McAfee SMC Installation Guide 5.7. Security Management Center

Transcription

1 McAfee SMC Installation Guide 5.7 Security Management Center

2 Legal Information The use of the products described in these materials is subject to the then current end-user license agreement, which can be found at the McAfee website: Revision: SGMIG_

3 TABLE OF CONTENTS INTRODUCTION CHAPTER 1 Using SMC Documentation How to Use This Guide Typographical Conventions Documentation Available Product Documentation Support Documentation System Requirements Supported Features Contact Information CHAPTER 2 Planning the SMC Installation McAfee NGFW Solution Overview of the Installation Procedure Important to Know Before Installation Supported Platforms Date and Time Settings Hosts File Obtaining Installation Files Downloading the Installation Files Checking File Integrity Creating the Installation DVD Obtaining License Files INSTALLING THE SECURITY MANAGEMENT CENTER CHAPTER 3 Installing the Security Management Center Getting Started with SMC Installation Installing on Linux Configuration Overview Installing Security Management Center Components Installing a Management Server Installing a Log Server Installing a Web Portal Server Installing an Authentication Server Installing in Demo Mode Finishing the Installation Starting the SMC After Installation Starting the Management Server Starting the Management Client Logging in to the Security Management Center Accepting the Management Server Certificate 28 Installing Licenses Binding Management Server POL-Bound Licenses to Servers Starting the Log Server, Web Portal Server, and Authentication Server Starting Servers Manually If the Log Server, Web Portal Server, or Authentication Server Fails to Start Generating Server Certificates After the Security Management Center is Installed Configuring Additional Management Servers.. 34 Overview Installing Licenses for Additional Management Servers Installing Additional Management Servers Applying the Authentication Server Configuration Non-Graphical Installation Configuring the Management Server in a Non-Graphical Installation Configuring the Log Server in a Non- Graphical Installation Configuring the Web Portal Server in a Non- Graphical Installation Configuring the Authentication Server in a Non-Graphical Installation CHAPTER 4 Distributing Management Clients Through Web Start Getting Started with Web Start Distribution Distributing Management Clients From the SMC Servers Distributing Management Clients From a Separate Server Accessing the Web Start Management Clients. 46 CHAPTER 5 Configuring NAT Addresses for SMC Components Getting Started with Configuring NAT Addresses for SMC Components Configuration Overview Table of Contents 3

4 Defining Locations Adding SMC Server Contact Addresses Setting the Management Client s Location MAINTENANCE CHAPTER 6 Upgrading Getting Started with Upgrading the SMC Configuration Overview Upgrading Licenses Upgrading Licenses Manually Installing Licenses Upgrading the Security Management Center Synchronizing Management Databases CHAPTER 7 Uninstalling the Security Management Center.. 63 Overview to Uninstalling the Security Management Center Uninstalling in Windows Uninstalling in Linux APPENDICES APPENDIX A Command Line Tools Security Management Center Commands NGFW Engine Commands Server Pool Monitoring Agent Commands APPENDIX B Default Communication Ports Security Management Center Ports Security Engine Ports Index Table of Contents

5 INTRODUCTION In this section: Using SMC Documentation - 7 Planning the SMC Installation

6 6

7 CHAPTER 1 USING SMC DOCUMENTATION This chapter describes how to use the McAfee SMC Installation Guide and lists other available documentation. It also provides directions for obtaining technical support and giving feedback. The following sections are included: How to Use This Guide (page 8) Documentation Available (page 9) Contact Information (page 10) 7

8 How to Use This Guide The McAfee SMC Installation Guide is intended for the administrators who install the McAfee Security Management Center (SMC). It describes the installation step by step. The chapters in this guide are organized in the general order you should follow when installing the system. Most tasks are explained using illustrations that include explanations on the steps you need to complete in each corresponding view in your own environment. The explanations that accompany the illustrations are numbered when the illustration contains more than one step. Typographical Conventions The following conventions are used throughout the documentation: Table 1.1 Typographical Conventions Formatting User Interface text References, terms Command line User input Command parameters Informative Uses Text you see in the User Interface (buttons, menus, etc.) and any other interaction with the user interface are in bold-face. Cross-references and first use of acronyms and terms are in italics. File names, directories, and text displayed on the screen are monospaced. User input on screen is in monospaced bold-face. Command parameter names are in monospaced italics. We use the following ways to indicate important or additional information: Note Notes prevent commonly-made mistakes by pointing out important points. Caution Cautions prevent breaches of security, information loss, or system downtime. Cautions always contain critical information that you must observe. Tip Tips provide additional helpful information, such as alternative ways to complete steps. Example Examples present a concrete scenario that clarifies the points made in the adjacent text. 8 Chapter 1 Using SMC Documentation

9 Documentation Available SMC documentation is divided into two main categories: Product Documentation and Support Documentation (page 10). Each SMC product has a separate set of manuals. Product Documentation The table below lists the available product documentation. Table 1.2 Product Documentation Guide Reference Guide Installation Guide Online Help Administrator s Guide User s Guide Appliance Installation Guide Description Explains the operation and features of the SMC comprehensively. Demonstrates the general workflow and provides example scenarios for each feature area. Available as separate guides for McAfee Security Management Center and McAfee Firewall/VPN, and as a combined guide for McAfee IPS and McAfee Layer 2 Firewall. Instructions for planning, installing, and upgrading the SMC. Available as separate guides for McAfee Security Management Center and McAfee Firewall/VPN, and as a combined guide for McAfee IPS and McAfee Layer 2 Firewall. Describes how to configure and manage the system step-by-step. Accessible through the Help menu and by using the Help button or the F1 key in any window or dialog. Available in the Management Client and the Web Portal. An HTML-based system is available in the SSL VPN Administrator through help links and icons. Describes how to configure and manage the system step-by-step. Available as a combined guide for McAfee Firewall/VPN, McAfee IPS, and McAfee Layer 2 Firewall, and as separate guides for the SSL VPN and the IPsec VPN Client. Instructions for end-users. Available for the IPsec VPN Client and the Web Portal. Instructions for physically installing and maintaining McAfee NGFW appliances (rack mounting, cabling, etc.). Available for all McAfee NGFW appliances. PDF guides are available at current/. The McAfee SMC Administrator s Guide, and the Reference Guides and Installation Guides for McAfee Security Management Center, McAfee Firewall/VPN, McAfee IPS, and McAfee Layer 2 Firewall are also available as PDFs on the Security Management Center DVD. Documentation Available 9

10 Support Documentation The McAfee support documentation provides additional and late-breaking technical information. These technical documents support the SMC guide books, for example, by giving further examples on specific configuration scenarios. The latest technical documentation is available at System Requirements The system requirements for running the McAfee Security Management Center can be found in the Security Management Center Release Notes available at Supported Features Not all features are supported on all platforms. See the Appliance Software Support Table for more information. Contact Information For general information about SMC products, visit our web site at 10 Chapter 1 Using SMC Documentation

11 CHAPTER 2 PLANNING THE SMC INSTALLATION This chapter provides important information to take into account before the McAfee Security Management Center installation can begin. It also includes an overview to the installation process. The following sections are included: McAfee NGFW Solution (page 12) Overview of the Installation Procedure (page 13) Important to Know Before Installation (page 14) Obtaining Installation Files (page 15) Obtaining License Files (page 16) 11

12 McAfee NGFW Solution The system consists of one or more NGFW engines, the Security Management Center, and Management Client(s). The Management Server, Log Server, and one or more Management Clients are always included in the installation. The type and number of optional components and engines varies according to environment and depends on your licenses. Illustration 2.1 SMC Components Management Client Web Portal Management Server Log Server Web Portal Server Authentication Server NGFW Engines (Security Engines) The Security Management Center consists of the following standard components: The Management Server. One or more Log Servers. The Management Client is a single unified tool that is used for all configuration and monitoring tasks related to the whole system. You can install an unlimited number of Management Clients. Optionally, and for a separate license fee, you can also have: One or more additional Management Servers. Only one Management Server is active at a time. The additional Management Servers function as standby Management Servers. One or more Web Portal Servers for Web Portal users. One Authentication Server for end-user authentication. SSL VPN gateways that you can optionally connect to the Security Management Center. This allows you to monitor the status of SSL VPN appliances and to view SSL VPN logs in the Management Client. The Security Management Center components can be installed separately on different machines or on the same machine, depending on your requirements. 12 Chapter 2 Planning the SMC Installation

13 The Security Management Center can manage several NGFW engines (Security Engines). See the McAfee SMC Reference Guide, McAfee NGFW Reference Guide for Firewall/VPN Role, and the McAfee NGFW Reference Guide for IPS and Layer 2 Firewall Roles for general information on the Security Management Center and NGFW engines. Overview of the Installation Procedure 1. Install and configure the Security Management Center and a Management Client. See Installing the Security Management Center (page 19). 2. (Optional) Set up Management Client distribution through Java Web Start for automatic installation and upgrade. See Distributing Management Clients Through Web Start (page 43). 3. If network address translation (NAT) is applied to communications between system components, define contact addresses. See Configuring NAT Addresses for SMC Components (page 47). The chapters and sections of this guide proceed in the order outlined above. Once you have installed the Security Management Center components and the Management Client, and configured the communications between the system components, you can proceed to configuring and installing the Firewall/VPN, IPS, and Layer 2 Firewall engines. See the McAfee NGFW Installation Guide for Firewall/VPN Role, and the McAfee NGFW Installation Guide for IPS and Layer 2 Firewall Roles for information on installing the engines. Overview of the Installation Procedure 13

14 Important to Know Before Installation Consult the McAfee SMC Reference Guide, the McAfee NGFW Reference Guide for Firewall/VPN Role, or the McAfee NGFW Reference Guide for IPS and Layer 2 Firewall Roles if you need more detailed background information on the operation of the system than what is offered in this chapter. Supported Platforms The Release Notes list the basic requirements for installation. For information on supported and certified hardware, search for the version-specific Hardware Requirements on the technical documentation web page at Date and Time Settings Make sure that the Date, Time, and Time zone settings are correct on any computer you will use as a platform for any Security Management Center component, including the workstations used for the Management Client. The time settings of the engines do not need to be adjusted, as they are automatically synchronized with the Management Server s time setting. For this operation, the time is converted to UTC time according to the Management Server s time zone setting. The SMC always uses UTC internally. Hosts File Due to a restriction of the Java platform, the Management Server and Log Server hostnames must be resolvable on the computer running the Management Client (even if running on the same computer as the servers) to ensure good performance. To ensure that the hostnames can be resolved, you can add the IP address-hostname pairs to the local hosts file on the client computer: In Windows: \%SystemRoot%\system32\drivers\etc\hosts In Linux: /etc/hosts 14 Chapter 2 Planning the SMC Installation

15 Obtaining Installation Files Depending on your order, you may have received ready-made installation DVDs for the Security Management Center. Otherwise, download the installation files from the McAfee web site. Downloading the Installation Files To download the installation files 1. Go to 2. Enter your license code or log in using an existing user account. 3. Download the.iso image files or the installation.zip file. Checking File Integrity Before installing the SMC from downloaded files, check that the installation files have not become corrupt or been modified. Using corrupt files may cause problems at any stage of the installation and use of the system. File integrity is checked by generating an MD5 or SHA-1 file checksum of the downloaded files and by comparing the checksum with the checksum on the download page at the McAfee web site. Windows does not have MD5 or SHA-1 checksum tools by default, but there are several thirdparty programs available. To check the MD5 or SHA-1 file checksum 1. Look up the correct checksum at 2. Change to the directory that contains the file(s) to be checked. 3. Generate a checksum of the file using the command md5sum filename or sha1sum filename, where filename is the name of the installation file. 4. Compare the displayed output to the checksum on the web site. They must match. Caution Do not use files that have invalid checksums. If downloading the files again does not help, contact McAfee Support to resolve the issue. What s Next? If you downloaded the installation files as a.zip file, unzip the contents at the installation location and proceed to Obtaining License Files (page 16). Otherwise, continue by Creating the Installation DVD (page 15). Creating the Installation DVD Once you have checked the integrity of the installation files, create the installation DVD from the files. Use a DVD-burning application that can correctly read and burn the DVD-structure stored in the.iso images. If the end result is a DVD file with the original.iso file on it, the DVD cannot be used for installation. Obtaining Installation Files 15

16 Obtaining License Files You must generate license files and install them after the installation to bring your system fully operational. Each Management Server, Log Server, Web Portal Server, and Authentication Server must have its own license. However, a Management Server license that includes the high availability features is a combined license for all the Management Servers and must list the IP addresses of all the Management Servers. The Authentication Server license defines the maximum number of RADIUS clients (excluding other SMC components) that can use the authentication methods provided by the Authentication Server, and the maximum number of named users for user linking in the Authentication Server s user database. You must also generate and install licenses for any Firewall, IPS, and Layer 2 Firewall engines, and SSL VPN gateways in order to make them operational. For more information on licenses, see the McAfee SMC Administrator s Guide or the Management Client Online Help. To generate a new license 1. Go to the License Center at 2. Enter the Management Server proof-of-license (POL) code and click Submit. The license page opens. 3. Click Register. The license generation page opens. 4. Enter the IP addresses of the SMC components. 5. Enter the Management Server s proof-of-license code for the engines you want to license. Information on the Management Server s POL is included in the regarding licenses that was earlier sent to you. This information is later shown in the Licenses branch of the Administration Configuration view in the Management Client. 6. Click Submit Request. The license file is sent to you shortly afterward and will then be available for download on the license page. All licenses include the highest version for which they are valid. Automatic upgrade and installation of licenses is enabled by default. If you have disabled automatic license upgrades, you must upgrade the licenses when you upgrade to a new major release of the software. 16 Chapter 2 Planning the SMC Installation

17 INSTALLING THE SECURITY MANAGEMENT CENTER In this section: Installing the Security Management Center - 19 Distributing Management Clients Through Web Start - 43 Configuring NAT Addresses for SMC Components

18 18

19 CHAPTER 3 INSTALLING THE SECURITY MANAGEMENT CENTER This chapter gives instructions on how to install the Security Management Center on Windows and Linux platforms. The following sections are included: Getting Started with SMC Installation (page 20) Installing Security Management Center Components (page 21) Starting the SMC After Installation (page 27) After the Security Management Center is Installed (page 33) Configuring Additional Management Servers (page 34) Non-Graphical Installation (page 37) 19

20 Getting Started with SMC Installation You are ready to start the Security Management Center installation when you have obtained and verified the installation files. See Obtaining Installation Files (page 15) for more information on these tasks. Caution Make sure that the operating system version you plan to install on is supported. The supported platforms for running the Security Management Center are listed in the Security Management Center Release Notes. Log in to the system where you are installing the Security Management Center with the correct administrative rights. In Windows, you must log in with administrator rights. In Linux you must log in as root. During the installation, certificates can be generated for the SMC server components. The certificates are needed for authentication in establishing the secure encrypted communication channel between system components. We recommend installing a Management Client on the system on which you install the Management Server. After this, further Management Clients can be installed locally by running the Security Management Center installer or be made available through Java Web Start (see Distributing Management Clients Through Web Start (page 43)), which eliminates the need to update all Management Clients individually at each version upgrade. The Management Client has no configurable parameters. Installing on Linux The installation creates sgadmin user and group accounts. If there is a pre-existing sgadmin account, the installation fails. All the shell scripts are owned by sgadmin and can be executed either by root or the sgadmin user. The shell scripts are executed with sgadmin privileges. After the installation, the sgadmin account is disabled. The sgadmin account is deleted at uninstallation. Configuration Overview 1. Install the Security Management Center. See Installing Security Management Center Components (page 21). If you are installing components on separate servers, install the Management Server as the first component. 2. Start the Security Management Center. See Starting the SMC After Installation (page 27). 3. (Optional) Install additional Management Server(s). See Configuring Additional Management Servers (page 34). Caution Do not install the Security Management Center on a McAfee NGFW appliance. 20 Chapter 3 Installing the Security Management Center

21 Installing Security Management Center Components For obtaining, verifying, and preparing the installation files, see Obtaining Installation Files (page 15). This section guides you through a Security Management Center installation in a graphical user interface. For command line installation in Linux, see Non-Graphical Installation (page 37). To start the installation 1. Start the installation in one of the following ways: From a.zip file: unzip the file and run setup.exe on Windows or setup.sh on Linux. From a DVD: insert the installation DVD and run the setup executable from the DVD: Operating System Windows 32-bit Windows 64-bit Linux 32-bit Linux 64-bit Path to Executable \McAfee_SMC_Installer\Windows\setup.exe \McAfee_SMC_Installer\Windows-x64\setup.exe /McAfee_SMC_Installer/Linux/setup.sh /McAfee_SMC_Installer/Linux-x64/setup.sh Note If the DVD is not automatically mounted in Linux, mount the DVD with mount / dev/cdrom /mnt/cdrom. 2. When the Installation Wizard shows the Introduction screen, click Next to start the installation. The License Agreement appears. You can click Cancel at any time to exit the Installation Wizard. You can click Previous at any time to go back. 3. Indicate that you agree to the license agreement and click Next. 4. (Optional) Click Choose to browse to a different installation folder. This folder is for the application. Log Servers can have a separate data storage location. Note We do not recommend selecting C:\Program Files\McAfee\Security Management Center as the installation directory in Windows. Selecting C:\Program Files\McAfee\Security Management as the installation directory creates an additional C:\ProgramData\McAfee\Security Management Center folder, which duplicates some of the folders in the installation directory. Some of the program data is also stored in the C:\ProgramData\McAfee\Security Management Center folder. 5. Click Next. 6. Select where to create shortcuts. These shortcuts can be used to manually start components and to run some maintenance tasks. 7. Click Next. Installing Security Management Center Components 21

22 8. Select the installation type: Typical installs all Security Management Center components except the Web Portal Server or the Authentication Server. Management Client Only installation is meant for administrators workstations. Demo Mode installation is meant for evaluating the SMC in a simulated environment. Custom installation allows you to select components one by one. 9. Click Next. 10.(Custom installation only) Select the components that you want to install and click Next. Note Make sure you have a license for any separately licensed components before installing them. The Web Portal Server and Authentication Server are not included in standard Security Management Center licenses. What s Next? For Demo Mode installations, proceed to Installing in Demo Mode (page 26). Otherwise, proceed to the next applicable section according to the components you are installing: Installing a Management Server. Installing a Log Server (page 24). Installing a Web Portal Server (page 24). Installing an Authentication Server (page 25). Installing a Management Server To configure the Management Server installation 1. Select the Management Server s IP address. The Management Server s license must be generated using this IP address. 2. Enter the Log Server IP Address to which this Management Server sends its log data. 3. (Optional) Select Enable and Configure Web Start Server if you want the Management Server to distribute the Management Client through Java Web Start. 4. (Optional) Select 256-bit Security Strength if you want to use 256-bit encryption for communication between the Management Server and the engines. This requires all engines to be version 5.5 or higher. Caution Engines with versions lower than 5.5 and SSL VPN gateways cannot communicate with the SMC when 256-bit encryption is used for the communication between the Management Server and the engines. 5. Leave Install as a Service selected to make the Management Server start automatically. 6. (256-Bit Security Strength only) Click Next. A warning about the compatibility of 256-bit security strength is displayed. If you did not select Enable and Configure Web Start Server, proceed to Step (Web Start Server only) Click Next. You are prompted to configure the Web Start Server. 22 Chapter 3 Installing the Security Management Center

23 8. (Web Start Server only) Configure the Web Start Server settings as explained in the table below: Table 3.1 Web Start Server Settings Setting Description Port Host Name (Optional) Enter the TCP Port Number that the service listens to. By default, the standard HTTP port 80 is used on Windows and 8080 on Linux (which does not allow the use of reserved ports for this type of service). Note! Make sure the listening port is not in use on the server. For ports reserved for Security Management Center services, see Default Communication Ports (page 89). Enter the Host Name that the Web Start service uses. Leave the field blank to allow requests to any of the server s host names. 9. Click Next. You are prompted to create a superuser account. Note This is the only account that can log in after the installation. 10.Enter a User Name. 11.Enter and confirm the Password. 12.Click Next. What s Next? Proceed to the next applicable section according to the components you are installing: Installing a Log Server (page 24). Installing a Web Portal Server (page 24). Installing an Authentication Server (page 25). Finishing the Installation (page 26). Installing Security Management Center Components 23

24 Installing a Log Server To configure the Log Server installation 1. Select the Log Server s IP address. If IP address binding is used, the Log Server s license must be generated with this IP address as the binding. 2. Enter the IP address(es) of the Management Server(s) that control this Log Server. 3. If the components are installed on different machines and the Management Server is not reachable at the moment, deselect Certify the Log Server During the Installation to avoid connection attempts after installation. Certifying is mandatory for running the Log Server. 4. Leave Install as a Service selected to make the Log Server start automatically. 5. Click Next. 6. (Optional) Click Choose to browse to a different storage folder for log data. Remote locations are not suitable for active storage, as quick and reliable access is required. 7. Click Next. What s Next? Proceed to the next applicable section according to the components you are installing: Installing a Web Portal Server. Installing an Authentication Server (page 25). Finishing the Installation (page 26). Installing a Web Portal Server Note Make sure you have a license for the Web Portal Server before installing it. The Web Portal Server is an optional component and is not included in standard Security Management Center licenses. You can use the Previous button to return to component selection. To configure the Web Portal Server installation 1. Select the Web Portal Server s IP address. If IP address binding is used, the Web Portal Server s license must be generated with this IP address as the binding. 2. Enter the IP address(es) of the Management Server(s) that control this Web Portal Server. 3. If the components are installed on different machines and the Web Portal Server is not reachable at the moment, deselect Certify the Web Portal Server During the Installation to avoid connection attempts after installation. Certifying is mandatory for running the Web Portal Server. 4. Enter the IP address of the Log Server to which this Web Portal Server sends its log data. 5. Leave Install as a Service selected to make the Web Portal Server start automatically. 6. Click Next. What s Next? Proceed to the next applicable section according to the components you are installing: Installing an Authentication Server (page 25). Finishing the Installation (page 26). 24 Chapter 3 Installing the Security Management Center

25 Installing an Authentication Server Note Make sure you have a license for the Authentication Server before installing it. The Authentication Server is an optional component and is not included in standard Security Management Center licenses. You can use the Previous button to return to component selection. If you are installing a single node Authentication Server on a different computer than the Management Server, or you are installing an Authentication Server cluster, you must define the Authentication Server element and install the correct licenses in the Management Client before installing the Authentication Server node(s). See Integrating Authentication Server Services in the McAfee SMC Administrator s Guide or the Management Client Online Help. To configure the Authentication Server installation 1. Select the Authentication Server s IP address. 2. Enter the IP address(es) of the Management Server(s) that control this Authentication Server. 3. If you are installing the components on different machines and the Management Server is not reachable at the moment, deselect Certify the Authentication Server During the Installation to avoid connection attempts after installation. Certifying is mandatory for running the Authentication Server and for installing the second node of a cluster. 4. Enter the IP address of the Log Server to which this Authentication Server sends its log data. 5. Leave Install as a Service selected to make the Authentication Server start automatically. 6. Click Next. What s Next? Proceed to Finishing the Installation (page 26). Installing Security Management Center Components 25

26 Installing in Demo Mode The Demo Mode installation creates a simulated network environment for evaluation. Note Demo Mode installation is for evaluation only. A Security Management Center in Demo Mode cannot be used with any traffic inspection engines and cannot be upgraded. To install in Demo Mode 1. Select the type of demo to install: Use a standard backup to simulate a preconfigured environment. Select your own backup file to create the simulation based on your own backup. 2. (Custom backup file only) Click Choose and browse to the location of the backup file. 3. Click Next. A description of the Demo Mode installation is displayed. 4. Click Next. The Pre-Installation Summary is displayed. 5. Click Install. The installation starts. 6. When the installation finishes, click Next. 7. Click Done to close the installer. The Security Management Center starts up automatically in the background. What s Next? The simulated environment is now ready for testing. Proceed to Logging in to the Security Management Center (page 28). Finishing the Installation This is the last chance to cancel or make changes by clicking Previous. Caution If you are installing any server components as a service on a Windows system, make sure the Services window is closed before you proceed. To finish the installation 1. Check that the information in the Pre-Installation Summary is correct and click Install to install the selected components. Depending on the options you selected, you may be prompted to generate certificates during the installation. If this happens, see To generate a certificate for an SMC server (page 32). 2. Click Done to close the installer. Note If any Log Server, Web Portal Server, or Authentication Server certificate was not retrieved during the installation, a certificate must be retrieved manually before the server can be started. See To manually certify a Server (page 32). 26 Chapter 3 Installing the Security Management Center

27 Starting the SMC After Installation Proceed through the listed sections in order to start the Security Management Center for the first time: 1. Starting the Management Server 2. Starting the Management Client 3. Logging in to the Security Management Center (page 28) 4. Installing Licenses (page 29) 5. Binding Management Server POL-Bound Licenses to Servers (page 30) 6. Starting the Log Server, Web Portal Server, and Authentication Server (page 30) Starting the Management Server If the Management Server has been installed as a service, it should start automatically both after the installation and during the operating system boot process. In Windows, the McAfee NGFW Management Server service is controlled in the Services window, which can be found in the Windows Control Panel under the Administrative Tools category. If the Management Server is installed as a service and has successfully started, proceed to Starting the Management Client. Otherwise, start the Management Server manually as explained below. To start a Management Server that is not installed as a service In Windows, use the shortcut icon in the location you selected during installation or run the script <installation directory>/bin/sgstartmgtsrv.bat. In Linux, run the script <installation directory>/bin/sgstartmgtsrv.sh. Starting the Management Client To start a locally installed Management Client In Windows, use the shortcut icon in the location you selected during installation or run the script <installation directory>/bin/sgclient.bat. In Linux, run the script <installation directory>/bin/sgclient.sh. A graphical environment is needed for the Management Client. What s Next? Logging in to the Security Management Center (page 28) Starting the SMC After Installation 27

28 Logging in to the Security Management Center The Management Client connects to the Management Server and to Log Servers. See Default Communication Ports (page 89) for a list of the ports used. In Demo Mode, use the following credentials to log in to one of the default scenarios: User Name: demo Password: demo Server Address: To log in to the Security Management Center 1. Type in the user name and password for the Administrator you defined during the Management Server installation. 2. Enter the Management Server s IP address or DNS name. If you connect to the Management Server from an external network, the Management Server s IP address may be translated using NAT. 3. Leave Remember Server Address selected if you want the Management Client to add the address permanently in the Server Address list. 4. Click Login. Tip You can access the Management Client Online Help in the Login window or any other window in the Management Client by pressing the F1 key. Accepting the Management Server Certificate A certificate dialog is displayed when the Management Client contacts any Management Server for the first time. As a precaution, you can make sure that the communication really is with your Management Server by checking the Certificate Authority fingerprint as explained below. To check the Certificate Authority fingerprint 1. View the Management Server fingerprint on the Management Server: In Windows, use the shortcut icon in the location you selected during installation (default: Start Programs McAfee Security Management Center Show Fingerprint) or run the script <installation directory>/bin/sgshowfingerprint.bat. In Linux, run the script <installation directory>/bin/sgshowfingerprint.sh. 2. If the fingerprint matches, click Accept. The Management Client opens. 28 Chapter 3 Installing the Security Management Center

29 Installing Licenses The Security Management Center servers require licenses to become operational. To obtain licenses, see Obtaining License Files (page 16). You can install licenses even before the components are installed. If you do not have a valid Management Server license, you are notified with a message when you log in. If the message appears after licensing, make sure the licensed IP addresses are correct and active on the server when the Management Server service starts up. To install licenses through the License Information message Click Continue and select the license file(s) in the dialog that opens. What s Next? If the message is not shown, install the licenses as explained below. Otherwise, proceed to the task To check that the licenses were installed correctly (page 29). To install licenses 1. Select File System Tools Install Licenses. A file browser dialog opens. 2. Select the license files and click Install. To check that the licenses were installed correctly 1. Select Configuration Configuration Administration. The Administration Configuration view opens. 2. Expand the Licenses branch and select All Licenses. 3. Check that all licenses you installed are listed here. What s Next? If you have Log Server, Web Portal Server, or Authentication Server licenses that are bound to the Management Server s POL code, proceed to Binding Management Server POL-Bound Licenses to Servers (page 30). Otherwise, continue by Starting the Log Server, Web Portal Server, and Authentication Server (page 30). Starting the SMC After Installation 29

30 Binding Management Server POL-Bound Licenses to Servers You must bind Management Server POL-bound licenses for Log Servers, Authentication Servers, and Web Portal Servers to specific Server elements. To bind a Management Server POL-bound license to a server 1. Select Configuration Configuration Administration. The Administration Configuration view opens. 2. Browse to Licenses Servers. Installed licenses appear in the right panel. 3. Right-click a Management Server POL-bound license and select Bind. The Select License Binding dialog opens. 4. Select the correct server from the list. 5. Click Select. The license is now bound to the selected Log Server, Web Portal Server, or Authentication Server element. If you bound the license to an incorrect element, right-click the license and select Unbind. Note The license is permanently bound to the Log Server, Web Portal Server, or Authentication Server when the server is started for the first time. A permanently bound license cannot be re-bound to a different Log Server, Web Portal Server, or Authentication Server without re-licensing or deleting the Log Server, Web Portal Server, or Authentication Server element that the license is bound to. Until you do that, the unbound license is shown as Retained. Starting the Log Server, Web Portal Server, and Authentication Server If the Log Server, Web Portal Server, and Authentication Server have been installed as a service, the servers are started automatically during the operating system boot process. However, if the operating system is rebooted and the servers do not yet have a license, you may need to start them as explained here. If you installed the Log Server, Web Portal Server, or Authentication Server as a service, you can start or stop the server manually in Windows through the Services window. In other cases, you can start the Log Server, Web Portal Server, or Authentication Server manually as explained in Starting Servers Manually (page 31). 30 Chapter 3 Installing the Security Management Center

31 Starting Servers Manually To start the Log Server, Web Portal Server, or Authentication Server manually, run the scripts in a console window. Read the console messages for information on the progress. Closing the console stops the service. To start the Log Server, Web Portal Server, or Authentication Server manually Run one of the following scripts in Windows or in Linux depending on the server type: Server Type Windows Script Linux Script Log Server Web Portal Server Authentication Server <installation directory>/bin/ sgstartlogsrv.bat <installation directory>/bin/ sgstartwebportalserver.bat <installation directory>/bin/ sgstartauthsrv.bat <installation directory>/bin/ sgstartlogsrv.sh <installation directory>/bin/ sgstartwebportalserver.sh <installation directory>/bin/ sgstartauthsrv.sh What s Next? If you have started all servers successfully, proceed to After the Security Management Center is Installed (page 33). If you have trouble starting the server, see If the Log Server, Web Portal Server, or Authentication Server Fails to Start (page 31). If the Log Server, Web Portal Server, or Authentication Server Fails to Start If the Log Server, Web Portal Server, or Authentication Server does not start automatically as a service, do the following: 1. Try starting the server manually as explained in the previous section to see if there is some error displayed on the console. 2. Check that licenses are correctly bound to components as explained in the tasks To check that the licenses were installed correctly (page 29) and To bind a Management Server POL-bound license to a server (page 30). 3. Make sure that the server has a valid certificate for secure system communications. If there are certificate-related problems or problems you are not able to identify, try (re)generating the certificate as explained below. Starting the SMC After Installation 31

32 Generating Server Certificates Note If the Management Server is not running, see Starting the Management Server (page 27). To manually certify a Server Run one of the following scripts in Windows or in Linux depending on the server type: Server Type Windows Script Linux Script Log Server Web Portal Server Authentication Server <installation directory>/bin/ sgcertifylogsrv.bat <installation directory>/bin/ sgcertifywebportalserver.bat <installation directory>/bin/ sgcertifyauthsrv.bat <installation directory>/bin/ sgcertifylogsrv.sh <installation directory>/bin/ sgcertifywebportalserver.sh <installation directory>/bin/ sgcertifyauthsrv.sh To generate a certificate for an SMC server 1. Enter the user name and password for the account you created during the Management Server installation (other accounts with unrestricted permissions can also be used). 2. Click Accept to accept the certificate fingerprint of the Management Server s Certificate Authority. As a precaution, you can make sure that the communication really is with your Management Server as explained in To check the Certificate Authority fingerprint (page 28). The Server Selection dialog opens. 3. (Log Server or Web Portal Server only) Identify the component that you want to certify: If the server element that represents the component is listed, select it. If the name of a server element is followed by recommended, this means that the component ID of the server element matches the ID of the component that you are certifying. It is strongly suggested that you select the recommended server element. Caution If a server element is shown as recommended it is strongly suggested that you select it when you are certifying the component. Selecting a server element that is not the recommended server element may cause serious problems (for example, the server s log data or the monitoring status of the server is displayed incorrectly). If the correct server element is not listed, select Create a New Log Server or Create a New Web Portal Server and enter a Name. This name is shown in the Management Client. 32 Chapter 3 Installing the Security Management Center

33 4. (Authentication Server only) Identify the component that you want to certify: If the server element that represents the component is listed, select it. If the correct server element is not listed, select Create a New Authentication Server and enter a Name. This name is shown in the Management Client. Caution If a server element is shown as recommended it is strongly suggested that you select it when you are certifying the component. Selecting a server element that is not the recommended server element may cause serious problems (for example, the server s log data or the monitoring status of the server is displayed incorrectly). If you are installing the second node of an existing Authentication Server, select Create a New Authentication Server Node in an Existing Cluster and select the Authentication Server to which you want to add the node. 5. Click OK. What s Next? Start the Log Server, Web Portal Server, and Authentication Server as described in Starting the Log Server, Web Portal Server, and Authentication Server (page 30), then proceed to After the Security Management Center is Installed (page 33). The Authentication Server installation is complete. Proceed to After the Security Management Center is Installed (page 33). After the Security Management Center is Installed If you want to install an additional Management Server, proceed to Configuring Additional Management Servers. If you configured in the Installation Wizard that the Management Server can distribute Management Clients through Java Web Start and you want to test Web Start distribution, proceed to Accessing the Web Start Management Clients (page 46). If you want to enable that administrators can install Management Clients through Web Start or you want to modify the Web Start Server settings, proceed to Distributing Management Clients Through Web Start (page 43). If NAT is applied to communications between any SMC components, proceed to Configuring NAT Addresses for SMC Components (page 47). If you installed an Authentication Server, continue by Applying the Authentication Server Configuration (page 36). Otherwise, you are ready to configure the Firewall, IPS, and Layer 2 Firewall element(s) in the Management Client. The elements must be configured before installing the physical engines. See the McAfee NGFW Installation Guide for Firewall/VPN Role and the McAfee NGFW Installation Guide for IPS and Layer 2 Firewall Roles for more information. After the Security Management Center is Installed 33

34 Configuring Additional Management Servers You can optionally install one or more additional Management Servers. This requires a special Management Server license for multiple Management Servers. Only one Management Server at a time can be used as an active Management Server to configure and manage the system. Additional Management Servers allow controlling the system without delays and without loss of configuration information if the active Management Server is damaged, loses power, or becomes otherwise unusable. Configuration data is automatically replicated between the Management Servers. This section guides you through the installation using a graphical user interface. For command line installation, see Non-Graphical Installation (page 37). Overview 1. If you have not yet installed a license for the additional Management Server(s), install the license. See Installing Licenses for Additional Management Servers. 2. Install the additional Management Server(s) using the Installation Wizard. See Installing Additional Management Servers (page 34). Installing Licenses for Additional Management Servers To use additional Management Servers, you must have a special Management Server license that lists the IP addresses of all the Management Servers within the same SMC. You must install the license in the Management Client before installing the additional Management Server(s). If you do not yet have the license, generate the license at the McAfee web site after receiving the Proof-of-License (see Obtaining License Files (page 16)), and then install the license as described in Installing Licenses (page 29). Installing Additional Management Servers To install an additional Management Server 1. Start the installation in one of the following ways: From a.zip file: unzip the file and run setup.exe on Windows or setup.sh on Linux. From a DVD: insert the installation DVD and run the setup executable from the DVD: Operating System Windows 32-bit Windows 64-bit Linux 32-bit Linux 64-bit Path to Executable \McAfee_SMC_Installer\Windows\setup.exe \McAfee_SMC_Installer\Windows-x64\setup.exe /McAfee_SMC_Installer/Linux/setup.sh /McAfee_SMC_Installer/Linux-x64/setup.sh Note If the DVD is not automatically mounted in Linux, mount the DVD with mount / dev/cdrom /mnt/cdrom. 34 Chapter 3 Installing the Security Management Center