Cascade® Sensor and Cascade® Gateway Appliance User's Guide

114 Pages·2012·1.54 MB·English

Cascade® Sensor and Cascade® Gateway
Appliance User’s Guide
Version 10.0
December 2012
© 2012 Riverbed Technology. All rights reserved.
Accelerate®, AirPcap®, BlockStream™, Cascade®, Cloud Steelhead®, Granite™, Interceptor®, RiOS®, Riverbed®, Shark®, SkipWare®,
Steelhead®, TrafficScript®, TurboCap®, Virtual Steelhead®, Whitewater®, WinPcap®, Wireshark®, and Stingray™ are trademarks or
registered trademarks of Riverbed Technology, Inc. in the United States and other countries. Riverbed and any Riverbed product or service
name or logo used herein are trademarks of Riverbed Technology. All other trademarks used herein belong to their respective owners. The
trademarks and logos displayed herein cannot be used without the prior written consent of Riverbed Technology or their respective owners.
F5, the F5 logo, iControl, iRules and BIG-IP are registered trademarks or trademarks of F5 Networks, Inc. in the U.S. and certain other
countries. Linux is a trademark of Linus Torvalds in the United States and in other countries. VMware, ESX, ESXi are trademarks or registered
trademarks of VMware, Incorporated in the United States and in other countries.
Portions of Cascade® products contain copyrighted information of third parties. Title thereto is retained, and all rights therein are reserved, by
the respective copyright owner. PostgreSQL is (1) Copyright © 1996-2009 The PostgreSQL Development Group, and (2) Copyright © 1994-
1996 the Regents of the University of California; PHP is Copyright © 1999-2009 The PHP Group; gnuplot is Copyright © 1986-1993, 1998,
2004 Thomas Williams, Colin Kelley; ChartDirector is Copyright © 2007 Advanced Software Engineering; Net-SNMP is (1) Copyright ©
1989, 1991, 1992 Carnegie Mellon University, Derivative Work 1996, 1998-2000 Copyright © 1996, 1998-2000 The Regents of The
University of California, (2) Copyright © 2001-2003 Network Associates Technology, Inc., (3) Copyright © 2001-2003 Cambridge Broadband
Ltd., (4) Copyright © 2003 Sun Microsystems, Inc., (5) Copyright © 2003-2008 Sparta, Inc. and (6) Copyright © 2004 Cisco, Inc. and
Information Network Center of Beijing University of Posts and Telecommunications, (7) Copyright © Fabasoft R&D Software; Apache is
Copyright © 1999-2005 by The Apache Software Foundation; Tom Sawyer Layout is Copyright © 1992 - 2007 Tom Sawyer Software; Click
is (1) Copyright © 1999-2007 Massachusetts Institute of Technology, (2) Copyright © 2000-2007 Riverbed Technology, Inc., (3) Copyright
© 2001-2007 International Computer Science Institute, and (4) Copyright © 2004-2007 Regents of the University of California; OpenSSL is
(1) Copyright © 1998-2005 The OpenSSL Project and (2) Copyright © 1995-1998 Eric Young ([email protected]); Netdisco is (1) Copyright
© 2003, 2004 Max Baker and (2) Copyright © 2002, 2003 The Regents of The University of California; SNMP::Info is (1) Copyright © 2003-
2008 Max Baker and (2) Copyright © 2002, 2003 The Regents of The University of California; mm is (1) Copyright © 1999-2006 Ralf S.
Engelschall and (2) Copyright © 1999-2006 The OSSP Project; ares is Copyright © 1998 Massachusetts Institute of Technology; libpq++ is
(1) Copyright © 1996-2004 The PostgreSQL Global Development Group, and (2) Copyright © 1994 the Regents of the University of
California; Yahoo is Copyright © 2006 Yahoo! Inc.; pd4ml is Copyright © 2004-2008 zefer.org; Rapid7 is Copyright © 2001-2008 Rapid7
LLC; CmdTool2 is Copyright © 2008 Intel Corporation; QLogic is Copyright © 2003-2006 QLogic Corporation; Tarari is Copyright © 2008
LSI Corporation; Crypt_CHAP is Copyright © 2002-2003, Michael Bretterklieber; Auth_SASL is Copyright © 2002-2003 Richard Heyes;
Net_SMTP is Copyright © 1997-2003 The PHP Group; XML_RPC is (1) Copyright © 1999-2001 Edd Dumbill, (2) Copyright © 2001-2006
The PHP Group; Crypt_HMAC is Copyright © 1997-2005 The PHP Group; Net_Socket is Copyright © 1997-2003 The PHP Group;
PEAR::Mail is Copyright © 1997-2003 The PHP Group; libradius is Copyright © 1998 Juniper Networks. This software is based in part on the
work of the Independent JPEG Group the work of the FreeType team.
This documentation is furnished "AS IS" and is subject to change without notice and should not be construed as a commitment by Riverbed
Technology. This documentation may not be copied, modified or distributed without the express authorization of Riverbed Technology and
may be used only in connection with Riverbed products and services. Use, duplication, reproduction, release, modification, disclosure or
transfer of this documentation is restricted in accordance with the Federal Acquisition Regulations as applied to civilian agencies and the
Defense Federal Acquisition Regulation Supplement as applied to military agencies. This documentation qualifies as "commercial computer
software documentation" and any use by the government shall be governed solely by these terms. All other use is prohibited. Riverbed
Technology assumes no responsibility or liability for any errors or inaccuracies that may appear in this documentation.
Individual license agreements can be viewed at the following location: https://<appliance_name>/license.php
This manual is for informational purposes only. Addresses shown in screen captures were generated by simulation software and are for
illustrative purposes only. They are not intended to represent any real traffic or any registered IP or MAC addresses.
Riverbed Technology
199 Fremont Street
San Francisco, CA 94105
Phone: [phone]
Fax: [phone] Part Number
Web: http://www.riverbed.com 712-00061-11
Contents
Introduction.................................................................................................................................................1
About This Guide............................................................................................................................................1
Types of Users..........................................................................................................................................1
Organization of This Guide......................................................................................................................1
Document Conventions............................................................................................................................2
Product Dependencies and Compatibility.......................................................................................................2
Hardware and Software Dependencies.....................................................................................................3
Ethernet Network Compatibility..............................................................................................................3
SNMP-Based Management Compatibility...............................................................................................3
Contacting Riverbed........................................................................................................................................3
Internet......................................................................................................................................................3
Customer Support.....................................................................................................................................4
Professional Services................................................................................................................................4
Documentation.........................................................................................................................................4
Chapter 1 - Overview..................................................................................................................................5
Sensor and Gateway appliances.......................................................................................................................5
Cascade Sensor.........................................................................................................................................5
Cascade Gateway and Gateway-VE.........................................................................................................6
User interfaces.................................................................................................................................................6
Traffic reporting...............................................................................................................................................6
User accounts...................................................................................................................................................6
Getting help.....................................................................................................................................................6
Chapter 2 - Riverbed Cascade Sensor.....................................................................................................7
Introduction......................................................................................................................................................7
Browser requirements......................................................................................................................................7
Accessing Sensor.............................................................................................................................................8
Sensor configuration........................................................................................................................................8
UI Preferences..........................................................................................................................................9
Cascade Sensor and Cascade Gateway User’s Guide iii
Contents

Account management..............................................................................................................................10
Passwords................................................................................................................................................14
Profilers...................................................................................................................................................14
Licenses...................................................................................................................................................15
General Settings.......................................................................................................................................16
Overview page................................................................................................................................................19
Bandwidth Statistics................................................................................................................................20
Suspicious Traffic....................................................................................................................................21
Traffic Analysis pages.....................................................................................................................................21
Graph view..............................................................................................................................................21
Packet view..............................................................................................................................................23
Saving packet logs...................................................................................................................................24
Statistical View........................................................................................................................................24
System pages..................................................................................................................................................25
Information..............................................................................................................................................26
Shutdown/Reboot....................................................................................................................................27
Updates....................................................................................................................................................27
Chapter 3 - Riverbed Cascade Sensor-VE.............................................................................................29
Introduction.....................................................................................................................................................30
Browser requirements.....................................................................................................................................30
Accessing Sensor-VE.....................................................................................................................................30
Sensor-VE status.............................................................................................................................................31
Sensor-VE Overview page......................................................................................................................31
Headers on Sensor-VE pages..................................................................................................................32
Profiler Devices/Interfaces page..............................................................................................................32
Sensor-VE SNMP MIB..................................................................................................................................33
Outgoing Mail Server Settings.......................................................................................................................33
Management interface....................................................................................................................................34
Name Resolution............................................................................................................................................34
Search domains........................................................................................................................................34
DNS servers.............................................................................................................................................34
Host name resolution...............................................................................................................................35
Monitor interfaces..........................................................................................................................................35
Packet Deduplication......................................................................................................................................36
Time zones......................................................................................................................................................37
RADIUS.........................................................................................................................................................37
User Accounts.................................................................................................................................................39
Managing user accounts..........................................................................................................................39
Global account settings............................................................................................................................40
Passwords.......................................................................................................................................................41
Display preferences........................................................................................................................................41
iv Cascade Sensor and Cascade Gateway User’s Guide
Contents

Profilers...........................................................................................................................................................42
Licenses..........................................................................................................................................................42
Updates...........................................................................................................................................................43
Chapter 4 - Riverbed Cascade Gateway.................................................................................................45
Overview.........................................................................................................................................................46
Browser requirements..............................................................................................................................47
Gateway setup.........................................................................................................................................47
Auxiliary Interface..........................................................................................................................................47
Static routes....................................................................................................................................................49
Data source types............................................................................................................................................49
Profiler addresses............................................................................................................................................50
Flow record forwarding..................................................................................................................................50
RADIUS.........................................................................................................................................................51
Profiler status..................................................................................................................................................53
Gateway status................................................................................................................................................54
SNMP MIB Access.........................................................................................................................................54
Outgoing Mail Server Settings.......................................................................................................................55
Passwords.......................................................................................................................................................55
User accounts..................................................................................................................................................56
Account permission levels.......................................................................................................................57
Access and role considerations................................................................................................................57
Managing user accounts..........................................................................................................................57
Global account settings............................................................................................................................58
Date and time preferences..............................................................................................................................59
Management interface configuration..............................................................................................................60
Name Resolution...........................................................................................................................................61
Search domains......................................................................................................................................61
DNS servers............................................................................................................................................61
Host name resolution.............................................................................................................................61
Setting the time zone in which the Gateway is operating...............................................................................62
Shutdown/Reboot...........................................................................................................................................62
Updates...........................................................................................................................................................62
Licenses (Gateway-VE only)..........................................................................................................................64
Licenses (Gateway only)................................................................................................................................64
Chapter 5 - Appliance Security................................................................................................................67
Overview.........................................................................................................................................................67
Password Security...........................................................................................................................................68
Cascade Sensor and Cascade Gateway User’s Guide v
Contents

Security Compliance.......................................................................................................................................69
Operational modes...................................................................................................................................69
Accounts..................................................................................................................................................72
Access......................................................................................................................................................73
Encryption Key Management.........................................................................................................................74
Displays and controls on the page...........................................................................................................74
Replacing Keys and Certificates.............................................................................................................76
Replacing SSH keys.......................................................................................................................................77
Regenerating an SSH key pair.................................................................................................................77
Changing SSH key pair...........................................................................................................................77
Replacing SSL certificates..............................................................................................................................78
Replacing the MNMP SSL certificate.....................................................................................................78
Replacing the Apache SSL certificate.....................................................................................................85
SSL certificate requirements...................................................................................................................88
Chapter 6 - Audit trail report....................................................................................................................91
Audit trail........................................................................................................................................................91
Report Criteria.........................................................................................................................................91
Report results...........................................................................................................................................93
Activity Types and Subtypes...................................................................................................................99
Saved reports................................................................................................................................................105
Reports section......................................................................................................................................105
Templates section..................................................................................................................................106
vi Cascade Sensor and Cascade Gateway User’s Guide
Introduction
Welcome to the Cascade Sensor and Cascade Gateway User’s Guide. This guide also covers the Cascade Gateway
Virtual Edition (Gateway-VE), which is a software-only version of the Gateway. The Gateway-VE operates the same
as the hardware-based Gateway appliance except for a small difference in licensing. This is described in Chapter 4,
“Riverbed Cascade Gateway.”
Read this introduction for an overview of the information provided in this guide, the documentation conventions used
throughout, the hardware and software dependencies, additional reading, and contact information. This introduction
includes the following sections:
 “About This Guide,” next
 “Product Dependencies and Compatibility” on page 2
 “Contacting Riverbed” on page 3
About This Guide
The Cascade Sensor and Cascade Gateway User’s Guide describes how to configure and manage the Cascade Sensor
appliance (Sensor), Cascade Sensor-VE software (Sensor-VE), Cascade Gateway appliance (Gateway) and Gateway
Virtual Edition software (Gateway-VE). It describes configuring the appliances on the network, accessing their user
interfaces, and using their features.
Types of Users
This guide is written for network operations and security operators, administrators, managers and analysts. It assumes
that you have at least a basic understanding of networking and network management concepts.
Organization of This Guide
The Cascade Sensor and Cascade Gateway User’s Guide includes the following chapters:
 Chapter 1, “Overview,” introduces, compares, and contrasts the Cascade Sensor and Cascade Gateway.
 Chapter 2, “Riverbed Cascade Sensor,” describes the features and configuration of the Cascade Sensor.
 Chapter 3, “Riverbed Cascade Sensor-VE,” describes the features and configuration of the Cascade Sensor-VE.
 Chapter 4, “Riverbed Cascade Gateway,” describes the features and configuration of the Cascade Gateway.
Cascade Sensor and Cascade Gateway User’s Guide 1
Introduction Product Dependencies and Compatibility

 Chapter 5, “Appliance Security,” describes the security features common to Sensor, Sensor-VE and Gateway.
 Chapter 6, “Audit trail report,” describes the auditing features common to Sensor, Sensor-VE and Gateway.
Document Conventions
This guide uses the following standard set of typographical conventions to introduce new terms, describe command
syntax, and so forth.
Convention Meaning
italics Within text, new terms and emphasized words appear in italic typeface.
boldface Within text, commands, keywords, identifiers (names of classes, objects, constants, events, functions,
program variables), environment variables, filenames, GUI controls, and other similar terms appear in
bold typeface.
Courier Information displayed on your terminal screen and information that you are instructed to enter appears
in Courier font.
< > Within syntax descriptions, values that you specify appear in angle brackets. For example:
interface <ipaddress>
[ ] Within syntax descriptions, optional keywords or variables appear in brackets. For example:
ntp peer <addr> [version <number>]
{ } Within syntax descriptions, required keywords or variables appear in braces. For example:
{delete <filename> | upload <filename>}
| Within syntax descriptions, the pipe symbol represents a choice to select one keyword or variable to
the left or right of the symbol. (The keyword or variable can be either optional or required.) For
example:
{delete <filename> | upload <filename>}
Product Dependencies and Compatibility
This section provides information about product dependencies and compatibility. It includes the following sections:
 “Hardware and Software Dependencies,” next
 “Ethernet Network Compatibility” on page 3
 “SNMP-Based Management Compatibility” on page 3
2 Cascade Sensor and Cascade Gateway User’s Guide
Contacting Riverbed Introduction

Hardware and Software Dependencies
The following table summarizes the hardware and software requirements for the Cascade Sensor and Cascade Gateway
appliances.
Riverbed Cascade Component Hardware and Software Requirements
chassis 19 inch (483 mm) two or four-post rack.
user interface Secure Sockets Layer (SSL) capable browser.
The user interface has been successfully tested using Firefox 3.6 through
8.1 and Microsoft Internet Explorer 7 and 8. Internet Explorer 6 is no
longer supported.
Note: JavaScript and cookies must be enabled in your Web browser.
command line interface A computer with a Secure Shell (ssh) client that is connected by an IP
network to the appliance management interface. Free ssh clients include
PuTTY for Windows computers and OpenSSH for Linux.
Ethernet Network Compatibility
The appliance supports the following types of Ethernet networks:
 Ethernet Logical Link Control (LLC) (IEEE 802.2 - 2002)
 Fast Ethernet 100 Base-TX (IEEE 802.3 - 2002)
 Gigabit Ethernet over Copper 1000 Base-T and Fiber 1000 Base-SX (LC connector) (IEEE 802.3 - 2002)
The management port in the appliance is 10 Base-T/100, Base-TX/1000.
The appliance supports VLAN Tagging (IEEE 802.1Q - 2003). It does not support the Cisco ISL protocol.
All copper interfaces are auto-sensing for speed and duplex (IEEE 802.3 - 2002).
SNMP-Based Management Compatibility
The appliance supports a proprietary Riverbed MIB accessible through SNMP. Both SNMP v1 (RFCs 1155, 1157,
1212, and 1215) and SNMP v3 are supported.
SNMP support allows the appliance to be integrated into network management systems such as Hewlett Packard
OpenView Network Node Manager, BMC Patrol, and other SNMP-based network management tools.
Contacting Riverbed
This section describes how to contact departments within Riverbed.
Internet
You can find out about Riverbed products through our Web site at http://www.riverbed.com.
Cascade Sensor and Cascade Gateway User’s Guide 3
Introduction Contacting Riverbed

Customer Support
If you have problems installing, using, or replacing Riverbed products contact Riverbed Customer Support or your
channel partner who provides support. To contact Riverbed Customer Support, please open a trouble ticket at https:/
/support.riverbed.com or call 1-888-RVBD-TAC (1-888-782-3822) in the United States and Canada or +1 415 247
7381 outside the United States.
Professional Services
Riverbed has a staff of professionals who can help you with installation assistance, provisioning, network redesign,
project management, custom designs, consolidation project design, and custom coded solutions. To contact Riverbed
Professional Services go to http://www.riverbed.com or email [email protected].
Documentation
We continually strive to improve the quality and usability of our documentation. We appreciate any suggestions you
may have about our online documentation or printed materials. Send documentation comments to
[email protected].
4 Cascade Sensor and Cascade Gateway User’s Guide