CommandCenter NOC ® Administrator Guide Release 5.4 Copyright © 2006 Raritan Computer, Inc.
This page intentionally left blank.
Copyright and Trademark Information This document contains proprietary information that is protected by copyright. All rights reserved. No part of this document may be photocopied, reproduced, or translated into another language without express prior written consent of Raritan Computer, Inc. © Copyright 2006 Raritan, CommandCenter, RaritanConsole, Dominion, and the Raritan company logo are trademarks or registered trademarks of Raritan Computer, Inc. All rights reserved.
Safety Guidelines To avoid potentially fatal shock hazard and possible damage to Raritan equipment: • Do not use a 2-wire power cord in any product configuration. • Test AC outlets at your computer and monitor for proper polarity and grounding. • Use only with grounded outlets at both the computer and monitor. When using a backup UPS, power the computer, monitor and appliance off the supply. Default Login User ID/Password The default username for CC-NOC is admin and the password is raritan.
FIGURES v Contents Chapter 1: Introduction .................................................................. 1 Stand-alone Appliances....................................................................................................................1 Distributed 2500 Series Appliances..................................................................................................1 CommandCenter Secure Gateway (CC-SG) ...................................................................................
vi FIGURES Chapter 3: Configuring Intrusion Detection ................................. 45 Configure a Spanned or Mirrored Port ...........................................................................................45 Ethernet TAP ..................................................................................................................................45 Benefits......................................................................................................................................
FIGURES vii Map Users ............................................................................................................................................101 Appendix A: Specifications ........................................................ 103 V1 Platform ...................................................................................................................................103 General Specifications .....................................................................................
viii FIGURES Configuring a Windows 98/ME box for Remote WMI Management.............................................129 Configuring a Windows Proxy Details ..........................................................................................130 Registry Changes [configuration]: .........................................................................................................131 Appendix E: Managing and Responding to Intrusion Detection Events ...................................................
FIGURES ix Figures Figure 1 Appliance Shutdown/Restart.......................................................................................................... 9 Figure 2 Configure Date and Time............................................................................................................. 10 Figure 3 Configure Network Connection .................................................................................................... 11 Figure 4 Configure Network Connection ......................
x FIGURES Figure 52 Add a New Network Route......................................................................................................... 41 Figure 53 Prune Unused Performance Data .............................................................................................. 41 Figure 54 Delete Management Settings and Data ..................................................................................... 42 Figure 55 Delete Traffic Analysis Performance Data ..................................
FIGURES Figure 105 Modify Notification Paths ......................................................................................................... 83 Figure 106 Define Escalation in Notification Path ...................................................................................... 84 Figure 107 Configuring a User Target for Escalation in Notification Path .................................................. 84 Figure 108 Configuring a Group Target for Escalation in Notification Path .................
xii FIGURES
CHAPTER 1: INTRODUCTION 1 Chapter 1: Introduction The primary function of a CommandCenter NOC (CC-NOC) is to manage nodes in your network. Nodes are discovered automatically if their IP address is within the managed range of addresses. In addition to network discovery, a CC-NOC also provides service management, a database of network information, a rules engine, a notification engine, and a web server.
2 COMMANDCENTER NOC ADMINISTRATOR GUIDE User PC Preparation To access CC-SG and any targets managed by CC-SG, the browser must have the correct version of Sun JRE, such as rev 1.4.2.05. See Compatibility Matrix under Firmware Upgrades for CCSG on www.raritan.com/support for details. For CC-SG, pop-up blockers should be disabled as well as any firewall software such as XP SP2 that is enabled by default.
CHAPTER 1: INTRODUCTION • • • • • • • • • • • • • 3 Vulnerability Scanning Event Viewing and Searching Performance Monitoring per category or device Integration with CC-SG where CC-SG is notified of events within the subscribed discovery range.
4 COMMANDCENTER NOC ADMINISTRATOR GUIDE • ICMP – (Internet Control Management Protocol) ICMP is used by the CC-NOC to discover devices in your network and is documented in RFC 792. In-band – going through the TCP/IP network to control a target by accessing the target directly. KVM, Serial, and Generic devices can be accessed via these in-band applications: RemoteDesktop Viewer, SSH Client, VNC Viewer.
CHAPTER 1: INTRODUCTION • • • • • • • 5 SSO – Single Sign-On. With Single Sign-on (SSO) access to CC-SG targets, CC-NOC users can connect to targets seamlessly, without having to sign onto CC-SG as long as remote authentication has been configured. System Vulnerabilities – unpatched systems, older known vulnerable server daemons on your system that can be exploited by harmful network traffic.
6 COMMANDCENTER NOC ADMINISTRATOR GUIDE Licensing Explained As devices are discovered in your network, data is collected from the device and the device is then assigned a license. License types include Infrastructure, Server, Workstation, and Promoted Workstation. Administrators can change a license from one type to another. The following explains each license type.
CHAPTER 1: INTRODUCTION 7 Workstation A Workstation license can be assigned to any type of device, be it a Windows or non-Windows system. For example, a Linux box which is discovered as a node and which does not support any of the infrastructure services will be assigned a Workstation license. Similarly, a desktop Windows system will be assigned a Workstation license.
8 COMMANDCENTER NOC ADMINISTRATOR GUIDE
CHAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 9 Chapter 2: General and Advanced Administration Power Down CC-NOC If running CC-NOC on the V1 platform and if it loses AC power while it is up and running, the V1 unit remembers its last power state. Once AC power is restored, the V1 unit automatically reboots. However, if a V1 unit loses AC power when it is turned OFF, the V1 unit will remain powered off when AC power is restored.
10 COMMANDCENTER NOC ADMINISTRATOR GUIDE Configure Date and Time This page allows you to modify the current time zone and set the local time or configure a network time protocol (NTP) server with which to synchronize the local time. Note: If a CC-NOC 250 or 2500N is powered down for more than six hours, upon booting back up, you will be asked to validate if the time settings are correct. 1. Click on the Admin tab in the top navigation bar. 2. Click Appliance Network Settings. 3.
CHAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 11 Configure Network Connection This page allows you to change the fixed IP address associated with this appliance. This IP address was configured when setting up the initial configuration using a serial connection – see Raritan’s CommandCenter NOC Deployment Guide. The CC-NOC mimics the traffic generated by a user trying to access various services throughout the network.
12 COMMANDCENTER NOC ADMINISTRATOR GUIDE 3. Click Change the ISP Gateway Address. Figure 4 Configure Network Connection 4. Type the IP address of the ISP gateway or type an address of 0.0.0.0 if you do not wish to supply an ISP address. 5. Click save changes. Outgoing Email Communication This page provides an interface to change the From: email address in notifications, as well as the SMTP relay settings. These settings affect how the CC-NOC communicates with you.
CHAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 13 email address is a required field and will be used to send status information on the CC-NOC itself. 7. Clicking test SMTP settings sends a test email to the email address specified in the Admin Email Address field using the specified SMTP server. This test verifies that the CC-NOC has the proper network connections to be able to send emails. 8. Click save changes.
14 COMMANDCENTER NOC ADMINISTRATOR GUIDE WMI management range – see Specifying Windows Management Ranges in Chapter 4: Configuring Windows Management for details. Typically, you would want the discovery range specified here to overlap with the WMI management range. Note: A CC-NOC discovers devices in the network using ICMP protocol.
CHAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 15 Important! Ensure your discovery range is not too wide, for example, entering multiple Class B address ranges. This consumes large amounts of resources and may reduce the performance of CC-NOC. Also, it is recommended to keep the default “Automatically license and manage new devices discovered via the ranges and addresses listed below” checked. This avoids devices being discovered more than once. 5.
16 COMMANDCENTER NOC ADMINISTRATOR GUIDE 3. Click Edit the SNMP Ranges. Figure 8 Edit SNMP Ranges 4. Click add new community or edit next to the already defined SNMP range. Figure 9 Defining SNMP Ranges 5. Edit the community string or add a new one. 6. Specify the SNMP version by selecting v1, v2c, or Not Specified from the SNMP version drop-down list box. 7. Add ranges or addresses to the community, one at a time.
CHAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 17 3. Click Configure Schedule Outages. Figure 10 Configuring Scheduled Outages 4. Type a name for the scheduled outage and click add new scheduled outage. Figure 11 Edit Scheduled Outages 5. Type a name for the scheduled outage. 6. Select a node label, that is, a DNS hostname or IP address, from the Included Node Label drop-down list and click add. Adding a node label is optional and can be removed once added. 7.
18 COMMANDCENTER NOC ADMINISTRATOR GUIDE 8. Specify an outage window. For outage windows that are set to Recurring Weekly, you cannot specify outages that start on one day of the week and end on a different day. In these cases where the outage spans 12:00 AM (Midnight), you should create two outages, one that ends at 11:59 PM and another that begins at 12:00 AM on the following day. Even though there appears to be a one minute gap between these outage spans, that is not the case.
CHAPTER 2: GENERAL AND ADVANCED ADMINISTRATION • • • 19 intervals (they were initially set at 5 minutes for a reason), timeouts and/or retries without proper planning or forethought runs the risk of: Having the pollers get behind Adding unreasonable amounts of network traffic in the environment Misdiagnosis of outages, in the case of low retries Note: Raritan strongly recommends that these parameters be adjusted only if change is absolutely necessary. 4.
20 COMMANDCENTER NOC ADMINISTRATOR GUIDE 3. Click Manage, Unmanage, Rescan, or Delete Devices. Figure 13 Manage, Unmanage, Rescan, or Delete Devices 4. Select the devices from the list by clicking in the check boxes. 5. You can change the license type of the selected devices to: Server, Infrastructure, Workstation, Promoted Workstation, or Unmanaged.
CHAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 21 Configure Performance Thresholds This page displays the current values at which SNMP performance metrics are considered problematic and events are generated. You have complete control over these thresholds, including their value, their re-arm values, and the number of consecutive data samples, for example, "triggers" which must be exceeded before an event is generated.
22 COMMANDCENTER NOC ADMINISTRATOR GUIDE 4. Each time you adjust the performance thresholds, click save thresholds to commit the changes. 5. You can also click reset to restore the threshold values to their pre-set condition. Configure Outage Report This page allows you to view and modify the working business hours and days for the Outage Report.
CHAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 23 SNMP Reparenting Exclusion List This page allows you to specify addresses that should be excluded from SNMP reparenting. This feature is useful if you have multi-interface SNMP devices that have identical IP addresses to other multi-interface devices. The most common example of this is if you are managing several routers that each act as gateways to separate private networks. In this case, all of the routers may have a "192.168.0.
24 COMMANDCENTER NOC ADMINISTRATOR GUIDE 3. Click add association. Figure 20 Configure a CommandCenter Secure Gateway 4. Type an IP address or hostname for the CC-SG. This is a required field. If entering a hostname, it can only contain letters, numbers, periods, or hyphens, and it must begin with either a letter or a number. 5. Clicking Active will turn on all links to the CC-SG.
CHAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 25 Create a CC-SG Peer via a Secure Channel After configuring the CC-SG with CC-NOC information, for example, specifying its IP address, and configuring CC-NOC with CC-SG information, you can create a secure channel between CCSG and CC-NOC. Configuring CC-SG with CC-NOC information is documented in the CommandCenter Secure Gateway Administrator Guide. Note: To create a valid connection, the time settings on both the CC-NOC and CC-SG should be synchronized.
26 COMMANDCENTER NOC ADMINISTRATOR GUIDE Important! To successfully connect, you must enter the passcodes in CC-NOC within five minutes after they are generated on CC-SG. This will minimize the window of opportunity for intruders to breach the system with a brute-force attack. Avoid transmitting the passcodes over email or other electronic means to avoid a possible interception by automated systems.
CHAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 27 Important! Configuring these mappings is required in order for remote authentication to work. Although you may have several CC-SG’s connected to this CC-NOC via a secure connection, only one can be the remote authentication and authorization source.
28 COMMANDCENTER NOC ADMINISTRATOR GUIDE Configure Event Forwarding This page allows you to configure the events, for example, SNMP traps you want forwarded to external systems. It also allows you to configure the external systems to forward the events to.
CHAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 29 address or a hostname that this appliance can resolve. Example: Protocol=Trap, Host= 192.168.51.150, Port=162. 8. Type protocol, host, and port for the Path Back URL which is the IP address or hostname of this CC-NOC. The Host entered is the web address that a user of the external event recipient can use to connect back to this appliance via a web browser.
30 COMMANDCENTER NOC ADMINISTRATOR GUIDE 3. Click Configure Trap Relaying. Figure 31 Configure Trap Relaying 4. Click add recipient. Figure 32 Specifying Trap Recipient 5. Specify a hostname that is resolvable from this appliance or an IP address in the Host field. This can be the same platform or appliance that was specified when configuring event recipients – see section Configure Event Recipients earlier in this chapter for additional information. 6.
CHAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 31 Edit Performance Thresholds (Per Device) In addition to configuring performance values per category–see section Configure Performance Thresholds earlier in this chapter, you can also configure performance thresholds on a per-device basis. Per-device thresholds will override those set per category. Note: Performance thresholds can be configured on a per-device basis only for devices with Infrastructure, Server, or Promoted Workstation licenses. 1.
32 COMMANDCENTER NOC ADMINISTRATOR GUIDE Administrator Tools Administrator tools help you diagnose and fix problems with the CC-NOC. These tools allow you to backup configuration files, download logs, check the disk usage of your CC-NOC, and establish connections to Technical Support. Access administrator tools either from the Tools tab or from the Admin tab. Export and Download Configuration Files This page allows you to export the current configuration of the CC-NOC appliance.
CHAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 33 3. Click Check Disk Utilization on Appliance. Figure 37 Check Disk Utilization on Appliance The Disk Usage section lists the current free space percentages for different areas of the storage within the CC-NOC appliance.
34 COMMANDCENTER NOC ADMINISTRATOR GUIDE 4. Type a description of the problem you are experiencing in the text box. 5. Type an email address in Confirmation Email: so that when the incident report email is received, you will get a confirmation message. 6. Click send incident email.
CHAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 35 Download Data Archives Every 24 hours, the previous day’s events are placed into an event archival file and made accessible. Download this archival file or unzip it to access a comma-separated value (CSV) file, which can be opened with any spreadsheet application to view the events for that day. 1. Click on the Admin tab in the top navigation bar. 2. Click Administrator Tools. 3. Click Download Archived Data. Figure 41 Download Data Archives 4.
36 COMMANDCENTER NOC ADMINISTRATOR GUIDE All CC-NOC patches and updates are made available on a web server which can be automatically checked by your CC-NOC appliance. If new patches/updates are available, they can also be automatically downloaded, and optionally, automatically applied. The degree to which this process is performed is in your control, using the options available in this page.
CHAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 37 4. Click Install Updates. Figure 44 Install Updates 5. Click install to install any of the updates that are listed. If an update is listed as downloading, it will be available for installation once it is fully downloaded. Check for new updates by accessing the Download Updates page – see section Download Updates earlier in this chapter for additional information.
38 COMMANDCENTER NOC ADMINISTRATOR GUIDE available, yet do not want them automatically installed, set Auto Download to enable, but leave Auto Install configured as disabled. 1. Click on the Admin tab in the top navigation bar. 2. Click Advanced Administration. 3. Click System Software & Signature Updates. 4. Click Configure Automatic Download Settings. Figure 47 View All Updates 5. Click Enabled or Disabled for Auto Check, Auto Download, and Auto Install. 6.
CHAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 39 Appliance Database Administration This page allows you to clean out unnecessary or unused information stored in the database, including node information, events, outages, etc. These operations are necessary if you would like to purge some of the data and start over with a clean database.
40 1. 2. 3. 4. COMMANDCENTER NOC ADMINISTRATOR GUIDE Click on the Admin tab in the top navigation bar. Click Advanced Administration. Click Data Backup and Restore. Click Download Backup Files. Figure 49 Download Backup Files 5. Click a file to begin the download. Install a Backup File If restoring a backup file to a new piece of hardware, contact Raritan Support for assistance in migrating the data. 1. Click on the Admin tab in the top navigation bar. 2. Click Advanced Administration. 3.
CHAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 41 2. Click Advanced Administration. 3. Click Manage Routes. Figure 51 Manage Routes 4. To delete a user-defined static route, click remove in the row of the unwanted route. 5. To change the default gateway route, revisit the Configure Network Connection page – see Configure Network Connection earlier in this chapter for additional information. A restart is required. Add a New Network Route To add a new network route: 1.
42 COMMANDCENTER NOC ADMINISTRATOR GUIDE Delete Management Settings and Data This page gives you a way to completely reset the appliance to nearly a "factory default" state, deleting all collected information and configuration settings. Warning! This action is irreversible. If you download a backup of your data, you can restore it to the appliance later if necessary, but if you do not download a backup, all of your data will be lost permanently.
CHAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 43 3. Click Delete Traffic Analysis Performance Information. Figure 55 Delete Traffic Analysis Performance Data 4. Choose the appliance on which to delete the performance data. 5. Click delete. Install CC-NOC License This page allows you to upload a new license file to the CC-NOC. You were asked to do this during installation of the CC-NOC or when configuring the network – see Raritan’s CommandCenter NOC Deployment Guide).
44 COMMANDCENTER NOC ADMINISTRATOR GUIDE Note: In a distributed environment, to install a license for a CC-NOC 2500M or CC-NOC 2500S, from the CC-NOC 2500N click on the Admin tab, click Upload Appliance Licenses, and click load new appliance license. Installed Appliances List Use this page to change the name or description of a CC-NOC and disable specific functionality on the appliance.
CHAPTER 3: CONFIGURING INTRUSION DETECTION 45 Chapter 3: Configuring Intrusion Detection This chapter describes procedures to configure a CC-NOC so it can monitor and analyze system events for attempts to access system resources in an unauthorized manner. In the event of an attack, real-time alerts can be sent to specified individuals. Intrusion detection can be configured to run on a CC-NOC 100, CC-NOC 250, or on a CC-NOC 2500S in a distributed environment.
46 COMMANDCENTER NOC ADMINISTRATOR GUIDE Deployment Place the Ethernet TAP on the Ethernet cable in the same location where an Ethernet hub would be used. The Ethernet tap has the exact same function as the hub, except that one of the ports is uni-directional and outputs data that is passing over the wire. This is the port that is connected to CC-NOC’s monitoring interface.
CHAPTER 3: CONFIGURING INTRUSION DETECTION 47 4. Choose the appliance that you wish to configure by clicking Configure next to it. Figure 60 Configuring Home Network for Intrusion Detection Appliance 5. To include an entire subnet in your home network, use the Add Addresses box. Type in the network address and select the subnet mask from the list that is provided. 6. To include single hosts or ranges of host IP addresses, use the input boxes in the bottom half of the panel.
48 COMMANDCENTER NOC ADMINISTRATOR GUIDE All of the Intrusion Detection appliances that can communicate with this system are listed in the box. The Last Change field indicates the last time that the home network for the appliance was changed. Figure 61 Selecting an Intrusion Detection Appliance for Portscan Detection 4. Choose the appliance that you wish to configure by clicking Configure next to it.
CHAPTER 3: CONFIGURING INTRUSION DETECTION 49 Determining which ports are open on a target machine is often the first step towards a successful attack on a network system. Attackers generally use port scanning utilities to probe a target system and make a list of all open ports on the device. After they have this list, they will send specific attacks to the open ports with the hope of exploiting a vulnerability on the target.
50 COMMANDCENTER NOC ADMINISTRATOR GUIDE Select Intrusion Detection Appliance(s) All of the Intrusion Detection appliances that can communicate with the system hosting this Web Console are listed in the Intrusion Detection Appliance box. The Last Configuration field indicates the last time that the detection scheme for the Intrusion Detection was changed or the last time that a security patch was used to update the signatures on the Intrusion Detection.
CHAPTER 3: CONFIGURING INTRUSION DETECTION 51 Select Types of Signatures to Monitor When in doubt, enable detection. There is no disadvantage to enabling extra detection, except that you may receive extraneous events from your Intrusion Detection appliances. You should usually never disable detection of General Security on the Network. This category includes a variety of attacks that can affect any network, regardless of the devices and services on it.
52 COMMANDCENTER NOC ADMINISTRATOR GUIDE Load Default Signatures or Settings from Another Appliance Alternatively, you can quickly configure your Intrusion Detection appliance by selecting a set of pre-selected signatures appropriate for most networks or by selecting a previously saved appliance’s signature settings. 10. To load the defaults, select Load defaults from the drop-down selection list and click Load Configuration. 11.
CHAPTER 3: CONFIGURING INTRUSION DETECTION 53 Advanced Intrusion Detection Administration Advanced administration assists in fine tuning the set of signatures that an intrusion detection application will use to detect intrusion traffic on the network. Manage Signatures The Manage Signatures page allows you to disable specific signatures on a per-appliance basis. This allows you to disable signatures that may produce false-positive alerts because of conditions on your network.
54 COMMANDCENTER NOC ADMINISTRATOR GUIDE Upload Custom Signatures Tool The Upload Custom Signatures page allows you to upload a specific set of rules that will be sent to a specified Intrusion Detection appliance. This feature can be used to augment the set of signatures that Raritan provides as part of the ongoing software updates for the appliance. 1. Click on the Admin tab in the top navigation bar. 2. Click Intrusion Detection Configuration. 3. Click Advanced Security Administration. 4.
CHAPTER 4: CONFIGURING WINDOWS MANAGEMENT 55 Chapter 4: Configuring Windows Management This chapter describes procedures to configure a CC-NOC so it can use Microsoft’s WMI (Windows Management Instrumentation) to monitor and manage Windows servers and workstations in your network. WMI information is collected from the Windows systems and is used to extract and report on inventory and event information.
56 COMMANDCENTER NOC ADMINISTRATOR GUIDE External Proxy Host Requirements For best results, it is recommended to use Windows XP Professional, Service Pack 2 (or later) with auto updates enabled to facilitate communications between CC-NOC and the managed systems.
CHAPTER 4: CONFIGURING WINDOWS MANAGEMENT 57 4. Unzip the ProxyInstaller archive on your Windows machine and move the directory to a location where you would like to keep the program. For example, a good location could be: C:\Program Files\Raritan\ProxyInstaller 5. Double-click on ProxyInstaller.exe to run the program. 6. Type in either the Remote Appliance (CC-NOC 2500M) IP address or the Manager Server (CC-NOC 100 or 250) IP address depending on the type of series you are installing. 7.
58 COMMANDCENTER NOC ADMINISTRATOR GUIDE The Windows Management Configuration Wizard is an interface to specify and configure proxy hosts, which facilitate connectivity between the CC-NOC and your managed Windows servers and workstations. This configuration wizard walks you step-by-step through the creation of proxies, association of authentication information with specific domains, and the ability to associate authentication information with specific hosts as well. 1.
CHAPTER 4: CONFIGURING WINDOWS MANAGEMENT 59 6. Type the IP address for the proxy host. This should be the same host that the configuration tool was run – see section Download and Run earlier in this chapter for additional information. Note: Hostname values in this field must be resolvable via DNS or must be a numeric IP address. 7. Type values for domain, username, password, and confirm the password.
60 COMMANDCENTER NOC ADMINISTRATOR GUIDE Note: After windows discovery process is complete, you may notice an overlap in devices that were specified in the Discovery Range – please see Edit Discovery Ranges in Chapter 2: General and Advanced Administration for additional information. Therefore, it may be necessary to change the licenses of some devices, especially if you want to collect additional data.
CHAPTER 4: CONFIGURING WINDOWS MANAGEMENT 61 Note: Any local user defined must be a member of the Local Administrators group to authenticate and allow data collection to occur. Trusted Domain-based authentication is used when the target machines are part of a domain other than the domain to be used for authentication, yet there exists a trust relationship between the two domains. This feature can be difficult to troubleshoot and should be used only by advanced Windows administrators. 10.
62 COMMANDCENTER NOC ADMINISTRATOR GUIDE Configuring a WINS Server or LMHOSTS File If you need to collect WMI data from Windows servers that exist in another network and you need to resolve Windows NetBIOS names to IP addresses, on the external proxy you can either: • Configure the WINS server. • Edit the lmhosts file.
CHAPTER 4: CONFIGURING WINDOWS MANAGEMENT 63 8. Click on the WINS tab. Figure 77Selecting WINS Tab 9. Click the Add… button and specify the address of the WINS server for the remote appliance to use for Windows computer name resolution and click add.
64 COMMANDCENTER NOC ADMINISTRATOR GUIDE Authenticate Windows Computers This option allows you to change the authentication usernames and passwords for discovered servers and workstations. 1. Click on the Admin tab in the top navigation bar. 2. Click Windows Management Configuration. 3. Click Authenticate Windows Computers. Figure 78 Change Authentication Usernames and Passwords for Discovered Targets 4.
CHAPTER 4: CONFIGURING WINDOWS MANAGEMENT 65 5. Choose the desired operation, for example, change license type to Promoted Workstation. 6. Click submit. To generate an inventory report of the current list of devices, select an output format, for example, HTML or XML, and click generate report. XML can be used in Crystal Reports.
66 COMMANDCENTER NOC ADMINISTRATOR GUIDE To edit WINS settings: 1. Click on the Admin tab in the top navigation bar. 2. Click CommandCenter NOC 2500M Configuration. Figure 81 Edit WINS Settings 3. Select the CC-NOC 2500M appliance from the pull-down menu next to edit WINS settings. 4. Click edit WINS settings. Figure 82 WINS Server IP Address 5. Specify a WINS server for the remote appliance to use for Windows computer name resolution and click submit changes.
CHAPTER 4: CONFIGURING WINDOWS MANAGEMENT 67 Edit LMHOSTS File To resolve Windows NetBIOS names to IP addresses, you can edit the lmhosts file if you are using the internal proxy on the CC-NOC 2500M appliance and a WINS server is not available. 1. Click on the Admin tab in the top navigation bar. 2. Click CommandCenter NOC 2500M Configuration. Figure 83 CommandCenter NOC 2500M Options 3. Select the CC-NOC 2500M appliance from the pull-down menu next to edit LMHOSTS settings. 4.
68 COMMANDCENTER NOC ADMINISTRATOR GUIDE 5. Specify the IP address of each remote Windows server from which you wish to collect WMI data. 6. You can also delete all of the lmhosts settings for the appliance by clicking delete LMHOSTS file. 7. Click submit changes.
CHAPTER 5: CONFIGURING VULNERABILITY SCANNING 69 Chapter 5: Configuring Vulnerability Scanning This chapter describes procedures to configure a CC-NOC so it can scan for vulnerabilities, for example, exploits and thresholds against devices within your network. Scanning for vulnerabilities assists administrators in resolving security concerns. Vulnerability scanning finds system vulnerabilities, for example, unpatched systems, older known vulnerable server daemons, etc.
70 COMMANDCENTER NOC ADMINISTRATOR GUIDE 3. Read the warning and at the bottom of the page, click I Agree. By clicking on I Agree and proceeding to the configuration page, you acknowledge these risks and take responsibility for all potential damages and outages. Otherwise, click I Do Not Agree and you will be returned to the Admin page. Contact your reseller or product support for more information about the benefits and risks involved in vulnerability scanning.
CHAPTER 5: CONFIGURING VULNERABILITY SCANNING 71 Scan Level 4 Scan Level 4 performs all checks of previous levels and also attempts exploits that are known to be directly harmful to target systems. These include vulnerabilities that can alter data on the target or bring down services or the operating system by using denial-of-service techniques. It is absolutely not advisable to use this scan against mission-critical targets, regardless of OS or services that are running.
72 COMMANDCENTER NOC ADMINISTRATOR GUIDE 3. Click add to have the targets added, or excluded, from the scan. 4. Click save settings to save all addresses entered and return to the previous page. 5. Scroll to the bottom of the page and create a scanning schedule. Vulnerability scanning can be scheduled to occur when it won't adversely impact your network. This will allow you to perform the more intensive vulnerability scanning without impacting your network availability.
CHAPTER 6: CONFIGURING NOTIFICATIONS 73 Chapter 6: Configuring Notifications This chapter describes procedures to configure a CC-NOC so it can send and escalate notices through email, pagers, etc. if and when specific CC-NOC events occur. When important events are detected, users may receive a notice that is a descriptive message sent automatically to a pager, an email address, or both.
74 COMMANDCENTER NOC ADMINISTRATOR GUIDE Configure Event Notifications By configuring event notifications, each system event can be configured to send a notification whenever that event is triggered. 1. Click on the Admin tab in the top navigation bar. 2. Click Notification Configuration. 3. Click Configure Event Notifications. Figure 90 A Configuring Event Notifications This page lists the default event notifications, grouped by Event Label.
CHAPTER 6: CONFIGURING NOTIFICATIONS 75 Select Event Type The first step when adding or editing a notification is to select one event type to associate with the notification. Notice that if you are adding a new notice for an existing event, you will bypass this step. Figure 91 Adding a New Event Notification 4. From the list of all events that may be encountered, select one of the event-types to associate with this notification. If the event that you pick occurs, the system will send this notification.
76 COMMANDCENTER NOC ADMINISTRATOR GUIDE 6. Click one of the radio buttons: • • To NOT build a rule, click Do not constrain notice against interface or service. To build a rule, click Send notice only if it contains an interface that matches the interface/service rule below. 7. If you selected to build a rule, specify TCP/IP address and service information that needs to match the interface and service information contained in the event to send the notification.
CHAPTER 6: CONFIGURING NOTIFICATIONS 77 8. If you do not wish to validate the rule or did not define an interface/service rule, click skip results validation to continue. Otherwise, click validate rule results to provide a visual representation of the rule just built and check that the TCP/IP address(es) and/or service(s) specified returned expected results. Figure 93 Validating an Interface/Service Rule 9.
78 COMMANDCENTER NOC ADMINISTRATOR GUIDE and will also appear in the Notification Browser as described in Raritan’s CC-NOC User Guide. 15. Type an Email Subject that will appear as the subject of the email sent as a result of this Event Notification. This is optional and a default subject “Notice #%notice[id]%” will be used if text is not provided.
CHAPTER 6: CONFIGURING NOTIFICATIONS 79 notification path – please see section Configure Notification Paths later in this chapter for additional information. Note: To assign users to a group, the users must be pre-defined – please see section Add a New User in Chapter 8: Creating Users, Categories, Views for additional information. 1. Click on the Admin tab in the top navigation bar. 2. Click Notification Configuration. 3. Click Configure Notification Groups.
80 COMMANDCENTER NOC ADMINISTRATOR GUIDE Figure 99 Assigning Users to a Notification Group 5. Type in comments that describe the group. This is optional. 6. Assign users to the group by clicking select all, or Ctrl+click to select more than one user, or hold down the Shift key and click on the opposing end to select a range of users. Select >> to move the users to the Currently in Group: box. 7.
CHAPTER 6: CONFIGURING NOTIFICATIONS 81 Configure Notification Paths In this section, you will create notification paths that defines the users or groups who will receive notifications, how the notifications will be sent, for example, numeric or text pagers, email, and who to notify if escalation is needed.
82 COMMANDCENTER NOC ADMINISTRATOR GUIDE Create New Path Name and Specify Targets In this step, you need to specify a new name and select a target, that is, user, group, or email. Figure 101 Configuring a Notification Path To create a new notification path: 4. Type a unique new path name. The name must be alphanumeric and can include “/”, and “–”, and “_” characters. 5.
CHAPTER 6: CONFIGURING NOTIFICATIONS • 83 For Group Target, select only one group as previously defined, please see section Configure Notification Groups earlier in this chapter for details, and specify an interval, that is, minutes, hour, or days, to indicate how long to wait before sending the notification to users in this group. Then select one or more delivery methods for the group.
84 COMMANDCENTER NOC ADMINISTRATOR GUIDE Define Escalation in Notification Path In this step, you need to define how long the CC-NOC will wait until it sends a subsequent notification after sending out the first one. You also need to specify who will be receiving this subsequent notification. Figure 106 Define Escalation in Notification Path To define the escalation for a notification path: 5.
CHAPTER 6: CONFIGURING NOTIFICATIONS • For Group Target, select only one group as previously defined, see section Configure Notification Groups earlier in this chapter for additional information, specify an interval, that is, minutes, hour, or days, to indicate how long to wait before sending the notification to users in this group. Then select one or more delivery methods for the group.
86 COMMANDCENTER NOC ADMINISTRATOR GUIDE Configure TAP Paging This section explains configuring the Telocator Alphanumeric Protocol (TAP) for a specific paging service provider. This allows the CC-NOC to send notifications to users' pagers if the appliance has its modem connected to a telephone line. TAP is a standard protocol that enables modems to send text messages to pager systems. The CCNOC can use TAP services to send notifications as text messages to pagers.
CHAPTER 6: CONFIGURING NOTIFICATIONS 87 Add a new TAP Service In this step, you need to enter the phone number, baud rate, and other information for a TAP service. Different phone carriers will typically have separate TAP services so if you have pagers from different phone carriers or from different manufacturers, you may need to enter settings for several TAP services. Refer to your phone carrier for more information about TAP service availability and settings.
88 COMMANDCENTER NOC ADMINISTRATOR GUIDE Edit Modem Parameters In this step, you will set up the modem parameters. If your modem requires special parameters for initialization or dialing prefixes, such as dialing "9" to get an outside line, you’ll need to enter these parameters. These settings are necessary for the modem to initialize properly. All of the fields on this page are optional. Note: If you need assistance in setting up modem parameters, please call Technical Support.
CHAPTER 7: MANAGING ASSETS 89 Chapter 7: Managing Assets This chapter describes procedures to configure a CC-NOC so it can track and share important information about capital assets in your organization. This data, when coupled with information about your network that is obtained by the CC-NOC during network discovery, can be a powerful tool not only for solving problems, but in tracking the current state of equipment repairs as well as network or system related moves, additions, or changes.
90 COMMANDCENTER NOC ADMINISTRATOR GUIDE 3. Click Import Assets. Figure 114 Importing assets 4. Paste your comma-separated values into this text field to import them into the assets database. There is one line per record, and the fields are delimited by commas. A new asset record will be created for each line. 5. Click import. Note: You MUST include all 38 fields – even if there is no data between the comma delimiters, the commas have to be included.
CHAPTER 7: MANAGING ASSETS 91 Export Assets All the nodes with asset information can be exported to a comma-separated value file (CSV), which is suitable for use in a spreadsheet application. If you do an import into the CC-NOC with this CSV file, you will be asked to re-map all assets that were previously mapped to a node. 1. Click on the Assets tab in the top navigation tab bar. 2. Click Manage assets. 3. Click Export Assets. 4. Click open to view the assets in Excel. Figure 115 Exporting assets 5.
92 COMMANDCENTER NOC ADMINISTRATOR GUIDE Clear All Asset Records This allows you to remove all asset records from the CC-NOC. Be sure to export the assets if you ever need to recover this data in the future. If you are rebuilding the asset records from an export via the CC-NOC, you will need to clear the asset table prior to re-importing. Otherwise, all asset records will be duplicated. 1. Click on the Assets tab in the top navigation tab bar. 2. Click Manage assets. 3. Click clear asset records.
CHAPTER 8: CREATING USERS, CATEGORIES, VIEWS 93 Chapter 8: Creating Users, Categories, Views This chapter describes procedures to add users, delete and modify users, build views, and create categories. Build your own custom way of looking at your network, called views, and then assign them to your users. Categories allow you to define specific groups of systems and/or services. The rules created when defining categories will be used in the user interface, the reports, and availability calculations.
94 COMMANDCENTER NOC ADMINISTRATOR GUIDE • • Operators have access to everything on the CC-NOC except administrative configurations. Executive User have read-only access to only a few key reports that show the network health at a high level. • Admin have configuration access to the CC-NOC. 7. Click create user. Edit a User When adding or editing a user, the procedure below will be the same. 1. Click on the Admin tab in the top navigation bar. 2. Click User Configuration.
CHAPTER 8: CREATING USERS, CATEGORIES, VIEWS 95 5. Supply a full name and enter comments. This is optional. 6. If desired, provide Executive User Constraints to provide an executive-level user access only to the specified category and appliance that is specified. This user will not be able to see information on nodes outside of the specified category or data collected by appliances other than the specified appliance. 7.
96 COMMANDCENTER NOC ADMINISTRATOR GUIDE 6. Choose the start time and stop time from the select boxes. If a user works a shift that spans midnight you will have to enter two duty schedules. One from the start of the shift till midnight, and the second on the next day from midnight till the end of the shift.
CHAPTER 8: CREATING USERS, CATEGORIES, VIEWS Web Servers 97 Includes all managed interfaces which are running an HTTP (web) server on port 80 or other common ports. Categories can then be combined into views, providing you the ability to focus users on the nodes that are pertinent to their role. You have the ability to create, modify, and delete categories and the filters that populate them.
98 COMMANDCENTER NOC ADMINISTRATOR GUIDE 7. Specify either IP addresses/ranges or services that will be included in this category. The category will be populated with those nodes/services that you define here so you can design customized views for your users. For example, you could create one category for just Exchange servers, and another for any other mail servers you might have in the environment like a Linux box with Sendmail).
CHAPTER 8: CREATING USERS, CATEGORIES, VIEWS 99 Configure Views Configuring views allows you to create a mapping between users and views, or sets of categories, they will see when logging into the CC-NOC. Views are simply the combination of categories that your users will see when logging in.
100 COMMANDCENTER NOC ADMINISTRATOR GUIDE Add/Modify an Existing View In this page, you can add a new view or modify an existing one, including adding or removing sections, for example, logical groupings of categories under a common heading, as well as the categories within them. To create or modify the categories, including the filters that populate them, please see section Configure Categories earlier in this chapter for additional information. Figure 127 Add/Modify Views 1.
CHAPTER 8: CREATING USERS, CATEGORIES, VIEWS 101 Map Users After creating views, you can now map users to a view that will be displayed after they log into the CC-NOC. If users are not mapped to a specific view, then the Default view that was selected in section Configure Views will be displayed. 1. Click on the Admin tab in the top navigation bar. 2. Click Category and View Configuration. 3. Click Configure Views. 4. Click map users. Figure 128 Map users to views 5.
102 COMMANDCENTER NOC ADMINISTRATOR GUIDE
APPENDIX B: TROUBLESHOOTING 103 Appendix A: Specifications V1 Platform General Specifications 1U 24.21”x 19.09” x 1.75” 615mm x 485mm x 44mm 23.80lb (10.80kg) Form Factor Dimensions (DxWxH) Weight Single Supply (1 x 300 watt) Power Operating Temperature Mean Time Between (MTBF) KVM Admin Port Serial Admin Port Console Port 10℃- 35℃ (50℉- 95℉) 36,354 hours Failure (DB15 + PS2 or USB Keyboard/Mouse) DB9 2 x USB 2.
104 COMMANDCENTER NOC ADMINISTRATOR GUIDE NON-OPERATING Temperature Humidity Altitude Vibration Shock -40 - +60 (-40 -140 ) 5% - 95% RH Operate properly at any altitude between 0 to 10,000 feet, storage 40,000 feet (Estimated) 5-55-5 HZ, 0.
APPENDIX B: TROUBLESHOOTING 105 Appendix B: Troubleshooting Raritan wants to be involved from the beginning of your deployment and throughout the entire lifetime of your use of Raritan products. We have identified the following as the three pillars on which the success of your deployment rests: • • • Your network – Understanding and maintaining your network is key to success.
106 COMMANDCENTER NOC ADMINISTRATOR GUIDE Checking Appliance Database Settings From time to time, you may see this message: It is recommended you contact Technical Support, who can then request SSH access to your appliance. You can allow this access and open an SSH connection by clicking the establish support connection button. Opening the connection may take between 10 to 30 seconds. Your firewall must allow out-going connections from the CC-NOC on both port 22 (SSH) and port 443 (HTTPS).
APPENDIX B: TROUBLESHOOTING 107 Capability Scanning The capability scanning service scans individual nodes to discover which services are supported on that node. It uses an intelligent service discovery mechanism and relies heavily upon communication over the TCP protocol (and sometimes UDP). In its initial state, the capability scanning service waits and listens for suspect node events. When a suspect node event occurs, it begins scanning the node.
108 COMMANDCENTER NOC ADMINISTRATOR GUIDE The notifications service does not generate any events; it only reacts to them. It does, however, save its history in the database so that you can review past notifications. SNMP Data Collection The SNMP data collection service collects additional data from nodes that support SNMP. Just like the pollers, the SNMP data collection service runs every five minutes by default. If a scheduled device is available, it will collect as much information as it possibly can.
APPENDIX B: TROUBLESHOOTING 109 Your Network Understanding and maintaining your network is the key to success. The Raritan services will help you understand and troubleshoot your network, as it relates to the CC-NOC. This chapter, however, is about troubleshooting the CC-NOC. Raritan Support Structure Before troubleshooting anything else, you should always make sure that your basic connectivity to the Raritan support structure is available should you need to utilize it.
110 COMMANDCENTER NOC ADMINISTRATOR GUIDE If you are confident that the CC-NOC can ping the node in question, the next step is to confirm that the CC-NOC has discovered a device correctly. Check the following things: If the ping was successful, the CC-NOC will generate a suspect node event. The text of the event will look like "A new node (hostname) was discovered." The node status will be listed as "Active", if it has an interface within the current managed ranges.
APPENDIX B: TROUBLESHOOTING 111 the Admin tab, Network Management, and Configure Pollers. For each service that responds during the intelligent service scan, the system will generate a “Node Gained Service” event. The text of this event will look like the following: The X service has been discovered on interface WWW.XXX.YYY.ZZZ Typically, this will also be the signal to the Pollers that they should begin polling this new service for availability.
112 COMMANDCENTER NOC ADMINISTRATOR GUIDE Why Can’t My CC-NOC Manage X Service? ICMP - If a device responds to a "ping", which uses ICMP for its transport, the device will be flagged as supporting ICMP and will be tested for ICMP availability on the standard polling interval.
APPENDIX B: TROUBLESHOOTING 113 If a service successfully connects, but otherwise "fails", a "service unresponsive" event is generated. An example of this would be a poller sends a TCP connect request… and gets a connecting, but within the “timeout” period there is no response. Thus, the Service is “up”, but it is not performing up to an adequate level. This could be caused by the service itself, or through network congestion – but in either case, it is a condition that warrants investigation.
114 COMMANDCENTER NOC ADMINISTRATOR GUIDE The Management group receives notifications for any default notifications sent to the Network/Systems, Windows Management, or Security groups. Any notification sent to these groups is given, by default, a 15 minute window for acknowledgement. The Reporting group receives the Availability and Outage reports via email every Monday morning.
APPENDIX B: TROUBLESHOOTING 115 Of these five, Raritan only uses three: • GET - A message sent from the Manager to the Agent requesting information • GET RESPONSE – The message the Agent sends to the Manager in reply to a GET transaction, and • TRAP – An unsolicited message from an Agent to the Manager advising the Manager of some abnormal condition Of these three, only the first two are used in data collection.
116 COMMANDCENTER NOC ADMINISTRATOR GUIDE In most cases, if the CC-NOC is not collecting data from a particular device, it’s usually because of a misconfiguration on the remote device. Often, incorrect community strings are the culprit, or the SNMP service has not been turned on or configured correctly. There are several ways you can test the SNMP configuration for your devices: • Use the SNMP Walk tool on the Network Infrastructure Tools page from the Tools tab. This is the quickest and easiest method.
APPENDIX B: TROUBLESHOOTING 117 from the CC-NOC to the device and that TCP and UDP are working. If you have already performed the troubleshooting steps for Pollers and Capability Scanning on the node in question, you have adequately tested this. If you are having trouble with vulnerability scanning, try the troubleshooting steps below: 1. If you are not getting vulnerability information, make sure that you set the scan parameters correctly in Admin-> Vulnerability Scanning Configuration. 2.
118 COMMANDCENTER NOC ADMINISTRATOR GUIDE SNMP, used for collection performance data for reporting, is still considered a service and as such, if a poll fails, it will still generate an outage that is integrated with the notification system. To determine if an interface supports SNMP, check the appropriate Interface page for that node. To find the Interface page, search for the appropriate node by name or by TCP/IP address from the Search page, then click on the appropriate interface.
APPENDIX B: TROUBLESHOOTING • • 119 If you are a reseller seeking technical resources, please send an email to tech@raritan.com. For technical support, call the number as stated in the front of this document. Note that Technical Support is intended to provide resellers and customers with technical assistance if necessary. All callers will be asked to provide their reseller or customer number before any questions can be answered.
120 COMMANDCENTER NOC ADMINISTRATOR GUIDE
APPENDIX C: PERFORMANCE MONITORING 121 Appendix C: Performance Monitoring Overview The CC-NOC is designed to provide you with the information necessary to support critical decisions in your environment. Depending on your role, the nature of those decisions may be different, from a help desk technician analyzing memory usage on a CC-NOC to determine if upgrades are appropriate, to a network designer using router buffer failures in support of better sizing decisions in equipment acquisition.
122 COMMANDCENTER NOC ADMINISTRATOR GUIDE Equipment Vendor All Device Type Any device supporting MIB2 (RF 1213) Metric(s) In/Out Octets In/Out Discards In/Out Errors All Linux or Unix variants running Net-SNMP Microsoft Windows Novell NetWare Drive Size & Utilization (1)System Uptime Number of current users Number of processes Total memorySystem load average for 1, 5, and 15 minute intervals CPU Utilization Drive Size & Utilization (C:) Drive Size & Utilization (D:) CPU Utilization Number of NLMs
APPENDIX C: PERFORMANCE MONITORING 123 Checkpoint Firewall products State information stored Process Contexts Allocated storage CPU Utilization Packets accepted Packets rejected Packets dropped Packets logged Lotus (IBM) Domino/Notes Servers Compaq Insight Agent Current users Maximum users Dead Mail Delivered Mail Transferred Mail Waiting Mail Messages waiting for delivery Average mail delivery time Average mail size delivered Mail transmission failures Replication failures Average transactions/min
124 COMMANDCENTER NOC ADMINISTRATOR GUIDE Cisco Network gear Bay/Wellfleet Routers/Switches 3Com Routers/Switches CPU Utilization Free Memory Buffer failures Buffer memory allocation failures Total kernel tasks Total kernel tasks in queue Free memory Free buffers Total memory CPU Utilization Buffer memory available Buffer allocation failures Buffer memory total Buffer memory total available Provides insight as to router sizing and performance, especially as augmented by MIB2 data.
APPENDIX C: PERFORMANCE MONITORING 125 Memory In Use Free Physical Memory Total Logical Memory Logical Memory In Use Percent Logical Memory In Use Free Logical Memory Memory Pages per Second1 underpowered devices. Processor (CPU) Total Processor Time Processor Queue Length1 Interrupts per Second1 Microsoft summarizes the usage of all processors (for SMP systems) into a single statistic. This indicates the Platforms overall ability to handle the workload.
126 COMMANDCENTER NOC ADMINISTRATOR GUIDE on demand. The remaining item is determining when performance metrics have reached a point at which they should be acted upon. And with the CC-NOC’s capability of managing performance thresholds, that’s easy too! Thresholding An exciting new feature significantly improved with the CC-NOC is threshold alerts.
APPENDIX C: PERFORMANCE MONITORING 127 Example Here’s an example. There is a high threshold set with a value of 70, a trigger of 3, and a rearm of 55. A new value is generated every minute. The first reported value is 65, which is less than our high threshold of 70, so no action is taken. The next poll is 72. This is above 70, so the trigger is checked. As this is the first time the threshold was exceeded, a trigger counter is started, but no further action is taken.
128 COMMANDCENTER NOC ADMINISTRATOR GUIDE Windows Performance Metric Thresholds The following values apply to data reported by Windows boxes. Note that there are separate events for Workstations and Servers – this is due to what data points Microsoft reveals. The event associated with a reported value violating a threshold is “High Threshold Exceeded” for a High threshold type and “Low Threshold Exceeded” for a low threshold type.
APPENDIX D: SETTING UP WMI ON TARGET MACHINES 129 Appendix D: Setting up WMI on Target Machines Configuring a Windows 98/ME box for Remote WMI Management The ability of the CC-NOC to manage Windows 98 and Windows ME systems is limited by the design of the Windows platform. Windows 98 and ME are consumer operating systems and are not as feature rich as the Microsoft systems based upon Windows NT.
130 COMMANDCENTER NOC ADMINISTRATOR GUIDE 3. Add the machine to the domain using the control panel, network settings by doing the following: • Start->Settings->Control Panel->Network. • Select Client for Microsoft Networks from the tab. • Click on the tab named Properties. • Check the box for Log on to Windows NT Domain and specify the domain name. • Click OK to save the network settings. 4.
APPENDIX D: SETTING UP WMI ON TARGET MACHINES 131 Note: Using Windows 98/ME, XP Home, or any NT 4.0 system is not recommended or supported as a proxy system. Additionally, although Servers are supported, it is not advisable to utilize them as your proxy due to error logging issues. To enable a Windows proxy system for the CC-NOC, Raritan provides a binary that can be downloaded and run. The binary tweaks the registry to enable remote communications with the WMI scripting system on the local box.
132 COMMANDCENTER NOC ADMINISTRATOR GUIDE
APPENDIX E: MANAGING AND RESPONDING TO INTRUSION DETECTION EVENTS Appendix E: Managing and Intrusion Detection Events 133 Responding to This appendix is intended to provide a little insight as to how Raritan goes about assessing the traffic that the CC-NOC sees, determining what constitutes an event, and in turn, what that event should mean to you.
134 COMMANDCENTER NOC ADMINISTRATOR GUIDE as to whether or not new signatures should be applied to a given CC-NOC. This reduces your workload, while automating the most difficult part of intrusion detection—keeping it up-to-date. Responding to Events and Notifications Once you’ve used the Signature Profiler to build a model of your network and systems infrastructure, your CC-NOC is now ready to start generating events and notifications.
APPENDIX E: MANAGING AND RESPONDING TO INTRUSION DETECTION EVENTS • • • • • • • • • 135 Are all of your systems at the most recent revision of operating system and patch level? Patches and hot-fixes are extremely important for Microsoft platforms. Have my network platforms been upgraded to avoid unnecessary risks? SNMP, if leaked to the outside world, can be a troublesome protocol.
136 COMMANDCENTER NOC ADMINISTRATOR GUIDE
APPENDIX F: NOTIFICATION PARAMETERS 137 Appendix F: Notification Parameters Notification Parameter Substitution The notification subsystem is very robust and flexible, allowing the appropriate notification of the appropriate personnel at the appropriate time. One feature you have control over is the content of the notification message. You can include any text, and use parameter substitution to fill in values the CC-NOC knows.
138 %event[parm[name]]% %event[parm[##]]% %event[parm[#]]% Assets: COMMANDCENTER NOC ADMINISTRATOR GUIDE replaced by the value of the parameter named 'name', if present replaced by the total number of parameters replaced by the value of the parameter number '#', if present The format of an asset parameter is simply %asset[Field Name]% where field name matches the labels (with formatting changes) in the asset information screen.
APPENDIX G: NETWORK TRAFFIC OVERHEAD: NETWORK MANAGEMENT’S NECESSARY EVIL 139 Appendix G: Network Traffic Overhead: Network Management’s Necessary Evil On five-minute intervals, the CC-NOC polls services on managed nodes using Raritan's 'synthetic transactions'. These transactions serve to better test the service's availability, as they actually exercise the service, as opposed to simply “pinging” the box, making the leap of faith that the services you rely on are still responding appropriately.
140 COMMANDCENTER NOC ADMINISTRATOR GUIDE CK-ACK three-way handshake, which when completed, indicates that the port is listening and accepting connections. This handshake is a pre-cursor to any TCP session and is also embedded within most other synthetic transactions, including HTTP, which we'll discuss later. In the case of this node: TCP SYN issued: 74 bytes (592 bits) TCP SYN/ACK response: 74 bytes (592 bits) TCP ACK response: 66 bytes (528 bits) Total Traffic: 524 bytes (1712 bits) .
APPENDIX G: NETWORK TRAFFIC OVERHEAD: NETWORK MANAGEMENT’S NECESSARY EVIL 141 host, and an additional five metrics per managed interface. The host used in this example has two interfaces, so the results reflect metrics for a second interface as well as the de facto first interface.
142 COMMANDCENTER NOC ADMINISTRATOR GUIDE In addition to polling overhead, our services scan will run less than once a day and generate traffic roughly equivalent to a single polling interval. If vulnerability scanning is enabled, the CC-NOC will also generate the traffic associated with completing those tests. Benchmarks as to those tests are not currently available. In summary, the overhead introduced by any network management tool is not necessarily trivial, given some network types.
APPENDIX G: NETWORK TRAFFIC OVERHEAD: NETWORK MANAGEMENT’S NECESSARY EVIL 255-80-5301-00 143
World Headquarters Raritan Korea European Headquarters Raritan Computer, Inc. 400 Cottontail Lane Somerset, NJ 08873 USA Tel. (732) 764-8886 Fax (732) 764-8887 Email: sales@raritan.com www.raritan.com Raritan Computer Korea Inc. #3602, Trade Tower, World Trade Center Samsung-dong, Kangnam-gu Seoul, Korea Tel. (82) 2 557-8730 Fax (82) 2 557-8733 Email: sales.korea@raritan.com http://www.raritan.co.kr Raritan Computer Europe, B.V. Eglantierbaan 16 2908 LV Capelle aan den IJssel The Netherlands Tel.
