document and then enter yto accept the EULA and continue until the commands completes.
d. Type Exit to leave the CLI.
e. Log in as admin with password admin, and click Login.
You are prompted to set a new password.
Configure SecureTrack
1. Activate your SecureTrack license: Relevant only for central clusters. Skip for remote collectors.
For complete instructions, see https://forum.tufin.com/support/kc/aurora/Content/Suite/2258.htm#activate.
T-1100/1100XL Quick Start Guide
Chapter 5: Installing and Configuring Tufin Orchestration Suite Aurora
Copyright 2003-2021, Tufin Software Technologies Ltd. 15

2. Set the Time Zone: TheTOS Auroraapplication has its own timezone, independent of your host node and the default is UTC. If UTC is
not the timezone you want to use,see https://forum.tufin.com/support/kc/aurora/Content/ST2/ManagingTOS/SetTimeZone.htm.
3. Set up your IP Addresses: To set up your Syslog VIP address, see
https://forum.tufin.com/support/kc/aurora/Content/ST2/ManagingTOS/VIP-syslog.htm.
Primary and VIP addresses can be changed if needed. For more information, see
https://forum.tufin.com/support/kc/aurora/Content/ST2/ManagingTOS/ChangingIPAddress.htm.
4. Add Nodes to your cluster: TOS Aurora is deployed by default as a single node Kubernetes cluster. See
https://forum.tufin.com/support/kc/aurora/Content/ST2/ManagingTOS/MultiNodeProcessing.htm for more information about adding
additional nodes.
Configure SecureChange
1. Create a SecureTrack Administrator User:
a. Go to at https://<IP> where IP is the cluster VIP.
b. Log in to SecureTrack as tufin-admin with password admin.
c. Create a new SecureTrack Administrator user.
Note: If you are going to configure SecureChange for multi-domain management, make the user either a
super administrator or multi-domain administrator, depending on whether you want to restrict the
administrator to selected domains.
For more information, see https://forum.tufin.com/support/kc/aurora/Content/Suite/1073.htm.
2. Log in to SecureChange:
a. Go to https://<IP>/securechangeworkflow where<IP>is thecluster VIP.
b. Log in to SecureChange as tufin-admin with password admin.
You are prompted to change the password.SecureChangeusers are separate fromSecureTrackusers; there is no connection
between aSecureTrackuser anda SecureChangeuser with the same name.
On the prompt window, you can also enter an email address for administrative email notifications. We recommend using the
address of an email list so you can edit the list of recipients easily.
3. Configure the SecureChange Settings
a. Go to Settings>Miscellaneous.
b. Enter a value for Server DNS name. The DNS server is used for links in email notifications. This can be an IP address in the
format 11.22.33.44 or a FQDN in the format https://mydomain.com.
The SecureChange DNS name is published bySecureChangeso it can be accessed from external sources. For example, it is
embedded in notification mails sent bySecureChange, which include a link to a ticket, such as an email notifying a handler
assigned with a task, or informing a requester that the ticket has been successfully resolved.
T-1100/1100XL Quick Start Guide
Chapter 5: Installing and Configuring Tufin Orchestration Suite Aurora
Copyright 2003-2021, Tufin Software Technologies Ltd. 16

c. Go to Settings>SecureTrack.
d. Enter the SecureTrack administrator username, which was created previously.
e. If you want a link to SecureTrack to be available in the SecureChange applications icon, select Show link to SecureTrack.
f. If you want to change how often SecureChange tests its connectivity to SecureTrack, change the value of the Connection check
interval.
g. Click Test connection to verify that SecureChange has a connection to SecureTrack.
h. Click Save.
4. Additional SecureChange Configurations
These tasks can be done now or at a later stage.
lConnect to a mail server. For instructions, see https://forum.tufin.com/support/kc/aurora/Content/Suite/1794.htm.
l(optional) Connect to an LDAP directory to use LDAP user accounts. For instructions, see
https://forum.tufin.com/support/kc/aurora/Content/Suite/2386.htm.
lCreate local users and user roles. For instructions, see https://forum.tufin.com/support/kc/aurora/Content/Suite/2287.htm.
If you need to reset the password of the initial Administrator (username: admin), see
https://forum.tufin.com/support/kc/aurora/Content/Suite/1922.htm.
T-1100/1100XL Quick Start Guide
Chapter 5: Installing and Configuring Tufin Orchestration Suite Aurora
Copyright 2003-2021, Tufin Software Technologies Ltd. 17

Chapter 6: Setting up the Remote Management Module
The remote management module (RMM) or IPMI port in Tufin appliances lets you connect to an administration web interface for the appliance. You
can configureRMMvia BIOS or via SSH or a Console. With this module you will be install newer versions of TufinOS on the appliance without
having to access the server physically.
Prerequisites for Remote Computer
lTo avoid latency issues, we recommend that the remote computer be on the same local network as the appliance.
lWeb browser.We recommend Internet Explorer with anti-virus enforcement and browser protection disabled.
lJava version 8 or later.
Ports
The following ports must be open between the appliance and the TufinOS remote installation computer:
Use Port
HTTP 80 (TCP)
HTTPS 443 (TCP)
KVM 7578, 7582 (UDP/TCP)
Virtual Media 5120, 5123, 5124, 5127 (UDP/TCP)
Configure RMM Using BIOS
1. Reboot/power on the appliance.
2. In the next screen, press the F2 key to enter the BIOS setup.
T-1100/1100XL Quick Start Guide
Chapter 6: Setting up the Remote Management Module
Copyright 2003-2021, Tufin Software Technologies Ltd. 18

3. In the next screen, go to Setup Menu.
4. Select Server Management and enter the BMC LAN Configuration.
T-1100/1100XL Quick Start Guide
Chapter 6: Setting up the Remote Management Module
Copyright 2003-2021, Tufin Software Technologies Ltd. 19

5. Edit the settings as required.
6. Save settings and reboot the appliance.
T-1100/1100XL Quick Start Guide
Chapter 6: Setting up the Remote Management Module
Copyright 2003-2021, Tufin Software Technologies Ltd. 20