Nortel 2070 User manual

Nortel Threat Protection System

Threat Protection System

Troubleshooting Guide

Release: 4.7

Document Revision: 01.01

www.nortel.com

NN47240-700 324442-A

Nortel Threat Protection System

Release: 4.7

Publication: NN47240-700

Document status: Standard

Document release date: 112007

The information in this document is subject to change without notice. The statements, configurations, technical

data, and recommendations in this document are believed to be accurate and reliable, but are presented without

express or implied warranty. Users must take full responsibility for their applications of any products specified in this

document. The information in this document is proprietary to Nortel Networks.

Export

This product, software and related technology is subject to U.S. export control and may be subject to export or

import regulations in other countries. Purchaser must strictly comply with all such laws and regulations. A license to

export or reexport may be required by the U.S. Department of Commerce.

Licensing

This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit

(http://www.openssl.org/).

This product includes cryptographic software written by Eric Young ([email protected]).

This product includes software written by Tim Hudson ([email protected]).

This product includes software developed by the Apache Software Foundation http://www.apache.org/.

Wilson, and is licensed under the GPL.

See Appendix D, "License Information", in the User’s Guide for more information

Contents

New in this release 7

Navigation 7

Introduction 9

Prerequisites 9

Navigation 10

Acronyms 10

Troubleshooting Fundamentals 11

Navigation 11

Log files 11

Issues that require Sourcefire assistance 12

Hardware Troubleshooting 15

Navigation 15

TPS Hardware 15

Ports to open in a firewall 16

Software Troubleshooting 17

Creating a troubleshoot file from a TPS device 18

Obtaining the troubleshoot file following a failed software upgrade 19

Resetting passwords 20

Resetting the root password of a TPS device 20

Resetting the Administrator Password for a TPS device 21

Installing an Old Version of SEU 22

Event handling 22

Troubleshooting TPS Sensor when not receiving events 23

Troubleshooting Defense Center when not receiving events 23

Troubleshooting errors when adding sensor to DC 23

Troubleshooting the SFDataCorrelator 24

Troubleshooting alerting problems 25

Troubleshooting mail alerting problems 25

Troubleshooting SNMP alerting problems 25

Troubleshooting Syslog alerting problems 25

Troubleshooting events that show incorrect time 25

Troubleshooting LDAP authentication 26

Nortel TPS 4.7

Threat Protection System Troubleshooting Guide

NN47240-700 01.01 Standard

112007

RUA 27

Configuring Snort through the User Interface 27

Verifying prohibit packet data on the DC 28

Performing RNA IP/Port Exclusion 28

Scanning the NMAP 29

Remediation Procedures 29

Remediating NAS 29

Troubleshooting Global Faults 31

Navigation 31

Troubleshooting when no white list events are generated 32

Troubleshooting an IS that does not generate events 32

Troubleshooting an SDM IS that could not be added to a DC 32

Troubleshooting an IS that does not block traffic 33

Validating the failopen function 33

Troubleshooting an IS that does not send email 34

Troubleshooting a DC that cannot push a policy to a sensor that it is

managing 34

Troubleshooting a faulty OPSEC 34

Troubleshooting a failed upgrade 35

Troubleshooting a failed automatic SEU Update 35

Troubleshooting when a customer is unable to add a sensor to be managed by a

DC 36

Troubleshooting a system crash 37

Verify the ports to be opened in the firewall for 4.6 37

Troubleshooting Snort 37

Troubleshooting memory problems 38

IPS mode cable Deployment Scenarios 38

Deploying between two endpoints 38

Deploying between two network switches 39

Between a switch and an endpoint 39

Between a switch and a router 39

Between a router and an endpoint 39

Between a firewall and an endpoint 40

Between two firewalls 40

Between a switch and a firewall 40

Between router and a firewall 40

Checking IPv6 configurations on the CLI 41

Verification of Detection Resources on the CLI 41

Viewing the enabled rules on the CLI 41

Viewing remediation log 42

Viewing the LDAP SSL certificate 42

Emergency recovery trees 43

Lost access to the TPS DC/IS device -- recovery tree 43

Nortel TPS 4.7

Threat Protection System Troubleshooting Guide

NN47240-700 01.01 Standard

112007

Licensing 5

The TPS DC/ IS cannot receive events -- recovery tree 44

Reference to third party Application Guides 47

Contact Nortel technical support 49

Navigation 49

Gathering critical information 49

Getting help from the Nortel Web site 50

Getting help over the phone from a Nortel Solutions Center 50

Getting help from a specialist by using an Express Routing Code 51

Getting help through a Nortel distributor or reseller 51

Glossary 53

Nortel TPS 4.7

Threat Protection System Troubleshooting Guide

NN47240-700 01.01 Standard

112007

Nortel TPS 4.7

Threat Protection System Troubleshooting Guide

NN47240-700 01.01 Standard

112007

New in this release

The Nortel Threat Protection System Release. 4.7 Troubleshooting Guide

with Emergency Recovery Tree (NN47240-700) is a new document for

Nortel Threat Protection System Release 4.7.

Navigation

Nortel TPS 4.7

Threat Protection System Troubleshooting Guide

NN47240-700 01.01 Standard

112007

8New in this release

Nortel TPS 4.7

Threat Protection System Troubleshooting Guide

NN47240-700 01.01 Standard

112007

Introduction

The Nortel Threat Protection System is a fully integrated intrusion

detection system that consists of the following:

•TPS 2070 Defense Center, which manages intrusion sensors in the

network environment

•TPS 2050 Intrusion Sensor and TPS 2070 Intrusion Sensor, which

detect and track network intrusions, either independently or under the

management of the TPS 2070 Defense Center

•TPS 2150 Intrusion Sensor and TPS 2170 Intrusion Sensor, which

have fail-open functionality in inline mode

This chapter describes the prerequisites and various tools used to

troubleshoot the Nortel TPS 4.7. Use these troubleshooting tools to

enhance the overall performance, resolve error messages, and increase

response time for a specific feature. Each tool is described by purpose,

usage procedures, and how to interpret the output.

Prerequisites

Nortel recommends you to use one or more of the following commercially

available troubleshooting tools as well as the tools described in this

document.

•Capture and analyze HTTP and HTTPS with the HTTP Analyzer from

IE Inspector http://www.ieinspector.com/

•Capture and analyze HTTP and HTTPS with Tamper Data, a plug-in

available for Mozilla Firefox https://addons.mozilla.org/en-US/firefox/

addon/966

•Display the time to load Web pages with Faster Fox, a plug-in available

for Mozilla Firefox https://addons.mozilla.org/en-US/firefox/addon/1269

•Capture and analyze packets with either Sniffer or Wireshark from

Network General http://www.wireshark.org/ and http://www.networkge

neral.com/

Nortel TPS 4.7

Threat Protection System Troubleshooting Guide

NN47240-700 01.01 Standard

112007

10 Introduction

Navigation •“Troubleshooting Fundamentals” (page 11)

•“Hardware Troubleshooting” (page 15)

•“Software Troubleshooting” (page 17)

•“Troubleshooting Global Faults” (page 31)

•“Emergency recovery trees” (page 43)

•“Reference to third party Application Guides” (page 47)

•“Contact Nortel technical support” (page 49)

•“Glossary” (page 53)

Acronyms Table 1 "Acronyms" (page 10) lists the acronyms used in this guide.

Table 1

Acronyms

TPS Threat Protection System

CLI Command Line Interface

LED Light Emitting Diode

Nortel TPS 4.7

Threat Protection System Troubleshooting Guide

NN47240-700 01.01 Standard

112007

Other manuals for 2070

This manual suits for next models

Table of contents

Other Nortel Software manuals

Nortel

Nortel Agent Manual

Nortel

Nortel Web OS Switch Software User guide

Nortel

Nortel SREM User manual

Nortel

Nortel NN42030-110 User manual

Nortel

Nortel Configuration Manager Quick guide

Nortel

Nortel Quality Monitoring User manual

Nortel

Nortel N0035509 User manual

Nortel

Nortel NN43119-101 User manual

Nortel

Nortel NN43119-100 User manual

Nortel

Nortel Host Tools Owner's manual

Nortel

Nortel BayStack 380-24F Service manual

Nortel

Nortel 5100 Series Release 2.3.3 User manual

Nortel

Nortel VPN Client Instruction Manual

Nortel

Nortel 1000 Con?guration guide Operating and maintenance instructions

Nortel

Nortel AS 5300 User manual

Nortel

Nortel Voice Mail Quick start guide

Nortel

Nortel 1000 Con?guration guide User manual

Nortel

Nortel BCM 4.0 User manual

Nortel

Nortel NN-10300-053 User manual

Nortel

Nortel VoIP Gateway User manual

Nortel

Nortel NA Operation manual

Nortel

Nortel Passport 4400 Guide

Nortel

Nortel Meridian Mail User manual

Nortel

Nortel Quality Monitoring Instruction Manual

Popular Software manuals by other brands

COMPRO

COMPRO COMPROFM manual

Muratec

Muratec OFFICEBRIDGE ONLINE user guide

Oracle

Oracle Contact Center Anywhere 8.1 installation guide

Adobe

Adobe 65007312 - Photoshop Lightroom Programmer's guide

Avaya

Avaya NULL One-X for RIM Blackberry user guide

HP ProLiant BL420c user guide

PS Audio

PS Audio PowerPlay Programming manual

Brady

Brady LOCKOUT PRO 3.0 Administrator's guide

Avaya

Avaya Interaction Center user guide

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Guide book

Novell

Novell GROUPWISE 8 - INTERNET AGENT manual

Oracle

Oracle Application 9i Configuration guide

Acer

Acer RDM user guide

Canon

Canon Vixia HF21 instruction manual

Canon

Canon ZR950 instruction manual

Samsung

Samsung Auto Backup user manual

Polycom

Polycom Vortex EF2201 Application note

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c user manual