CyberGuard 5.2 Installation Guide

Transcription

1 CyberGuard 5.2 Installation Guide IN December 2003

2 Copyright 2003 by CyberGuard Corporation. All rights reserved. This publication or any part thereof may not be reproduced for any reason in any form without the written permission of the publisher. This publication or any part thereof is intended solely for use with CyberGuard Corporation products by CyberGuard Corporation personnel, customers, and end users. The information contained in this document is believed to be correct at the time of publication. It is subject to change without notice. CyberGuard Corporation makes no warranties, express or implied, concerning the information contained in this document. To report an error or comment on a specific portion of the manual, photocopy the page in question and mark the correction or comment on the copy. Mail the photocopied page (and any additional comments) to CyberGuard Corporation, 2000 West Commercial Boulevard, Suite 200, Fort Lauderdale, FL Mark the envelope Attention: Publications Department. Adaptec, ANA, Quartet, and Quartet64 are trademarks of Adaptec, Inc., which may be registered in some jurisdictions. CyberGuard is a registered trademark of CyberGuard Corporation. DEC is a trademark of Digital Equipment Corporation. Ethernet is a registered trademark of Xerox Corporation. Ghost is a trademark of Symantec Corporation. Microsoft and Windows are registered trademarks of Microsoft Corporation. UnixWare is a registered trademark of Caldera International, Inc. Printed in the U. S. A. Revision History: Level: Effective With: Original Release -- June CyberGuard Firewall Release 3.1 Previous Release -- October CyberGuard Firewall Release 5.1 Current Release -- December CyberGuard Firewall Release 5.2

3 Preface Scope of Manual This manual explains the procedures for setting up CyberGuard s appliance firewalls. Structure of Manual This manual consists of four chapters and three appendixes. A brief description of the chapters and appendixes is presented as follows. Chapter 1 explains the procedures for preparation and initial setup of CyberGuard s appliance firewalls. It describes the software and procedures for installing, upgrading, and configuring an appliance firewall system. Chapter 2 explains the procedures for setting up and configuring FS appliance firewalls. Chapter 3 explains the procedures for setting up and configuring KS appliance firewalls. Chapter 4 explains the procedures for setting up and configuring SL appliance firewalls. Appendix A provides information needed to use the getmib and resmgr utilities to identify ports and interface unit number assignments. Appendix B describes the system backup and restore procedures for the appliance firewalls. Appendix C provides information needed to use the privadm command. This command allows you to set up an administrative network at the SYS_PRIVATE level. iii

4 CyberGuard 5.2 Installation Guide Syntax Notation The following notation is used throughout this manual: italic Books, reference cards, and items that the user must specify appear in italic type. Special terms may also appear in italics. list bold User input appears in list bold type and must be entered exactly as shown. Names of directories, files, commands, options and system manual page references also appear in list bold type. list Operating system and program output such as prompts and messages and listings of files and programs appear in list type. [ ] Brackets enclose command options and arguments that are optional. You do not type the brackets if you choose to specify such options or arguments iv

5 Contents Chapter 1 Installing and Configuring Appliances Before You Begin Appliance Firewall Software Licensing Upgrading an Existing Firewall System Upgrading an Appliance Firewall System Upgrading a Standard Firewall System to an Appliance Using the Initial Configuration Utility Setting Up the Hardware Appliance Firewall Autoconfiguration Logging Into the Appliance Firewall Chapter 2 FS Systems Hardware Ethernet Port Ordering Setup Firmware for ISP1100 Systems Setting the BIOS Setting Up the COM Port Setting Up Boot Devices Saving Changes Firmware for FS Systems with Bonham Motherboard Setting the BIOS Setting Up Boot Devices Saving Changes Firmware for FS250 and FS500 Systems Setting the BIOS Setting Up Boot Devices Saving Changes FS Initial Configuration Chapter 3 KS Systems KS 1U and 2U Systems Hardware Ethernet Port Ordering Setup Firmware for KS 2U with Lancewood Motherboard Setting the BIOS Setting Up the COM Port Setting Up Boot Devices Saving Changes Setting the SCSI BIOS Firmware for KS 2U with Tupelo Motherboard v

6 CyberGuard 5.2 Installation Guide Setting the BIOS Setting Up the COM Port Setting Up Boot Devices Saving Changes Setting the SCSI BIOS Firmware for KS1000 Systems Setting the BIOS Setting Up Advanced Features Setting Up Security Setting Up the Server Setting Up Boot Devices Saving Changes Setting the SCSI BIOS Firmware for KS1500 Systems Setting the BIOS Setting Up Advanced Features Setting Up Security Setting Up the Server Setting Up Boot Devices Saving Changes Setting the SCSI BIOS KS Initial Configuration KS 5U Systems Hardware PCI Slot Ordering Setup Firmware for KS 5U with Lancewood Motherboard Setting the BIOS Setting Up the COM Port Setting Up Boot Devices Saving Changes Setting the SCSI BIOS Firmware for KS 5U with Tupelo Motherboard Setting the BIOS Setting Up the COM Port Setting Up Boot Devices Saving Changes Setting the SCSI BIOS Firmware for KS 5U with Tupelo Motherboard and RAID Setting the BIOS Setting Up the COM Port Setting Up Boot Devices Saving Changes Setting up the RAID Array Firmware for KS1500R with Hodges Motherboard Setting the BIOS Setting Up Advanced Features Setting Up the Server Setting Up Boot Devices Saving Changes Setting up the RAID Array Firmware for KS1500R with Bryson Motherboard Setting the BIOS Setting Up Advanced Features vi

7 Contents Setting Up Security Setting Up the Server Setting Up Boot Devices Saving Changes Setting up the RAID Array KS [5U] Initial Configuration Chapter 4 SL Systems Hardware PCI Slot and Port Ordering Setup Firmware for SL 4U with KOA Motherboard Setting the BIOS Setting Up the COM Port Setting Up Boot Devices Saving Changes Setting Up the RAID Array Firmware for SL2000 Systems Setting the BIOS Setting Up Advanced Features Setting Up Security Setting Up the Server Setting Up Boot Devices Saving Changes Setting Up the RAID Array Firmware for SL3200 Systems Setting the BIOS Setting Up Advanced Features Setting Up Security Setting Up the Server Setting Up Boot Devices Saving Changes Setting Up the RAID Array SL Initial Configuration Appendix A Identifying Ports and Unit Numbers Appendix B Backup and Restore Procedures Backing Up an Appliance Firewall Configuration B-1 Restoring an Appliance Firewall Configuration B-2 Restoring a Configuration B-3 Restoring a Configuration After a System Failure B-4 Appendix C privadm Command vii

8 CyberGuard 5.2 Installation Guide Illustrations Figure 1-1. Initial Configuration Window for Appliance Firewalls Figure 1-2. Stand-Alone KS System Figure 1-3. Sample Initial Configuration Data for Stand-Alone System Figure 1-4. KS High Availability Pair Figure 1-5. Sample Configuration Data for HA Primary System Figure 1-6. Sample Configuration Data for HA Secondary System Figure 2-1. ISP1100 Back Panel Figure 2-2. ISP1100 Front Panel Figure 2-3. FS with Bonham Motherboard Back Panel Figure 2-4. FS250 Back Panel Figure 2-5. FS500 Back Panel Figure 2-6. Initial Configuration Window for FS Platform Figure 3-1. Port Ordering for First-Generation Systems Top Slot Empty Figure 3-2. Port Ordering for Other First-Generation Systems Figure 3-3. Port Ordering for Second-Generation Systems Figure 3-4. Port Ordering for KS 2U with Tupelo Motherboard Figure 3-5. Port Ordering for KS1000 Systems Figure 3-6. Port Ordering for KS1500 Systems Figure 3-7. KS 2U with Lancewood Motherboard Back Panel Figure 3-8. KS 2U with Tupelo Motherboard Back Panel Figure 3-9. KS1000 Back Panel Figure KS1500 Back Panel Figure Initial Configuration Window for KS Platform Figure Lancewood Motherboard PCI Slot Ordering Figure Tupelo Motherboard PCI Slot Ordering Figure KS1500R PCI Slot Ordering Figure Back Panel of KS 5U with Lancewood Motherboard Figure Back Panel of KS 5U with Tupelo Motherboard Figure Back Panel of KS1500R Figure Initial Configuration Window for KS 5U Platform Figure 4-1. PCI Slot Ordering on SL 4U Systems Figure 4-2. PCI Slot Ordering on SL2000 Systems Figure 4-3. PCI Slot Ordering on SL3200 Systems Figure 4-4. SL 4U with KOA Motherboard Back Panel Figure 4-5. SL2000 Back Panel Figure 4-6. SL3200 Back Panel Figure 4-7. Initial Configuration Window for SL Platform Figure C-1. Firewall Administered by a Private Administrative Network C-1 viii

9 1 Installing and Configuring Appliances Before You Begin Appliance Firewall Software Licensing Upgrading an Existing Firewall System Upgrading an Appliance Firewall System Upgrading a Standard Firewall System to an Appliance Using the Initial Configuration Utility Setting Up the Hardware Appliance Firewall Autoconfiguration Logging Into the Appliance Firewall

10 CyberGuard 5.2 Installation Guide

11 1 Chapter 1 Installing and Configuring Appliances 1 This chapter describes CyberGuard appliance firewall software for FS, KS, and SL appliances and explains the procedures for setting up, installing, and configuring these types of systems. It also explains the procedures for upgrading FS, KS, and SL appliance firewall systems to Release Before You Begin 1 This section provides an overview of the appliance firewall software and licensing. Appliance Firewall Software 1 The appliance firewall software consists of one CD-ROM for each type of FS, KS, and SL appliance. The CD-ROM provides a complete image of an installed appliance firewall system. This image is created using Symantec Corporation s Norton Ghost TM. The CD-ROM is bootable; consequently, the appliance firewall has the CD-ROM device as the first boot device. The appliance firewall image is loaded onto the system s hard drive prior to shipment from the factory. It is ready when you first power up the system. In addition to the firewall image, the CD-ROM contains the following important directory: ksinit. This directory contains the browser-based CyberGuard Firewall Appliance Initial Configuration utility, ksinit.htm, and associated files: mssave.htm, shieldwm.jpg, fshelp.htm, kshelp.htm, ks5uhelp.htm, slhelp.htm, FSBack.jpg, FSBackS.jpg, FSBBack.jpg, FSBBackS.jpg, KSLBack.jpg, KSLBackS.jpg, KSTBack.jpg, KSTBackS.jpg. This utility allows you to create a configuration file that can be used for autoconfiguration of the basic components of the firewall during initial boot. These components include the following: High Availability Administrative user Licensing Firewall host name Remote management Central authentication Domain name System mouse type Restore firewall configuration Network interfaces System time and time synchronization Default route 1-1

12 CyberGuard 5.2 Installation Guide The ksinit utility can be run on a remote workstation that runs Microsoft Internet Explorer 4.x or higher or Netscape Navigator 4.x. The configuration file that you create is saved as a text file and stored on a diskette. The diskette can then be inserted in the floppy drive of the firewall for which the configuration is intended. During initial boot, the firewall will read the configuration file from the diskette, load the initial configuration, and reboot. Procedures for using the CyberGuard Firewall Appliance Initial Configuration utility are explained in Using the Initial Configuration Utility, page The appliance firewall software also consists of one additional CD-ROM that contains CyberGuard Supplemental Products and CyberGuard Firewall Release 5.2 manuals in PDF format. These manuals are the Release Notes, Installation Guide, and the Cyber- Guard Firewall Manual, a 3-volume set that includes Administering the CyberGuard Firewall, Configuring the CyberGuard Firewall, and Configuring SmartProxies on the CyberGuard Firewall. Licensing 1 To use the features of the appliance firewall, you must have one of the following types of licenses: 30-day trial license System license obtained from the CyberGuard Corporation Web site The type of license that you have affects the information that you must enter on the Initial Configuration window (see Using the Initial Configuration Utility, page 1-11, and Figure 1-1 for a picture of this window). Information required with each type of license is outlined as follows. 30-Day Trial License Allows you to leave the following fields blank: Onboard MAC Address Hardware ID Serial Number License Key 1-2

13 Installing and Configuring Appliances System License Requires that you enter information in the following fields: Onboard MAC Address Hardware ID (read-only field completed by clicking the Generate button) Serial Number License Key NOTE If you are upgrading an existing FS, KS, or SL appliance firewall system to Release 5.2, you may choose to use your current hardware ID to obtain a system license. In this case, you must enter only the Serial Number and License Key on the Initial Configuration window. Upgrading an Existing Firewall System 1 If you wish to upgrade an existing firewall system to Release 5.2, you must complete the following procedures. Otherwise, proceed to Using the Initial Configuration Utility on page To upgrade an appliance firewall, follow the procedures presented on page 1-3. To upgrade a standard firewall system to an appliance, follow the procedures presented on page 1-7. Upgrading an Appliance Firewall System 1 If you wish to upgrade an existing FS, KS, or SL appliance firewall system to Release 5.2, complete the following procedures. NOTE Currently, on FS250 and FS500 models only, the PS/2 mouse must be plugged in when the system is booted. Be sure that you have a box of blank diskettes available for backing up the system. Label each diskette as appropriate so that you will be able to restore your configuration successfully. 1-3

14 CyberGuard 5.2 Installation Guide NOTE Some of the procedures can be performed by accessing the appliance from a remote workstation; some of the procedures must be performed on the appliance. Follow the procedures described in Using the Initial Configuration Utility on page 1-11 to create a Release 5.2 configuration file that can be used for autoconfiguration of the basic components of the firewall during initial boot. On the appliance firewall system, insert a blank, writable diskette into the floppy drive to prepare for backing up your system. On the appliance or a remote workstation: Select System from the firewall Control Panel, and then select Software Update. When the Software Update window is displayed, enter the following in the Remote Host field: ftp.cybg.com Enter the following in the Remote Directory field: /Unix/5.2/Optional_pkgs Enter the following in the Remote File Name field: backupconfig_orders Enter the login name to be used on the Remote Host in the Remote User Name field (anonymous login is allowed). Enter the password associated with the Remote User Name in the Remote Password field. Check the Use Encryption check box. Enter the string required to decrypt the file in the Encryption Password field. Click on Invoke. The following message will be displayed when the process has been completed: Software Update has been invoked. The system will be restarted to perform upgrade maintenance in a few minutes. Please wait. See /var/adm/log/cg_getorders.log for details. 1-4

15 Installing and Configuring Appliances The system will not be restarted. NOTE Click on OK. On the appliance firewall system: Remove the diskette from the drive, and label it Firewall Recovery Diskette n, where n represents the sequence number of the recovery diskette. Continue to insert, remove, and label recovery diskettes until you have completed backing up your system. Insert the FS, KS, or SL appliance firewall Release 5.2 bootable CD in the CD-ROM drive. Press <Reset> to reboot the system. When prompted, press <F2> to enter Setup. The BIOS Setup Utility screen is displayed. On the Main page, set System Time and System Date to appropriate values for Greenwich Mean Time (GMT). Use the right arrow key to select Exit. Select Exit Saving Changes, and press <Enter>. A window displays the following message: Save configuration changes and exit now? Select Yes, and press <Enter>. A system reboot occurs. Following installation of several drivers, the following message is displayed on the appliance firewall: IMPORTANT: This program is about to overwrite your hard drive! All existing data will be lost! Do you want to continue (you have 20 seconds to respond) [Y,N]? If you do not wish to proceed, press <N>. Otherwise, press <Y> or wait 20 seconds for the program to continue. The system runs Norton Ghost TM. As the image is loaded, the Progress Indicator window is displayed. Loading the image requires approximately 20 minutes. 1-5

16 CyberGuard 5.2 Installation Guide When the image has been loaded, the computer beeps, and the following messages and prompt are displayed on the appliance firewall: Image loaded successfully... Batch File Finished D:\ Remove the appliance firewall CD from the CD-ROM drive. Proceed with autoconfiguration as explained in Appliance Firewall Autoconfiguration on page After the firewall system reboots (requires approximately four minutes), remove the Initial Configuration diskette from the floppy drive. Insert Firewall Recovery Diskette n, where n is a sequence number ranging from one to the total number of recovery diskettes, into the drive. NOTE You must continue to remove and insert recovery diskettes into the drive until you have completed recovery of your firewall configuration. On the appliance or a remote workstation: As applicable, use an attached monitor or Remote Web Administration to log in to the appliance firewall system. Select Tools from the firewall Control Panel, and then select Shell Window. When the Shell Window is displayed, enter the following to become root: /sbin/tfadmin newlvl SYS_PRIVATE su Enter the corresponding password, and press <Enter>. Enter the following to change level to network: newlvl network Enter the following to execute cginstall: cginstall 1-6

17 Installing and Configuring Appliances Enter 4 to select Restore Configuration Files. The following message is displayed: Select source device: (t)ape, (f)loppy, (d)isk Enter f. When the configuration files have been restored, you are returned to the menu. Enter q to quit. Enter exit to exit the root shell. Enter exit to return to the previous level. Enter exit to close the Shell Window. Select System from the firewall Control Panel, and then select System Shutdown. When the System Shutdown window is displayed, select Reinitialize Network. On the appliance firewall system, remove the last Firewall Recovery Diskette from the drive. Upgrading a Standard Firewall System to an Appliance 1 If you wish to upgrade an existing standard firewall system to a Release 5.2 appliance firewall, you must complete the following procedures. NOTE Currently, on FS250 and FS500 models only, the PS/2 mouse must be plugged in when the system is booted. Be sure that you have a box of blank diskettes available for backing up the system. Label each diskette as appropriate so that you will be able to restore your configuration successfully. Follow the procedures described in Using the Initial Configuration Utility on page 1-11 to create a Release 5.2 configuration file that can be used for autoconfiguration of the basic components of the appliance firewall during initial boot. On the standard firewall system, insert a blank, writable diskette into the floppy drive to prepare for backing up your system. 1-7

18 CyberGuard 5.2 Installation Guide Select System from the firewall Control Panel, and then select Software Update. When the Software Update window is displayed, enter the following in the Remote Host field: ftp.cybg.com Enter the following in the Remote Directory field: /Unix/5.2/Optional_pkgs Enter the following in the Remote File Name field: backupconfig_orders Enter the login name to be used on the Remote Host in the Remote User Name field (anonymous login is allowed). Enter the password associated with the Remote User Name in the Remote Password field. Check the Use Encryption check box. Enter the string required to decrypt the file in the Encryption Password field. Click on Invoke. The following message will be displayed when the process has been completed: Software Update has been invoked. The system will be restarted to perform upgrade maintenance in a few minutes. Please wait. See /var/adm/log/cg_getorders.log for details. The system will not be restarted. NOTE Click on OK. Remove the diskette from the drive, and label it Firewall Recovery Diskette n, where n represents the sequence number of the recovery diskette. Continue to insert, remove, and label recovery diskettes until you have completed backing up your standard firewall system. Move to the new appliance firewall system. Proceed with hardware and firmware setup procedures as explained in Setting Up the Hardware on page

19 Installing and Configuring Appliances Proceed with autoconfiguration as explained in Appliance Firewall Autoconfiguration on page After the appliance firewall system reboots (requires approximately four minutes), remove the Initial Configuration diskette from the floppy drive. Now that you have installed and configured the appliance firewall, you can access it via an attached monitor or via a remote management service (i.e., Remote Web Administration or SSH-Secure Shell). On the appliance or a remote workstation, complete the following steps: When the CyberGuard Firewall login window is displayed with your system name, log in as the FSO user that you specified on the appliance firewall Initial Configuration window. When prompted, enter the FSO password, and press <Enter>. The CyberGuard Firewall Control Panel is displayed. Change the root password by completing the following steps. Select the Configuration menu, and then select Users. When the Users window appears, click on Show Editor. Select the root user, and click on the Authentication tab. Click on the Password tab. Click on Generate, or enter a new password in the Password field. Click on Save. Set up your security policy by restoring the configuration that you backed up to diskettes on the standard firewall system. Complete the following steps: On the appliance firewall system: Insert Firewall Recovery Diskette n, where n is a sequence number ranging from one to the total number of recovery diskettes, into the drive. NOTE You must continue to remove and insert recovery diskettes into the drive until you have completed recovery of your firewall configuration. On the appliance or a remote workstation: Select Tools from the firewall Control Panel, and then select Shell Window. 1-9

20 CyberGuard 5.2 Installation Guide When the Shell Window is displayed, enter the following to become root: /sbin/tfadmin newlvl SYS_PRIVATE su Enter the corresponding password, and press <Enter>. Enter the following to change level to network: newlvl network Enter the following to execute cginstall: cginstall Enter 4 to select Restore Configuration Files. The following message is displayed: Select source device: (t)ape, (f)loppy, (d)isk Enter f. When the configuration files have been restored, you are returned to the menu. Enter q to quit. Enter exit to exit the root shell. Enter exit to return to the previous level. Enter exit to close the Shell Window. Select System from the firewall Control Panel, and then select System Shutdown. When the System Shutdown window is displayed, select Reinitialize Network. On the appliance firewall system, remove the last Firewall Recovery Diskette from the drive. 1-10

21 Installing and Configuring Appliances Using the Initial Configuration Utility 1 This section explains the procedures for extracting the appliance firewall Initial Configuration utility, ksinit.htm, from the FS, KS, or SL Appliance Firewall Release 5.2 CD and for using it to create a configuration file that can be used to configure an appliance firewall automatically on first boot. The onboard MAC address is used to generate the hardware ID that is required for obtaining a system license. It may be used in forming the name of the configuration file (otherwise, the name is generic.txt). If the configuration file names are based on the MAC address, they are unique, and multiple configuration files can be stored on a single diskette; the firewall will be able to select the appropriate one when the diskette is inserted in its floppy drive. If you are upgrading an appliance firewall system to Release 5.2, you already have your MAC address and your hardware ID. It is recommended that you make a note of both before proceeding. The MAC address appears on a label on the front panel of the machine. The hardware ID is displayed in the Hardware Number field on the License Keys window of the CyberGuard Firewall GUI. If you have a newly-shipped FS, SL, or KS appliance system other than the KS1000 model, the MAC address appears on a label on the front panel of the machine. If you have a KS1000 system, the MAC address appears on a label on the top of the front right-hand corner of the machine. It is recommended that you make a note of the MAC address before proceeding. NOTE If you are upgrading an existing FS, KS, or SL appliance and you wish to use the MAC address to form the name of your configuration file, you must enter the MAC address in the Onboard MAC Address field on the CyberGuard Firewall Appliance Initial Configuration window. You must also generate a new hardware ID to use in obtaining a system license. If you are upgrading an existing FS, KS, or SL appliance firewall system to Release 5.2 and you do not wish to base the initial configuration file name on the MAC address, you may use your current hardware ID to obtain a system license. Proceed as follows to use the appliance firewall Initial Configuration utility. Insert the FS, KS, or SL Appliance Firewall 5.2 bootable CD in the CD- ROM drive on a remote workstation that runs Microsoft Internet Explorer 4.x or higher or Netscape Navigator 4.x. Open the Windows Explorer, and use the scroll bars to locate the CD- ROM drive in the left pane. Click on the drive to display the contents of the appliance firewall 5.2 CD in the right pane. Locate the ksinit folder, and copy it onto your hard drive. 1-11

22 CyberGuard 5.2 Installation Guide Be sure that you have one or more diskettes available for creating the initial configuration file(s) for your appliance firewall system(s). Insert a blank diskette in the floppy drive on the remote workstation. Open a browser, and in the Location or Address field, enter the following: file://c:/ksinit/ksinit.htm where c represents the hard drive to which you copied the ksinit folder. The screen shown in Figure 1-1 is displayed: 1-12

23 Installing and Configuring Appliances Figure 1-1. Initial Configuration Window for Appliance Firewalls The CyberGuard Firewall Appliance Initial Configuration window provides an easy means for you to supply the information required for initial setup of an FS, KS, or SL appliance system. The fields and controls on this window vary according to the type of appliance that you select from the Firewall Appliance drop-down list box and the particular model that you select from the associated Models drop-down list box. The following sections show the Initial Configuration window for each type of appliance and describe the fields and controls on each window: 1-13

24 CyberGuard 5.2 Installation Guide FS Initial Configuration on page 2-15 KS Initial Configuration on page 3-24 KS [5U] Initial Configuration on page 3-62 SL Initial Configuration on page 4-23 Prior to entering data in the Initial Configuration window, it is recommended that you use the blank configuration window provided in the section associated with your appliance to record information that is appropriate for your system. To assist you, diagrams and example configurations for a stand-alone KS system and a primary and secondary system in a KS High Availability pair are provided in the pages that follow. In the diagrams, note that dashed lines are used to denote optional features. Figure 1-2 shows a stand-alone KS system. 1-14

25 Installing and Configuring Appliances INTERNET External Interface Remote Web Administration Hosts Administrative Interface Host A Gateway Internal Interface Host B Server A Server B RADIUS Server Figure 1-2. Stand-Alone KS System The KS Initial Configuration window shown in Figure 1-3 contains data appropriate for the stand-alone KS system illustrated in Figure

26 CyberGuard 5.2 Installation Guide Figure 1-3. Sample Initial Configuration Data for Stand-Alone System Figure 1-4 shows a KS High Availability pair. 1-16

27 Installing and Configuring Appliances INTERNET dministrative (Exempt) Interface External Interfaces Heartbeat Interfaces Administrative (Exempt) Interface Gateway Internal Interface Internal Interface Remote Web Administration Hosts Gateway Host A Host B Server A Server B RADIUS Server Figure 1-4. KS High Availability Pair 1-17

28 CyberGuard 5.2 Installation Guide The KS Initial Configuration window shown in Figure 1-5 contains data appropriate for the primary KS system illustrated in Figure 1-4. Figure 1-5. Sample Configuration Data for HA Primary System 1-18

29 Installing and Configuring Appliances The KS Initial Configuration window shown in Figure 1-6 contains data appropriate for the secondary KS system illustrated in Figure Figure 1-6. Sample Configuration Data for HA Secondary System 1-19

30 CyberGuard 5.2 Installation Guide Enter data in the fields on the appliance firewall Initial Configuration window as appropriate for your site. Click on the Help button to obtain a detailed description of the fields and controls on the window. NOTE A Class A, Class B, or Class C address must be entered in the IP Address field associated with each network interface; that is, the value of the first byte of the address must be less than 224. If you are configuring an HA primary or secondary system, the Type setting for the Remote Web Administration interface (e.g., eee0) interface must be Internal Exempt; otherwise, it must be Internal. You must configure the Management Interface (e.g., eee0) to permit further configuration of the firewall using Remote Web Administration. Verify that the information that you have entered is correct, and press the Submit button. A configuration page is displayed in the browser. Follow the instructions provided on that page to save it as a text file. When you select Save As from the browser s File menu, you must select Text File (*.txt) from the Save as type drop-down list. NOTE If you have entered a value in the Onboard MAC Address field, the file name is based on the MAC address; otherwise, it is generic.txt. If the file name is based on the MAC address, you may save multiple configuration files to the diskette. In this case, the firewall will select the correct file when the diskette is inserted in the floppy drive on a firewall. If the firewall does not find a file with a unique name, it looks for the generic.txt file. Remove the diskette from the drive, and take it to the firewall on which you plan to use it. 1-20

31 Installing and Configuring Appliances Setting Up the Hardware 1 Hardware requirements for Release 5.2 for FS, KS, and SL appliances are as follows: FS, KS, or SL system Keyboard Video monitor PS/2 or Serial mouse Hardware and firmware setup procedures vary according to type of appliance. The following chapters and sections explain the procedures for setting up each type of appliance: Chapter 2, FS Systems, Hardware on page 2-1 Chapter 3, KS Systems, KS 1U and 2U Systems on page 3-1 Chapter 3, KS Systems, KS 5U Systems on page 3-34 Chapter 4, SL Systems, Hardware on page 4-1 NOTE With the exception of FS250 and FS500 models, the keyboard, monitor, and mouse are not required after you have completed the hardware and firmware setup procedures. Complete the hardware and firmware setup procedures applicable to your appliance. Proceed with appliance firewall autoconfiguration as explained in the section that follows (page 1-22). 1-21

32 CyberGuard 5.2 Installation Guide Appliance Firewall Autoconfiguration 1 Before you begin, be sure that you have the diskette containing the FS, KS, KS[5U], or SL initial configuration file that you have created for your system. NOTE On first boot of the SL, SL2000, or SL3200 software image, an error message regarding a partition not mounted will be displayed. Disregard this message. Insert the Initial Configuration diskette in the floppy drive on the firewall. Press <Reset> to reboot the machine. During the initial boot to run level 2, the firewall will attempt to read the configuration file created through use of the appliance firewall Initial Configuration window. NOTE If the file is not found, the system will retry the read every five seconds for three minutes. After three minutes, the system will shut down. If the file is read successfully, the initial configuration is loaded, and the system automatically reboots. NOTE The firewall will not attempt to read the diskette on the second and subsequent boots. A log file (log) that contains the status of the autoconfiguration is written to the diskette (if it is writable). 1-22

33 Installing and Configuring Appliances Logging Into the Appliance Firewall 1 After you have installed and configured the appliance firewall, you can access it via an attached monitor or via a remote management service (i.e., Remote Web Administration or SSH-Secure Shell). Complete the following steps: When the CyberGuard Firewall login window is displayed with your system name, log in as the FSO user that you specified on the appliance firewall Initial Configuration window. When prompted, enter the FSO password, and press <Enter>. The CyberGuard Firewall Control Panel is displayed. Change the root password by completing the following steps. Select the Configuration menu, and then select Users. When the Users window appears, click on Show Editor. Select the root user, and click on the Authentication tab. Click on the Password tab. Click on Generate, or enter a new password in the Password field. Click on Save. If you have a new appliance firewall system, use the menus accessible from the firewall Control Panel to set up the security policy for your enterprise network. Refer to the CyberGuard Firewall Manual for assistance. Back up your system. Procedures are explained in the Backing Up an Appliance Firewall Configuration section of Appendix B. 1-23

34 CyberGuard 5.2 Installation Guide 1-24

35 2 FS Systems Hardware Ethernet Port Ordering Setup Firmware for ISP1100 Systems Setting the BIOS Setting Up the COM Port Setting Up Boot Devices Saving Changes Firmware for FS Systems with Bonham Motherboard Setting the BIOS Setting Up Boot Devices Saving Changes Firmware for FS250 and FS500 Systems Setting the BIOS Setting Up Boot Devices Saving Changes FS Initial Configuration

36 CyberGuard 5.2 Installation Guide

37 2 Chapter 2FS Systems 2 This chapter provides information specific to FS systems. These include ISP1100 systems, FS systems with Bonham motherboards, and FS systems with Woodruff motherboards (hereinafter referred to as models FS250 and FS500). This chapter explains hardware and firmware setup procedures and provides reference information needed to complete the FS Initial Configuration window. 2 2 Hardware 2 This section shows port ordering for each type of FS system and explains how to set up the hardware. Refer to Appendix A for information needed to use the getmib and resmgr utilities to identify ports and interface unit number assignments. Ethernet Port Ordering 2 Port ordering for an ISP110 system is shown in Figure 2-1 (page 2-2). Port ordering for an FS with Bonham motherboard is shown in Figure 2-3 (page 2-3). Port ordering for an FS250 is shown in Figure 2-4 (page 2-3). Port ordering for an FS500 is shown in Figure 2-5 (page 2-3). Setup 2 To set up an FS firewall system, complete the following steps. Remove the computer from the box. Plug in the serial or PS/2 mouse and the keyboard, video, network, and power cables by using the diagrams in Figure 2-1, ISP1100 Back Panel, and Figure 2-2, ISP1100 Front Panel, or Figure 2-3, FS with Bonham Motherboard Back Panel, Figure 2-4, FS250 Back Panel, or Figure 2-5, FS500 Back Panel. NOTE Currently, on FS250 and FS500 models only, the PS/2 mouse must be plugged in when the system is booted. 2-1

38 CyberGuard 5.2 Installation Guide The current default video setting for this appliance firewall system is 1024 x 768 x Hz refresh. Turn on the computer. PS/2 Mouse On-Board Ethernet Port eee1 Video Four-Port Adapter Keyboard USB On-Board Ethernet Port eee0 COM1 Figure 2-1. ISP1100 Back Panel Figure 2-2 shows the ISP1100 front panel and indicates the position of the COM2 port. The FS appliances with Bonham and Woodruff motherboards do not have a COM2 port. COM2 Figure 2-2. ISP1100 Front Panel 2-2

39 FS Systems PS2 Mouse On-Board Ethernet Port eee0 Four-Port Adapter Keyboard USB Video COM1 USB Figure 2-3. FS with Bonham Motherboard Back Panel PS2 Mouse RJ45 10/100 (eee_2) Single-Port Adapter (eee_0) Keyboard COM1 Video USBs RJ45 10/100 (eee_1) Figure 2-4. FS250 Back Panel PS2 Mouse RJ45 10/100 (eee_1) Four-Port Adapter Keyboard COM1 Video USBs RJ45 10/100 (eee_0) Figure 2-5. FS500 Back Panel 2-3

40 CyberGuard 5.2 Installation Guide Firmware for ISP1100 Systems 2 NOTE The BIOS and SCSI BIOS are set as required for operation of the firewall prior to shipment of the appliance firewall system from the factory. It is recommended that you check the settings to ensure that they are correct, however. Follow the steps presented in Setting the BIOS on page 2-4. Setting the BIOS 2 Ensure that you have turned on the computer. When prompted, press <F2> to enter Setup. The BIOS Setup Utility screen is displayed. On the Main page, verify that System Time and System Date are set to appropriate values for Greenwich Mean Time (GMT). Setting Up the COM Port 2 Use the right arrow key to select System Management, and press <Enter>. Select Serial Features, and press <Enter>. On the Serial Features page, select Serial Console Redirection, and press <Enter>. Use the arrow key to select Disabled, and press <Enter>. On the Serial Features page, select Serial Port, and press <Enter>. Use the arrow key to select COM1 3F8 IRQ4, and press <Enter>. On the Serial Features page, select BAUD Rate, and press <Enter>. Use the arrow key to select 9600, and press <Enter>. On the Serial Features page, select Flow Control, and press <Enter>. Use the arrow key to select XON/XOFF, and press <Enter>. Press <Esc>. Use the right arrow key to select Exit from the Menu Bar. 2-4

41 FS Systems Setting Up Boot Devices 2 Use the right arrow key to select Advanced from the Menu Bar. On the Advanced page, select Boot Configuration, and press <Enter>. Verify the following settings: Plug & Play O/S Reset Config Data Numlock [No] [No] [No] Press <Esc>. On the Advanced page, select Peripheral Configuration, and press <Enter>. Verify the following settings: Serial Port A Base I/O Address [3F8] Interrupt [IRQ 4] Serial Port B Base I/O Address [2F8] Interrupt [IRQ 3] Legacy USB Support Press <Esc>. On the Advanced page, select IDE Configuration, and press <Enter>. Set the value of IDE Controller to Primary. Verify the following settings: Hard Disk Pre-Delay Primary IDE Master Primary Slave Secondary Master Secondary Slave [QUANTUM FIREBALLlct1] [CD-224E] [Not Installed] [Not Installed] Press <Esc>. On the Advanced page, select Diskette Configuration, and press <Enter>. 2-5

42 CyberGuard 5.2 Installation Guide Verify the following settings: Diskette Controller Floppy A [1.44/1.25 MB 3½"] Diskette Write Protect Press <Esc>. On the Advanced page, select Event Log Configuration, and press <Enter>. Verify the following settings: Event Log Event Log Validity Clear All Event Logs Event Logging ECC Event Logging [Space Available] [Valid] [No] Press <Esc>. Use the right arrow key to select Boot from the Menu Bar. Verify the following settings: Quiet Boot Quick Boot After Power Failure On Modem Ring On LAN On PME [Last State] [Stay Off] [Stay Off] [Stay Off] Primary master IDE [1 st IDE] Primary slave IDE [2 nd IDE] Secondary master IDE [3 rd IDE] Secondary slave IDE [4 th IDE] On the Boot page, select 1 st Boot Device, and press <Enter>. Use the arrow key to select ATAPI CD-ROM, and press <Enter>. On the Boot page, select 2nd Boot Device, and press <Enter>. Use the arrow key to select IDE-HDD, and press <Enter>. On the Boot page, select 3rd Boot Device, and press <Enter>. Use the arrow key to select Floppy, and press <Enter>. On the Boot page, select 4th Boot Device, and press <Enter>. Use the arrow key to select Disabled, and press <Enter>. 2-6

43 FS Systems Saving Changes 2 Select Exit Saving Changes, and press <Enter>. A window displays the following message: Save configuration changes and exit now? Select Yes, and press <Enter>. A system reboot occurs. Follow the remainder of the procedures outlined in Setting Up the Hardware on page Firmware for FS Systems with Bonham Motherboard 2 NOTE The BIOS and SCSI BIOS are set as required for operation of the firewall prior to shipment of the appliance firewall system from the factory. It is recommended that you check the settings to ensure that they are correct, however. Follow the steps presented in Setting the BIOS on page 2-7. Setting the BIOS 2 Ensure that you have turned on the computer. When prompted, press <F2> to enter Setup. The BIOS Setup Utility screen is displayed. On the Main page, verify that System Time and System Date are set to appropriate values for Greenwich Mean Time (GMT). Setting Up Boot Devices 2 Use the right arrow key to select Advanced from the Menu Bar. On the Advanced page, select Boot Configuration, and press <Enter>. 2-7