1. Manuals
  2. Brands
  3. RSA Manuals
  4. Network Hardware
  5. NetWitness 6 Series
  6. Hardware setup manual

RSA NetWitness 6 Series Hardware Setup Manual

Hide thumbs
Table of Contents

Advertisement

Quick Links

Series 6 Hardware Setup Guide

Advertisement

Table of Contents
loading
Need help?

Need help?

Do you have a question about the NetWitness 6 Series and is the answer not in the manual?

Questions and answers

Subscribe to Our Youtube Channel

Related Manuals for RSA NetWitness 6 Series

Summary of Contents for RSA NetWitness 6 Series

  • Page 1 Series 6 Hardware Setup Guide...
  • Page 2 RSA. Third-Party Licenses This product may include software developed by parties other than RSA. The text of the license agreements applicable to third-party software in this product may be viewed on the product documentation page on NetWitness Community. By using this product, a user of this product agrees to be fully bound by terms of the license agreements.

  • Page 3: Table Of Contents

    Contents About this Document S6 R640 Hardware Description Package Contents Customer Supplied Materials Front View of the Series 6 Hardware (Except Hybrid) Rear View of the Series 6 Hardware (Except Hybrid) Series 6 Hardware Specifications Install a Deep-Rack Adapter for R640 Hardware S6 R740xd Hybrid Hardware Description Package Contents Customer Supplied Materials...

  • Page 4: About This Document

    Series 6 Hardware Setup Guide About this Document This document provides instructions for setting up RSA NetWitness® Platform Series 6 (S6) physical hosts and connecting them to your network. This document applies to both Series 6 and Series 6E hardware. Series 6E hardware uses self- encrypting drives (SEDs).

  • Page 5: S6 R640 Hardware Description

    Series 6 Hardware Setup Guide S6 R640 Hardware Description All but one of the RSA NetWitness® Platform Series 6 (S6) physical hosts are based on the Dell PowerEdge R640 chassis. The exception is the Hybrid host, which is based on the Dell PowerEdge R740xd chassis.

  • Page 6: Package Contents

    RSA does not support re-shipping of racked servers. The customer assumes all risk and liability for transporting NetWitness servers and hosts mounted in a rack. Package Contents Verify the contents of the packing box to ensure that you have received all items necessary to install and configure the RSA physical host.

  • Page 7: Front View Of The Series 6 Hardware (Except Hybrid)

    Series 6 Hardware Setup Guide Front View of the Series 6 Hardware (Except Hybrid) Item numbers 1-5 are status LED indicators, which indicate the status of the system. The status LED indicators are always off and only turn on to a solid amber if any error occurs. Description Drive indicator.
  • Page 8 Series 6 Hardware Setup Guide Description System health and system ID indicators: Solid blue: Indicates that the system is turned on, the system is healthy, and system ID mode is not active. Press the system health and system ID button to switch to system ID mode.

  • Page 9: Rear View Of The Series 6 Hardware (Except Hybrid)

    Series 6 Hardware Setup Guide Rear View of the Series 6 Hardware (Except Hybrid) Description System identification connector PERC H840 RAID controller. It is in PCIe slot 1. The PERC H840 is the the RAID controller for the storage expansion JBOD. It requires a cable with a Mini-SAS port to connect to the JBOD.

  • Page 10: Series 6 Hardware Specifications

    Series 6 Hardware Setup Guide Series 6 Hardware Specifications Core Hybrid Item ESA/Analytics Host Type NW Server, Log Log Decoder Hybrid, Decoder, Network UEBA Network Decoder Hybrid Decoder (Packets), (Packets), Endpoint Log Concentrator, Hybrid Broker, Archiver, Malware Analysis Model Dell PowerEdge R640 Dell PowerEdge Dell PowerEdge R740 R640 Processor...
  • Page 11 Series 6 Hardware Setup Guide Core Hybrid Item ESA/Analytics Series 6E 2 X 1.2TB SAS 2 X 1.2TB SAS 10K 2 X 2.4TB SAS 10K 10K SED Self-Encrypting 2 X 2.4TB SAS 4 X 2.4TB SAS 10K 10 X 8TB NL-SAS 7.2K Drives (SEDs) 10K SED FIPS140 Certified...
  • Page 12 Series 6 Hardware Setup Guide Core Hybrid Item ESA/Analytics Shipping Server boxed for Server boxed for shipping Dimensions shipping (includes rail (includes rail kit) kit) Height: 30.48 cm (12 inch) Height: 32.39 cm (12.75 Width: 104.14 cm (41 inch) inch) Depth: 64.14 cm (25.25 inch) Width: 95.25 cm (37.50 Weight: 25.85 kg (57 lb)

  • Page 13: Install A Deep-Rack Adapter For R640 Hardware

    EMC Titan D Ultra Rack. When installing the RSA S6 R640 physical host into the EMC Titan D Ultra Rack, a 1U deep- rack adapter is required. Follow this procedure to install a new bracket on the server rails.
  • Page 14 Series 6 Hardware Setup Guide Each rail is marked. 3. Use a Phillips screwdriver to remove the two mounting screws. Install a Deep-Rack Adapter for R640 Hardware...
  • Page 15 Series 6 Hardware Setup Guide 4. Remove the bracket and replace it with the new bracket. 5. Re-use the screws to fasten the new bracket in place. The rail is now ready for the R640 host installation. Install a Deep-Rack Adapter for R640 Hardware...

  • Page 16: S6 R740Xd Hybrid Hardware Description

    Series 6 Hardware Setup Guide S6 R740xd Hybrid Hardware Description The RSA NetWitness® Platform Series 6 Hybrid physical host is based on the Dell PowerEdge R740xd chassis. The Series 6 Hybrid host is shipped with NetWitness Platform Hybrid host software installed. Hybrid host software includes Concentrator and Decoder (log or packet, not both).

  • Page 17: Package Contents

    RSA NetWitness® Platform Series 6 Hybrid physical host Static Ready Rails 2U (1 set) Left Rail 2U Adapter for EMC deep rack (1) 2U RSA Bezel (1) - Keys are taped to the bezel Power Cord (2) Short Range (SR) SFP Optical Transceivers (2)

  • Page 18: Front View Of The Series 6 Hybrid Hardware

    Series 6 Hardware Setup Guide Front View of the Series 6 Hybrid Hardware Item numbers 1-5 are status LED indicators, which indicate the status of the system. The status LED indicators are always off and only turn on to a solid amber if any error occurs. Description Drive indicator.
  • Page 19 Series 6 Hardware Setup Guide Description System health and system ID indicators: Solid blue: Indicates that the system is turned on, the system is healthy, and system ID mode is not active. Press the system health and system ID button to switch to system ID mode.

  • Page 20: Rear View Of The Series 6 Hybrid Hardware

    Series 6 Hardware Setup Guide Rear View of the Series 6 Hybrid Hardware Description Full-height PCIe expansion card slots (3). The Decoder may use a PCIe slot for an optional Intel i350 Quad RJ-45 port network interface card. These slots can also be used for an Emulex HBA card to connect to a SAN and for an Intel 520 based dual port 10G NIC Fiber card.

  • Page 21: Series 6 R740Xd Hybrid Hardware Specifications

    Series 6 Hardware Setup Guide Description System identification connector System identification button Note: The PERC H840 RAID controller requires a cable with a Mini-SAS port to connect to the JBOD. The cables are included with the storage. Series 6 R740xd Hybrid Hardware Specifications Series 6 Hardware Specifications S6 R740xd Hybrid Hardware Description...

  • Page 22: Install A Deep-Rack Adapter For An R740Xd Hybrid

    EMC Titan D Ultra Rack. When installing the RSA S6 R740xd Hybrid physical host into the EMC Titan D Ultra Rack, a 2U deep-rack adapter is required. Follow this procedure to install a new bracket on the server rails.
  • Page 23 Series 6 Hardware Setup Guide 3. Use a Phillips screwdriver to remove the two mounting screws. 4. Remove the bracket and replace it with the new bracket. Install a Deep-Rack Adapter for an R740xd Hybrid...
  • Page 24 Series 6 Hardware Setup Guide 5. Re-use the screws to fasten the new bracket in place. The rail is now ready for the R740xd Hybrid host installation. Install a Deep-Rack Adapter for an R740xd Hybrid...

  • Page 25: Connect To The Series 6 Hardware Console

    Series 6 Hardware Setup Guide Connect to the Series 6 Hardware Console Before installing software on your Series 6 hardware, you need to add a keyboard and monitor to it, connect it to your network, and power it on. 1. Connect a monitor or KVM adapter to the VGA Port on the back of the host. The following figure shows the VGA Port location for the Hybrid host.
  • Page 26 Series 6 Hardware Setup Guide 4. Connect a power cord to each of the two power supplies on the rear of the host. Connect the power cords to a power source. To provide a more robust setup, connect each power supply to a different circuit.

  • Page 27: And Later 10.6.X.x Versions Installation Tasks

    If you are on NetWitness Platform version 10.6.5.2 or later 10.6.x.x versions, follow the steps below to configure the network parameters on the RSA physical host and finish the setup in NetWitness Platform. If you are on version 11.x, see 11.1.0.2 and Later Installation Tasks...

  • Page 28: Specify The Network Clock Source

    This sets the network information and restarts the network services. 4. If your RSA physical host is not a Security Analytics Server host, wait approximately 15 seconds for a prompt and then enter the Security Analytics Server host IP Address at the prompt.

  • Page 29: Best Practices

    If the other RSA physical hosts have NetWitness Platform 10.5.1 or later, the time is automatically set on all RSA physical hosts attached to the NetWitness Server hosts. If the other RSA physical hosts do not have NetWitness Platform 10.5.1 or later, set the time to point to the Security Analytics Server host manually.

  • Page 30: Finish Host Setup In Netwitness Platform

    4. When you see an output of Success from the command, type exit to log out and exit the NwConsole program. Note: If you specified an NTP clock source of local, the RSA physical host clock serves as the clock source and the time is configured using Set Host Built-In Clock as described in NetWitness Platform online documentation.
  • Page 31 Configuration Guides and the Licensing Guide. A good starting point to understand the general configuration process and begin configuration is the Hosts and Services Getting Started Guide. To locate these documents, go to the RSA NetWitness® Platform online documentation at RSA Link (https://community.rsa.com/docs/DOC-40370) and for your software version, click the Documentation link.

  • Page 32: 11.1.0.2 And Later Installation Tasks

    Series 6 Hardware Setup Guide 11.1.0.2 and Later Installation Tasks If you are on RSA NetWitness® Platform version 11.1.0.2 or later, go to the Physical Host Installation Guide and follow the steps for installing and configuring your RSA physical host.

  • Page 33: Nic Bonding

    Series 6 Hardware Setup Guide NIC Bonding The following procedure outlines a NIC Bonding fault tolerance configuration. If one of the underlying physical NICs is broken or its cable is unplugged, the NW host will detect the fault condition and automatically failover traffic to the slave NIC in the bond, which eliminates a single point of failure for the network interfaces.
  • Page 34 Series 6 Hardware Setup Guide 6. Create bonding definition file. a. Navigate to script directory using the following command: cd /etc/sysconfig/network-scripts/ b. Create ifcfg-eth0 using the following command: vi ifcfg-eth0 Add the following attributes in the file: DEVICE=eth0 TYPE=Bond NAME=eth0 BONDING_MASTER=yes BOOTPROTO=none IPADDR=<ip address of the host>...
  • Page 35 Series 6 Hardware Setup Guide a. Remove the files except the UUID and append the following attributes: TYPE=Ethernet BOOTPROTO=none NAME=em2 UUID=xxxxxxxx-yyyy-zzzz-aaaa-bbbbbbbbbbbb DEVICE=em2 ONBOOT=yes MASTER=eth0 SLAVE=yes b. Save the ifcfg-em2 file 9. Open the interface definition file for em3 using the following command: vi ifcfg-em3 a.
  • Page 36 Series 6 Hardware Setup Guide cat /proc/net/bonding/eth0 Make sure that em1, em2 are listed and Bonding Mode is ‘fault-tolerance (active-backup)’ and Speed is 1000 Mbps. 14. Reboot the host. 15. Verify if the bonding interface is active using the following command: ethtool eth0 | grep -i 'link detected' This returns ‘Link detected: yes’...

  • Page 37: Example For Bonding Em3 Or Em4 (10G Fiber Interfaces)

    Series 6 Hardware Setup Guide Note: The NETMASK attribute value should not conflict with NETMASK defined in the dhcp server for this network. i. Save the file. b. If Static IP Configuration is selected, the Subnet Mask corresponds to the NETMASK attribute in the bond interface (/etc/sysconfig/network-scripts/ifcfg- eth0) definition.
  • Page 38 Series 6 Hardware Setup Guide 5. Verify if the bonding is enabled using the following command: modinfo bonding 6. Create bonding definition file. a. cd /etc/sysconfig/network-scripts/ b. vi ifcfg-eth0 Add the following attribute in the file: DEVICE=eth0 TYPE=Bond BONDING_MASTER=yes IPADDR=<ip address of the host> Important: This IP address MUST be assigned during nwsetup-tui network configuration.
  • Page 39 Series 6 Hardware Setup Guide c. Delete the following attributes in the file: i. HWADDR (mac address) line ii. IPADDR (if exists) iii. NETMASK (if exists) iv. GATEWAY (if exists) d. Save the file 8. Open the interface definition file for em4 using the following command: vi /etc/sysconfig/network-scripts/ifcfg-em4 a.
  • Page 40 Series 6 Hardware Setup Guide b. Save the file. 11. Restart the network service using the following command: service network restart 12. Verify that em3, em4 and bond interface is active using the following command: service network status 13. check the status of bond interface (ifcfg-eth0) using the following command: cat /proc/net/bonding/eth0 Make sure that em0,em3, em4 are listed and Bonding Mode is ‘fault-tolerance (active- backup)’...
  • Page 41 Series 6 Hardware Setup Guide Note: The NETMASK value is not automatically updated when the Subnet Mask value is set. These two attributes values should not be in conflict. i. After running nwsetup-tui, you must delete NETMASK attribute from the bonding interface ifcfg-eth0.

  • Page 42: Revision History

    Series 6 Hardware Setup Guide Revision History Date Description Series 6 Hosts Hardware Setup Guide for RSA NetWitness® Platform June 27, 2018 version 11.1.0.2 and later July 17, 2018 Moved the PERC H840 RAID controller to slot 4 for the Series 6 Hybrid host.

This manual is also suitable for:

S6 r740xd

Table of Contents