SolarWinds Firewall Security Manager Quick Start Guide

Transcription

1 SolarWinds Firewall Security Manager Quick Start Guide

2 FIREWALL SECURITY MANAGER Copyright SolarWinds Worldwide, LLC. All rights reserved worldwide. No part of this document may be reproduced by any means nor modified, decompiled, disassembled, published or distributed, in whole or in part, or translated to any electronic medium or other means without the written consent of SolarWinds. All right, title, and interest in and to the software and documentation are and shall remain the exclusive property of SolarWinds and its respective licensors. SOLARWINDS DISCLAIMS ALL WARRANTIES, CONDITIONS OR OTHER TERMS, EXPRESS OR IMPLIED, STATUTORY OR OTHERWISE, ON SOFTWARE AND DOCUMENTATION FURNISHED HEREUNDER INCLUDING WITHOUT LIMITATION THE WARRANTIES OF DESIGN, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT. IN NO EVENT SHALL SOLARWINDS, ITS SUPPLIERS, NOR ITS LICENSORS BE LIABLE FOR ANY DAMAGES, WHETHER ARISING IN TORT, CONTRACT OR ANY OTHER LEGAL THEORY EVEN IF SOLARWINDS HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. The SolarWinds, the SolarWinds & Design, ipmonitor, LANsurveyor, Orion, and other SolarWinds marks, identified on the SolarWinds website, as updated from SolarWinds from time to time and incorporated herein, are registered with the U.S. Patent and Trademark Office and may be registered or pending registration in other countries. All other SolarWinds trademarks may be common law marks or registered or pending registration in the United States or in other countries. All other trademarks or registered trademarks contained and/or mentioned herein are used for identification purposes only and may be trademarks or registered trademarks of their respective companies. Microsoft, Windows, and SQL Server are registered trademarks of Microsoft Corporation in the United States and/or other countries. SolarWinds Firewall Security Manager version 6.4, revised

3 SolarWinds Firewall Security Manager Quick Start Guide About SolarWinds SolarWinds, Inc develops and markets an array of network management, monitoring, and discovery tools to meet the diverse requirements of today s network management and consulting professionals. SolarWinds products continue to set benchmarks for quality and performance and have positioned the company as the leader in network management and discovery technology. The SolarWinds customer base includes over 45 percent of the Fortune 500 and customers from over 90 countries. Our global business partner distributor network exceeds 100 distributors and resellers. Contacting SolarWinds You can contact SolarWinds in a number of ways, including the following: Team Contact Information Sales Technical Support User Forums thwack.com Conventions The documentation uses consistent conventions to help you identify items throughout the printed and online library. Convention Specifying Bold Italics Fixed font Straight brackets, as in [value] Curly braces, as in {value} Logical OR, as in value1 value2 Window items, including buttons and fields. Book and CD titles, variable names, new terms File and directory names, commands and code examples, text typed by you Optional command parameters Required command parameters Exclusive command parameters where only one of the options can be specified

4 About SolarWinds iii

5 SolarWinds Firewall Security Manager Quick Start Guide SolarWinds Firewall Security Manager Documentation Library The following documents are included in the SolarWinds Firewall Security Manager (FSM) documentation library: Document Purpose Online User Guide Evaluation Guide Quick Start Guide Release Notes Provides context-sensitive help for the user interface as well as an online reference manual for FSM users and administrators. Targeted to users evaluating FSM. Provides installation, setup, and common scenarios for which FSM provides a simple, yet powerful, solution. Provides installation, setup, and common scenarios for which FSM provides a simple, yet powerful, solution. Provides late-breaking information, known issues, and updates. The latest Release Notes can be found at

6 Quick Start Guide SolarWinds Firewall Security Manager iv SolarWinds Firewall Security Manager Documentation Library Contents About SolarWinds... iii Contacting SolarWinds... iii Conventions... iii SolarWinds Firewall Security Manager Documentation Library... iv Chapter 1 Introduction... 1 Integrating with SolarWinds NCM... 2 Chapter 2 Installing Firewall Security Manager... 3 Requirements... 3 Deployment Best Practices... 4 Installing the FSM Server... 4 Importing Firewall Configurations... 5 Connecting to the Device... 7 Importing from SolarWinds NCM... 8 Installing FSM Clients... 9 FSM Licensing Chapter 3 Getting Started... 13

7 SolarWinds Firewall Security Manager Quick Start Guide Viewing and Querying Firewall Details Using Packet Tracer Optimizing Firewalls Running and Scheduling FSM Reports Running PCI Analysis Reports Running the Security Audit Report Scheduling FSM Batch Reports Using Change Advisor Configuring Change Advisor Users Contents Configuring a Name Server Submitting a Change Request Managing Change Requests v

8 Quick Start Guide SolarWinds Firewall Security Manager vi Contents

9 SolarWinds Firewall Security Manager Quick Start Guide Chapter 1 Introduction SolarWinds Firewall Security Manager (FSM) is a versatile firewall and router management tool that provides comprehensive solution sets for audit and daily operational tasks. Use FSM to view and query device configurations in a normalized format, compare configuration versions, and model configuration changes before implementing them. Use reports in FSM to analyze compliance with enterprise and industry standards. The following illustrates the components of an FSM installation. FSM Server The FSM server consists of the database server, which all clients share, the SolarWinds License Manager, an FSM client, and the FSM web server, which provides the web-based interface for Change Advisor. FSM Clients The FSM client software analyzes the configurations and log data the FSM server collects for your managed devices. For additional information, see "Deployment Best Practices" on page 4. FSM Change Advisor Web Console The FSM Change Advisor web console provides a web-based interface to enter and review change requests for the managed firewalls. For additional information, see "Using Change Advisor" on page 20. Introduction 1

10 Quick Start Guide SolarWinds Firewall Security Manager Integrating with SolarWinds NCM SolarWinds NCM is a network configuration change management software that allows you to back up, analyze, and modify the configuration files on all of your network devices. This includes firewalls and firewall-capable routing devices. The following describes how you FSM and NCM can work together to help you collect, analyze, and update your device configurations without ever having to go to the command line or manually access the device itself. Collecting the Configuration Files In FSM you have several options for collecting configurations files: connect directly to a Cisco or Juniper NetScreen device connect to a Check Point management server import configuration files from your company's file system You can also connect to your NCM server to import configuration files from multiple devices. This allows you to leverage what NCM has already done for you and streamline the initial import process in FSM. Analyzing the Configuration Files After you have the configuration files in FSM, you can analyze your firewall rules in human-readable tables, compare different versions of configuration files, and even generate reports to tell you what rules are not being used or open your network for security risks. Using the various tools and reports in FSM, you can easily identify what needs to be changed on what devices, and then test those changes in an offline change-modeling environment to ensure your changes will not have any adverse effects. Updating the Device Configurations After you have identified what needs changing, FSM generates change scripts with the proposed changes. These scripts are fully editable, so you can implement only what you want and customize where necessary. After you have finalized the scripts, use NCM to execute it on the target devices. For additional information about SolarWinds NCM, visit Introduction 2

11 SolarWinds Firewall Security Manager Quick Start Guide Chapter 2 Installing Firewall Security Manager Install FSM on a server that meets or exceeds the minimum requirements. After you install the FSM server, configure additional FSM clients as necessary. This section addresses the following topics regarding the initial setup: Requirements Deployment Best Practices Installing the FSM Server Importing Firewall Configurations FSM Licensing Requirements The following table provides the minimum requirements for SolarWinds FSM. Software/Hardware Operating System Internet Browser (Change Advisor web console) CPU Speed Memory Requirements Install FSM on a 32- or 64-bit computer running any of the following operating systems: Windows Server 2003 or later (including SP2) Windows Server 2003 R2 or later (including SP2) Windows Server 2008 or later (including SP2) Windows Server 2008 R2 or later (including SP1) Windows Server 2012 Windows 7 (clients only) Windows 8 (clients only) The FSM Change Advisor web console is compatible with the following Internet browsers: Microsoft Internet Explorer versions 7 and higher Mozilla Firefox versions 14 and higher Google Chrome versions 20 and higher Apple Safari Mobile Note: SolarWinds does not support administrative functions for the FSM Change Advisor web console on Apple Safari Mobile. Pentium 2 GHz equivalent or faster (x86, x64, or AMD64) Dual Core recommended 2 GB RAM for 32-bit installations 4 GB RAM for 64-bit installations 8 GB or more recommended for 64-bit installations Installing Firewall Security Manager 3

12 Quick Start Guide SolarWinds Firewall Security Manager Software/Hardware Hard Drive Space Adobe Acrobat Reader Microsoft Excel Ports Requirements 1 GB 10 GB of temp space 50 GB of temp space for large firewall configurations 50 GB of temp space for the Usage Analysis task Version 6.0 or later Microsoft Office 2007 or later FSM uses the following ports for communication: 3050 (TCP) for access to the shared database 4568 (TCP) for license manager (TCP) for license manager 8080 (TCP) for access to the Change Advisor web server (TCP) for access to the Change Advisor web server (express install only) (TCP) for access to a SolarWinds NCM server if you are using one to import device configurations into FSM Note: All ports except for the NCM port are fully configurable in the licensed version of this product. Deployment Best Practices Install the FSM server on a dedicated server-class host. FSM automatically installs a client on this server. Use this client primarily to configure automatic imports of device configurations. Although an FSM client is already installed on the FSM server, the best practice is to install a remote FSM client to perform analysis tasks from a computer other than the FSM server. Additionally, you can install multiple remote clients if you need to perform different analysis tasks at the same time. For example: If you have more than one network engineer If you run Impact Monitor If you need to poll devices on a regular basis If you want a dedicated report server for analysis reports For additional information, see "Installing FSM Clients" on page 9. Installing the FSM Server Complete the following procedure to install the FSM server. To install the FSM server: 1. Temporarily disable any antivirus software. 2. Extract the contents of the ZIP file you downloaded from the SolarWinds Customer Portal. 3. Run setup.exe. 4 Installing Firewall Security Manager

13 SolarWinds Firewall Security Manager Quick Start Guide 4. Select an installation type, and then click Next. For the sake of this guide, select Express Install Recommended to install FSM with default settings. Note: The Express installation option creates the FSM database with a default password. If you want to change this password during the installation, select the Advanced option. Otherwise, you can change the password manually at any time. For additional information, see the help topic, Changing the FSM Database Password. 5. Enter your address, and then click Next. 6. Accept the End User License Agreement (EULA), and then click Next. 7. After the installer finishes running the installation files, click Next. 8. After the installer finishes configuring FSM, click Next. 9. On the summary screen, review the list of installed components, and then click Done. Importing Firewall Configurations After you launch the FSM client for the first time, the application displays the Import Firewall Configurations wizard. This task stores the configuration files for the firewalls you import on the FSM server, which allows you to access the files offline for reporting and change modeling tasks. FSM currently supports configurations from the following devices: Cisco security appliances: PIX, ASA, FWSM, ASA 8.3 Cisco IOS routers: version 12.0 to 12.14, excluding X* series Juniper firewalls: Netscreen, SSG, ISG Check Point products: SmartCenter NG/NGX, Security Management R70 to R75 running on any platform, including: o SecurePlatform o o Check Point IPSO (formerly Nokia) Crossbeam o Linu x o Solaris o Win dows Installing Firewall Security Manager 5

14 Quick Start Guide SolarWinds Firewall Security Manager For additional information about the devices we support, see the KB article, FSM Supported Devices. When you import device configurations, the wizard presents the following import method options: Import from FileSystem Imports the configuration files for a single device from any locally accessible filesystem. This option requires that you have extracted the configuration files from the device and have them available. Connect to Device Connects to a specific device to extract the current configuration files. This option requires that you have network connectivity to the device and the appropriate credentials. Import from NCM Repository Imports the configuration files for one or more devices from a SolarWinds Network Configuration Manager (NCM) repository. FSM currently supports SolarWinds NCM versions 5.x, 6.x, and 7.x. This option requires network connectivity to the NCM server and the appropriate credentials. Import from Check Point Management Server Imports the configuration files for one or more Check Point firewalls from the Check Point management server. This option requires network connectivity to the Check Point management server and the appropriate credentials. This guide covers two import scenarios: Connecting to the Device Importing from SolarWinds NCM For additional information about importing device configurations from a file system, see the help topic, Data Collection Guide for Configs. For additional information about importing device configurations from a Check Point management server, see the help topic, CPMI Connection Parameters. Connecting to the Device Use the following procedure if you want FSM to connect directly to your devices to retrieve their configuration files. This option requires that you have network connectivity to the device and the appropriate credentials. To import firewall configurations directly from the device: 1. In the Import Firewall Configurations window, click Next. 2. On the Import New Firewall screen, complete the Device Information section as appropriate (optional). 3. In the Select Import Method section, select Connect to Device. 6 Installing Firewall Security Manager

15 SolarWinds Firewall Security Manager Quick Start Guide 4. In the Select Firewall Type section, select the type of device configuration you want to import. For the sake of this example, select Cisco Security Appliance (PIX/ASA/FWSM). 5. Click Next. 6. On the Firewall Connection Parameters screen, complete the Connection Parameters section: a. In the Device name or IP Address field, enter the hostname or IP address of the device. b. If you are connecting to the device using SSH, enter the appropriate username in the Username field. c. If you provided a username in the previous step, enter the corresponding password in the Password field. d. In the Transfer configs using field, select the transfer protocol. Note: FSM currently supports SSH 2 or Telnet. If your device uses SSH 1 or SSH 1.5, select Telnet as the transfer protocol. e. If you use a non-standard port for the protocol you selected, modify the default value in the Port field. 7. In the Firewall Command Template Parameters section, enter the appropriate values in the Value column, and then press Enter. For this example, enter the Enable password in the Value column for that parameter. Notes: After importing the firewall's configurations, FSM stores these credentials to retrieve configuration updates. The device command template uses additional parameters, which the wizard hides by default. If you have trouble connecting to a device, select Show internal command template parameters with default values, and modify the default parameters as necessary to mitigate the issue. 8. Click Finish. After you import a firewall, FSM adds it to the Firewall Inventory. For additional information, see "Viewing and Querying Firewall Details" on page 13. Importing from SolarWinds NCM Use the following procedure if you want to import your device configuration files from a SolarWinds Network Configuration Manager (NCM) server. This procedure works with NCM version 7.x and higher. For information about earlier versions, see the help topic, NCM Connector Setup for NCM 6.x. For additional information about SolarWinds NCM, visit Requirements Installing Firewall Security Manager 7

16 Quick Start Guide SolarWinds Firewall Security Manager The procedure in this section requires the following: Network access to the NCM server over port The IP address of the NCM server The username and password of an NCM user with Execute Script permissions. NCM roles with this permission include: o Administrator o Engineer o WebUploader Procedure Complete the following procedure from an FSM client to import device configurations from a SolarWinds NCM server. To import firewall configurations from an NCM server: 1. In the Import Firewall Configurations window, click Next. 2. On the Import New Firewall screen, complete the Device Information section as appropriate. 3. In the Select Import Method section, select Import from NCM Repository. 4. Click Next. 5. On the NCM Repository Connection Parameters screen, complete the Connection Parameters section: a. In the Server URL field, enter serverip :17778, where serverip is the IP address of the NCM server. b. In the Username field, enter the username for an NCM user with Execute Script permissions. c. In the Password field, enter the password for the NCM user. 6. Click Next. 7. After the wizard imports the list of available devices, select the devices you want to import. Note: FSM only imports configuration files from supported Cisco or NetScreen devices. The wizard does not allow you to proceed if you select a device with the type, "Unknown." 8. If the wizard returns a supported device with an Unknown type, click the Type field for that device, and then select the correct device type from the menu. To fix this issue on the NCM side, enable SNMP on the device, or manually select the device type in the node settings. 9. Click Finish. 8 Installing Firewall Security Manager

17 SolarWinds Firewall Security Manager Quick Start Guide 10. On the Firewall Import Status window, review the results of the import, and then click Complete Import. Note: Warning messages in this window do not affect FSM's ability to analyze the device configurations. After you import a firewall, FSM adds it to the Firewall Inventory. For additional information, see "Viewing and Querying Firewall Details" on page 13. Installing FSM Clients The FSM server includes the FSM client automatically. Install additional FSM clients to connect to the FSM server remotely, facilitate regular device polling, or to use as a report server. To install an FSM client: 1. Temporarily disable any antivirus software. 2. Ensure the FSM server is accessible from the client over the required ports. Temporarily disable the firewall on the FSM server or create the applicable firewall rules to allow client connectivity. For additional information, see "Requirements" on page Using the same installer media you used to install the FSM server, run setup.exe. 4. Select Client Install, and then click Next. Installing Firewall Security Manager 9

18 Quick Start Guide SolarWinds Firewall Security Manager 5. Enter your address, and then click Next. 6. Accept the End User License Agreement (EULA), and then click Next. 7. Browse to a custom installation folder or accept the default, and then click Next. 8. After the installer finishes installing the FSM client, click Next. 9. On the Local database configuration screen, click Test Connection. 10 Note: If you specified a new password for the FSM database either during the initial server installation or anytime thereafter, enter it here before testing the connection. 10. If the test is successful, click OK, and then click Next. 11. On the Shared database configuration screen, complete the information for the FSM server: a. Enter the IP address of the FSM server in the IP-Address of the server field. b. If you changed the shared database password, enter it in the Shared database password field. c. Click Test Connection. 12. If the test is successful, click OK, and then click Next. 13. After the installer finishes configuring the FSM client, click Next. 14. On the summary screen, review the list of installed components, and then click Done. FSM Licensing SolarWinds licenses the FSM server according to the number of devices it manages. Managed devices include all firewall and firewall-capable routing devices. When you install the FSM server, it automatically starts a 30-day trial period. When you are ready to enter your licensing information, open the SolarWinds License Manager and complete the appropriate licensing procedure: To access the SolarWinds License Manager: 1. In the FSM client, click Help > License Manager. 2. If you need to purchase a license, click Buy Now to navigate to the SolarWinds website. 3. If you already have a license, click Enter Registration Key, and then complete one of the following procedures. Installing Firewall Security Manager Licensing Servers with Internet Access

19 Licensing Servers without Internet Access SolarWinds Firewall Security Manager Quick Start Guide Licensing Servers with Internet Access Complete the following procedure to license your FSM server if it has access to the Internet. Note: If your FSM server accesses the Internet through a proxy server, complete the procedure for activating without Internet access instead. To license FSM on a server with Internet access: 1. On the Add License window, select I have internet access and an activation key. 2. Click the link to access the customer portal on the SolarWinds web site. 3. Log on to the portal using your SolarWinds customer ID and password. 4. On the left navigation bar, click License Management. 5. Navigate to your product, choose an activation key from the Unregistered Licenses section, and then copy the activation key. 6. If you cannot find an activation key in the Unregistered Licenses section, contact SolarWinds customer support. 7. Return to the Add License window, and then enter the activation key in the Activation Key field. 8. Click Next. 9. Enter your address and other registration information, and then click Next. Licensing Servers without Internet Access Complete the following procedure to license your FSM server if it does not have access to the Internet, or if it accesses the Internet through a proxy server. To license FSM on a server without Internet access: 1. On the Add License window, select This server does not have internet access, and then click Next. 2. Click Copy Unique Machine ID. 3. Paste the copied data into a text editor document. 4. Transfer the document to a computer with Internet access. Installing Firewall Security Manager 5. On the computer with Internet access, complete the following steps: a. Browse to 11

20 Quick Start Guide SolarWinds Firewall Security Manager nt.aspx, and then log on to the portal with your SolarWinds customer ID and password. b. Navigate to your product, and then click Manually Register License. c. If the Manually Register License option is not available for your product, contact SolarWinds customer support. d. Provide the Machine ID from Step 3, and then download your license key file. 6. Transfer the license key file to the FSM server. 7. Return to the Activate FSM window, browse to the license key file, and then click Next. Installing Firewall Security Manager Chapter 3 12

21 SolarWinds Firewall Security Manager Quick Start Guide Getting Started This chapter addresses some initial configuration steps along with a few common use cases for FSM. Review the following sections to get started: Viewing and Querying Firewall Details Using Packet Tracer Optimizing Firewalls Running and Scheduling FSM Reports Using Change Advisor Viewing and Querying Firewall Details After you import your devices, FSM lists them in the Firewall Inventory pane of the console. To view a firewall's details: 1. Select the firewall in the Firewall Inventory pane. 2. Click File > View Details. FSM displays the details under dedicated tabs in the right pane. The following define the sub-tabs on the details view. Use the filter fields at the top of the first four tabs to apply custom filters and query the configuration file. Security Rules The Security Rules tab of the details view displays all of the access control list (ACL) rules in the device configuration. Click an object in the Source, Destination, or Service column to view the object's definition in a separate dialog. Click outside of the definition dialog to close it. NAT Rules The NAT Rules tab of the details view provides a representation of the network address translation (NAT) rules in the device configuration. It displays the object's source, destination, and services before and after translation. Click an object in the Source, Destination, or Service column to view the object's definition in a separate dialog. Click outside of the definition dialog to close it. Getting Started 13

22 Quick Start Guide SolarWinds Firewall Security Manager Note: The entry, Original, in the translation (Trns.) columns indicates the NAT rule left the original value unchanged. Network Objects The Network Objects tab of the details view displays all the network address objects in the device configuration. This tab displays network object groups as collapsed tree lists. Click [+] next to the group name to expand the list and view the member objects. Service Objects The Service Objects tab of the details view displays all the service objects in the device configuration. This tab displays service object groups as collapsed tree lists. Click [+] next to the group name to expand the list and view the member objects. Interfaces The Interfaces tab of the details view displays a table of all the network interfaces identified in the device configuration. Select the checkbox in the PCI Zone column to indicate the selected zone leads to a PCI network. This is useful when preparing for a PCI audit. FSM assigns a default zone to each of these interfaces. Click the Zone field to modify the zone assigned to a specific interface. To create custom zones, click Window > Preferences, and then specify the custom zones in the Zone Definitions section. Native Configs The Native Configs tab of the details view displays the native configuration file FSM imported from the device. This is exactly what you would see if you viewed the configuration file from the command-line interface (CLI). Problems The Problems tab of the details view displays general status messages from FSM regarding the configuration import process. Most notably, this tab displays errors or warnings if FSM is not able to translate any part of the configuration. These problems may or may not impact analysis. Using Packet Tracer Packet Tracer traces a packet's path through a Layer 3 network. This is useful when evaluating configuration changes or troubleshooting issues. To do this, Packet Tracer performs two steps: 1. It finds all routable paths between the source and destination addresses in the packet using the network address translation (NAT) rules on all the devices along each path. 2. It evaluates the access control lists (ACL) of each device along a path to locate a routable path for the packet that is not blocked by the ACL. 14 Getting Started

23 SolarWinds Firewall Security Manager Quick Start Guide Complete the following procedure to specify the path you want Packet Tracer to evaluate. To run Packet Tracer for a specific path: 1. In the FSM client, click the Query menu, and then select Packet Tracer. 2. In the Packet Tracer window, enter the required information: Source IP Address Destination IP Address Protocol Port (number or service name) 3. Click Run. 4. In the Save As dialog, specify a name and location for the output file, and then click Save. For additional information about the Packet Tracer report, see the help topic, Packet Tracer. Optimizing Firewalls Use the Rule/Object Cleanup task with supported Cisco or Juniper firewall configurations to optimize your firewalls. The task generates a report that informs you of rules or objects in the selected firewall that you may want to remove or revise. This task also generates a new configuration file and a clean-up script, which you can edit and apply as necessary. The Rule/Object Cleanup task consists of two primary options: Redundant and Shadowed rules analysis This option checks the firewall configuration to identify redundant or shadowed rules and unreferenced network or service objects. Redundant rules are those covered by other rules that have the same action. Shadowed rules are those covered by other rules that have the opposite action. Find these results in the Structural Rule and Object Cleanup section of the Firewall Cleanup report. Log Usage Analysis Getting Started This option checks the firewall log to identify unused rules, network objects, or service objects. Find these results in the Usage-Based Rule and Object Cleanup section of the Firewall Cleanup report. Optionally, FSM can recommend the most optimal order for the firewall rules based on usage. If you select Include optimal rule ordering, FSM puts the 15