Page 3 - regional Raritan office contact information.
Copyright and Trademark Information This document contains proprietary information that is protected by copyright. All rights reserved. No part of this document may be photocopied, reproduced, or translated into another language without express prior written consent of Raritan Computer, Inc. © Copyr...
Page 4 - Safety Guidelines; Do not use a 2-wire power cord in any product configuration.; Default Login User ID/Password; The default username for CC-NOC is; admin; and the password is; raritan; . It is recommended to; Rack Mount Safety Guidelines; Specifications; Ensure sufficient airflow through the rack environment.
Safety Guidelines To avoid potentially fatal shock hazard and possible damage to Raritan equipment: • Do not use a 2-wire power cord in any product configuration. • Test AC outlets at your computer and monitor for proper polarity and grounding. • Use only with grounded outlets at both the computer a...
Page 5 - Contents
F IGURES v Contents Chapter 1: Introduction .................................................................. 1 Stand-alone Appliances....................................................................................................................1 Distributed 2500 Series Appliances................
Page 6 - ProxyInstaller
vi F IGURES Chapter 3: Configuring Intrusion Detection ................................. 45 Configure a Spanned or Mirrored Port ...........................................................................................45 Ethernet TAP ...................................................................
Page 9 - Figures
F IGURES ix Figures Figure 1 Appliance Shutdown/Restart.......................................................................................................... 9 Figure 2 Configure Date and Time ..........................................................................................................
Page 13 - Chapter 1: Introduction; refers to the following models:; Stand-alone Appliances; CommandCenter NOC Deployment Guide; Distributed 2500 Series Appliances; CC-NOC 2500S: Used for Intrusion Detection and Traffic Analysis.
C HAPTER 1: INTRODUCTION 1 Chapter 1: Introduction The primary function of a CommandCenter NOC (CC-NOC) is to manage nodes in your network. Nodes are discovered automatically if their IP address is within the managed range of addresses. In addition to network discovery, a CC-NOC also provides servic...
Page 14 - User PC Preparation; Compatibility Matrix; Remote Authentication; Mapping of User Groups; Local Authentication; Intended Audience; Administrator; CommandCenter NOC User Guide; Features Described in this Document
2 COMMANDCENTER NOC ADMINISTRATOR GUIDE User PC Preparation To access CC-SG and any targets managed by CC-SG, the browser must have the correct version of Sun JRE, such as rev 1.4.2.05. See Compatibility Matrix under Firmware Upgrades for CC- SG on www.raritan.com/support for details. For CC-SG, pop...
Page 16 - service down
4 COMMANDCENTER NOC ADMINISTRATOR GUIDE • ICMP – (Internet Control Management Protocol) ICMP is used by the CC-NOC to discover devices in your network and is documented in RFC 792 . • In-band – going through the TCP/IP network to control a target by accessing the target directly. KVM, Serial, and Ge...
Page 17 - – unpatched systems, older known vulnerable server daemons on
C HAPTER 1: INTRODUCTION 5 • SSO – Single Sign-On. With Single Sign-on (SSO) access to CC-SG targets, CC-NOC users can connect to targets seamlessly, without having to sign onto CC-SG as long as remote authentication has been configured. • System Vulnerabilities – unpatched systems, older known vuln...
Page 18 - Licensing Explained; Infrastructure
6 COMMANDCENTER NOC ADMINISTRATOR GUIDE Licensing Explained As devices are discovered in your network, data is collected from the device and the device is then assigned a license. License types include Infrastructure, Server, Workstation, and Promoted Workstation. Administrators can change a license...
Page 19 - Workstation
C HAPTER 1: INTRODUCTION 7 Workstation A Workstation license can be assigned to any type of device, be it a Windows or non-Windows system. For example, a Linux box which is discovered as a node and which does not support any of the infrastructure services will be assigned a Workstation license. Simi...
Page 21 - Chapter 2: General and Advanced Administration; Appliance Shutdown/Restart; System Shutdown; Admin; Appliance Network Settings; CommandCenter NOC
C HAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 9 Chapter 2: General and Advanced Administration Power Down CC-NOC If running CC-NOC on the V1 platform and if it loses AC power while it is up and running, the V1 unit remembers its last power state. Once AC power is restored, the V1 unit automaticall...
Page 22 - Configure Date and Time
10 COMMANDCENTER NOC ADMINISTRATOR GUIDE Configure Date and Time This page allows you to modify the current time zone and set the local time or configure a network time protocol (NTP) server with which to synchronize the local time. Note: If a CC-NOC 250 or 2500N is powered down for more than six ho...
Page 23 - Configure Network Connection; Change the ISP Gateway Address
C HAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 11 Configure Network Connection This page allows you to change the fixed IP address associated with this appliance. This IP address was configured when setting up the initial configuration using a serial connection – see Raritan’s CommandCenter NOC Dep...
Page 24 - Outgoing Email Communication
12 COMMANDCENTER NOC ADMINISTRATOR GUIDE 3. Click Change the ISP Gateway Address . Figure 4 Configure Network Connection 4. Type the IP address of the ISP gateway or type an address of 0.0.0.0 if you do not wish to supply an ISP address. 5. Click save changes . Outgoing Email Communication This page...
Page 25 - Change Nameserver Addresses; Network Management Configuration; Edit Discovery Ranges; CommandCenter
C HAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 13 email address is a required field and will be used to send status information on the CC-NOC itself. 7. Clicking test SMTP settings sends a test email to the email address specified in the Admin Email Address field using the specified SMTP server. Th...
Page 26 - CommandCenter Secure Gateway Administrator Guide
14 COMMANDCENTER NOC ADMINISTRATOR GUIDE WMI management range – see Specifying Windows Management Ranges in Chapter 4: Configuring Windows Management for details. Typically, you would want the discovery range specified here to overlap with the WMI management range. Note: A CC-NOC discovers devices i...
Page 27 - Enable DHCP IP address...; Example; Edit SNMP Ranges
C HAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 15 Important! Ensure your discovery range is not too wide, for example, entering multiple Class B address ranges. This consumes large amounts of resources and may reduce the performance of CC-NOC. Also, it is recommended to keep the default “Automatica...
Page 28 - must; Configure Scheduled Outages
16 COMMANDCENTER NOC ADMINISTRATOR GUIDE 3. Click Edit the SNMP Ranges . Figure 8 Edit SNMP Ranges 4. Click add new community or edit next to the already defined SNMP range. Figure 9 Defining SNMP Ranges 5. Edit the community string or add a new one. 6. Specify the SNMP version by selecting v1 , v2c...
Page 30 - Recurring Weekly; Configure Pollers
18 COMMANDCENTER NOC ADMINISTRATOR GUIDE 8. Specify an outage window . For outage windows that are set to Recurring Weekly , you cannot specify outages that start on one day of the week and end on a different day. In these cases where the outage spans 12:00 AM (Midnight), you should create two outag...
Page 31 - n a m e
C HAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 19 intervals (they were initially set at 5 minutes for a reason), timeouts and/or retries without proper planning or forethought runs the risk of: • Having the pollers get behind • Adding unreasonable amounts of network traffic in the environment • Mis...
Page 33 - Configure Performance Thresholds
C HAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 21 Configure Performance Thresholds This page displays the current values at which SNMP performance metrics are considered problematic and events are generated. You have complete control over these thresholds, including their value, their re-arm values...
Page 34 - Configure Outage Report
22 COMMANDCENTER NOC ADMINISTRATOR GUIDE 4. Each time you adjust the performance thresholds, click save thresholds to commit the changes. 5. You can also click reset to restore the threshold values to their pre-set condition. Configure Outage Report This page allows you to view and modify the workin...
Page 35 - SNMP Reparenting Exclusion List
C HAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 23 SNMP Reparenting Exclusion List This page allows you to specify addresses that should be excluded from SNMP reparenting. This feature is useful if you have multi-interface SNMP devices that have identical IP addresses to other multi-interface device...
Page 37 - Create a CC-SG Peer via a Secure Channel
C HAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 25 Create a CC-SG Peer via a Secure Channel After configuring the CC-SG with CC-NOC information, for example, specifying its IP address, and configuring CC-NOC with CC-SG information, you can create a secure channel between CC-SG and CC-NOC. Configurin...
Page 38 - Map CC-SG User Groups to Local User Roles
26 COMMANDCENTER NOC ADMINISTRATOR GUIDE Important! To successfully connect, you must enter the passcodes in CC-NOC within five minutes after they are generated on CC-SG. This will minimize the window of opportunity for intruders to breach the system with a brute-force attack. Avoid transmitting the...
Page 39 - CommandCenter Secure Gateway; Multi-Site Management
C HAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 27 Important! Configuring these mappings is required in order for remote authentication to work. Although you may have several CC-SG’s connected to this CC-NOC via a secure connection, only one can be the remote authentication and authorization source....
Page 40 - Configure Event Forwarding; Configure Event Recipients
28 COMMANDCENTER NOC ADMINISTRATOR GUIDE Configure Event Forwarding This page allows you to configure the events, for example, SNMP traps you want forwarded to external systems. It also allows you to configure the external systems to forward the events to. Within event forwarding, you can: • Configu...
Page 41 - Configure Event Severities to Forward; Configure Trap Relaying
C HAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 29 address or a hostname that this appliance can resolve. Example: Protocol=Trap, Host= 192.168.51.150, Port=162. 8. Type protocol, host, and port for the Path Back URL which is the IP address or hostname of this CC-NOC. The Host entered is the web add...
Page 42 - Discover a Single Device
30 COMMANDCENTER NOC ADMINISTRATOR GUIDE 3. Click Configure Trap Relaying . Figure 31 Configure Trap Relaying 4. Click add recipient . Figure 32 Specifying Trap Recipient 5. Specify a hostname that is resolvable from this appliance or an IP address in the Host field. This can be the same platform or...
Page 43 - Edit Performance Thresholds (Per Device)
C HAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 31 Edit Performance Thresholds (Per Device) In addition to configuring performance values per category–see section Configure Performance Thresholds earlier in this chapter, you can also configure performance thresholds on a per-device basis. Per-device...
Page 44 - Administrator Tools; Export and Download Configuration Files; Download Log Files; Check Disk Utilization on Appliance
32 COMMANDCENTER NOC ADMINISTRATOR GUIDE Administrator Tools Administrator tools help you diagnose and fix problems with the CC-NOC. These tools allow you to backup configuration files, download logs, check the disk usage of your CC-NOC, and establish connections to Technical Support. Access adminis...
Page 45 - Send Incident Report
C HAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 33 3. Click Check Disk Utilization on Appliance . Figure 37 Check Disk Utilization on Appliance The Disk Usage section lists the current free space percentages for different areas of the storage within the CC-NOC appliance. The disk storage inside this...
Page 46 - Generate Diagnostics File; Establish Support Connection
34 COMMANDCENTER NOC ADMINISTRATOR GUIDE 4. Type a description of the problem you are experiencing in the text box. 5. Type an email address in Confirmation Email: so that when the incident report email is received, you will get a confirmation message. 6. Click send incident email . Generate Diagnos...
Page 47 - Download Data Archives; Click on the; tab in the top navigation bar.; Click; Download Archived Data; Click one of the files to download.; Advanced Administration; System Software & Signature Updates
C HAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 35 Download Data Archives Every 24 hours, the previous day’s events are placed into an event archival file and made accessible. Download this archival file or unzip it to access a comma-separated value (CSV) file, which can be opened with any spreadshe...
Page 48 - Download Updates; Install Updates
36 COMMANDCENTER NOC ADMINISTRATOR GUIDE All CC-NOC patches and updates are made available on a web server which can be automatically checked by your CC-NOC appliance. If new patches/updates are available, they can also be automatically downloaded, and optionally, automatically applied. The degree t...
Page 49 - View Installed Updates; View All Updates; Configure Automatic Download Settings
C HAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 37 4. Click Install Updates . Figure 44 Install Updates 5. Click install to install any of the updates that are listed. If an update is listed as downloading, it will be available for installation once it is fully downloaded. Check for new updates by a...
Page 50 - Upload Update Manually
38 COMMANDCENTER NOC ADMINISTRATOR GUIDE available, yet do not want them automatically installed, set Auto Download to enable , but leave Auto Install configured as disabled . 1. Click on the Admin tab in the top navigation bar. 2. Click Advanced Administration . 3. Click System Software & Signa...
Page 51 - Appliance Database Administration; Data Backup and Restore; Download a Backup File
C HAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 39 Appliance Database Administration This page allows you to clean out unnecessary or unused information stored in the database, including node information, events, outages, etc. These operations are necessary if you would like to purge some of the dat...
Page 52 - Install a Backup File; Manually Upload a Backup File; Manage Routes
40 COMMANDCENTER NOC ADMINISTRATOR GUIDE 1. Click on the Admin tab in the top navigation bar. 2. Click Advanced Administration . 3. Click Data Backup and Restore. 4. Click Download Backup Files. Figure 49 Download Backup Files 5. Click a file to begin the download. Install a Backup File If restoring...
Page 53 - Add a New Network Route; Prune Unused Performance Data
C HAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 41 2. Click Advanced Administration . 3. Click Manage Routes. Figure 51 Manage Routes 4. To delete a user-defined static route, click remove in the row of the unwanted route . 5. To change the default gateway route, revisit the Configure Network Connec...
Page 54 - Delete Management Settings and Data; Delete Traffic Analysis Performance Information; Note: Traffic analysis performance data is stored in backup files.
42 COMMANDCENTER NOC ADMINISTRATOR GUIDE Delete Management Settings and Data This page gives you a way to completely reset the appliance to nearly a "factory default" state, deleting all collected information and configuration settings. Warning! This action is irreversible. If you download a...
Page 55 - Install CC-NOC License
C HAPTER 2: GENERAL AND ADVANCED ADMINISTRATION 43 3. Click Delete Traffic Analysis Performance Information. Figure 55 Delete Traffic Analysis Performance Data 4. Choose the appliance on which to delete the performance data . 5. Click delete . Install CC-NOC License This page allows you to upload a ...
Page 56 - Installed Appliances List; Installed Appliances List.
44 COMMANDCENTER NOC ADMINISTRATOR GUIDE Note: In a distributed environment, to install a license for a CC-NOC 2500M or CC-NOC 2500S, from the CC-NOC 2500N click on the Admin tab, click Upload Appliance Licenses, and click load new appliance license. Installed Appliances List Use this page to change...
Page 57 - Chapter 3: Configuring Intrusion Detection; Configure a Spanned or Mirrored Port; Ethernet TAP; Benefits; The traffic is always precisely mirrored without alteration.
C HAPTER 3: CONFIGURING INTRUSION DETECTION 45 Chapter 3: Configuring Intrusion Detection This chapter describes procedures to configure a CC-NOC so it can monitor and analyze system events for attempts to access system resources in an unauthorized manner. In the event of an attack, real-time alerts...
Page 58 - Deployment; Configure Appliance Home Networks; CCNOC
46 COMMANDCENTER NOC ADMINISTRATOR GUIDE Deployment Place the Ethernet TAP on the Ethernet cable in the same location where an Ethernet hub would be used. The Ethernet tap has the exact same function as the hub, except that one of the ports is uni-directional and outputs data that is passing over th...
Page 59 - Configure Port Scan Detection
C HAPTER 3: CONFIGURING INTRUSION DETECTION 47 4. Choose the appliance that you wish to configure by clicking Configure next to it. Figure 60 Configuring Home Network for Intrusion Detection Appliance 5. To include an entire subnet in your home network, use the Add Addresses box. Type in the network...
Page 60 - Last Change; Choose the appliance that you wish to configure by clicking; Configure
48 COMMANDCENTER NOC ADMINISTRATOR GUIDE All of the Intrusion Detection appliances that can communicate with this system are listed in the box. The Last Change field indicates the last time that the home network for the appliance was changed. Figure 61 Selecting an Intrusion Detection Appliance for ...
Page 62 - Select Intrusion Detection Appliance(s)
50 COMMANDCENTER NOC ADMINISTRATOR GUIDE Select Intrusion Detection Appliance(s) All of the Intrusion Detection appliances that can communicate with the system hosting this Web Console are listed in the Intrusion Detection Appliance box. The Last Configuration field indicates the last time that the ...
Page 63 - Select Types of Signatures to Monitor; on the; Network; . This category includes a variety of; General Security; for those machines to reduce the; To disable detection, uncheck the check box.; Finish
C HAPTER 3: CONFIGURING INTRUSION DETECTION 51 Select Types of Signatures to Monitor When in doubt, enable detection. There is no disadvantage to enabling extra detection, except that you may receive extraneous events from your Intrusion Detection appliances. You should usually never disable detecti...
Page 64 - Load Default Signatures or Settings from Another Appliance
52 COMMANDCENTER NOC ADMINISTRATOR GUIDE Load Default Signatures or Settings from Another Appliance Alternatively, you can quickly configure your Intrusion Detection appliance by selecting a set of pre-selected signatures appropriate for most networks or by selecting a previously saved appliance’s s...
Page 65 - Advanced Intrusion Detection Administration; Manage Signatures
C HAPTER 3: CONFIGURING INTRUSION DETECTION 53 Advanced Intrusion Detection Administration Advanced administration assists in fine tuning the set of signatures that an intrusion detection application will use to detect intrusion traffic on the network. Manage Signatures The Manage Signatures page al...
Page 66 - Upload Custom Signatures Tool
54 COMMANDCENTER NOC ADMINISTRATOR GUIDE Upload Custom Signatures Tool The Upload Custom Signatures page allows you to upload a specific set of rules that will be sent to a specified Intrusion Detection appliance. This feature can be used to augment the set of signatures that Raritan provides as par...
Page 67 - Chapter 4: Configuring Windows Management; Windows Management Instrumentation (WMI)
CHAPTER 4: CONFIGURING WINDOWS MANAGEMENT 55 Chapter 4: Configuring Windows Management This chapter describes procedures to configure a CC-NOC so it can use Microsoft’s WMI (Windows Management Instrumentation) to monitor and manage Windows servers and workstations in your network. WMI information is...
Page 68 - External Proxy Host Requirements
56 COMMANDCENTER NOC ADMINISTRATOR GUIDE External Proxy Host Requirements For best results, it is recommended to use Windows XP Professional, Service Pack 2 (or later) with auto updates enabled to facilitate communications between CC-NOC and the managed systems. The external proxy needs to meet thes...
Page 69 - Install; Open Ports on External Proxy Host; cmd; Configuring the CC-NOC to communicate with the Proxy
CHAPTER 4: CONFIGURING WINDOWS MANAGEMENT 57 4. Unzip the ProxyInstaller archive on your Windows machine and move the directory to a location where you would like to keep the program. For example, a good location could be: C:\Program Files\Raritan\ProxyInstaller 5. Double-click on ProxyInstaller.exe...
Page 70 - pro x y; add new external proxy; Identifying Local Proxy
58 COMMANDCENTER NOC ADMINISTRATOR GUIDE The Windows Management Configuration Wizard is an interface to specify and configure pro x y h o s t s , which facilitate connectivity between the CC-NOC and your managed Windows servers and workstations. This configuration wizard walks you step-by-step throu...
Page 71 - Specifying Windows Management Ranges
CHAPTER 4: CONFIGURING WINDOWS MANAGEMENT 59 6. Type the IP address for the proxy host. This should be the same host that the configuration tool was run – see section Download and Run earlier in this chapter for additional information. Note: Hostname values in this field must be resolvable via DNS o...
Page 72 - lmhosts; Configure WINS; Proxy Identification and Credentials
60 COMMANDCENTER NOC ADMINISTRATOR GUIDE Note: After windows discovery process is complete, you may notice an overlap in devices that were specified in the Discovery Range – please see Edit Discovery Ranges in Chapter 2: General and Advanced Administration for additional information. Therefore, it m...
Page 74 - Configuring a WINS Server or LMHOSTS File
62 COMMANDCENTER NOC ADMINISTRATOR GUIDE Configuring a WINS Server or LMHOSTS File If you need to collect WMI data from Windows servers that exist in another network and you need to resolve Windows NetBIOS names to IP addresses, on the external proxy you can either: • Configure the WINS server. • Ed...
Page 75 - WINS; Add...; netsh interface ip set WINS <; Edit LMHOSTS File on External Proxy; Notepad
CHAPTER 4: CONFIGURING WINDOWS MANAGEMENT 63 8. Click on the WINS tab. Figure 77Selecting WINS Tab 9. Click the Add… button and specify the address of the WINS server for the remote appliance to use for Windows computer name resolution and click add . Command Line Interface Alternatively, you can is...
Page 76 - Authenticate Windows Computers
64 COMMANDCENTER NOC ADMINISTRATOR GUIDE Authenticate Windows Computers This option allows you to change the authentication usernames and passwords for discovered servers and workstations. 1. Click on the Admin tab in the top navigation bar. 2. Click Windows Management Configuration . 3. Click Authe...
Page 77 - Configure Windows Performance Thresholds; Configure WINS Server or LMHOSTS File on 2500M; Edit WINS Settings
CHAPTER 4: CONFIGURING WINDOWS MANAGEMENT 65 5. Choose the desired operation, for example, change license type to Promoted Workstation . 6. Click submit . To generate an inventory report of the current list of devices, select an output format, for example, HTML or XML, and click generate report . XM...
Page 79 - Edit LMHOSTS File; edit LMHOSTS
CHAPTER 4: CONFIGURING WINDOWS MANAGEMENT 67 Edit LMHOSTS File To resolve Windows NetBIOS names to IP addresses, you can edit the lmhosts file if you are using the internal proxy on the CC-NOC 2500M appliance and a WINS server is not available. 1. Click on the Admin tab in the top navigation bar. 2....
Page 80 - You can also delete all of the; delete; submit changes
68 COMMANDCENTER NOC ADMINISTRATOR GUIDE 5. Specify the IP address of each remote Windows server from which you wish to collect WMI data. 6. You can also delete all of the lmhosts settings for the appliance by clicking delete LMHOSTS file . 7. Click submit changes .
Page 81 - Chapter 5: Configuring Vulnerability Scanning; system vulnerabilities,; Accessing Vulnerability Scanning; Common Vulnerabilities and Exposures (CVE)
CHAPTER 5: CONFIGURING VULNERABILITY SCANNING 69 Chapter 5: Configuring Vulnerability Scanning This chapter describes procedures to configure a CC-NOC so it can scan for vulnerabilities, for example, exploits and thresholds against devices within your network. Scanning for vulnerabilities assists ad...
Page 82 - I Agree; Vulnerability Scan Levels; any
70 COMMANDCENTER NOC ADMINISTRATOR GUIDE 3. Read the warning and at the bottom of the page, click I Agree. By clicking on I Agree and proceeding to the configuration page, you acknowledge these risks and take responsibility for all potential damages and outages. Otherwise, click I Do Not Agree and y...
Page 83 - Scan Level 4; Specify IP Addresses and Schedule the Scan; After clicking; to the warning, click; edit settings; at the bottom of the page.; Single IP or Beginning of Range; field, or a range of IP; End of Range
CHAPTER 5: CONFIGURING VULNERABILITY SCANNING 71 Scan Level 4 Scan Level 4 performs all checks of previous levels and also attempts exploits that are known to be directly harmful to target systems. These include vulnerabilities that can alter data on the target or bring down services or the operatin...
Page 84 - add; save settings; to save all addresses entered and return to the previous page.; schedule this vulnerability scan
72 COMMANDCENTER NOC ADMINISTRATOR GUIDE 3. Click add to have the targets added, or excluded, from the scan. 4. Click save settings to save all addresses entered and return to the previous page. 5. Scroll to the bottom of the page and create a scanning schedule. Vulnerability scanning can be schedul...
Page 85 - Chapter 6: Configuring Notifications; notifi cati on paths,; Enable/Disable Notifications
CHAPTER 6: CONFIGURING NOTIFICATIONS 73 Chapter 6: Configuring Notifications This chapter describes procedures to configure a CC-NOC so it can send and escalate notices through email, pagers, etc. if and when specific CC-NOC events occur. When important events are detected, users may receive a notic...
Page 86 - Configure Event Notifications; notification path; Add/Edit a Notification
74 COMMANDCENTER NOC ADMINISTRATOR GUIDE Configure Event Notifications By configuring event notifications, each system event can be configured to send a notification whenever that event is triggered. 1. Click on the Admin tab in the top navigation bar. 2. Click Notification Configuration . 3. Click ...
Page 87 - Select Event Type; next; Build and Validate an Interface/Service Rule
CHAPTER 6: CONFIGURING NOTIFICATIONS 75 Select Event Type The first step when adding or editing a notification is to select one event type to associate with the notification. Notice that if you are adding a new notice for an existing event, you will bypass this step. Figure 91 Adding a New Event Not...
Page 88 - OR
76 COMMANDCENTER NOC ADMINISTRATOR GUIDE 6. Click one of the radio buttons: • To NOT build a rule, click Do not constrain notice against interface or service. • To build a rule, click Send notice only if it contains an interface that matches the interface/service rule below. 7. If you selected to bu...
Page 89 - Enter Content for Notification and Notification Path
CHAPTER 6: CONFIGURING NOTIFICATIONS 77 8. If you do not wish to validate the rule or did not define an interface/service rule, click skip results validation to continue. Otherwise, click validate rule results to provide a visual representation of the rule just built and check that the TCP/IP addres...
Page 90 - Guide; Configure Notification Groups
78 COMMANDCENTER NOC ADMINISTRATOR GUIDE and will also appear in the Notification Browser as described in Raritan’s CC-NOC User Guide . 15. Type an Email Subject that will appear as the subject of the email sent as a result of this Event Notification. This is optional and a default subject “ Notice ...
Page 91 - Add/Modify a Notification Group
CHAPTER 6: CONFIGURING NOTIFICATIONS 79 notification path – please see section Configure Notification Paths later in this chapter for additional information. Note: To assign users to a group, the users must be pre-defined – please see section Add a New User in Chapter 8: Creating Users, Categories, ...
Page 93 - Configure Notification Paths; Add/Edit a Notification Path
CHAPTER 6: CONFIGURING NOTIFICATIONS 81 Configure Notification Paths In this section, you will create notification paths that defines the users or groups who will receive notifications, how the notifications will be sent, for example, numeric or text pagers, email, and who to notify if escalation is...
Page 94 - Create New Path Name and Specify Targets; Type a unique new; path name; Choose one of the; target types; for this notification path:; User Target
82 COMMANDCENTER NOC ADMINISTRATOR GUIDE Create New Path Name and Specify Targets In this step, you need to specify a new name and select a target, that is, user, group, or email. Figure 101 Configuring a Notification Path To create a new notification path: 4. Type a unique new path name . The name ...
Page 95 - Modify a Notification Path
CHAPTER 6: CONFIGURING NOTIFICATIONS 83 • For Group Target , select only one group as previously defined, please see section Configure Notification Groups earlier in this chapter for details, and specify an interval, that is, minutes, hour, or days, to indicate how long to wait before sending the no...
Page 96 - Define Escalation in Notification Path; for this escalation notification:
84 COMMANDCENTER NOC ADMINISTRATOR GUIDE Define Escalation in Notification Path In this step, you need to define how long the CC-NOC will wait until it sends a subsequent notification after sending out the first one. You also need to specify who will be receiving this subsequent notification. Figure...
Page 97 - Group Target; , select only one group as previously defined, see section; For; Email Target; , type an email address for the notification path.; add escalation
CHAPTER 6: CONFIGURING NOTIFICATIONS 85 • For Group Target , select only one group as previously defined, see section Configure Notification Groups earlier in this chapter for additional information, specify an interval, that is, minutes, hour, or days, to indicate how long to wait before sending th...
Page 98 - Configure TAP Paging; TAP Modem Settings; box by clicking; edit; Notification Configuration; TAP Paging Configuration
86 COMMANDCENTER NOC ADMINISTRATOR GUIDE Configure TAP Paging This section explains configuring the Telocator Alphanumeric Protocol (TAP) for a specific paging service provider. This allows the CC-NOC to send notifications to users' pagers if the appliance has its modem connected to a telephone line...
Page 99 - Add a new TAP Service
CHAPTER 6: CONFIGURING NOTIFICATIONS 87 Add a new TAP Service In this step, you need to enter the phone number, baud rate, and other information for a TAP service. Different phone carriers will typically have separate TAP services so if you have pagers from different phone carriers or from different...
Page 100 - Edit Modem Parameters
88 COMMANDCENTER NOC ADMINISTRATOR GUIDE Edit Modem Parameters In this step, you will set up the modem parameters. If your modem requires special parameters for initialization or dialing prefixes, such as dialing "9" to get an outside line, you’ll need to enter these parameters. These settin...
Page 101 - Chapter 7: Managing Assets; Map; Manage Assets; Import Assets; Assets
CHAPTER 7: M ANAGING A SSETS 89 Chapter 7: Managing Assets This chapter describes procedures to configure a CC-NOC so it can track and share important information about capital assets in your organization. This data, when coupled with information about your network that is obtained by the CC-NOC dur...
Page 103 - Export Assets; Map Unassociated Assets to Nodes
CHAPTER 7: M ANAGING A SSETS 91 Export Assets All the nodes with asset information can be exported to a comma-separated value file ( CSV), which is suitable for use in a spreadsheet application. If you do an import into the CC-NOC with this CSV file , you will be asked to re-map all assets that were...
Page 104 - Clear All Asset Records; tab in the top navigation tab bar.; Manage assets; clear asset records
92 COMMANDCENTER NOC ADMINISTRATOR GUIDE Clear All Asset Records This allows you to remove all asset records from the CC-NOC. Be sure to export the assets if you ever need to recover this data in the future. If you are rebuilding the asset records from an export via the CC-NOC, you will need to clea...
Page 105 - Add a New User; add new user; username
C HAPTER 8: C REATING U SERS , C ATEGORIES , V IEWS 93 Chapter 8: Creating Users, Categories, Views This chapter describes procedures to add users, delete and modify users, build views, and create categories. Build your own custom way of looking at your network, called views, and then assign them to...
Page 106 - Edit a User
94 COMMANDCENTER NOC ADMINISTRATOR GUIDE • Operators have access to everything on the CC-NOC except administrative configurations. • Executive User have read-only access to only a few key reports that show the network health at a high level. • Admin have configuration access to the CC-NOC. 7. ...
Page 107 - Adding/Editing a Duty Schedule
C HAPTER 8: C REATING U SERS , C ATEGORIES , V IEWS 95 5. Supply a full name and enter comments. This is optional. 6. If desired, provide Executive User Constraints to provide an executive-level user access only to the specified category and appliance that is specified. This user will not be able to...
Page 108 - save; delete selected; Configure Categories; Categories
96 COMMANDCENTER NOC ADMINISTRATOR GUIDE 6. Choose the start time and stop time from the select boxes. If a user works a shift that spans midnight you will have to enter two duty schedules. One from the start of the shift till midnight, and the second on the next day from midnight till the end of th...
Page 109 - views
C HAPTER 8: C REATING U SERS , C ATEGORIES , V IEWS 97 Web Servers Includes all managed interfaces which are running an HTTP (web) server on port 80 or other common ports. Categories can then be combined into views , providing you the ability to focus users on the nodes that are pertinent to their r...
Page 111 - Configure Views
C HAPTER 8: C REATING U SERS , C ATEGORIES , V IEWS 99 Configure Views Configuring views allows you to create a mapping between users and views, or sets of categories, they will see when logging into the CC-NOC. Views are simply the combination of categories that your users will see when logging in....
Page 112 - Add/Modify an Existing View
100 COMMANDCENTER NOC ADMINISTRATOR GUIDE Add/Modify an Existing View In this page, you can add a new view or modify an existing one, including adding or removing sections, for example, logical groupings of categories under a common heading, as well as the categories within them. To create or modify...
Page 113 - Map Users
C HAPTER 8: C REATING U SERS , C ATEGORIES , V IEWS 101 Map Users After creating views, you can now map users to a view that will be displayed after they log into the CC-NOC. If users are not mapped to a specific view, then the Default view that was selected in section Configure Views will be displa...
Page 115 - Appendix A: Specifications; V1 Platform; General Specifications; Not Applicable; Environmental Requirements; Operate properly at any altitude between
APPENDIX B : TROUBLESHOOTING 103 Appendix A: Specifications V1 Platform General Specifications Form Factor 1U Dimensions (DxWxH) 24.21”x 19.09” x 1.75” 615mm x 485mm x 44mm Weight 23.80lb (10.80kg) Power Single Supply (1 x 300 watt) Operating Temperature 10 ℃ - 35 ℃ (50 ℉ - 95 ℉ ) Mean Time Between ...
Page 116 - Electrical Specifications; Average Power Consumption:
104 COMMANDCENTER NOC ADMINISTRATOR GUIDE N ON -O PERATING Temperature -40 - +60 (-40 -140 ) Humidity 5% - 95% RH Altitude Operate properly at any altitude between 0 to 10,000 feet, storage 40,000 feet (Estimated) Vibration 5-55-5 HZ, 0.38mm,1 minutes per cycle; 30 minutes for each axis (X,Y,Z) Shoc...
Page 117 - Appendix B: Troubleshooting; The Raritan Support Structure; Raritan Support Structure; , we will provide details on how to maintain and troubleshoot; The CC-NOC’s Ability to SSH to Raritan
APPENDIX B : TROUBLESHOOTING 105 Appendix B: Troubleshooting Raritan wants to be involved from the beginning of your deployment and throughout the entire lifetime of your use of Raritan products. We have identified the following as the three pillars on which the success of your deployment rests: • Y...
Page 118 - Checking Appliance Database Settings; establish; RAID Array Failure; Degraded RAID Array; Discovery; p in g
106 COMMANDCENTER NOC ADMINISTRATOR GUIDE Checking Appliance Database Settings From time to time, you may see this message: It is recommended you contact Technical Support, who can then request SSH access to your appliance. You can allow this access and open an SSH connection by clicking the establi...
Page 119 - Capability Scanning; suspe ct nod e; not; remove those services.; Pollers; page, but it is strongly advised that you consider the; Notifications
APPENDIX B : TROUBLESHOOTING 107 Capability Scanning The capability scanning service scans individual nodes to discover which services are supported on that node. It uses an intelligent service discovery mechanism and relies heavily upon communication over the TCP protocol (and sometimes UDP). In it...
Page 120 - SNMP Data Collection; good deal more information than the CC-NOC can obtain remotely.; Windows Management
108 COMMANDCENTER NOC ADMINISTRATOR GUIDE The notifications service does not generate any events; it only reacts to them. It does, however, save its history in the database so that you can review past notifications. SNMP Data Collection The SNMP data collection service collects additional data from ...
Page 121 - Your Network; Contacting Raritan; Help; tab. You may be requested by Technical Support to establish
APPENDIX B : TROUBLESHOOTING 109 Your Network Understanding and maintaining your network is the key to success. The Raritan services will help you understand and troubleshoot your network, as it relates to the CC-NOC. This chapter, however, is about troubleshooting the CC-NOC. Raritan Support Struct...
Page 122 - node detail
110 COMMANDCENTER NOC ADMINISTRATOR GUIDE If you are confident that the CC-NOC can ping the node in question, the next step is to confirm that the CC-NOC has discovered a device correctly. Check the following things: If the ping was successful, the CC-NOC will generate a suspect node event. The text...
Page 123 - The X service has been discovered on interface WWW.XXX.YYY.ZZZ; Do the NetBIOS Node Names Match?
APPENDIX B : TROUBLESHOOTING 111 the Admin tab, Network Management , and Configure Pollers . For each service that responds during the intelligent service scan, the system will generate a “Node Gained Service” event. The text of this event will look like the following: The X service has been discove...
Page 124 - Microsoft Exchange -; If a; and; synthetic transactions
112 COMMANDCENTER NOC ADMINISTRATOR GUIDE Why Can’t My CC-NOC Manage X Service? ICMP - If a device responds to a "ping", which uses ICMP for its transport, the device will be flagged as supporting ICMP and will be tested for ICMP availability on the standard polling interval. Microsoft Excha...
Page 125 - Why am I Not Receiving Notifications?
APPENDIX B : TROUBLESHOOTING 113 If a service successfully connects, but otherwise "fails", a "service unresponsive" event is generated. An example of this would be a poller sends a TCP connect request… and gets a connecting, but within the “timeout” period there is no response. Thus...
Page 126 - for any default notifications sent to the; What Conditions Cause a Notification to be Sent?; SNMP – What it is and What it Does
114 COMMANDCENTER NOC ADMINISTRATOR GUIDE The Management group receives notifications for any default notifications sent to the Network/Systems, Windows Management, or Security groups. Any notification sent to these groups is given, by default, a 15 minute window for acknowledgement. The Reporting g...
Page 127 - or via the Edit the SNMP Ranges page; , it will query the newly discovered; Troubleshooting SNMP Data Collection
APPENDIX B : TROUBLESHOOTING 115 Of these five, Raritan only uses three: • GET - A message sent from the Manager to the Agent requesting information • GET RESPONSE – The message the Agent sends to the Manager in reply to a GET transaction, and • TRAP – An unsolicited message from an Agent to the Man...
Page 128 - Use the; SNMP Walk; tool on the Network Infrastructure Tools page from the; Tools; tab. This is the quickest and easiest method.; GetIF; A d d re s se s; Vulnerability Scanning
116 COMMANDCENTER NOC ADMINISTRATOR GUIDE In most cases, if the CC-NOC is not collecting data from a particular device, it’s usually because of a misconfiguration on the remote device. Often, incorrect community strings are the culprit, or the SNMP service has not been turned on or configured correc...
Page 129 - Vulnerability Scanning Configuration; If you are; only; scanning for at least Level 2 scans.; exclude; them from scanning. Visit the; Admin-> Vulnerability Scanning Configuration; page and enter their IP addresses in the exclude list.; Vulnerabilities; and interface pages.; Historic Data and Graphs; How is Performance Data Summarized?
APPENDIX B : TROUBLESHOOTING 117 from the CC-NOC to the device and that TCP and UDP are working. If you have already performed the troubleshooting steps for Pollers and Capability Scanning on the node in question, you have adequately tested this. If you are having trouble with vulnerability scanning...
Page 130 - Search; How Do I Interpret the SNMP Graphs/Reports?; Additional Support; The Tools Discussed in this Chapter; GetIF –; Documentation; Our documentation is available from the CC-NOC, under the; tab, and is also available on
118 COMMANDCENTER NOC ADMINISTRATOR GUIDE SNMP, used for collection performance data for reporting, is still considered a service and as such, if a poll fails, it will still generate an outage that is integrated with the notification system. To determine if an interface supports SNMP, check the appr...
Page 133 - Appendix C: Performance Monitoring; Overview
APPENDIX C : PERFORMANCE MONITORING 121 Appendix C: Performance Monitoring Overview The CC-NOC is designed to provide you with the information necessary to support critical decisions in your environment. Depending on your role, the nature of those decisions may be different, from a help desk technic...
Page 136 - SNMP Data Collection Enhancements; Measured Component
124 COMMANDCENTER NOC ADMINISTRATOR GUIDE Cisco Network gear CPU Utilization Free Memory Buffer failures Buffer memory allocation failures Provides insight as to router sizing and performance, especially as augmented by MIB2 data. Bay/Wellfleet Routers/Switches Total kernel tasks Total kernel tasks ...
Page 137 - Not available on Windows 98 or Millenium Edition; Leveraging Performance Data in Network Management
APPENDIX C : PERFORMANCE MONITORING 125 Memory In Use Free Physical Memory Total Logical Memory Logical Memory In Use Percent Logical Memory In Use Free Logical Memory Memory Pages per Second 1 underpowered devices. Processor (CPU) Total Processor Time Processor Queue Length 1 Interrupts per Second ...
Page 138 - Thresholding; How it works; threshold; Type
126 COMMANDCENTER NOC ADMINISTRATOR GUIDE on demand. The remaining item is determining when performance metrics have reached a point at which they should be acted upon. And with the CC-NOC’s capability of managing performance thresholds, that’s easy too! Thresholding An exciting new feature signific...
Page 139 - SNMP Performance Metric Thresholds
APPENDIX C : PERFORMANCE MONITORING 127 Example Here’s an example. There is a high threshold set with a value of 70, a trigger of 3, and a rearm of 55. A new value is generated every minute. The first reported value is 65, which is less than our high threshold of 70, so no action is taken. The next ...
Page 140 - Windows Performance Metric Thresholds
128 COMMANDCENTER NOC ADMINISTRATOR GUIDE Windows Performance Metric Thresholds The following values apply to data reported by Windows boxes. Note that there are separate events for Workstations and Servers – this is due to what data points Microsoft reveals. The event associated with a reported val...
Page 141 - Appendix D: Setting up WMI on Target Machines; Windows Management Instrumentation; Add the program
APPENDIX D : SETTING UP WMI ON TARGET MACHINES 129 Appendix D: Setting up WMI on Target Machines Configuring a Windows 98/ME box for Remote WMI Management The ability of the CC-NOC to manage Windows 98 and Windows ME systems is limited by the design of the Windows platform. Windows 98 and ME are con...
Page 142 - Configuring a Windows Proxy Details
130 COMMANDCENTER NOC ADMINISTRATOR GUIDE 3. Add the machine to the domain using the control panel, network settings by doing the following: • Start->Settings->Control Panel->Network. • Select Client for Microsoft Networks from the tab. • Click on the tab named Properties . • Check the box ...
Page 145 - and in turn, what that; How the Intrusion Detection works; f a l s e p o s i t iv e s ,; Reducing False Positives with the Signature Profiler
APPENDIX E : MANAGING AND RESPONDING TO INTRUSION DETECTION EVENTS 133 Appendix E: Managing and Responding to Intrusion Detection Events This appendix is intended to provide a little insight as to how Raritan goes about assessing the traffic that the CC-NOC sees, determining what constitutes an e v ...
Page 146 - Responding to Events and Notifications; Event Categories; systems at a user level that have failed.; What do I do when...
134 COMMANDCENTER NOC ADMINISTRATOR GUIDE as to whether or not new signatures should be applied to a given CC-NOC. This reduces your workload, while automating the most difficult part of intrusion detection—keeping it up-to-date. Responding to Events and Notifications Once you’ve used the Signature ...
Page 147 - What if I have been hacked?; is
APPENDIX E : MANAGING AND RESPONDING TO INTRUSION DETECTION EVENTS 135 • Are all of your systems at the most recent revision of operating system and patch • level? Patches and hot-fixes are extremely important for Microsoft platforms. • Have my network platforms been upgraded to avoid unnecessary ri...
Page 149 - Appendix F: Notification Parameters; Notification Parameter Substitution
APPENDIX F : NOTIFICATION PARAMETERS 137 Appendix F: Notification Parameters Notification Parameter Substitution The notification subsystem is very robust and flexible, allowing the appropriate notification of the appropriate personnel at the appropriate time. One feature you have control over is th...
Page 150 - replaced by the total number of parameters
138 COMMANDCENTER NOC ADMINISTRATOR GUIDE %event[parm[name]]% replaced by the value of the parameter named 'name', if present %event[parm[##]]% replaced by the total number of parameters %event[parm[#]]% replaced by the value of the parameter number '#', if present Assets: The format of an asset par...
Page 151 - ICMP pings; ICMP Pings
APPENDIX G : NETWORK TRAFFIC OVERHEAD : NETWORK MANAGEMENT ’ S NECESSARY EVIL 139 Appendix G: Network Traffic Overhead: Network Management’s Necessary Evil On five-minute intervals, the CC-NOC polls services on managed nodes using Raritan's 'synthetic transactions'. These transactions serve to bette...
Page 152 - seconds; HTTP Synthetic Transaction; HTTP Response and
140 COMMANDCENTER NOC ADMINISTRATOR GUIDE CK-ACK three-way handshake, which when completed, indicates that the port is listening and accepting connections. This handshake is a pre-cursor to any TCP session and is also embedded within most other synthetic transactions, including HTTP, which we'll dis...
Page 154 - Additional Notes
142 COMMANDCENTER NOC ADMINISTRATOR GUIDE In addition to polling overhead, our services scan will run less than once a day and generate traffic roughly equivalent to a single polling interval. If vulnerability scanning is enabled, the CC-NOC will also generate the traffic associated with completing ...