Resumen del contenido incluido en la página 1
®
CommandCenter
NOC
Administrator Guide
Release 5.4
Copyright © 2006 Raritan Computer, Inc.
CCNOC-0D-E
June 2006
255-80-5301-00
Resumen del contenido incluido en la página 2
This page intentionally left blank.
Resumen del contenido incluido en la página 3
Copyright and Trademark Information This document contains proprietary information that is protected by copyright. All rights reserved. No part of this document may be photocopied, reproduced, or translated into another language without express prior written consent of Raritan Computer, Inc. © Copyright 2006 Raritan, CommandCenter, RaritanConsole, Dominion, and the Raritan company logo are trademarks or registered trademarks of Raritan Computer, Inc. All rights reserved. Java is a reg
Resumen del contenido incluido en la página 4
Safety Guidelines To avoid potentially fatal shock hazard and possible damage to Raritan equipment: • Do not use a 2-wire power cord in any product configuration. • Test AC outlets at your computer and monitor for proper polarity and grounding. • Use only with grounded outlets at both the computer and monitor. When using a backup UPS, power the computer, monitor and appliance off the supply. Default Login User ID/Password The default username for CC-NOC is admin and the password is ra
Resumen del contenido incluido en la página 5
FIGURES v Contents Chapter 1: Introduction .................................................................. 1 Stand-alone Appliances....................................................................................................................1 Distributed 2500 Series Appliances..................................................................................................1 CommandCenter Secure Gateway (CC-SG) ........................................................................
Resumen del contenido incluido en la página 6
vi FIGURES Chapter 3: Configuring Intrusion Detection................................. 45 Configure a Spanned or Mirrored Port ...........................................................................................45 Ethernet TAP ..................................................................................................................................45 Benefits........................................................................................................................
Resumen del contenido incluido en la página 7
FIGURES vii Map Users ............................................................................................................................................101 Appendix A: Specifications ........................................................ 103 V1 Platform...................................................................................................................................103 General Specifications..........................................................................
Resumen del contenido incluido en la página 8
viii FIGURES Configuring a Windows 98/ME box for Remote WMI Management.............................................129 Configuring a Windows Proxy Details ..........................................................................................130 Registry Changes [configuration]:.........................................................................................................131 Appendix E: Managing and Responding to Intrusion Detection Events .....................................
Resumen del contenido incluido en la página 9
FIGURES ix Figures Figure 1 Appliance Shutdown/Restart.......................................................................................................... 9 Figure 2 Configure Date and Time............................................................................................................. 10 Figure 3 Configure Network Connection .................................................................................................... 11 Figure 4 Configure Network Connection .......
Resumen del contenido incluido en la página 10
x FIGURES Figure 52 Add a New Network Route......................................................................................................... 41 Figure 53 Prune Unused Performance Data.............................................................................................. 41 Figure 54 Delete Management Settings and Data ..................................................................................... 42 Figure 55 Delete Traffic Analysis Performance Data ....................
Resumen del contenido incluido en la página 11
FIGURES xi Figure 105 Modify Notification Paths ......................................................................................................... 83 Figure 106 Define Escalation in Notification Path ...................................................................................... 84 Figure 107 Configuring a User Target for Escalation in Notification Path .................................................. 84 Figure 108 Configuring a Group Target for Escalation in Notification Pat
Resumen del contenido incluido en la página 12
xii FIGURES
Resumen del contenido incluido en la página 13
CHAPTER 1: INTRODUCTION 1 Chapter 1: Introduction The primary function of a CommandCenter NOC (CC-NOC) is to manage nodes in your network. Nodes are discovered automatically if their IP address is within the managed range of addresses. In addition to network discovery, a CC-NOC also provides service management, a database of network information, a rules engine, a notification engine, and a web server. A CC-NOC can also be instructed to collect statistics from your Windows systems, monitor
Resumen del contenido incluido en la página 14
2 COMMANDCENTER NOC ADMINISTRATOR GUIDE User PC Preparation To access CC-SG and any targets managed by CC-SG, the browser must have the correct version of Sun JRE, such as rev 1.4.2.05. See Compatibility Matrix under Firmware Upgrades for CC- SG on www.raritan.com/support for details. For CC-SG, pop-up blockers should be disabled as well as any firewall software such as XP SP2 that is enabled by default. Remote Authentication CC-NOC users can be authenticated remotely by CC-SG to provide
Resumen del contenido incluido en la página 15
CHAPTER 1: INTRODUCTION 3 • Vulnerability Scanning • Event Viewing and Searching • Performance Monitoring per category or device • Integration with CC-SG where CC-SG is notified of events within the subscribed discovery range. • Scheduled Outages • User, Views, and Category Configuration • License Upload • Event, Outage Notification • Asset Management • Reports (Outage, Availability, Inventory, Delta Inventory, Vulnerability, Security, SNMP) • Tools – Network Tools (ping host, port
Resumen del contenido incluido en la página 16
4 COMMANDCENTER NOC ADMINISTRATOR GUIDE • ICMP – (Internet Control Management Protocol) ICMP is used by the CC-NOC to discover devices in your network and is documented in RFC 792. • In-band – going through the TCP/IP network to control a target by accessing the target directly. KVM, Serial, and Generic devices can be accessed via these in-band applications: RemoteDesktop Viewer, SSH Client, VNC Viewer. • Intrusion Detection – monitors and analyzes system events for attempts to access sys
Resumen del contenido incluido en la página 17
CHAPTER 1: INTRODUCTION 5 • SSO – Single Sign-On. With Single Sign-on (SSO) access to CC-SG targets, CC-NOC users can connect to targets seamlessly, without having to sign onto CC-SG as long as remote authentication has been configured. • System Vulnerabilities – unpatched systems, older known vulnerable server daemons on your system that can be exploited by harmful network traffic. • TAP – (Telocator Alphanumeric Protocol) A standard protocol enabling modems to send text messages to pa
Resumen del contenido incluido en la página 18
6 COMMANDCENTER NOC ADMINISTRATOR GUIDE Licensing Explained As devices are discovered in your network, data is collected from the device and the device is then assigned a license. License types include Infrastructure, Server, Workstation, and Promoted Workstation. Administrators can change a license from one type to another. The following explains each license type. Infrastructure In order for a device to be assigned an infrastructure license, it must be discovered as a node and support
Resumen del contenido incluido en la página 19
CHAPTER 1: INTRODUCTION 7 Workstation A Workstation license can be assigned to any type of device, be it a Windows or non-Windows system. For example, a Linux box which is discovered as a node and which does not support any of the infrastructure services will be assigned a Workstation license. Similarly, a desktop Windows system will be assigned a Workstation license. A workstation device is eligible for the following functionality: • Capability scans once every 24 hours for new services
Resumen del contenido incluido en la página 20
8 COMMANDCENTER NOC ADMINISTRATOR GUIDE
