Product Guide
Page 1
M-8000 Sensor Product Guide revision 2.0 McAfee® IntruShield® IPS IntruShield M-8000 Sensor version 4.1 McAfee® Network Protection Industry-leading intrusion prevention solutions
M-8000 Sensor Product Guide revision 2.0 McAfee® IntruShield® IPS IntruShield M-8000 Sensor version 4.1 McAfee® Network Protection Industry-leading intrusion prevention solutions
Product Guide
Page 2
.... Miller, (C) 1998. * Software copyrighted by Chris Torek. Issued JUNE 2009 / M-8000 Sensor Product Guide 700-1763-00-G/ 2.0 - Sauder. * Software developed by Douglas ...1998-2000. * Software copyrighted by Gunnar Ritter. * Software copyrighted by Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, California 95054, U.S.A., (C) 2003. * Software copyrighted by Gisle Aas. (C) ... Copyright (C) 2001, 2002, 2003. Siek (C) 1997-2000 University of McAfee, Inc. TRADEMARKS ACTIVE FIREWALL, ACTIVE SECURITY, ACTIVESECURITY (AND IN KATAKANA), ACTIVESHIELD, CLEAN-UP, DESIGN (STYLIZED E), ...
.... Miller, (C) 1998. * Software copyrighted by Chris Torek. Issued JUNE 2009 / M-8000 Sensor Product Guide 700-1763-00-G/ 2.0 - Sauder. * Software developed by Douglas ...1998-2000. * Software copyrighted by Gunnar Ritter. * Software copyrighted by Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, California 95054, U.S.A., (C) 2003. * Software copyrighted by Gisle Aas. (C) ... Copyright (C) 2001, 2002, 2003. Siek (C) 1997-2000 University of McAfee, Inc. TRADEMARKS ACTIVE FIREWALL, ACTIVE SECURITY, ACTIVESECURITY (AND IN KATAKANA), ACTIVESHIELD, CLEAN-UP, DESIGN (STYLIZED E), ...
Product Guide
Page 3
Contents Preface ...v Introducing McAfee IntruShield IPS v About this guide...v Audience ...v Contents of this guide...vi Contacting Technical Support ...vi Related documentation ...vi Conventions used in this guide ...vii Chapter 1 Overview 1 About IntruShield sensors ...1 Sensor functionality ...1 Network topology considerations 1 M-8000 key features...2 M-8000 physical description...2 Ports ...3 Front panel LEDs ...5 Chapter 2 Before You Install 7 Usage Restrictions ...7 Safety...
Contents Preface ...v Introducing McAfee IntruShield IPS v About this guide...v Audience ...v Contents of this guide...vi Contacting Technical Support ...vi Related documentation ...vi Conventions used in this guide ...vii Chapter 1 Overview 1 About IntruShield sensors ...1 Sensor functionality ...1 Network topology considerations 1 M-8000 key features...2 M-8000 physical description...2 Ports ...3 Front panel LEDs ...5 Chapter 2 Before You Install 7 Usage Restrictions ...7 Safety...
Product Guide
Page 4
Cabling for in-line ...21 Cabling for TAP mode ...21 Cabling for SPAN or hub mode 22 Cabling the Failover interconnection ports 22 Using Fail-Open hardware ...23 Chapter 5 Troubleshooting 24 Appendix A Sensor Technical Specifications 25 iv
Cabling for in-line ...21 Cabling for TAP mode ...21 Cabling for SPAN or hub mode 22 Cabling the Failover interconnection ports 22 Using Fail-Open hardware ...23 Chapter 5 Troubleshooting 24 Appendix A Sensor Technical Specifications 25 iv
Product Guide
Page 5
.... Preface This preface provides a brief introduction to McAfee IntruShield, discusses the information in the market. IntruShield combines real-time detection and prevention to setup your M-8000 sensor model. About this guide This guide contains information necessary to provide the most comprehensive, accurate, and scalable network IPS solution for installing, configuring, and maintaining sensors...
.... Preface This preface provides a brief introduction to McAfee IntruShield, discusses the information in the market. IntruShield combines real-time detection and prevention to setup your M-8000 sensor model. About this guide This guide contains information necessary to provide the most comprehensive, accurate, and scalable network IPS solution for installing, configuring, and maintaining sensors...
Product Guide
Page 6
...name and password for assistance: Online Contact McAfee Technical Support http://mysupport.mcafee.com. Contacting Technical Support If you must follow prior to configuring the sensor. • Chapter 4: Attaching Cables to the M-8000 Sensor describes how to attach network, monitoring, configuration, and response cables to ...of your system when opening a ticket with the online case submit, software downloads, and signature updates. McAfee® IntruShield® IPS 4.1 M-8000 Sensor Product Guide Contents of this guide Contents of this guide This guide is organized as operating and environmental ...
...name and password for assistance: Online Contact McAfee Technical Support http://mysupport.mcafee.com. Contacting Technical Support If you must follow prior to configuring the sensor. • Chapter 4: Attaching Cables to the M-8000 Sensor describes how to attach network, monitoring, configuration, and response cables to ...of your system when opening a ticket with the online case submit, software downloads, and signature updates. McAfee® IntruShield® IPS 4.1 M-8000 Sensor Product Guide Contents of this guide Contents of this guide This guide is organized as operating and environmental ...
Product Guide
Page 7
...; Special Topics Guide • Database Tuning • Best Practices • Denial-of keys on the User Interface (UI) are denoted using UPPER CASE. McAfee® IntruShield® IPS 4.1 M-8000 Sensor Product Guide Conventions used in this guide • Sensor Configuration Guide-using CLI • Sensor Configuration Guide-using the Wizard For information...
...; Special Topics Guide • Database Tuning • Best Practices • Denial-of keys on the User Interface (UI) are denoted using UPPER CASE. McAfee® IntruShield® IPS 4.1 M-8000 Sensor Product Guide Conventions used in this guide • Sensor Configuration Guide-using CLI • Sensor Configuration Guide-using the Wizard For information...
Product Guide
Page 8
Caution: Information that you to prevent injury, accidents from contact with electricity, or other serious consequences is denoted using this notation. Note: Conventions used in this notation. McAfee® IntruShield® IPS 4.1 M-8000 Sensor Product Guide Convention Information that you must read before beginning a procedure or that alerts you must read to negative consequences of certain actions, such as loss of data is denoted using this notation. Warning: Notes that provide related, but non-critical, information are denoted using this guide Example viii
Caution: Information that you to prevent injury, accidents from contact with electricity, or other serious consequences is denoted using this notation. Note: Conventions used in this notation. McAfee® IntruShield® IPS 4.1 M-8000 Sensor Product Guide Convention Information that you must read before beginning a procedure or that alerts you must read to negative consequences of certain actions, such as loss of data is denoted using this notation. Warning: Notes that provide related, but non-critical, information are denoted using this guide Example viii
Product Guide
Page 9
... sensors IntruShield sensors are specifically designed to handle traffic at key network access points, an IntruShield sensor provides real-time traffic monitoring to detect malicious activity and respond to the security needs of this guide. IntruShield sensors are high-performance, scalable,... and even blocking attack packets entirely before they reach the intended target. If an attack is described in detail in the network traffic that indicate malicious activity. CHAPTER 1 Overview This chapter provides an introduction to its configured policy. The IntruShield ISM server...
... sensors IntruShield sensors are specifically designed to handle traffic at key network access points, an IntruShield sensor provides real-time traffic monitoring to detect malicious activity and respond to the security needs of this guide. IntruShield sensors are high-performance, scalable,... and even blocking attack packets entirely before they reach the intended target. If an attack is described in detail in the network traffic that indicate malicious activity. CHAPTER 1 Overview This chapter provides an introduction to its configured policy. The IntruShield ISM server...
Product Guide
Page 10
...; Dual power supply • 6 Fan units (that are field replaceable) M-8000 physical description The high-port density IntruShield M-8000, designed for the monitoring of a network topology using Gigabit Ethernet throughput. Additionally, it supports eight 1 Gigabit 2 McAfee® IntruShield® IPS 4.1 M-8000 Sensor Product Guide Overview M-8000 key features The IntruShield sensor is purpose-built for high...
...; Dual power supply • 6 Fan units (that are field replaceable) M-8000 physical description The high-port density IntruShield M-8000, designed for the monitoring of a network topology using Gigabit Ethernet throughput. Additionally, it supports eight 1 Gigabit 2 McAfee® IntruShield® IPS 4.1 M-8000 Sensor Product Guide Overview M-8000 key features The IntruShield sensor is purpose-built for high...
Product Guide
Page 11
McAfee® IntruShield® IPS 4.1 M-8000 Sensor Product Guide Overview M-8000 physical description dull-duplex Ethernet segments or sixteen 1 Gigabit SPAN ports transmitting aggregated traffic. Ports The M-8000 sensor consists of two 2RU units and is equipped with the following components: Name 1 2 3 4 5 6 7 8 9 10 11 12 Description Management port (on M-8000... P only) Console port Auxiliary port SFP Gigabit Ethernet Monitoring ports XFP Gigabit Ethernet Monitoring ports XFP Interconnect ports Response port (on M-8000 S only) Fail-Open Control...
McAfee® IntruShield® IPS 4.1 M-8000 Sensor Product Guide Overview M-8000 physical description dull-duplex Ethernet segments or sixteen 1 Gigabit SPAN ports transmitting aggregated traffic. Ports The M-8000 sensor consists of two 2RU units and is equipped with the following components: Name 1 2 3 4 5 6 7 8 9 10 11 12 Description Management port (on M-8000... P only) Console port Auxiliary port SFP Gigabit Ethernet Monitoring ports XFP Gigabit Ethernet Monitoring ports XFP Interconnect ports Response port (on M-8000 S only) Fail-Open Control...
Product Guide
Page 12
... Configuration Guide-using the CLI of the primary sensor. The supply uses a standard IEC port (IEC320-C13). McAfee® IntruShield® IPS 4.1 M-8000 Sensor Product Guide Overview M-8000 physical description 1 One RJ-45 10/100/1000 Management port on -line KnowledgeBase at https://mysupport....mcafee.com. 10 Two Primary Power Supplies-A (included). For more information, see the on M-8000 P, which is used to set up and configure the sensor. 4 Sixteen small form-factor pluggable (SFP...
... Configuration Guide-using the CLI of the primary sensor. The supply uses a standard IEC port (IEC320-C13). McAfee® IntruShield® IPS 4.1 M-8000 Sensor Product Guide Overview M-8000 physical description 1 One RJ-45 10/100/1000 Management port on -line KnowledgeBase at https://mysupport....mcafee.com. 10 Two Primary Power Supplies-A (included). For more information, see the on M-8000 P, which is used to set up and configure the sensor. 4 Sixteen small form-factor pluggable (SFP...
Product Guide
Page 13
... is normal. (Chassis temperature OK.) Inlet air temperature measured inside chassis is functioning. Amber Sensor is functioning. The link is connected. The M-8000 does not have internal taps; Management Port Link Green Off The link is disconnected. Pwr B (Power B) Green Amber Power Supply B is ... on external compact flash. (For example, the Fail-Open Controller has been inserted.) No activity on its ports. McAfee® IntruShield® IPS 4.1 M-8000 Sensor Product Guide Overview M-8000 physical description 11 Two Power Supplies-B (optional, purchased separately).
... is normal. (Chassis temperature OK.) Inlet air temperature measured inside chassis is functioning. Amber Sensor is functioning. The link is connected. The M-8000 does not have internal taps; Management Port Link Green Off The link is disconnected. Pwr B (Power B) Green Amber Power Supply B is ... on external compact flash. (For example, the Fail-Open Controller has been inserted.) No activity on its ports. McAfee® IntruShield® IPS 4.1 M-8000 Sensor Product Guide Overview M-8000 physical description 11 Two Power Supplies-B (optional, purchased separately).
Product Guide
Page 15
... voltages and currents inside the chassis, contain electromagnetic interference (EMI) that might disrupt other than operating the IntruShield IPS. • McAfee prohibits the modification or installation of any hardware or software in the sensor appliance that the host is connected to power lines, remove...: • Read the installation instructions before you connect the system to its power source. • To remove all power from the M-8000 sensor, unplug all power cords, including the redundant power cord. • Only trained and qualified personnel should be grounded. Ensure that is...
... voltages and currents inside the chassis, contain electromagnetic interference (EMI) that might disrupt other than operating the IntruShield IPS. • McAfee prohibits the modification or installation of any hardware or software in the sensor appliance that the host is connected to power lines, remove...: • Read the installation instructions before you connect the system to its power source. • To remove all power from the M-8000 sensor, unplug all power cords, including the redundant power cord. • Only trained and qualified personnel should be grounded. Ensure that is...
Product Guide
Page 16
McAfee® IntruShield® IPS 4.1 M-8000...Some LAN and WAN ports both use with the M-8000 sensor. These limits are designed to correct the ... • two printed Quick Start Guide. • Release Notes. 8 McAfee provides a standard and international power cables. • two sets of rack ...interference to cause harmful interference in the M-8000 sensor crate: • two sensors (M-8000 P and M-8000 S). • two power supplies. •... (SELV) circuits to comply with Fiber-Optic ports The IntruShield M-8000 sensor uses fiber-optic connectors for example, SFP/XFP, FDDI, OC...
McAfee® IntruShield® IPS 4.1 M-8000...Some LAN and WAN ports both use with the M-8000 sensor. These limits are designed to correct the ... • two printed Quick Start Guide. • Release Notes. 8 McAfee provides a standard and international power cables. • two sets of rack ...interference to cause harmful interference in the M-8000 sensor crate: • two sensors (M-8000 P and M-8000 S). • two power supplies. •... (SELV) circuits to comply with Fiber-Optic ports The IntruShield M-8000 sensor uses fiber-optic connectors for example, SFP/XFP, FDDI, OC...
Product Guide
Page 17
...the packing list and in case you need to move or ship the sensor. 14 Remove the secondary sensor (M-8000 S). 15 Repeat Step 5 through Step 13. 9 McAfee® IntruShield® IPS 4.1 M-8000 Sensor Product Guide Before You Install Unpacking the sensor Unpacking the sensor To unpack the sensor: 1 Open crate....Verify you have received all parts. These parts are listed on the packing list and in Contents of the sensor box. 4 Remove the primary sensor (M-8000 P). 5 Place the sensor box as close to the installation site as possible. 6 Position the box with the text upright. 7 Open the top ...
...the packing list and in case you need to move or ship the sensor. 14 Remove the secondary sensor (M-8000 S). 15 Repeat Step 5 through Step 13. 9 McAfee® IntruShield® IPS 4.1 M-8000 Sensor Product Guide Before You Install Unpacking the sensor Unpacking the sensor To unpack the sensor: 1 Open crate....Verify you have received all parts. These parts are listed on the packing list and in Contents of the sensor box. 4 Remove the primary sensor (M-8000 P). 5 Place the sensor box as close to the installation site as possible. 6 Position the box with the text upright. 7 Open the top ...
Product Guide
Page 18
... mounting ears and rails to the sensor as described below .) 2 Installing interface modules (SFP and XFP). 3 Attaching power, network, and monitoring cables. (See Attaching Cables to the M-8000 sensor.) 4 Powering on the sensor. (See Powering on the sensor.) Once you have set up and powered on the sensor...chassis, follow these steps-using a Phillips screwdriver to the switches or routers it for configuration. To mount the sensor in a physically secure location, close to secure the Phillips flathead screws: 10 CHAPTER 3 Setting up an M-8000 This chapter describes the process of two 2RU units...
... mounting ears and rails to the sensor as described below .) 2 Installing interface modules (SFP and XFP). 3 Attaching power, network, and monitoring cables. (See Attaching Cables to the M-8000 sensor.) 4 Powering on the sensor. (See Powering on the sensor.) Once you have set up and powered on the sensor...chassis, follow these steps-using a Phillips screwdriver to the switches or routers it for configuration. To mount the sensor in a physically secure location, close to secure the Phillips flathead screws: 10 CHAPTER 3 Setting up an M-8000 This chapter describes the process of two 2RU units...
Product Guide
Page 19
... refer to the rack. When removing the chassis from the rack Note: Because of the weight of the appliance, McAfee recommends that power is intended for placement at the back of the rails, press in -one rails, two chassis ears... access to your sensors. You can also mid-mount the Sensor (optional). Ensure to fasten the ears securely to M-8000 Quick Start Guide. On each side of the chassis. 5 Mount L-shape and external rail to the front and ... Removing a sensor from the rack, pull chassis forward until you should have all network interface cables from the rail cabinet.
... refer to the rack. When removing the chassis from the rack Note: Because of the weight of the appliance, McAfee recommends that power is intended for placement at the back of the rails, press in -one rails, two chassis ears... access to your sensors. You can also mid-mount the Sensor (optional). Ensure to fasten the ears securely to M-8000 Quick Start Guide. On each side of the chassis. 5 Mount L-shape and external rail to the front and ... Removing a sensor from the rack, pull chassis forward until you should have all network interface cables from the rail cabinet.
Product Guide
Page 20
... outlet facing front and on the left side of the faceplate. 12 Each of these modules has one hot swappable supply. McAfee® IntruShield® IPS 4.1 M-8000 Sensor Product Guide Setting up an M-8000 Using the redundant power supply Figure 2: Rail release latch Using the redundant power supply A basic configuration of the... power supply is in the power supply slot. 3 Do not operate the sensor without the faceplate panel in place. 4 Place the power supply in the M-8000: 1 Unpack the power supply from McAfee) for insertion or extraction from the unit as well as a release latch.
... outlet facing front and on the left side of the faceplate. 12 Each of these modules has one hot swappable supply. McAfee® IntruShield® IPS 4.1 M-8000 Sensor Product Guide Setting up an M-8000 Using the redundant power supply Figure 2: Rail release latch Using the redundant power supply A basic configuration of the... power supply is in the power supply slot. 3 Do not operate the sensor without the faceplate panel in place. 4 Place the power supply in the M-8000: 1 Unpack the power supply from McAfee) for insertion or extraction from the unit as well as a release latch.
Product Guide
Page 21
... Product Guide Setting up an M-8000 Cabling the sensor Figure 4: Power supply installation 5 Slide in the power supply until it out. 5 Use faceplate panels to mate the connectors solidly with the optional redundant power supply, McAfee recommends that you are hotswappable): 1 Unplug the ...power cable from its power source and remove the power cable from the M-8000 (Optional-the power supplies are replacing. Note: For true redundant operation ...
... Product Guide Setting up an M-8000 Cabling the sensor Figure 4: Power supply installation 5 Slide in the power supply until it out. 5 Use faceplate panels to mate the connectors solidly with the optional redundant power supply, McAfee recommends that you are hotswappable): 1 Unplug the ...power cable from its power source and remove the power cable from the M-8000 (Optional-the power supplies are replacing. Note: For true redundant operation ...