Nortel 2070 Manuale utente

Nortel Threat Protection System

Threat Protection System

Troubleshooting Guide

Release: 4.7

Document Revision: 01.01

www.nortel.com

NN47240-700 324442-A

Nortel Threat Protection System

Release: 4.7

Publication: NN47240-700

Document status: Standard

Document release date: 112007

The information in this document is subject to change without notice. The statements, configurations, technical

data, and recommendations in this document are believed to be accurate and reliable, but are presented without

express or implied warranty. Users must take full responsibility for their applications of any products specified in this

document. The information in this document is proprietary to Nortel Networks.

Export

This product, software and related technology is subject to U.S. export control and may be subject to export or

import regulations in other countries. Purchaser must strictly comply with all such laws and regulations. A license to

export or reexport may be required by the U.S. Department of Commerce.

Licensing

This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit

(http://www.openssl.org/).

This product includes cryptographic software written by Eric Young ([email protected]).

This product includes software written by Tim Hudson ([email protected]).

This product includes software developed by the Apache Software Foundation http://www.apache.org/.

Wilson, and is licensed under the GPL.

See Appendix D, "License Information", in the User’s Guide for more information

Contents

New in this release 7

Navigation 7

Introduction 9

Prerequisites 9

Navigation 10

Acronyms 10

Troubleshooting Fundamentals 11

Navigation 11

Log files 11

Issues that require Sourcefire assistance 12

Hardware Troubleshooting 15

Navigation 15

TPS Hardware 15

Ports to open in a firewall 16

Software Troubleshooting 17

Creating a troubleshoot file from a TPS device 18

Obtaining the troubleshoot file following a failed software upgrade 19

Resetting passwords 20

Resetting the root password of a TPS device 20

Resetting the Administrator Password for a TPS device 21

Installing an Old Version of SEU 22

Event handling 22

Troubleshooting TPS Sensor when not receiving events 23

Troubleshooting Defense Center when not receiving events 23

Troubleshooting errors when adding sensor to DC 23

Troubleshooting the SFDataCorrelator 24

Troubleshooting alerting problems 25

Troubleshooting mail alerting problems 25

Troubleshooting SNMP alerting problems 25

Troubleshooting Syslog alerting problems 25

Troubleshooting events that show incorrect time 25

Troubleshooting LDAP authentication 26

Nortel TPS 4.7

Threat Protection System Troubleshooting Guide

NN47240-700 01.01 Standard

112007

RUA 27

Configuring Snort through the User Interface 27

Verifying prohibit packet data on the DC 28

Performing RNA IP/Port Exclusion 28

Scanning the NMAP 29

Remediation Procedures 29

Remediating NAS 29

Troubleshooting Global Faults 31

Navigation 31

Troubleshooting when no white list events are generated 32

Troubleshooting an IS that does not generate events 32

Troubleshooting an SDM IS that could not be added to a DC 32

Troubleshooting an IS that does not block traffic 33

Validating the failopen function 33

Troubleshooting an IS that does not send email 34

Troubleshooting a DC that cannot push a policy to a sensor that it is

managing 34

Troubleshooting a faulty OPSEC 34

Troubleshooting a failed upgrade 35

Troubleshooting a failed automatic SEU Update 35

Troubleshooting when a customer is unable to add a sensor to be managed by a

DC 36

Troubleshooting a system crash 37

Verify the ports to be opened in the firewall for 4.6 37

Troubleshooting Snort 37

Troubleshooting memory problems 38

IPS mode cable Deployment Scenarios 38

Deploying between two endpoints 38

Deploying between two network switches 39

Between a switch and an endpoint 39

Between a switch and a router 39

Between a router and an endpoint 39

Between a firewall and an endpoint 40

Between two firewalls 40

Between a switch and a firewall 40

Between router and a firewall 40

Checking IPv6 configurations on the CLI 41

Verification of Detection Resources on the CLI 41

Viewing the enabled rules on the CLI 41

Viewing remediation log 42

Viewing the LDAP SSL certificate 42

Emergency recovery trees 43

Lost access to the TPS DC/IS device -- recovery tree 43

Nortel TPS 4.7

Threat Protection System Troubleshooting Guide

NN47240-700 01.01 Standard

112007

Licensing 5

The TPS DC/ IS cannot receive events -- recovery tree 44

Reference to third party Application Guides 47

Contact Nortel technical support 49

Navigation 49

Gathering critical information 49

Getting help from the Nortel Web site 50

Getting help over the phone from a Nortel Solutions Center 50

Getting help from a specialist by using an Express Routing Code 51

Getting help through a Nortel distributor or reseller 51

Glossary 53

Nortel TPS 4.7

Threat Protection System Troubleshooting Guide

NN47240-700 01.01 Standard

112007

Nortel TPS 4.7

Threat Protection System Troubleshooting Guide

NN47240-700 01.01 Standard

112007

New in this release

The Nortel Threat Protection System Release. 4.7 Troubleshooting Guide

with Emergency Recovery Tree (NN47240-700) is a new document for

Nortel Threat Protection System Release 4.7.

Navigation

Nortel TPS 4.7

Threat Protection System Troubleshooting Guide

NN47240-700 01.01 Standard

112007

8New in this release

Nortel TPS 4.7

Threat Protection System Troubleshooting Guide

NN47240-700 01.01 Standard

112007

Introduction

The Nortel Threat Protection System is a fully integrated intrusion

detection system that consists of the following:

•TPS 2070 Defense Center, which manages intrusion sensors in the

network environment

•TPS 2050 Intrusion Sensor and TPS 2070 Intrusion Sensor, which

detect and track network intrusions, either independently or under the

management of the TPS 2070 Defense Center

•TPS 2150 Intrusion Sensor and TPS 2170 Intrusion Sensor, which

have fail-open functionality in inline mode

This chapter describes the prerequisites and various tools used to

troubleshoot the Nortel TPS 4.7. Use these troubleshooting tools to

enhance the overall performance, resolve error messages, and increase

response time for a specific feature. Each tool is described by purpose,

usage procedures, and how to interpret the output.

Prerequisites

Nortel recommends you to use one or more of the following commercially

available troubleshooting tools as well as the tools described in this

document.

•Capture and analyze HTTP and HTTPS with the HTTP Analyzer from

IE Inspector http://www.ieinspector.com/

•Capture and analyze HTTP and HTTPS with Tamper Data, a plug-in

available for Mozilla Firefox https://addons.mozilla.org/en-US/firefox/

addon/966

•Display the time to load Web pages with Faster Fox, a plug-in available

for Mozilla Firefox https://addons.mozilla.org/en-US/firefox/addon/1269

•Capture and analyze packets with either Sniffer or Wireshark from

Network General http://www.wireshark.org/ and http://www.networkge

neral.com/

Nortel TPS 4.7

Threat Protection System Troubleshooting Guide

NN47240-700 01.01 Standard

112007

10 Introduction

Navigation •“Troubleshooting Fundamentals” (page 11)

•“Hardware Troubleshooting” (page 15)

•“Software Troubleshooting” (page 17)

•“Troubleshooting Global Faults” (page 31)

•“Emergency recovery trees” (page 43)

•“Reference to third party Application Guides” (page 47)

•“Contact Nortel technical support” (page 49)

•“Glossary” (page 53)

Acronyms Table 1 "Acronyms" (page 10) lists the acronyms used in this guide.

Table 1

Acronyms

TPS Threat Protection System

CLI Command Line Interface

LED Light Emitting Diode

Nortel TPS 4.7

Threat Protection System Troubleshooting Guide

NN47240-700 01.01 Standard

112007

Altri manuali per 2070

Questo manuale è adatto per i seguenti modelli

Indice

Altri manuali Nortel Software

Nortel

Nortel V1 Manuale di istruzioni

Nortel

Nortel Application Server 53r 53 Manuale utente

Nortel

Nortel Manager Manuale di istruzioni

Nortel

Nortel Agent Manuale

Nortel

Nortel Observe Manuale utente

Nortel

Nortel MAS Manuale utente

Nortel

Nortel m3900 series Manuale utente

Nortel

Nortel TAPI Manuale utente

Nortel

Nortel 2350 Manuale utente

Nortel

Nortel 2350 Manuale utente

Nortel

Nortel Passport 8600 Series Manuale utente

Nortel

Nortel Norstar ICS Remote Tools 11 Manuale

Nortel

Nortel ALTEON OS BMD00009 Manuale utente

Nortel

Nortel 2070 Guida rapida

Nortel

Nortel VoIP Gateway Manuale utente

Nortel

Nortel BCM 4.0 Manuale di installazione e funzionamento

Nortel

Nortel INM 5.0 Manuale utente

Nortel

Nortel Contact Recording Manuale utente

Nortel

Nortel Express Call Center Manuale utente

Nortel

Nortel NA Manuale operativo

Nortel

Nortel NN-10300-053 Manuale utente

Nortel

Nortel TAPI Manuale utente

Nortel

Nortel 3100 Series Manuale utente

Nortel

Nortel CC MIS Manuale utente

Manuali Software popolari di altre marche

COMPRO

COMPRO COMPROFM Manuale utente

Muratec

Muratec OFFICEBRIDGE ONLINE Manuale utente

Oracle

Oracle Contact Center Anywhere 8.1 Manuale utente

Adobe

Adobe 65007312 - Photoshop Lightroom Manuale

Avaya

Avaya NULL One-X for RIM Blackberry Manuale utente

HP ProLiant BL420c Manuale utente

PS Audio

PS Audio PowerPlay Manuale del proprietario

Brady

Brady LOCKOUT PRO 3.0 Manuale di servizio

Avaya

Avaya Interaction Center Manuale utente

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Manuale

Novell

Novell GROUPWISE 8 - INTERNET AGENT Manuale utente

Oracle

Oracle Application 9i Manuale utente

Acer

Acer RDM Manuale utente

Canon

Canon Vixia HF21 Manuale utente

Canon

Canon ZR950 Manuale utente

Samsung

Samsung Auto Backup Manuale utente

Polycom

Polycom Vortex EF2201 Istruzioni per l'installazione e il funzionamento

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Manuale utente