IPScan V3.5 User s Guide

Transcription

1 IPScan V3.5 User s Guide ViaScope Int. Tel Technical Support: help@viascope.com

2 ViaScope IPScan Version 3.5 Copyright by ViaScope Int.. 4th Floor Nasung Bldg Suseo-dong, Kangnam-ku Seoul, Korea Printed in Republic of Korea. No part of this publication may be reproduced, photocopied, or transmitted without express, written consent of ViaScope Int.. 2

3 Contents PREFACE... 6 CHAPTER 1. INTRODUCTION PRODUCT OVERVIEW Features and Functions What s New and Changes in IPScan V New Released Feature... 9 CHAPTER 2. COMPULSORY CONFIGURATION OF IPSCAN SERVER AND CONSOLE IPSCAN SERVER CONFIGURATION Server Monitor ODBC configuration Server Configuration IPSCAN CONSOLE CONFIGURATION Probe Monitoring Range CHAPTER 3. GENERAL FEATURES OF IPSCAN CONSOLE DESCRIPTION OF IPSCAN CONSOLE WINDOW Probe Tree / Group Tree User List ICON States Event Log Viewer Event Log Event Log Description Login User Activity Details Current Login User Search Results CHAPTER 4. SAFE MODE AND PROBE MANAGEMENT TOOLS SAFE MODE PROBE MANAGEMENT TOOLS Properties User Login ID Configuration Search Information Dos Commands Import User Defined Column Batch File Option

4 Check Probe Connections Check All IP Status Check All IP Status Add New Probe Group Delete All Groups Rename Probe Delete Probe Create C Class Groups Telnet to Probe Change Probe CHAPTER 5. IP MANAGEMENT TOOLS GROUP TREE Add User Group and IP Grouping IP/MAC CONTROL IP Authorization IP/MAC Return Delete Row CHAPTER 6. DHCP SERVER DHCP SERVER CONFIGURING DHCP SERVER DHCP FEATURES Manage New MAC Temporary Access Period for Unauthorized MAC Authorize DHCP MAC Define MAC Lease for Unauthorized MAC DHCP IP Registration / DHCP Multiple IP Registration Automate Static IP Blocking CHAPTER 7. PROBE LEVEL BLOCKING MANAGE NEW IP/MAC MANAGE UNUSED IP MANAGE OFF RANGE IP AUTOMATE EXPIRED IP/MAC Expire Policy Free Device MANAGE BROADCAST PACKET CHAPTER 8. IP/MAC LEVEL BLOCKING MANAGE HOST IP/MAC APPLY IP/MAC & HOST NAME REGISTRATION

5 8.3. APPLY MULTIPLE IP/MAC REGISTRATION GLBP (Gateway Load Balancing Protocol) Registration TIME CONTROL SYSTEM DEVICE CHAPTER 9. DATABASE MANAGEMENT BACKUP AND RESTORE IPSCAN DATABASE MSSQL Server Backup Database MSSQL Server Restore Database MySQL Server - Backup Database MySQL Server - Restore Database CHAPTER 10. REPORT DATA EXPORT REPORT VIEWER Report Viewer Configuration and Execution Configure Report Group Report Viewer Execution Define Author

6 IP/MAC resource Management and network security solution Preface Conventions Convention [Bold font] [command] Bold font Blue small font Item Feature Names Commands and keywords Emphatic sentences References Note Means the following information will help you to apply functions T I P Means the following information shold be consiered when you apply the functions Obtaining Technical Support ViaScope Int. provides you the high quality technical support. The Technical Support Team is available on the day time, and for immediate response, please contact your reseller. Contact Details ViaScope International Int. Tel FAX : / Technical Support: help@viascope.com 6

7 IP/MAC resource Management and network security solution Chapter 1. Introduction This chapter describes the overview of the IPScan V3.5 with its new features. Network sizes have been expanded and upgraded rapidly to accommodate the increasing number of IP users in the network. Especially for large corporations and organizations, it is almost impossible to assign and keep track of IP addresses from a central location. Managing IP users is time consuming and can be very aggravating. IPScan, developed by ViaScope Int. is an IP address management and control solution that enables IT managers to manage the entire network s IP addresses from a central location. This chapter contains the following sections 1.1. Product Overview Features and Functions What s New and Changes in IPScan New Released Feature

8 1.1. Product Overview IPScan is the most successful IP management solution in IT industry. It provides the central managing and enforcing control over fundamental network access and IP address allocation. It is the integrated solution to streamline various tasks for IP managers. Also for the organization, it is the best way to enhance their management power with one solution Features and Functions. Secure IP Address Management Automatic IP/MAC resource monitoring IP address reservation IP-MAC binding Real-time IP/MAC inventory IP/MAC description column & quick search Event detection and log Network Access Control Layer 2 level blocking Network based IP/MAC blocking Visitor access time control Host name control Expired IP/MAC control Wireless access point security IP grouping IP conflicts Management Mission critical Server protection from IP conflict Ideal for static IP address device Built in DHCP Server Wireless access point security MAC authentication Reserved IP for a particular MAC Lease time for the unauthorized IP/MAC Secure Static IP What s New and Changes in IPScan V3.5 Function Upgrade DHCP features Manage Expired User License Policy Manage Off Range User Data Export Report Viewer Chat board Console Upgrade Assign GLBP device Description Unauthorized MAC can be managed. Can manage the Expired MAC user as well. Intensify the License policy Can manage the Off Range User and define the range of users as the Off range. Exported file can be saved as HTML type Upgrade the function of the User define field Chat board is available between the Console users. Automate the Console Upgrade procedure. The Gateway in use of GLBP (Gateway Load Balancing Protocol) can be assigned to secure its network connection, and its related event message can be managed. 8

9 New Released Feature Advanced Pack for IPScan V3.5 The Advanced Pack offers various add-on functions to extend management capabilities. The Advanced Pack V2.0 which is compatible with IPScan V3.5 is composed of following features. Function Unregistered Service Port Blocking Switch Port Management Description User defined TCP Port can be scanned and blocked. Switch port can be managed. Selected Switch Port blocking Router Conflicting Switch Port Blocking 9

10 IP/MAC resource Management and network security solution Chapter 2. Compulsory Configuration of IPScan Server and Console The IPScan Server is the core element to manage the Probes and Database Server. After the Probe has been installed in right position, the Server and the Probe will establish the connections between them. This chapter explains the must configuration of the IPScan Server and Console IPScan Server Configuration IPScan Server Monitor ODBC Configuration Server Configuration 2.2. IPScan Console Configuration Probe Monitoring Range

11 2.1. IPScan Server Configuration In order to activate IPScan Server, you need to configure ODBC configuration and Server configuration. Using IPScan Server Monitor, you can monitor the server status and probe connection status and data transmission status Server Monitor To manage the Probes and network users with the IPScan Console, the IPScan Server should be executed. If there are any changes in the configurations of the Server, you should stop the Server service and change configurations. Otherwise, the changed configuration could not be applied. Below is the main viewer of IPScan Server. You can change the ODBC Configuration and Server Configuration when you need to change. Select [Start Server] button from bottom of the IPScan Server Monitor screen. a b The IPScan Server starts service and gathers the information from the IPScan Probes from now on. a. IPScan Server Connection information Start Time : IPScan Server start time All Probes : all probes (On/Off line) detected by IPScan Server Disconnected Probe(s) : Number of Off line Probe(s) among the logged Probe(s) Current Console(s) : Number of IPScan Console connected to IPScan Server at the current time Current Agent(s) : Number of IPScan related applications such as Server application (If the manager defined the Server option for sending an event log to the manager), Warmsaver Agent and etc. Version : Version of IPScan Server. b. Database configuration information. c. It shows the log list to identify active status and other connection information of IPScan Server. Select [Start Server] to execute the IPScan Server. Note When the Server stops its service, the Probe will also stop to gathering data after the predefined time out period. 11

12 ODBC configuration ODBC (Open Database Connectivity) is an open standard application programming interface (API) for accessing a database. Using ODBC module, many different application programs can make a connection with the Database Server. Therefore, it is essential to define the ODBC information in order to make a connection between the IPScan Server and the MySQL or MSSQL Server. ODBC is also used to create and initialize tables in the database to store information. Select [Configuration ODBC]. a. Select the ODBC Driver in use. i a b c d e f g h b. Type ODBC data source name, you can make a simple name, otherwise type IPSCAN35 c. It is the name of the Database which you have defined as IPSCAN35DB in MySQL DB Installation d. Database Server IP address e. Write a simple discription of the ODBC f. The Username which you use to connect to the Database Server. MySQL DB Server uses Username root as default name. Also MSSQL uses the default sa ID as root. g. Define your password for the Username you have just defined. h. TCP/IP Port number to communicate with Database Server is automatically set by IPScan Server. It would appear different port number by Database Server. i. Once you have done to define all of the values, select [Test Connect] to test if the connection is established successfully. Database connect success message is appeared, select [OK]. Step4 Select [OK] to create ODBC. When you select [Yes] any existing ODBC tables in the database will be deleted and created new tables. This is a must step for IPScan to save necessary data in MySQL. Select [Yes]. Step5 This IPScan DB Generator will create new Database for IPScan. Select [OK] to continue. 12

13 Step6 Select [Next] to continue generating. Step7 To create database table for IPSCan, Select [OK]. Step8 After the DB creation is completed, you will be shown with this screen. Select [OK] to finish the DB Generator. Note After creating or change the ODBC configuration, you must check the Server configuration explained in next page. 13

14 Server Configuration Before you start the IPScan Server, the Server Configuration must be set to manage this Server. Note Before you set this option, the IPScan Server should be unloaded (stop) its service. Otherwise, the configuration can not be defiend. If the IPScan Server is on service, select [Stop Server] button from bottom of the IPScan Server Monitor screen Select [Configuration Server]. a. Database : Select Database you have installed for IPScan Server b. History Option : History means that IPScan Server will manage the history of all IP addresses information. If you do not want to keep the history of it, select [No History]. Default is [History]. c. IPScan System Language : Select a language you wish to use on IPScan Server Monitor. d. User Added Field Data : This option is related to Import Column of IPScan Console. If you choose [IP Base], the imported column will be listed by IP addresses, and if you use the DHCP Server feature, choose [MAC Base], the imported column will be listed by MAC addresses. e. Probe DHCP : If you use the IPScan Probe as a DHCP Server, this option must be selected. Even if the IPScan Probe offers the DHCP function, without this configuration, the IPScan Console can not manage that DHCP features. Since the IPScan Server detects the IPScan Probe s configuration, and manage it using the IPScan Console, the IPScan Server should match its configuration to the IPScan Probe. f. Control Switch Port : From IPScan V3.5, it is available to control Switch Port. If you want to use this function, click the box. Otherwise, the [Control Switch Port] function will not be appeared in the Console viewer. (Available with Advanced Pack V2.0 or higher version) g. Scan Host Port : From IPScan V3.5, it is also available to [Block Unregistered Service Port]. In other word, IPScan Probe detects and blocks the user who does not use the compulsory official application by the TCP port connection. It is also must selection if you wish to use this function in the Console viewer. Otherwise, the [Block Unregistered Service Port] function will not be appeared in the Console viewer. (Available with Advanced Pack V2.0 or higher version) h. Console Control Port : TCP port number for the connection between the Server and the Console. i. Console Event Port : TCP port number for the connection between the Server and the Console (foe Event) j. Communication Time Out (sec) : Time out checking interval between the Server and the Probe. Note When you change TCP port number in h,i,j, you should change that port number in the Probe configuration. See the Probe Installation Guide to change the configuration. 14

15 k. Service Port Information : Display the TCP ports status of the IPScan Server machine to show the TCP Ports in use. You should define those TCP ports to the firewall. Otherwise, the IPScan product family cannot connect each other and/or other problems could be caused. To get more detailed information about the TCP Ports, see the IPScan V3.5 Installation Guide. Select [OK] to save the configuration. 15

16 2.2. IPScan Console Configuration Probe Monitoring Range This configuration is explained in the Installation Guide as well. When you execute IPScan Console for the first time, although the IPScan Console can automatically detect IPScan Probes on the network and displays its IP addresses on the Probe Tree without any configuration, there would be no data information from the Probes. Since the Probe cannot gather the user data without the monitoring range which should be sent by the Console to the Server, and the Probe. To monitor and manage the data information for each probe, Monitoring Range must be configured by each probe. Select a Probe to assign the monitoring range from the Probe Tree and right mouse click. Select [Probe Monitoring Range]. The configuration box is appeared. a b d e f c Step4 a. It is automatically defined the IPScan Probe s IP address. If there is no VLAN on the network, define IP address of the IPScan Probe. If there are several VLAN ranges on the network, you should define individual monitoring range for each VLAN. When you define the VLAN monitoring range which the Probe s actual IP is involved in, [Host IP] should be the actual Probe IP address, and for other rest of the VLAN monitoring ranges, [Host IP] should be a virtual IP address for the IPScan Probe. This virtual IP address should not be allocated to other network machine. b. Define the start IP address of the monitoring range. c. Define the end IP address of the monitoring range. d. If there is a DHCP server to allocate IP addresses on the network, click the box. When you use the DHCP Server, the monitoring range should be defined in different way. For instance, the IP ranges are divided into three groups. From xxx.xxx.xxx.1 to xxx.xxx.xxx.90 IP range is for static IP addresses, and from xxx.xxx.xxx.91 to xxx.xxx.xxx.150 IP range is for DHCP IP addresses. Finally, from xxx.xxx.xxx.151 to xxx.xxx.xxx.254 IP range is for static IP addresses. In this case, you will have three different IP ranges. Add the first static IP range without clicking DHCP box, and add the DHCP IP range with clicking DHCP box. At the last, define the second static IP address range without DHCP. e. If you have VLAN on your network, define VLAN ID, and add each VLAN IP range. f. The number of Ethernet ports on the IPScan Probe. Depending on model the IPScan Probe, the number of ports could be different. Select actual number of IPScan Probe on the configuration. Select [Save] to and the message box will be shown to restart IPScan Probe automatically. Select [OK] Step5 To modify the configuration, double click the filed you wish to modify and enter vlaues. Select [Save]. 16

17 IP/MAC resource Management and network security solution Chapter 3. General Features of IPScan Console The IPScan Console is the actual user interface to control the Server and the Probe. You can apply policies and change configurations using the Console viewer. With the IPScan Console, the IT manager can manage the network from anywhere at anytime. This chapter describes general features and composition of the Console main screen Description of IPScan Console Window Probe Tree/Group Tree User List ICON States Column States Event Log Viewer Event Log Event Log Description Login User Activity Details Current Login User Search Results

18 3.1. Description of IPScan Console window When you login to the IPScan Console, below is the main screen which is in form of three parts of the list viewers and the Main Menu. d a b c e a. Probe Tree/Group Tree Display all probes and groups managed by the Server. You can create logical or physical groups and assign users for more comprehensive management. You can also define and/or remove probe level policies using right mouse click. More detailed information is on next page. b. User List Displays IP users ON/OFF network usage status and execute policies for individuals. Any policies per IP/MAC level should be defined and/or removed from this window. More detailed information is on next page. c. Event Log Real-time update on activities and events happened in the entire network. It includes history of login administrators activities and IP/MAC related events such as IP duplications, new MAC, IP login and etc More detailed information is on next page. d. Main Menu Bar Define server connection, console login and logout and launch ReportViewer for log query. e. Overall Status Bar Shows probe level policies defined on selected probe, access user and license information. 18

19 Probe Tree / Group Tree All probes and probe groups are listed. To apply any policy in Probe level, right mouse click. You will get the drop-down menu. The detailed features will be explained in Chapter 4 and Chapter 7. You can create logical group by user defined name. It is useful when you want to manage the IP/MAC addresses by distinguished logical area such as division, location, etc. The detailed features will be explained Chapter User List Real time The real time status for each IP/MAC address Display all users usage status. You can identify the user status by the color of the status Icons. Also the policy Icons are appeared when the policy is applied to each user s address. Policy The applied policy status for each IP/MAC address Event The event log for each IP/MAC address 19

20 ICON States Icon Features and Policies Icon Features and Policies IP/MAC is online IP/MAC is offline IP/MAC is never been used IP/MAC is used today Uses static IP Unauthorized IP IP assigned from DHCP serer Uses only one IP/MAC Uses multiple IP/MAC [IP Blocking] [Auto Expired IP Blocking] [IP/MAC based Time Control] [DHCP IP Registration] [Host Name Registration Blocking] [IP Registration Blocking] [MAC Registration Blocking] [Multiple IP Registration Blocking] [System Device Based on MAC] [Broadcast Limit Free Device] [Expire Free Device based on IP] IP expiry notification (Yellow Color) MAC expiry notification (Yellow Color) IP/MAC expiry notification (Yellow Color) Auto block expired IP defined (Green Color) Auto block expired MAC defined (Green Color) Auto block expired IP/MAC defined (Green Color) Expired IP/MAC blocked (Red Color) Expired MAC blocked (Red Color) Expired IP blocked (Red Color) [Mac Blocking] [Auto Expired MAC Blocking] Configured as a Router [Multiple DHCP IP Registration] Host Name Registration Log [IP Registration Log] [MAC Registration Log] [Multiple MAC Registration Blocking] [System Device based on IP] [Port Scan Free Device] [Expire Free Device based on MAC] IP/MAC Status Examples ICON Status ICON Status On + Static + Single IP On + Static + Multi IP On + DHCP Unknown + Static + Single IP Unknown + DHCP On + Illegal + DHCP On + Illegal +Static + Multi IP Off + Illegal + Static + Single IP On + GLBP Off + Static + Single IP Off + Static + Multi IP Off + DHCP Unknown + Static Multi IP Unused On + Illegal + Static + Single IP Off + Illegal + DHCP Off + Illegal + Static + Multi IP Off + GLBP Unknown + GLBP 20

21 Column States Column IP Address MAC Address Apply Host Name Group Name NIC Vendor Time Control Port Scan Service Description and Applied Features User s IP Address User s MAC Address Display Icons of applied policies User s NetBIOS name User s Group name Network Interface Card information [Time Control] policy is applied. Display temporary access period. Display blocking status of unregistered service port user Status Switch information Port State Port No. Port Name [Type] Last IP State Last MAC State Login Time Logout Time Display defined Managing Name of Switch. [Control Switch Port] policy is applied. Display port Up/Down status. Switch port number Switch port name [Switch Port Type : G=General U=Uplink D=Downlink] Display event state of IP address at last. Display event state of MAC address at last. Login time of IP/MAC address Logout time of IP/MAC address 21

22 Event Log Viewer Event Log Event Log : The real-time event log list. Display all event logs from the Probe. Right mouse click on the Event log screen, and select [Event Display Options] on the drop-down menu to control the display options and pop-up event. You can save the information shown in this screen to CSV or HTML file. Right mouse click on the Login User Activity screen and select [Save as a CSV File] -> [CSV] or [HTML] [Event Log Display Options] is shown. [Evnet] tab shows the all available commands and policies of IPScan. You can enable or disable the Event Name for the Display, the Pop Up and the option Display : Display status of enabled Event name Pop Up : Pop up evnet message Box is shown when the enabled Event has occurred. Send the event log of enabled Event to the manager by . [Probes] tab shows the all Probe list and its display option. If you want to display all Event from the selected Probe, double click the Display option to be green. 22

23 Event Log Description Event MAC Movement Description and Applied Features MAC has been moved to the other Probe when New MAC Blocking feature has been applied. Probe Exit Probe Login Multiple IP Login Single IP Login DHCP IP Enter Probe s connection with server has been lost. Probe s connection with server has been established. Device using more than one IP has entered the network. Device using a single IP has entered the network. IP addresses have been allocated by DHCP Server (the Probe DHCP Server or other DHCP Server) New IP IP Logoff IP Conflict Multiple IP Change Single IP Change DHCP IP Change IP Change (New IP) IP Blocking Time Control Blocking (IP) Automate Static IP Blocking Server Level New MAC Blocking (DHCP) Probe Level New MAC Blocking (DHCP) Unauthorized MAC Blocking Unregistered IP Blocking Off Range Blocking Time Control Blocking (MAC) Expired IP Blocking Expired MAC Blocking Block Broadcast Violation IP MAC Blocking Apply Port Scan violation Blocking IP Reg. Blocking New IP, not in DB, has been detected. Device using a single IP has disconnected from the network. IP conflict has occurred (more than one device is using a same IP) Device using more than one IP has changed IP. Device using a single IP has changed IP address. Device with IP assigned from DHCP, has changed IP Used IP changed its IP address to a new IP User has attempted to access the network using a blocked IP. Expire the temporary access period of IP. Unregistered Static IP has been detected in the DHCP environment. New MAC has been detected under the Probe in DHCP environment New MAC has been detected under the Probe Group in DHCP environment. Unauthorized MAC has been detected on the network. Unregistered IP has been attempted to access the network. IP out of the Probe Monitoring Range has been detected and blocked. Expire the temporary access period of MAC Expired IP has attempted to access the network Expired MAC has attempted to access the network. A particular IP has exceeded its broadcast packets over defined threshold value. Blocked MAC has attempted to access the network. A violation IP which did not use the defined TCP Ports has been blocked. MAC has been matched with particular IP(s), but the MAC attempted to access the network using a different IP. The access is denied. MAC Reg. Blocking IP has been matched with particular MAC(s), and another MAC has attempted to access the network using matched IP. The access is denied. Host Name Reg, Blocking IT manager has registered particular host name for the device, but the device attempted to access the network using a different host name. The access is denied. 23

24 Event Block New IP New MAC Host/Group Name Change Group Name Change Host Name Change Manage Off Range IP Manage Broadcast Packet MAC Reg. Log Description and Applied Features New IP, not in DB, has been blocked. New MAC, not in DB, has been detected. Host and Group names have been changed. Group name has been changed. Host name (collected from NetBIOS) has been changed IP not registered within the monitoring range has been detected. IP had exceeded allowed broadcast threshold (bytes per second). IP has been matched with particular MAC(s), and another MAC has attempted to access the network using matched IP. The access is allowed, but the history is logged. IP Reg. Log MAC has been matched with particular IP(s), but the MAC attempted to access the network using a different IP. The access is allowed, but the history is logged. Host Name Reg. Log IT manager has registered particular host name for the device, but the device attempted to access the network using a different host name. The access is allowed, but the history is logged. Probe fail over DHCP fail over Unknown DHCP Server detected IP Allocation Failure Gather Port Information Apply Router Conflicting Port Blocking Secondary Probe has taken over the Master Probe. Secondary DHCP Server has taken over the Master DHCP Server. Unauthorized DHCP Server has been detected. DHCP Server has failed to allocate IP addresses. The Probe has gathered the Switch Port Information. An IP user has duplicated its IP with the Router, and the Switch Port of that IP has been blocked Block Switch Port Switch Monitoring Status Switch port has been blocked. The Probe has failed to query SNMP MIB for the Switch Login User Activity It shows the applied policy in real-time for each IP/MAC user. You can save the information shown in this screen to CSV or HTML file. Right mouse click on the Login User Activity screen and select [Save as a CSV File] -> [CSV] or [HTML] 24

25 Details It shows the detailed information about the system and policies applied. If you execute the [Control Switch Port], the Switch Port information will be displayed as well Current Login User It shows the currently login users. If you have multiple Login users, you can have a chat to share information each other. Double click the Login user you wish to send a message The chat box will be shown. Type message and click [Send] Search Results It shows the searched results by [Search] on the Main Menu Bar. The searched results are shown as below. 25

26 IP/MAC resource Management and network security solution Chapter 4. Safe Mode and Probe Management Tools IPScan provides the simulation mode which is called Safe Mode to help the manager to practice IPScan features. This chapter describes the Safe mode and the basic management tools Safe Mode Probe Management Tools Properties User Log in ID configuration Search information Dos Command Import User defined column Batch File Option Check Probe Connections Check All IP Status Add New Probe Groups Delete All Groups Rename Probe Delete Probe Create C Class Groups Telnet to Probe Change Probe

27 4.1. Safe Mode Safe mode freezes defined blocking policies for the selected probes. You can execute [Safe Mode] to be applied to the entire network by running the feature from the very top (usually the licensed company name) level from the probe tree. It is useful when pausing all blocking features or other policies for a brief period of time to check the system. However, even under safety mode, if any violations against the defined policies occur, it will be shown on console and the log will be saved on database. T I P If the Probe is act as a DHCP Server, the Probe will allocate the IP addresses to the users even in [Save Mode]. However, the blocking functions and other policies are not applied. From the Probe Tree, choose the probe which you want to simulate all policies to be applied, and right mouse click. Choose [Safe Mode]. The message box is shown to execute the mode. Select [OK] to execute. The check mark will appear in front of the menu If you wish to release the [Safe Mode], do the same steps as the above, the check mark will disappear Probe Management Tools The Probe Management Tools are for configuring and managing the Probes with one integrated user interface. With these tools you could have time controlled management effect. The tools are such as User Login ID authorization, execution of Dos Command in the Console viewer, real-time check of IPs and the Probes status, telnet connection to the Probes in the Console viewer, and so on. 27

28 Properties It is the management tool that configures general configurations such as Mail Server configuration, user list display option and so on.. Step4 Step5 Choose [Options] from the Main Menu Bar on top of the Main view. Choose [Properties]. You will be bypassed to the Properties configuration box, and prompted to enter the value. Select [General]. a. You can define the number of rows for displaying searched list to be displayed at once. The default value is 1000 row that the searched list will not be displayed over 1000 rows at a once. You can define 0 that there is no limit to show the searched list at once. b. Define the connection waiting period between IPScan Server and the Console. If the Server is b not answer to the Console within the c [Timeout] period, the Console will regard the connection has been disconnected by the Server. The default value is 30 seconds. Depending on the network, the waiting period should be defined little more higher than 30 seconds. Otherwise, the Server and Console could be disconnected frequently. c. Define the connection waiting period between the Console and the Database Sever. If the database server is not answer to the Console within that period, the Console will consider the connection has been disconnected by the Database Server Select [Mail Server]. This is the configuration for sending event log by to the manager. If you do not define the Mail Server information, you will not receive the event log, and should check it manually. e f g h. Select [OK] or [Apply] to save the configuration. h a b c d a. Enter Outgoing mail server IP address or name. b. Enter the ID of the mail server with its password. c. Enter the Sender s address d. Enter the Receiver s address. You can enter multiple addresses using ;. e. Enter sending interval in minute, the event log will be sent by every defined interval to the manager. f. Select the type of event log file. g. Enter the number of maximum Lines for the sent event log at once. 28

29 Step6 Select [Expired]. This configuration relates to the [Automate Expire IP/MAC] funcion from the Probe Tree. When you execute that function, assign the expiration period, so that IP/MAC addresses are blocked from the network if they are not in use on the network for the expiration period. a b a. Enter the number of days you want to be notified before the expiration. Before IP/MAC expires, the manager can be notified prior to expiry. b. Enter the number of days to determine blocking of IP/MAC from the network. If there is no in use of that IP/MAC within the expiration period, the Probe will block the IP/MAC. Step5 Select [Data Backup]. This backup database contains the event log statistics which is related with the Report Viewer explained in Chapter 10. Report Viewer. b a. Select the saving period If you define 4months, the database within 4months from today will be saved in IPScan database and other previous database will be moved to the backup database (ips30_backup). b. Select the delete interval If you define 5months, the backup database within 5months from today will be saved in the backup database, and the previous bacup database will be removed. c. Execute DB Backup The IP/MAC data information will be stored in backup db everyday at midnight. If you do not click the box, which means that the data will not be saved, and there would be no data to view in the Report Viewer. 29

30 User Login ID Configuration Creating login user ID and assigning access authority can be executed by root account user. The menu will not be available if you have logged in under different user ID. If you have multiple managers in the network, you can create login ID and assign access authority. Select [Users] from the Main Menu Bar on top of the Main screen. Choose [Login ID] to create and/or modify Login ID authority. The following configuration box is shown. Select [Add] to bypass to the User Registration box to create new Login ID. You will be prompted to enter the values. a b c d e a. Enter a Login ID for new User ID. b. Enter a User Name c. Enter description for the new ID d. Enter an address of receiver. e. Enter password for the new ID Step4 Choose a login user on the login user list to assign access authority and select [Permission]. Step5 Assign Read/Write permission to the probe or the group by double clicking green/red symbol. Select the permission level which is created by the [User Group] from the [Users] menu. You can view the permission level and configure the Policy Execution Level for each Permission Level by clicking View Permission Level. T I P It is recommended to assign the Read/Write permission carefully to the Administator and the limited user to avoid any trouble from changing configuration and policies. Step6 Select [OK] to apply the changed configuration. 30

31 You can create and/or modify the Permission Level and its Policy Execution Level which is a list of the available policies applied by executing function. T I P It is recommended that you limit the policy definition authority since each login user can define policies conflicting to each other. Thus only one user ID, which could be the root the Administrator, should have a permission to assign some of critical functions such as Blocking and any Authorization of IP/MAC in order to streamline management capabilities and avoid any complexity. Therefore, you should define cautiously the Policy Execution Level for each Permission Level for each User ID. Select [Users] from the Main Menu Bar on top of the Main screen. Choose [Login User Group] to create and/or modify the Permission Level and its Policy Execution Level. You can assign the Policy Execution Lever for each Permission Level by double clicking the green/red symbol of the commands. The Commands are the functions available to be applied. Step4 Select [Add] to create new permission level. Enter the name of the Permission Level, and description Select [OK] to create. Step5 The left window will be shown. You can define the authorized functions to add User ID by double clicking the green/red symbol of command. Note This commands and user functions are corelated, thus if you deactivate any of these commands, the related functions will not be able to use on the Console menu. Also, if you delete any authority from the Permission Level, the related users will not be able to manage the Console viewer. Step6 Select [OK] to apply the changed configuration. 31

32 Search Information This function provides easy way to search the user information on the User List. Select [Tools] from the Main Menu Bar on top of the Main screen. Choose [Search] a. Contents in search : Enter the key word to search b. Key field : Select a column to search c. Search area : Select a Search area. d. Search display option Display the search results on current windows : If you select this option, the searched field will be marked on the currunt User List. Display the search results on Search Results windows : If you select this option, the searched results will be shown on the [Search Results] on the Event Log Viewer. e. Display recent update only : If you click the box, the search area will be the recent DB. Otherwise the search area will be all DB. Select [Search] to start search the key word on the selected column from the selected search area Dos Commands The IPScan Console provides you to execute the Dos Command in the Console window. It is useful to use the Dos commands to verify the status of IP address such as Telnet, Ping and so on. Select [Tools] from the Main Menu Bar on top of the Main screen. Choose [Add Dos Commands]. Or choose an IP address from the User List, and choose [DOS Command] -> [Add Dos Command] a. Name : Enter a name of the command to identify b. Command : Enter a command you wish to add c. Option : Enter a option for the command if it has. For example, Ping 211.xxx.xxx.xxx t. Default provided Dos Commands are Nbtstat (NetBIOS name service) and Ping. Step4 Select [OK] to apply the changed configuration. Choose an IP address to run the Dos command on the User List and right mouse click. Select [Dos Commands] and select any Dos Command you added. 32

33 Import User Defined Column The manager can create user definable column on the User List in order to organize the address information matched with user s information such as telephone number, division, position and so on. Select [Tools] from the Main Menu Bar on top of the Main screen. Choose [Add User Defined Columns]. You can add new column for user s information you wish to manage or identify. It is useful when you organize IP/MAC group by the user definable column. a. Name : Enter a name of column b. Description : Enter description for the column Select [Add] to apply the changed configuration, and select [OK]. You can verify the add columns on the [Import Column Data]. This imported column information will be displayed on the User List. Select [Tools] from the Main Menu Bar on top of the Main screen. Choose [Import Column Data]. b a d a. Depending on this selection, the user definable column will be imported based on the IP Address or MAC Address. If you use DHCP environment, default is MAC Address base, otherwise IP Address base is the c default selection. This is not selectable. b. Click the column name you wish to import to the User List. c. Import the CSV file contains the column information with IP/MAC address. d. The column list is displayed from the CSV file. Select [Save] to apply the changed configuration, and select [OK]. 33

34 Batch File Option This is very useful when the monitoring range is wide, since it is very complicate task to organize many of IP/MAC addresses and assign policies for each IP/MAC. Thus the Console offers you a simply function to minimize your work using CSV file. With this file you simply import the file which contains the IP/MAC addresses, and assign policies for them with one clicking. Select [Tools] from the Main Menu Bar on top of the Main screen. Choose [Batch File Options] a. Select the Probe to apply policy. If you are b not selecting the Probe, the Probe is automatically selected. Also If the IP/MAC a information c addresses to apply the policy are dispersed in several probes, you should not select the Probe. It will be automatically searched. b. Select the commands you wish to apply by clicking c. Load the CSV file which contains IP/MAC d. The IP/MAC list of CSV file is shown on the view. e. Select [Save] to apply the selected command to the listed IP/MAC list. The success message will be shown on the Result Column. Note If the IP/MAC you wish to apply the command is in several different Probe Monitoring Ranges, you should not select the Probe. Leave the box as blank. Select [Close] Check Probe Connections It is useful function that the Console checks the connection between the Probe and the Server. You can you this function when the Probe is unexpectedly disconnected or the Console cannot view the real time gathered data. Choose the Probe you wish to check its status and right mouse click. Select [Check Probe Connections] on the drop-down menu. The message box is shown to run this function. Select [OK] to run. If the connection has been disconnected, the message box will show you the connection status. Note When the connection is disconnected between the Probe and the Server, 1. Try Ping to the Probe. If there is no request from the Probe, please check the phisical status of the Probe, or check the network condition between the Server and the Probe. 2. If there is a request from the Probe, try telnet to the Probe and check any configuration changes and its System Status. 34

35 Check All IP Status This is the function that you can verify the all IP addresses current on/off status. If you manage the wide range of the network with huge numbers of IP, it takes time to check the IP on/off status by the ARP check from the Probe. Thus if you need to be sure of the IP status for the particular Probe at current, it is very useful to refresh the status quickly rather than to wait to be checked by the checking interval. Choose the Probe you wish to check its status and right mouse click. Select [Check All IP Status] on the drop-down menu. The message box is shown to run this function. Select [OK] to run Add New Probe Group To add new Probe Group Choose the Probe you wish to add new probe group and right mouse click. Select [Add New Probe Group] on the drop-down menu. Enter the name of new group. Select [OK] to create the new group Delete All Groups To delete all probe groups Choose the Probe you wish to delete all probe groups and right mouse click. Select [Delete All Groups] on the drop-down menu. The message box is shown to run this function. Select [OK] to run Rename Probe To rename probe Choose the Probe you wish to rename and right mouse click. Select [Rename Probe] on the drop-down menu. Enter new probe name. Select [OK] to run Delete Probe To delete one Probe (the Probe you want to delete should be switched off.) Choose the Probe you wish to delete and right mouse click. Select [Delete Probe] on the drop-down menu. The message box is shown to run this function. Select [OK] to run. 35

36 Create C Class Groups This is very useful function if there are several VLAN in use in the network. For example, if the Probe Monitoring Range is from to with multiple VLAN, there are 10 different C class ranges on this monitoring range. Thus, if you execute this function, 10 different C class groups will be created automatically as shown below. To create C class groups Choose the Probe you create C class groups and right mouse click. Select [Create C Class Groups] on the drop-down menu. The message box is shown to run this function. Select [OK] to run Telnet to Probe If you want to get into the Probe you can simply use this function. Choose the Probe you wish to connect and right mouse click. Select [Telnet to Probe] on the drop-down menu. You will get into the telnet screen of the selected Probe Change Probe When you need to change the Probe, the Probe should be logged out and turned off the power switch first. Choose the Probe you wish to change its H/W and right mouse click. Select [Change Probe] on the drop-down menu. Enter the serial number of the Probe you wish to change. The Serial number is unique by each Probe and/or each Ethernet Port (in case of Probe 200, 600). You can identify it using [Telnet to Probe] to connect to the Probe and select [2. LAN] from the Main Menu of the Probe. You can find a serial number of the Probe or Ethernet Port. Otherwise see the bottom of the Probe and you will fine 16 digit numbers. Select [Yes] to change the Probe. 36

37 IP/MAC resource Management and network security solution Chapter 5. IP Management Tools IPScan Provides IP Management Tools to organize user list. This chapter explains how to make a user group and authorize individual user Group Tree Add User Group and IP Grouping 5.2. IP/MAC Control IP Authorization IP/MAC Return Delete Row

38 5.1. Group Tree You can create logical group by user defined name. It is useful when you want to manage the IP/MAC addresses by distinguished logical area such as division, location, etc Add User Group and IP Grouping To add new user group Choose [Ungroup] and right mouse click Select [Add User Group] from the drop down menu. You will be prompted to enter the new group name. Enter New User Group name, for example Sales, and select [OK]. Once you create a User Group, you need to put IP/MAC Users into the Group. Choose [Sales] the user group and right mouse click Select [IP Grouping] from the drop down menu, and choose [By Selection] or [By Range] If you choose [By Selection], you can select users on the user list to put into the User Group. Step4 Double click [Ungroup] or [Probe Mode] to list user list. Ste5 Choose IP(s) or MAC(s) (use Shift or Ctrl key to select multiple users) that you want to put into the User Group Sales, and drag it into the group. Step6 Step7 Step8 Step9 Select [OK] to complete. If you choose [By Range], you can add IP ranges to the User Group. Enter the start IP and end IP of an IP range, and select [Add]. Select [OK] to complete. You can create the User Group to distinguish users by the logical group name. It is useful to manage and apply the policies to users with this group name. You can simply manage this user group with [Add User Group], [Delete Group] and [Rename]. In addition, you can define and apply all IP/MAC Level Blocking functions in the Group Tree with [Set Host Policy] from the drop-down menu. 38

39 5.2. IP/MAC Control IP/MAC addresses could be controlled with those IP/MAC control features IP Authorization As the [Manage New IP/MAC] feature authorize and/or block the unauthorized new IP/MAC address by the Probe level, this feature authorize the individual IP address. With this assignment, the assigned IP address will not be blocked by the [Block New IP] feature, even if the IP is a new on the network. It is disabled from the drop-down menu when the selected IP was assigned as an Unused IP. Choose an IP/MAC to authorize from the User List, and right mouse click Select [IP Authorization] from the drop down menu. The message box is appeared to execute the feature. Select [Yes] IP/MAC Return If an IP/MAC is no longer active in the network, you can return the IP to the Unused IP list, and delete the MAC from the User List. The returned IP/MAC address information will be deleted from the database, thus you can only have history information of the IP/MAC from the Backup DB. If the selected IP/MAC address is assigned as a System Device, this IP/MAC cannot be returned. Choose an IP/MAC to return to the Unused IP list form the User List, and right mouse click Select [IP Return] or [MAC Return] from the drop down menu. The message box is appeared to execute the feature. Select [Yes] Delete Row You can delete an off line IP/MAC address row from the User List to organize the User List. If the selected IP/MAC is in on line, the row cannot be deleted. It is just deleting the information from the viewer; the actual information is stored in the DB. Choose an IP/MAC to delete the row from the User List, and right mouse click Select [Delete Row] from the drop down menu. The message box is appeared to execute the feature. Select [Yes]. 39

40 IP/MAC resource Management and network security solution Chapter 6. DHCP Server IPScan V3.5 offers DHCP Server feature which allow the manager can have the integrated cost-effective management tool to streamline diverse management tasks. This chapter describes the DHCP Server, and its configurations and features for DHCP environment DHCP Server 6.2. Configuring DHCP Server 6.3. DHCP Features Manage New MAC Temporary Access Period for Unauthorized MAC Authorize DHCP MAC DHCP IP Registration / DHCP Multiple IP Registration Automate Static IP Blocking