Presentation is loading. Please wait.

Presentation is loading. Please wait.

IBM® Security Network Protection – Troubleshooting the XGS appliance

Similar presentations


Presentation on theme: "IBM® Security Network Protection – Troubleshooting the XGS appliance"— Presentation transcript:

1 IBM® Security Network Protection – Troubleshooting the XGS appliance
11/4/2017 IBM® Security Network Protection – Troubleshooting the XGS appliance IBM Security support Open Mic Reminder: You must dial-in to the phone conference to listen to the panelists. The webcast does not include audio. Dial-in numbers: INDIA BANGALORE: MUMBAI: INDIA A: INDIA B: INDIA C: USA Toll-Free: Toll: Participant passcode: Author notes: <please delete these instructions before presenting> This is the IBM Security Default Template for both internal and external use. It’s aspect ratio is 16:10 and measures 10 x 6.25”. This template was created in Microsoft PowerPoint 365 Pro Plus 2016. Template files (saved with the file extension .potx) contain slide designs and customized layouts and are stored in your Microsoft templates folder* To save your new template as your default template for future use: Click “File / Save as” and choose “PowerPoint template (.potx) from the pull down menu” Rename file to, “Blank.potx” and click “Save” (file will then be stored to the default template location) Themes provide a complete slide design that can be applied to your existing presentation, including background designs, font styles, colors, and layouts To save your new template’s theme file; click “View / Slide Master / Themes” On the Themes pull down menu, select, “Save Current Theme” This new Theme file is how you apply the new template design to your existing presentations For more information, visit: Office.com / PowerPoint / Support Copy your existing source slides in slide sorter view Paste special by right-clicking in slide sorter view of destination file or template Select “Keep source formatting” This helps to ensure your slides retain their existing styles Each slide needs to be adjusted by doing the following in “Normal view” Select body content except title and footer by (Control “A”; then select title and footers while holding shift key) Cut remaining selected body content (Control “X”) Reset slide layout using new template layouts Paste slide content back onto slide (Control “V”) Learn more about using templates, visit: Office.com / PowerPoint / Support Slides and additional dial in numbers: NOTICE: By participating in this call, you give your Irrevocable consent to IBM to record any statements that you may make during the call, as well as to IBM’s use of such Recording in any and all media, including for video postings on YouTube. If you object, please do not connect to this call. September 22, 2016

2 Panelists Padmaja Deshmukh - Presenter - L2 Support Engineer
11/4/2017 Panelists Padmaja Deshmukh - Presenter - L2 Support Engineer Prateek Jain - L2 Support Senior Engineer Satish Bhandurge - L2 Support Senior Engineer Tanmay Shah - L2 Support Product Lead Kenji Hamahata - L2 Support Senior Engineer Carlos Hsiao - L3 Support Gary Hsueh - QA Lead Yogesh Talekar – Moderator - Manager, IBM Security - Advanced Threat Support (AP)

3 11/4/2017 Goal of session To provide basic guidelines about how to troubleshoot IBM Security Network Protection appliance XGS

4 Agenda Hardware Troubleshooting phdiag Utility Command Line Interface
11/4/2017 Agenda Hardware Troubleshooting phdiag Utility Command Line Interface Local Management Interface Troubleshooting Update Failures Troubleshooting Traffic Issues

5 Hardware Troubleshooting

6 Hardware Troubleshooting

7 Hardware Troubleshooting
No Power - Check cables. - Check power source. - Check lights on power supply.

8 Hardware Troubleshooting
No Post - Are there any sounds (fans, post beeps, etc.)? - Is there an output on the LCD? - Check terminal connection settings.

9 Hardware Troubleshooting
No Boot Are there any boot messages or errors displayed? ‒ Run phdiag. ‒ Reimage. ‒ Have you installed any new hardware? If so, remove it and try to boot. Make sure you power off the appliance before removing any hardware.

10 Hardware Troubleshooting
Disk Issues ‒ Drive status indicator light. ‒ Run phdiag. ‒ Reseat drive.

11 Hardware Troubleshooting
Network Issues ‒ What type of cabling is used (copper or fiber)? ‒ Is the cable good? ‒ Try plugging the connecting the appliance to another device. ‒ Check the port status to see if it is up. ‒ Check port settings. ‒ Run phdiag with loopback cables. ‒ SFP issues.

12 Hardware Troubleshooting
Network Interface Module ‒ Run system diagnostics. ‒ Swap the NIMs. Make sure to power off the appliance before removing the NIMs. ‒ Make sure the NIMs are enabled in the inspection interface policy.

13 phdiag Utility

14 phdiag utility Platform Hardware Diagnostics Utility (phdiag) – Is used to detect and diagnose hardware issues. To run a test on the network interfaces you will need to connect loopback cables to each of the ports. The Management interfaces M.1 and M.2 will need to be connected. Each of the monitoring ports will need to be connected to its pair.

15 Phdiag utility 1) Connect to the appliance via a serial cable. 2) When you see the GRUB menu hit the UP or DOWN arrow. 3) Once the appliance boots to the diagnostic menu type “phdiag” and hit enter.

16 phdiag utility Optional parameters:
all - run all standard tests (No storage badblocks test -- default) lcd - run LCD tests network - run network port tests (Selftest, Traffic) storage - run storage tests (SMART, FSCK) system - run standard system tests (MTM-Serial, Inventory, PSU, FAN, SEL) badblocks - run storage badblocks Once it is complete you can download it to a usb drive by typing “usbdownload”

17 Command Line Interface

18 Command Line Interface
The command line interface has a hierarchical structure with commands specific to each module. The prompt changes to display the module you are in. The tab key can be used to finish commands. Global commands: back – Return to the previous menu exit – log out of the appliance help – Displays the help menu for a command reboot – Reboot the appliance shutdown – Turn appliance power off top – Return to the top menu

19 Command Line Interface
The following modules are available in the command line interface: analysis – Works with packet analysis feature. certificates – Manage the appliance certificates. firmware – Mange appliance firmware. Create backups of current firmware. Swap active firmware. fixpacks – Install and list fixpacks. license – Install and list licenses. logs – Work with log files. management – Force a heartbeat to SiteProtector. opensig – Display Open signature profiling stats. protection – List and show status of protection interfaces. services – Work with certain system services. session – Lists active logon sessions. snapshots – Create a policy snapshot. Can upload and apply policy snapshots. ssh – work with SSH keys. stats – Lists statistics/status. support – Generate a system support file. Download support file to USB drive. sysinfo – Show system/hardware information. tools – Network tools. updates – Install update, list or roll back updates.

20 Command Line Interface
Under the Tools menu you have the following options: capture – Perform a packet capture. connections – Display the network connections for the appliance. nslookup – Query name servers. ping – Send an echo request to network hosts. telnet – Test connectivity to a port on a host. traceroute – Trace the route to a host.

21 Command Line Interface
Running packet caps on the management interface is just running tcpdump and specifying the filter. You can type tcpdumphelp to get a list of valid filter options. You can also go to the tcpdump manpage to get options.

22 Command Line Interface
To run packet filters on the inspection interfaces you need to create a filter and then run start. Run starthelp from the pinterface module to display the help screen for creating filter. You can filter by interface, source or destination and protocol or port. The example below would filter traffic on interface from with a destination port of 3995.

23 Command Line Interface
You type “start” to start capturing traffic. Click “stop” when finished. When you type “stop” you will see the ID number of the packets you just collected. Then move back up one menu level to the capture module you will see the pcap file listed.

24 Local Management Interface

25 Local Management Interface
The Local Management Interface (LMI) is a browser based user interface for managing all aspects of the appliance. Access the LMI by Troubleshooting tools available through the LMI are: System Graphs – Monitor appliance memory, CPU and Storage use. Network Graphs – Graphs to display traffic patterns by application or user. Can also show traffic patterns for each interface. System Logs – System events, errors and changes in system state are logged to this log file.

26 Local Management Interface
System Graphs – Memory Statistics

27 Local Management Interface
Network Graphs – Traffic details by Application

28 Local Management Interface
Logs – System Logs

29 Troubleshooting Update Failures

30 Troubleshooting Updates Failures
Check network connectivity to the update server. If updating from SiteProtector verify that you can ping SiteProtector from the appliance. If updating from the internet, verify that the proper firewall rules are in place. Technote: Check proxy settings. Can the appliance bypass the proxy? Check the licenses for the appliance. Verify that it has proper maintenance. Check your Update Servers policy to verify that all the settings are correct.

31 Troubleshooting Traffic Issues

32 Troubleshooting Traffic Issues
Check Active Quarantine Rule under the Secure Policy Configuration Menu in the LMI to verify that the traffic is not being quarantined. Check Network Access Events and IPS Events under the Monitor Analysis menu in the LMI to verify that the traffic is not generating a block event. Use the packet capture feature to view the traffic that is being passed through the interface. Check your Network Access Policy to see if a rule blocks the traffic. Try creating an accept any rule at the top to see if the traffic is now permitted.

33 Questions for the panel
11/4/2017 Questions for the panel Now is your opportunity to ask questions of our panelists. To ask a question now: Press *1 to ask a question over the phone or Type your question into the IBM Connections Cloud Meeting chat To ask a question after this presentation: You are encouraged to participate in the Forum on this topic:

34 Where do you get more information?
11/4/2017 Where do you get more information? Questions on this or other topics can be directed to the XGS forum: More articles you can review: Technotes: Security Network Protection Command Line Interface (CLI) troubleshooting commands Checking the health of Security Network Protection and Security Network IPS sensors Running Platform Hardware Diagnostics utility on the Security Network Protection appliance IBM developerWorks Infrastructure Security Community: curity IBM Security Network Protection in IBM Knowledge Center: Useful links: Get started with IBM Security Support IBM Support Portal | Sign up for “My Notifications” Follow us:

35 Mandatory closing slide with copyright and legal disclaimers.
11/4/2017 Mandatory closing slide with copyright and legal disclaimers.


Download ppt "IBM® Security Network Protection – Troubleshooting the XGS appliance"

Similar presentations


Ads by Google