Summary of the content on the page No. 1
®
CommandCenter
NOC
Administrator Guide
Release 5.4
Copyright © 2006 Raritan Computer, Inc.
CCNOC-0D-E
June 2006
255-80-5301-00
Summary of the content on the page No. 2
This page intentionally left blank.
Summary of the content on the page No. 3
Copyright and Trademark Information This document contains proprietary information that is protected by copyright. All rights reserved. No part of this document may be photocopied, reproduced, or translated into another language without express prior written consent of Raritan Computer, Inc. © Copyright 2006 Raritan, CommandCenter, RaritanConsole, Dominion, and the Raritan company logo are trademarks or registered trademarks of Raritan Computer, Inc. All rights reserved. Java is a reg
Summary of the content on the page No. 4
Safety Guidelines To avoid potentially fatal shock hazard and possible damage to Raritan equipment: • Do not use a 2-wire power cord in any product configuration. • Test AC outlets at your computer and monitor for proper polarity and grounding. • Use only with grounded outlets at both the computer and monitor. When using a backup UPS, power the computer, monitor and appliance off the supply. Default Login User ID/Password The default username for CC-NOC is admin and the password is ra
Summary of the content on the page No. 5
FIGURES v Contents Chapter 1: Introduction .................................................................. 1 Stand-alone Appliances....................................................................................................................1 Distributed 2500 Series Appliances..................................................................................................1 CommandCenter Secure Gateway (CC-SG) ........................................................................
Summary of the content on the page No. 6
vi FIGURES Chapter 3: Configuring Intrusion Detection................................. 45 Configure a Spanned or Mirrored Port ...........................................................................................45 Ethernet TAP ..................................................................................................................................45 Benefits........................................................................................................................
Summary of the content on the page No. 7
FIGURES vii Map Users ............................................................................................................................................101 Appendix A: Specifications ........................................................ 103 V1 Platform...................................................................................................................................103 General Specifications..........................................................................
Summary of the content on the page No. 8
viii FIGURES Configuring a Windows 98/ME box for Remote WMI Management.............................................129 Configuring a Windows Proxy Details ..........................................................................................130 Registry Changes [configuration]:.........................................................................................................131 Appendix E: Managing and Responding to Intrusion Detection Events .....................................
Summary of the content on the page No. 9
FIGURES ix Figures Figure 1 Appliance Shutdown/Restart.......................................................................................................... 9 Figure 2 Configure Date and Time............................................................................................................. 10 Figure 3 Configure Network Connection .................................................................................................... 11 Figure 4 Configure Network Connection .......
Summary of the content on the page No. 10
x FIGURES Figure 52 Add a New Network Route......................................................................................................... 41 Figure 53 Prune Unused Performance Data.............................................................................................. 41 Figure 54 Delete Management Settings and Data ..................................................................................... 42 Figure 55 Delete Traffic Analysis Performance Data ....................
Summary of the content on the page No. 11
FIGURES xi Figure 105 Modify Notification Paths ......................................................................................................... 83 Figure 106 Define Escalation in Notification Path ...................................................................................... 84 Figure 107 Configuring a User Target for Escalation in Notification Path .................................................. 84 Figure 108 Configuring a Group Target for Escalation in Notification Pat
Summary of the content on the page No. 12
xii FIGURES
Summary of the content on the page No. 13
CHAPTER 1: INTRODUCTION 1 Chapter 1: Introduction The primary function of a CommandCenter NOC (CC-NOC) is to manage nodes in your network. Nodes are discovered automatically if their IP address is within the managed range of addresses. In addition to network discovery, a CC-NOC also provides service management, a database of network information, a rules engine, a notification engine, and a web server. A CC-NOC can also be instructed to collect statistics from your Windows systems, monitor
Summary of the content on the page No. 14
2 COMMANDCENTER NOC ADMINISTRATOR GUIDE User PC Preparation To access CC-SG and any targets managed by CC-SG, the browser must have the correct version of Sun JRE, such as rev 1.4.2.05. See Compatibility Matrix under Firmware Upgrades for CC- SG on www.raritan.com/support for details. For CC-SG, pop-up blockers should be disabled as well as any firewall software such as XP SP2 that is enabled by default. Remote Authentication CC-NOC users can be authenticated remotely by CC-SG to provide
Summary of the content on the page No. 15
CHAPTER 1: INTRODUCTION 3 • Vulnerability Scanning • Event Viewing and Searching • Performance Monitoring per category or device • Integration with CC-SG where CC-SG is notified of events within the subscribed discovery range. • Scheduled Outages • User, Views, and Category Configuration • License Upload • Event, Outage Notification • Asset Management • Reports (Outage, Availability, Inventory, Delta Inventory, Vulnerability, Security, SNMP) • Tools – Network Tools (ping host, port
Summary of the content on the page No. 16
4 COMMANDCENTER NOC ADMINISTRATOR GUIDE • ICMP – (Internet Control Management Protocol) ICMP is used by the CC-NOC to discover devices in your network and is documented in RFC 792. • In-band – going through the TCP/IP network to control a target by accessing the target directly. KVM, Serial, and Generic devices can be accessed via these in-band applications: RemoteDesktop Viewer, SSH Client, VNC Viewer. • Intrusion Detection – monitors and analyzes system events for attempts to access sys
Summary of the content on the page No. 17
CHAPTER 1: INTRODUCTION 5 • SSO – Single Sign-On. With Single Sign-on (SSO) access to CC-SG targets, CC-NOC users can connect to targets seamlessly, without having to sign onto CC-SG as long as remote authentication has been configured. • System Vulnerabilities – unpatched systems, older known vulnerable server daemons on your system that can be exploited by harmful network traffic. • TAP – (Telocator Alphanumeric Protocol) A standard protocol enabling modems to send text messages to pa
Summary of the content on the page No. 18
6 COMMANDCENTER NOC ADMINISTRATOR GUIDE Licensing Explained As devices are discovered in your network, data is collected from the device and the device is then assigned a license. License types include Infrastructure, Server, Workstation, and Promoted Workstation. Administrators can change a license from one type to another. The following explains each license type. Infrastructure In order for a device to be assigned an infrastructure license, it must be discovered as a node and support
Summary of the content on the page No. 19
CHAPTER 1: INTRODUCTION 7 Workstation A Workstation license can be assigned to any type of device, be it a Windows or non-Windows system. For example, a Linux box which is discovered as a node and which does not support any of the infrastructure services will be assigned a Workstation license. Similarly, a desktop Windows system will be assigned a Workstation license. A workstation device is eligible for the following functionality: • Capability scans once every 24 hours for new services
Summary of the content on the page No. 20
8 COMMANDCENTER NOC ADMINISTRATOR GUIDE
