User manual ALCATEL-LUCENT OMNIVISTA SAFEGUARD MANAGER

OmniVista SafeGuard Manager Release 3.0 Administration Guide PART NUMBER: 005-0034 REV A1 PUBLISHED: MARCH 2007 ALCATEL-LUCENT 26801 WEST AGOURA ROAD CALABASAS, CA 91301 USA (818) 880-3500 WWW.ALCATEL-LUCENT.COM Alcatel-Lucent Proprietary Copyright © 2007 Alcatel-Lucent. All rights reserved. This document may not be reproduced in whole or in part without the expressed written permission Alcatel-Lucent. Alcatel-Lucent ® and the AlcatelLucent logo are registered trademarks of Alcatel-Lucent. All other trademarks are the property of their respective owners. 2 OmniVista SafeGuard Manager Administration Guide Contents Preface About This Guide. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Intended Audience . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Guide Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Conventions Used in This Guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Related Documentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Additional Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Chapter 1: Getting Started Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Key Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Getting Started . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 System Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 OmniVista SafeGuard Manager Client Requirements. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Starting the Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Installing the Client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Logging In to the Client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Navigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Dashboards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Menus. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Page Bar . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Action Bar . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Viewing Tips . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Modifying Your Password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Adding a Device. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Chapter 2: Installation and Setup Installing the OmniVista SafeGuard Manager Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 Upgrading the OmniVista SafeGuard Manager Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 Pre-Upgrade Tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 Uninstalling the Server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 Starting the Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 Shutting Down the Server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 OmniVista SafeGuard Manager Administration Guide 3 Contents Installing the OmniVista SafeGuard Manager Client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 Logging into the OmniVista SafeGuard Manager Client. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 Connecting Over Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 Chapter 3: General Navigation Viewing Visualization Tables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 Viewing Table Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 Navigating between Different Table Views. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 Choosing Columns in a Table . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 Searching and Sorting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 Searching Table Data Locally. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 Sorting Table Data Locally. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 Searching and Sorting Data in the Entire Database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52 Exporting and Printing Data. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 Using the Status Bar. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 Chapter 4: Visualization Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56 Dashboards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57 Security Incidents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57 User Sessions with Incidents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62 Network Awareness . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63 Configuring Dashboards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 Defining Modules within a Dashboard. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69 Defining Bars within a Module. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76 Viewing Visualization Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 Viewing Policy Incidents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79 Viewing Malware Incidents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81 Viewing Posture Incidents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84 Viewing User Sessions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85 Viewing Application Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87 Viewing Application Instances . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88 Viewing Application Flows . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90 Creating Policy Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91 Viewing Time-based Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93 Additional Time-based Filtering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94 Viewing Active Data Against Historical Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95 4 OmniVista SafeGuard Manager Administration Guide Contents Chapter 5: Device Configuration Managing Devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98 Checking a Device . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98 Adding a New Device . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98 Configuring Device Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103 Application Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103 Application Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105 Network Zones . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107 Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109 Role Derivations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119 Roles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122 LDAP Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125 Editing Device Objects. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127 Editing Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131 Templates. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132 Creating a New Template. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133 Importing Templates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134 Deleting an Existing Device . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136 Polling a Device . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137 Synchronizing a Device . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137 Manually Synchronizing a Device . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138 Device Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138 Manage Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139 Manage Files. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144 Reboot Device . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149 Refresh . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150 Other Actions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152 Execute Show Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153 ICS Admin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154 Delete Visualization Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154 Update Template . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155 Discard Non-template Changes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156 Understanding Device Management Display. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157 Recommended Device Management Workflow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159 Chapter 6: Query and Reports Query . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162 Reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166 Defining a Report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166 Scheduling a Report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169 Generating a Report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170 OmniVista SafeGuard Manager Administration Guide 5 Contents Chapter 7: Managing the Server User Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 174 Authentication Guidelines. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 175 User Accounts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176 Adding a New User . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177 Enabling Dual-Admin or 4-Eye Mode. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178 File Repository . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 179 Client Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 182 Server Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183 Setting Visualization Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183 Exporting the Database. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 186 Purging the Database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188 Backing Up the Database. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 189 Restoring the Database. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 191 Mailing Malware and Report Notifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 192 Periodic Tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 195 Chapter 8: Audit Logs and Statistics Audit Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 198 OmniVista SafeGuard Manager Log Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 199 Device Health . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 201 Viewing Device Health Statistics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 202 Server Health . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 204 Viewing Server Health Statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 205 Index 6 OmniVista SafeGuard Manager Administration Guide Preface In this preface: About This Guide Conventions Used in This Guide Related Documentation Preface About This Guide This guide describes the OmniVista SafeGuard Manager command center features, including how to use and navigate through different views. This guide also provides detailed installation procedures for the server and client. Intended Audience The OmniVista SafeGuard Manager Administration Guide is for experienced network administrators who are responsible for installing, configuring, and maintaining the Alcatel-Lucent devices and OmniVista SafeGuard Manager command center. Guide Overview The information in this guide is separated into several chapters to make it easy for you to find exactly what you are looking for. Chapter Chapter 1, Getting Started Description Provides installation procedures and a brief overview of the key features of the OmniVista SafeGuard Manager command center. Provides detailed installation and setup instructions. Describes different navigation techniques such as, search and sorting. Describes the configuration of dashboards and the checking of user activity, health of the host system, violation histories, and other network activity. Provides instructions for configuring device objects and templates. Describes the creation, printing, and viewing of reports on network traffic and incidents. Describes client settings, user accounts, and user authentication. Additionally, it describes server settings: how to restore, purge, or back up the database and set up the OmniVista SafeGuard Manager mailer so email notifications can be sent on Malware events and reports. Provides audit log information and device and server health and statistics. Chapter 2, Installation and Setup Chapter 3, General Navigation Chapter 4, Visualization Chapter 5, Device Configuration Chapter 6, Query and Reports Chapter 7, Managing the Server Chapter 8, Audit Logs and Statistics 8 OmniVista SafeGuard Manager Administration Guide Preface Conventions Used in This Guide This document uses the following conventions: Italic Italics are used the first time a glossary term is introduced, for the titles of books, and for menu items. Bulleted lists designate items of equal importance. Numbered lists designate a specific sequence of steps required to complete a procedure. Boldface type is used for button names. Code excerpts and command line sequences are shown in this type face. Is used in code and argument syntax to indicate that inconsequential information is not shown. Bulleted lists 1 Numbered lists Boldface type Code Ellipsis.... NOTE: Means readers pay special attention to the information. Notes contain helpful suggestions or references to materials covered in the guide. CAUTION: Informs users to be careful of situation described in Cautions. In this situation, you could do something that could result in deletion of information or damage of equipment. WARNING: Informs users of safety conditions. In this situation, you could do something that could result in bodily injury or electric shock. OmniVista SafeGuard Manager Administration Guide 9 Preface Related Documentation OmniAccess SafeGuard Controller Installation Guide Describes the OmniAccess SafeGuard Controller. The guide provides detailed installation instructions and technical specifications for the OmniAccess SafeGuard Controller. OmniAccess SafeGuard OS Administration Guide Provides concepts and configuration instructions for the major features of OmniAccess SafeGuard OS and its supported products, which includes End Point Validation (EPV) the integral component for using ICS. ICS Dissolvable Agent for SafeGuard Administration Guide Describes how to configure the Integrity Clientless Security (ICS) module of the Alcatel-Lucent Network Admission Control (NAC). Additional Resources Alcatel-Lucent publishes documents for Alcatel-Lucent customers at: www.Alcatel-Lucent.com 10 OmniVista SafeGuard Manager Administration Guide chapter 1 Getting Started This section includes the following: Overview Key Features Getting Started Navigation Viewing Tips Modifying Your Password Adding a Device Chapter 1: Getting Started Overview The OmniVista SafeGuard Manager command center provides centralized and easy-touse management of one or more Alcatel-Lucent devices, enabling network administrators to perform basic configuration, management, and monitoring of several devices in a single interface. OmniVista SafeGuard Manager provides the foundation for gaining usage awareness and flagging network security incidents by users; it also enables global policy configuration with the ability to take real-time action from the control panel. Powerful predefined reports provide clear views on enterprise network health and user actions. Unlike traditional network management systems that report at the MAC or IP level, OmniVista SafeGuard Manager maps events to the network users. A user is identified by the SafeGuard Controller enforcement devices during the authentication phase. This user ID is then bound to the MAC and IP addresses of the computer, such that, that any future communication from that machine is bound to the user ID. This allows an administrator to identify any user incidents or identify the location of the violating machine. User-based features combined with drillable data navigation enable OmniVista SafeGuard Manager to communicate business information simply at a top level, yet the details are only a click away. This real-time correlation of network incident or awareness events to the user saves hours of manual association and custom scripting. OmniVista SafeGuard Manager 3.0 supports the following: Devices: OAG 1000, OAG 2400, OAG 4048x SafeGuard platform: SafeGuard software release 3.0 Key Features The OmniVista SafeGuard Manager command center Release 3.0 supports the following features: Device Configuration--Allows you to manage devices with detailed views of devices and physical ports. Also keeps your network under a single management system allowing you to select actions on the canned policies and push down to devices. User Authentication--In addition to local database authentication, OmniVista SafeGuard Manager users can be authenticated using an external RADIUS server. Visualization Filters--Allows you to set up visualization filters such that you can selectively view events based on VLAN ID, application type, or user role. VLAN Filters--Allows you set up visualization filters based on VLAN IDs. Drillable Database Query--Allows you to execute pre-defined and custom queries. 12 OmniVista SafeGuard Manager Administration Guide Chapter 1: Getting Started Policy Creation Using Flows--Allows you to create policy filters from data available in an application flow. CSV/HTML Report Generator--Allows you to create customized reports with server-side Scheduler; these reports can be e-mailed and printed easily. Real-time Incident Dashboard--Displays total number of users, authenticated and unauthenticated, device health, and policy, posture, and malware incidents. Also displays incidents for unauthenticated users and top user roles with incidents/incident counts. Administrators can remove offending machines off the network and revoke user privileges by de-authenticating users. Real-time User Incident Dashboard--Displays authentication failures by users, users with policy, posture, and malware incidents, and top user roles with incidents. Real-time Awareness Dashboard--Displays top 10 user sessions by bandwidth, top 10 destinations, top 10 Web Sites, top 10 applications by flow count, bottom 10 applications by flow count, or top 10 applications by bandwidth. Audit Logs--Provides logs that indicate who did what and when and on which device. These logs are for user and device operations and can be helpful for auditing purposes. Device and Server Health--Allows you to collect, view, and store statistics relating to device or server health. These statistics are helpful in analyzing each device's performance and its current connections. Software Upgrade--Allows you to upgrade the software version on the device. File Distribution--Allows you to manage files in a repository and distribute as necessary. Reboot--This feature allows you to reboot the selected device(s). Online Help--The online help feature is available using the F1 function key. OmniVista SafeGuard Manager Administration Guide 13 Chapter 1: Getting Started Getting Started The OmniVista SafeGuard Manager command center has client and server components. The server runs on a Windows server system, and the client runs on a Windows client system using Internet Explorer. The client can be deployed directly from the server using the Java Web Start technology. To quickly get started with OmniVista SafeGuard Manager, you need the following: System Requirements OmniVista SafeGuard Manager Client Requirements Starting the Server Starting the Server Installing the Client Logging In to the Client Dashboards Menus Adding a Device System Requirements The following requirements are for OmniVista SafeGuard Manager server installation. The software installation enforces these requirements, and exits you out of the installation if the minimum requirements are not met. For more installation information, see Installing the OmniVista SafeGuard Manager Server. 2-GB RAM 60-GB free disk space NOTE: The disk space is allocated as 5GB for installation and 55GB for data. Installation needs to be performed using the C drive and this drive should have a minimum of 5GB free space; however, data can be saved to the D drive that should have a minimum of 55GB space. Microsoft Windows Server 2003 (Enterprise, Standard, or Web Edition) NOTE: Microsoft Windows Server 2003 should have SP1 installed. Alcatel-Lucent supports 32 bit versions only. 14 OmniVista SafeGuard Manager Administration Guide Chapter 1: Getting Started 2.8-GHz processor speed 2 processors NOTE: The appliance that ships from Alcatel-Lucent meets all these requirements. OmniVista SafeGuard Manager Client Requirements The OmniVista SafeGuard Manager client can be run on most Windows systems. Minimum requirements are: One of the following Windows platforms: -- Microsoft Windows Server 2000 -- Microsoft Windows Server 2003 (Enterprise or Standard) -- Microsoft Windows XP Professional 2.8-GHz single CPU 512-MB RAM 2-GB hard disk Internet Explorer 6.0 or higher Screen resolution of 1024 x 768 pixels Internet connectivity to install Java Web Start OmniVista SafeGuard Manager Administration Guide 15 Chapter 1: Getting Started Starting the Server When you boot up the OmniVista SafeGuard Manager appliance, the OmniVista SafeGuard Manager server is started automatically. However, if you upgraded the software version or re-installed the software, you must manually start the server. For more information on installing, upgrading, or uninstalling, see Installation and Setup. To manually start the server: 1 Use the Windows shortcut from the Start menu, Programs > OmniVista SafeGuard Manager > Start Server. A GUI window displays. This window performs checks to verify that all ports needed for the server are available, starts all the server components as Windows services, and informs you when the server is ready. 2 Click OK to close the window. The OmniVista SafeGuard Manager server runs in the background. If you now reboot the system, the server should come up automatically. Installing the Client The OmniVista SafeGuard Manager client is based on Java Web Start technology, allowing you to install the client automatically with a single click over the network. For more information on client installation, see Installation and Setup. To install the client: 1 2 Launch Internet Explorer. Access the OmniVista SafeGuard Manager system by typing the following URL: http:// If the client does not have Java Web Start already installed, you are prompted to install Java Runtime Environment (JRE). Follow the on-screen prompts using the default options to install JRE. Java Web Start is included with JRE. NOTE: The automatic installation of JRE requires ActiveX controls to be enabled on your Internet Explorer. If ActiveX controls are not enabled, a "download Java Web Start" link displays. Internet Explorer also alerts you if ActiveX controls are not enabled and gives you an option to enable ActiveX controls. You can choose to enable ActiveX controls for automatic installation of Java Web Start, or you can download JRE version 1.5.0 by going to the download link. If you manually install Java Web Start, repeat Step 2. After Java Web Start is installed, the OmniVista SafeGuard Manager client code is downloaded and installed. Java Web Start displays a dialog box informing you 16 OmniVista SafeGuard Manager Administration Guide Chapter 1: Getting Started that the application is authored by Alcatel-Lucent and needs some privileges on your client system (Figure 1). Figure 1 Security Warning 3 4 Click Start. A prompt appears asking if you want to create a shortcut on the desktop. Select Yes to create a shortcut. If you select No, you can still launch the client using the URL from Step 2. The client launches. See Logging In to the Client for information on logging procedures. NOTE: Every time the OmniVista SafeGuard Manager client is launched, it compares its version with the OmniVista SafeGuard Manager server. If the client version is different than that of the server, the client automatically updates itself from the new version of the server. OmniVista SafeGuard Manager Administration Guide 17 Chapter 1: Getting Started Logging In to the Client To log in to the client: 1 Launch the client using either of the following methods: -- Double-click on the shortcut that was created on your desktop when you first installed the client. -- Invoke from Internet Explorer by typing the URL (http://ip-address-of- OmniVistaSafeGuardManager-server). -- Launch from the start menu using start menu > OmniVista SafeGuard Manager > Client NOTE: If you are launching the client from the server for the first time, you might be prompted to install certain applications. See Installing the Client for more information. The Login screen appears (Figure 2). Figure 2 OmniVista SafeGuard Manager Client Login Screen 2 3 In the Username field, type admin as the default user. In the Password field, type password. 18 OmniVista SafeGuard Manager Administration Guide Chapter 1: Getting Started 4 Click Login. If you are logging in for the first time to the OmniVista SafeGuard Manager server, the Alcatel-Lucent License Agreement will be displayed. You must accept it to use OmniVista SafeGuard Manager. NOTE: The license agreement is a one-time acknowledgement for each server and is not displayed for this client or any other client or this server. The client is successfully launched, and the OmniVista SafeGuard Manager command center panel displays (Figure 3). Figure 3 OmniVista SafeGuard Manager Dashboard OmniVista SafeGuard Manager Administration Guide 19 Chapter 1: Getting Started Navigation When you log into the OmniVista SafeGuard Manager command center, a navigation panel displays that allows you to access the various features by simply clicking a button or using a menu item. You can navigate the OmniVista SafeGuard Manager command center using the following: Dashboards Menu Bar Page Bar Action Bar Figure 4 Menu Bar OmniVista SafeGuard Manager Navigation Elements Page Bar Action Bar Dashboards The OmniVista SafeGuard Manager command center has three dashboards that provide a high-level network summary. These dashboards can be used to further investigate either actionable user incidents or informational and user traffic patterns. For more information on how to use the visualization features of the dashboard, see Visualization. The three dashboards are: Incidents--Displays total number of users, authenticated and unauthenticated, device health, and policy, posture, and malware incidents. Administrators can remove offending machines off the network and revoke user privileges by deauthenticating users. User Incidents--Displays authentication failures by users, users with policy, posture, and malware incidents, and top user roles with incidents. Network Awareness--Displays various application usage patterns and statistics for active users, such as top 10 user sessions by bandwidth, top 10 user sessions with most blocked incidents, top 10 destinations, top 10 Web Sites, and so forth. The modules are automatically refreshed every 5 minutes. 20 OmniVista SafeGuard Manager Administration Guide Chapter 1: Getting Started Menus You can access the OmniVista SafeGuard Manager features by selecting menu commands that are located in the menu bar, which is the toolbar located at the top of the screen (Figure 4). Page Bar The OmniVista SafeGuard Manager Page Bar icons allow you to access the various features of OmniVista SafeGuard Manager while retaining the context as much as possible. The Page Bar icons provide a quick single-click action that is synonymous with the menu items: Table 1 Page Bar Icon Navigating within OmniVista SafeGuard Manager Key Sequence Ctrl + 0 Displays View Dashboards Description Displays Incidents, User Incidents, and Global Awareness dashboards. Displays all policy incidents. Menu Sequence View > Go To > Dashboard View > Go To > Policy Incidents View > Go To > Malware Incidents View > Go To > Posture Incidents View > Go To > Users View > Go To > Applications View > Go To > Application Instances View > Go To > Application Flows View > Go To > Reports Ctrl + 1 Policy Incidents Malware Incidents Posture Incidents Users Ctrl + 2 Displays all malware incidents. Ctrl + 3 Displays all posture Incidents. Ctrl + 4 Displays network activity per user. Ctrl + 5 Applications Displays network activity per application. Displays the user bandwidth usage for each user, application type, destination port, and destination IP address. Displays application flows for all application. Allows you to create and view reports on network traffic patterns and anomalies. Ctrl + 6 Application Instances Ctrl + 7 Application Flows Reports Ctrl + 9 OmniVista SafeGuard Manager Administration Guide 21 Chapter 1: Getting Started Table 1 Page Bar Icon Navigating within OmniVista SafeGuard Manager (continued) Key Sequence Shift + 1 Displays View Config Management Description Enables you to manage AlcatelLucent devices, view inventory, and perform minimal configuration of the device system and ports. Displays log entries that are relevant for auditing purposes. Displays device and server health statistics. Menu Sequence View > Go To > Config Management View > Go To > Audit Logs View > Go To > Statistics Shift + 2 Audit Logs Shift + 3 Statistics When you click on any of the Page Bar icons, a table view is displayed that shows the Navigation Tree on the left-side, the contents in the upper-half of the screen and details for the selected object in the lower-half of the screen. The Navigation Tree and the Action Bar change based on the action task selected in the Page Bar. Action Bar The Action Bar allows you to access commands, as you need them, by a simple click of a button. To use the Action Bar, do any of the following: To choose a command from the bar, click the command button or Actions > command To view what a command does, position the mouse over the command button to see its tooltip. To close the Action Bar, choose View > Toolbars > Actions. 22 OmniVista SafeGuard Manager Administration Guide Chapter 1: Getting Started Viewing Tips The following tips expedite your navigation through the OmniVista SafeGuard Manager Manager panels and windows: Buttons in the Action Bar are used to execute actions. Select a row and then click the action button. If an action is not applicable for the selected row, the corresponding button is disabled. In the table views, some information about the table size is displayed above the table (the number of rows) and the alarm and infection status is displayed in the status bar below the table. You can search the data from the visualization database using filters. To view filters, click Find in the Action Bar. A free-form search field is displayed where you can type keywords to search data displayed in table views. To search the data from the database, click Database Search. A new search and sort header opens at the top of the table header. Click on the search bar of the column to specify the filtering criteria for that column. Click on the sort bar for the column to specify the sort criteria for that column. You can select multi-column sort order. After you have finished setting filters for one or more columns, click Refresh to see the new results. To clear all filters, click Clear. For more information on how to use the search and sort features, see General Navigation. Select a row to view detailed information on the selected row. Right-click on a row to display applicable actions. OmniVista SafeGuard Manager Administration Guide 23 Chapter 1: Getting Started Modifying Your Password The Account Management feature of OmniVista SafeGuard Manager allows an administrator to perform basic modifications to user accounts, such as adding users, changing passwords, and configuring dual-admin. To modify your password: 1 Select Tools > OmniVista SafeGuard Manager Users > User Accounts... The Account Management window (Figure 5) displays. Account Management Window Figure 5 2 Select one of the following Admin Login Setting: Standard--requires a single login and password Dual-admin--requires two logins and passwords 3 Click Apply to apply the login setting. NOTE: The Enabled checkbox shows the status of the user account. This is used to indicate whether the user can log in or not. For all user accounts, except admin, when an authentication method is changed from Radius to local, the account is set to "disabled". The account remains in a disabled state until the administrator resets the password for the account. 4 Select the "admin" user and click Modify to change the password for the "admin" user. The Modify User Account dialog box (Figure 6) displays. 24 OmniVista SafeGuard Manager Administration Guide Chapter 1: Getting Started Figure 6 Modify User Account Dialog Box 5 6 Modify the password, as needed, and click Modify Password. Click Modify Account if you are changing the admin role or user information. NOTE: For more information on adding a new user or the different types of user roles, see User Accounts. Adding a Device Before you can visualize any data, you need to add a device. For more information on device management, see Device Configuration. To add a single device: 1 2 3 Select the Device Configuration icon from the Page Bar or select the View > Go To > Config Management menu item. Click the New icon from the Action Bar. Select Single Device. The New Device (Figure 7) dialog box displays. OmniVista SafeGuard Manager Administration Guide 25 Chapter 1: Getting Started Figure 7 New Device Dialog Box 4 Enter the following device attributes: Add Device Attributes Attribute IP Address SNMP Community String (Read) SNMP Community (Read/Write) Name Region Building Enable Application Flow Collection Associated Template Description The Management IP address of the device. Simple Network Management Protocol (SNMP) read community name that was configured when the device was initially set up. SNMP read/write community name that was configured when the device was initially set up. Device name. Name of the region in which the device is located. Name of the building in which the device is located. Click this box if you want to collect application flow data. Select a template from the pull-down list that you want to associate with the device. For more information on templates, see Templates. Table 2 26 OmniVista SafeGuard Manager Administration Guide Chapter 1: Getting Started NOTE: Make sure that the attributes are specified correctly; otherwise, adding a device fails producing one of the following error messages, "Device unreachable," or "Device is not a Alcatel-Lucent device," or "Unable to communicate with IP Address." 5 Click OK to add the device. The add process reads the system configuration and the list of outstanding visualization events from the device using a combination of SNMP and Alcatel-Lucent proprietary OmniVista SafeGuard Manager Visualization Channel. NOTE: The device periodically ages out the visualization data; therefore, some of the events may be lost by the time you add the device. The device displays in the All Devices panel and the device objects display in the Device Hierarchy navigation tree. NOTE: The device must be reachable with appropriate community strings for the device to be added. To add multiple devices: 1 2 3 Figure 8 Select the Device Configuration icon from the Page Bar or select the View > Go To > Config Management menu item. Click the New icon from the Action Bar. Select Multi Device. The Create Devices (Figure 8) dialog box displays. You can populate this table using either the Import From File or the Add Entry option. Add Multiple Devices OmniVista SafeGuard Manager Administration Guide 27 Chapter 1: Getting Started 4 Click Import From File to import a list of devices written in a specific format. For example: ######################################################################### Name: Device List File #Purpose: For bulk device addition into OmniVista SafeGuard Manager Syntax of each line: # ip,read,readwrite,name,region,building,enable-flow-collection-in-truefalse # # Example: 172.16.3.125,public,private,controller,R1,B1,true ######################################################################### 172.16.3.125,public,private,controller,R1,B1,true 172.16.1.53,public,private,switch,R1,B2,true 5 6 Click Add Entry to add another entry in the table. This can be used to create a list. The following device attributes are displayed: Add Device Attributes Attribute Select Device Device IP Address SNMP Community String (Read) SNMP Community (Read/Write) Device Name Action Status Description Select the Select Device checkbox to select all devices in the list. Show the device name with its IP address. The Management IP address of the device. Simple Network Management Protocol (SNMP) read community name that was configured when the device was initially set up. SNMP read/write community name that was configured when the device was initially set up. Device name. Status of the action you selected. Table 3 7 8 Click Clear Entries to clear all entries from the table. Click Execute. The server schedules and processes each entry and provides feedback and action detail in the Action Status column. 28 OmniVista SafeGuard Manager Administration Guide chapter 2 Installation and Setup This section includes the following: Installing the OmniVista SafeGuard Manager Server Upgrading the OmniVista SafeGuard Manager Server Uninstalling the Server Starting the Server Shutting Down the Server Installing the OmniVista SafeGuard Manager Client Installing the OmniVista SafeGuard Manager Client Logging into the OmniVista SafeGuard Manager Client Connecting Over Firewall Chapter 2: Installation and Setup Installing the OmniVista SafeGuard Manager Server To install the OmniVista SafeGuard Manager server: 1 Double-click the executable file (omnivista-safeguard-.exe). The Installation Wizard prepares Java Virtual Machine (JVM) and initializes the installation wizard. This could take a few seconds. After the initialization process is completed, the Welcome screen displays (Figure 9). Figure 9 Installation Welcome Screen 2 Click Next. The Alcatel-Lucent license agreement displays (Figure 10). 30 OmniVista SafeGuard Manager Administration Guide Chapter 2: Installation and Setup Figure 10 Alcatel-Lucent License Agreement 3 4 Accept the licensing terms and click Next. The Directory Location screen displays (Figure 11). Figure 11 OmniVista SafeGuard Manager Alcatel-Lucent Installation Directory Location 5 Accept the default location to which the installation files will be downloaded for the Install Location, or click Browse to choose a different directory. The default location is C:\Alcatel-Lucent\OmniVistaSafeGuardManager. Specify a data directory where all application, application flow, and visualization data is saved. The data directory allows you to save data when you uninstall or upgrade to a newer version of OmniVista SafeGuard Manager. OmniVista SafeGuard Manager Administration Guide 31 Chapter 2: Installation and Setup 6 If a previous version of OmniVista SafeGuard Manager already exists on your system, a warning is displayed and you are given an option to exit the installation. Click Exit Installation to quit the installation process. Uninstall OmniVista SafeGuard Manager and then re-install. If a previous version is not installed, click Next. The Summary screen displays giving you a summary of where the installation files will be downloaded and the size of the files for the server and client installation. 7 8 Figure 12 Installation Summary 9 Click Next. The installation process begins. You can see the progress bar as the files are downloaded. A console window displays informing you of services and database being started. 10 After installation is completed, the OmniVista SafeGuard Manager Successfully Installed screen displays. Click Finish. OmniVista SafeGuard Manager server and client are now installed on your system. The server is installed as a Windows service. An icon for the OmniVista SafeGuard Manager client is created on your desktop. 11 Server start screen displays asking if you want to start the server. Click Yes to restart the server. Figure 13 Server Start 32 OmniVista SafeGuard Manager Administration Guide Chapter 2: Installation and Setup Upgrading the OmniVista SafeGuard Manager Server When the appliance is shipped from Alcatel-Lucent it comes pre-installed with OmniVista SafeGuard Manager. You need to uninstall OmniVista SafeGuard Manager and then re-install to upgrade. For more information on installing, upgrading, and uninstalling the server, see Installation and Setup. WARNING: When you upgrade the OmniVista SafeGuard Manager server, the existing database and reports are overwritten. Make sure that you make a backup copy of the database and the reports. Pre-Upgrade Tasks When upgrading the OmniVista SafeGuard Manager server from version 2.x to 3.0, 2.x data is not upgraded. Before performing an uninstall, administrators must export the device data using the following procedure, this will help them import back all the previously added devices: 1 2 3 4 Execute cimExportData.bat. This creates a file called "devices.txt" under the C:\Alcatel-Lucent\OmniVistaSafeGuardManager|ExportData directory. Uninstall the older version of the OmniVista SafeGuard Manager server. Install the newer version of the OmniVista SafeGuard Manager server. Import all devices through using the Add Multiple Devices > Import from File option. For more information, see Adding Multiple Devices. To upgrade the OmniVista SafeGuard Manager command center to the latest release: 1 Log in to the system using the administrator account. NOTE: To uninstall or upgrade software, you must have administrator-level privileges. Make sure you log in using the user account that is set up with these privileges. 2 Uninstall the existing version using the Windows shortcut from the Start menu, Programs > OmniVista SafeGuard Manager > Uninstall > Uninstall OmniVista SafeGuard Manager. Follow the on-screen prompts using default options. Reboot the system when the uninstallation is completed. After the system is rebooted, double-click on the installation package (omnivistasafeguard-.exe) available on the installation CD. 3 4 5 OmniVista SafeGuard Manager Administration Guide 33 Chapter 2: Installation and Setup 6 7 Follow the on-screen prompts using default options. After the installation is completed, you have to start the OmniVista SafeGuard Manager server. For more information on starting the server, see Starting the Server. Uninstalling the Server To uninstall the server: 1 From the Start menu, click Programs > OmniVista SafeGuard Manager > Uninstall > Uninstall OmniVista SafeGuard Manager. The Welcome screen displays (Figure 14). Figure 14 Uninstallation Welcome Screen 2 Click Next. A summary information window displays with directory location information. 34 OmniVista SafeGuard Manager Administration Guide Chapter 2: Installation and Setup Figure 15 Uninstallation Summary 3 Install asks you if you want to delete backup and data directories. Select No if you want to save the data. Figure 16 Delete Data Directory 4 Follow the on-screen prompts to uninstall the server. The uninstall wizard stops the server and database, cleans the log files and begins the uninstallation process. The status is displayed in a console window. The uninstall process completes and a "OmniVista SafeGuard Manager successfully uninstalled" window is displayed. 5 6 Click Next. Uninstall will ask you to restart the system. Select the restart option and click Finish to complete the uninstall. All associated files and shortcuts are removed from your system. OmniVista SafeGuard Manager Administration Guide 35 Chapter 2: Installation and Setup Starting the Server When you boot up the OmniVista SafeGuard Manager appliance, the OmniVista SafeGuard Manager server is started automatically. However, if you upgraded the software version or re-installed the software, you must manually start the server. To manually start the server: 1 Use the Windows shortcut from the Start menu, Programs > OmniVista SafeGuard Manager > Start Server. A GUI window displays. This window performs checks to verify that all ports needed for the server are available, starts all the server components as Windows services, and informs you when the server is ready. Click OK to close the window. 2 The OmniVista SafeGuard Manager server runs in the background. If you now reboot the system, the server should come up automatically. Shutting Down the Server To shut down the server: 1 From the Start menu, click Programs > OmniVista SafeGuard Manager > Stop Server. The OmniVista SafeGuard Manager server is stopped along with the Windows services. NOTE: When you shut down the OmniVista SafeGuard Manager appliance, the OmniVista SafeGuard Manager server is stopped automatically. 36 OmniVista SafeGuard Manager Administration Guide Chapter 2: Installation and Setup Installing the OmniVista SafeGuard Manager Client The OmniVista SafeGuard Manager client is based on Java Web Start technology, allowing you to install the client automatically over the network with a single click. NOTE: If the client machine has a JRE version that is earlier than 1.5, then the client is automatically upgraded to JRE 1.5. To install the client: 1 Launch Internet Explorer. NOTE: Currently, only Internet Explorer version 6.0 or higher is supported. 2 Access the OmniVista SafeGuard Manager system by typing the following URL: http:// If the client does not have Java Web Start already installed, you are prompted to install Java Runtime Environment (JRE). Follow the on-screen prompts using the default options to install JRE. Java Web Start is included with JRE. NOTE: The automatic installation of JRE requires ActiveX controls to be enabled on your Internet Explorer. If ActiveX controls are not enabled, a "download Java Web Start" link displays. Internet Explorer also alerts you if ActiveX controls are not enabled and gives you an option to enable ActiveX controls. You can choose to enable ActiveX controls for automatic installation of Java Web Start, or you can download JRE version 1.5.0 by going to the download link. If you manually install Java Web Start, repeat Step 2. After Java Web Start is installed, the OmniVista SafeGuard Manager client code is downloaded and installed when you access the OmniVista SafeGuard Manager server (Step 2). Java Web Start displays a dialog box informing you that the application is authored by Alcatel-Lucent and needs some privileges on your client system. OmniVista SafeGuard Manager Administration Guide 37 Chapter 2: Installation and Setup Figure 17 Security Warning 3 4 Click Start. A prompt appears asking if you want to create a shortcut on the desktop. Select Yes to create a shortcut. If you select No, you can still launch the client using the URL from Step 2. The client launches. See Logging into the OmniVista SafeGuard Manager Client for information on logging in procedures. NOTE: Every time the OmniVista SafeGuard Manager client is launched, it compares its version with the OmniVista SafeGuard Manager server. If the client version is different than that of the server, the client automatically updates itself with the new version of the server. 38 OmniVista SafeGuard Manager Administration Guide Chapter 2: Installation and Setup Logging into the OmniVista SafeGuard Manager Client To log into the client: 1 Launch the client using either of the following methods: -- Double-clicking on the shortcut that was created on your desktop when you first installed the client. -- Invoking from the Internet Explorer by typing the URL (http://ip-address-ofOmniVistaSafeGuardManager-server). NOTE: If you are launching the client from the server for the first time, you might be prompted to install certain applications. See Installing the OmniVista SafeGuard Manager Client for more information. The Login screen displays (Figure 18). Figure 18 OmniVista SafeGuard Manager Client Login Screen 2 3 In the Username field, type admin as the default user. In the Password field, type password. OmniVista SafeGuard Manager Administration Guide 39 Chapter 2: Installation and Setup 4 Click Login. If you are logging in for the first time to the OmniVista SafeGuard Manager server, the Alcatel-Lucent License Agreement displays. You must accept it to use OmniVista SafeGuard Manager. NOTE: The Alcatel-Lucent license agreement is a one-time acknowledgement for each server and is not displayed for this client or any other client or this server. The client is launched and the dashboard is displayed (Figure 19). Figure 19 OmniVista SafeGuard Manager Client - Dashboard 40 OmniVista SafeGuard Manager Administration Guide Chapter 2: Installation and Setup Connecting Over Firewall If a firewall exists between the OmniVista SafeGuard Manager client and the OmniVista SafeGuard Manager server, or between the OmniVista SafeGuard Manager server and the SafeGuard OS device, certain ports must be opened for successful deployment. Table 4 gives the number of ports that must be open: Table 4 Ports that must be open for successful deployment Ports that need to be open... When connecting... Between the OmniVista SafeGuard Manager server and client TCP 80 TCP 1099 TCP 8003 TCP 8004 TCP 8011 UDP 161 TCP 16001 TCP 16002 TCP 16005 UDP 69 Between the OmniVista SafeGuard Manager server and the SafeGuard OS device OmniVista SafeGuard Manager Administration Guide 41 Chapter 2: Installation and Setup 42 OmniVista SafeGuard Manager Administration Guide chapter 3 General Navigation This section includes the following: Viewing Visualization Tables Choosing Columns in a Table Searching and Sorting Exporting and Printing Data Using the Status Bar Chapter 3: General Navigation Viewing Visualization Tables Visualization allows administrators to track what a user is doing, what applications are being used, and what is being done to a network. Such tracking is useful for forensic and postmortem purposes, that is, for debugging and ensuring that the network is performing at its optimum and there are no threats to the network. SafeGuard collects this data and periodically pushes it in tabular format to OmniVista SafeGuard Manager as visualization data. Visualization data can be viewed in tabular format for the following objects: Table 5 Table Views Description Displays a list of all policy incidents against a user. For more information, see Viewing Policy Incidents. Displays a list of malware incidents. This table also displays the counts of various severities of the infection events. For more information, see Viewing Malware Incidents. Displays all posture incidents, including EPV incident ID, host IP and MAC addresses. For more information, see Viewing Posture Incidents. Displays user authentication and bandwidth usage that is aggregated for each user. Typically this has a navigation tree on the left panel that helps finds users belonging to a specific group/role or connected to a specific port of a specific device. For more information, see, Viewing User Sessions. Displays the user bandwidth usage that is aggregated for each type of application. For more information, see Viewing Application Types. Displays the user bandwidth usage for each user, application type, destination port, and destination IP address. For more information, see Viewing Application Instances. Allows an administrator to view application flows for a selected user or application. For more information, see Viewing Application Flows. Table Type Policy Incidents Malware Incidents Posture Incidents User Application Type Application Instance Application Flows When you click on a table view, you are presented with a table that shows all visible data and a column to the left that lets you customize or view data by time, incident, location, and so forth (Figure 20). 44 OmniVista SafeGuard Manager Administration Guide Chapter 3: General Navigation Figure 20 Table View (Users) Viewing Table Data To view table data: 1 2 3 Attribute Status Use the Action Bar buttons to navigate from one type of table view to another. See Viewing Visualization Tables for more information on different table views. Use the scroll buttons at the top of the table to scroll through the data, one page at a time, previous page, next page, first page, or last page. Use the fields in the left column to customize viewable data as follows: Description From the dropdown list, select to view incidents by status: Active--displays all active incidents Inactive--displays all inactive incidents OmniVista SafeGuard Manager Administration Guide 45 Chapter 3: General Navigation Attribute Time Range Description From the dropdown list choose a time for which you want to view table data. Following values are available: Current Hour--displays incidents for the current hour Last Hour--displays incidents for the last hour Current Day--displays incidents for the current day Last Day--displays incidents for the day before Previous Day--displays incidents for the previous 24 hours. Previous Hour--displays incidents for the hour before the current time. Custom--allows you to enter a specific time in the From and To time fields Detection Time--time when incident was detected (first occurrence, last occurrence, login time, and logout time depending on the view) Cleared Time--time when incident was cleared Time Filter Display incidents by: From/To