About This Guide

Document Objectives

Audience

Document Organization

Important Terms Used in This Guide

Document Conventions

Cisco Connection Online

Documentation CD-ROM

About This Guide

This preface includes the following sections:

Document Objectives

This guide provides information on installing, configuring, and operating NetRanger. The appendixes provide technical background and reference material for advanced users.

Audience

This guide is intended for users who:

Need to install and configure NetRanger components
Need to secure a network with NetRanger
Want to learn more about intrusion detection and network security

Document Organization

This guide is organized into the following chapters and appendixes:

"NetRanger Overview." This chapter provides a basic overview of NetRanger, its architecture and components.
"Pre-Installation Considerations." This chapter prepares you for installing NetRanger on a network.
"Installation and Configuration." This chapter provides detailed instructions for installing, configuring, and upgrading Sensors, Directors, and third-party database management tools.
"Introducing the Director." This chapter provides a basic overview of the Director.
"Operating the Director." This chapter provides information on basic menu functions and other Director utilities.
"Configuration Management." This chapter provides in-depth instruction on using nrConfigure, NetRanger's remote configuration management tool.
"Managing Security Data." This chapter introduces the Data Management Package, including basic concepts and procedures, and creating reports from SQL queries.
"The NSDB and Signatures." This chapter provides information on using the Network Security Database, and explains embedded and custom signatures. There is also a complete list of NetRanger signatures.
"Advanced Director Functions." This chapter provides information on SNMP support, customizing nrdirmap, creating read-only maps, and other advanced functions.
"Troubleshooting." This appendix provides troubleshooting assistance on the Sensor, Director, Data Management Package, and Oracle.
"NetSentry Information." This appendix provides assistance to those users who are using NetRanger in conjunction with BorderGuard routers or Nortel Passports.
"RDBMS Reference." This appendix provides information on installing and operating third-party relational database management tools.

Important Terms Used in This Guide

The following terms denoting NetRanger-specific functions and capabilities are used throughout this guide:

Configuration Management

: Configuration management refers to the Director's ability to remotely manage the configuration of Sensors. This ability allows network security personnel to centrally manage all the Sensors across an enterprise-wide collection.

Daemon/Service

: A NetRanger daemon or service performs a specific function, such as writing log files, analyzing IP traffic, or processing events.

Device Management

: Device Management refers to the Sensor's ability to interact with network devices. For example, it can dynamically reconfigure the access control lists of a router to shun an attacker.

Director

: The Director is NetRanger's graphical control interface. A single Director can manage and monitor a group of Sensors, which enables security personnel to secure a network from a centralized console.

Logging

: Logging of security information is performed on two levels: logging of events (such as NetRanger commands, errors, and alarms), and logging of individual IP session information.

Network Device

: A router or packet filter, especially one that works with a Sensor to shun or cut unauthorized connections.

nrConfigure

: NetRanger's Java-based tool for centralized configuration management of remote Sensors.

Post Office

: The NetRanger post office maintains communication across a network between NetRanger services.

Sensor

: The Sensor is NetRanger's intrusion detection engine. It analyzes network traffic, searching for signs of unauthorized activity.

Shunning

: Shunning refers to the Sensor's ability to use a network device to deny entry to a specific network host or an entire network.

Document Conventions

This guide uses the following conventions:

NetRanger services, important terminology, and variable input for commands is shown in italics.
Command names, buttons, and keywords are shown in boldface.
Examples depict screen displays in screen font.
Information you need to enter in examples is shown in boldface screen font.
Variables for which you must supply a value are shown in italic screen font.
Choosing a menu item is indicated by the following convention:

: Click Show>Context on the Security menu.

Note Means reader take note. Notes contain helpful suggestions or references to materials not covered in the manual.

Caution Means reader be careful. In this situation, you might do something that could result in equipment damage or loss of data.

TimeSaver Means the described action saves time. You can save time by performing the action described in the paragraph.

Warning Means danger. You are in a situation that could cause bodily injury. Before you work on any equipment, you must be aware of the hazards involved with electrical circuitry and familiar with standard practices for preventing accidents. To see translated versions of this warning, refer to the Regulatory Compliance and Safety document that accompanied the device.

Waarschuwing Dit waarschuwingssymbool betekent gevaar. U verkeert in een situatie die lichamelijk letsel kan veroorzaken. Voordat u aan enige apparatuur gaat werken, dient u zich bewust te zijn van de bij elektrische schakelingen betrokken risico's en dient u op de hoogte te zijn van standaard maatregelen om ongelukken te voorkomen.

Varoitus Tämä varoitusmerkki merkitsee vaaraa. Olet tilanteessa, joka voi johtaa ruumiinvammaan. Ennen kuin työskentelet minkään laitteiston parissa, ota selvää sähkökytkentöihin liittyvistä vaaroista ja tavanomaisista onnettomuuksien ehkäisykeinoista.

Attention Ce symbole d'avertissement indique un danger. Vous vous trouvez dans une situation pouvant causer des blessures ou des dommages corporels. Avant de travailler sur un équipement, soyez conscient des dangers posés par les circuits électriques et familiarisez-vous avec les procédures couramment utilisées pour éviter les accidents.

Warnung Dieses Warnsymbol bedeutet Gefahr. Sie befinden sich in einer Situation, die zu einer Körperverletzung führen könnte. Bevor Sie mit der Arbeit an irgendeinem Gerät beginnen, seien Sie sich der mit elektrischen Stromkreisen verbundenen Gefahren und der Standardpraktiken zur Vermeidung von Unfällen bewußt.

Avvertenza Questo simbolo di avvertenza indica un pericolo. La situazione potrebbe causare infortuni alle persone. Prima di lavorare su qualsiasi apparecchiatura, occorre conoscere i pericoli relativi ai circuiti elettrici ed essere al corrente delle pratiche standard per la prevenzione di incidenti.

Advarsel Dette varselsymbolet betyr fare. Du befinner deg i en situasjon som kan føre til personskade. Før du utfører arbeid på utstyr, må du vare oppmerksom på de faremomentene som elektriske kretser innebærer, samt gjøre deg kjent med vanlig praksis når det gjelder å unngå ulykker.

Aviso Este símbolo de aviso indica perigo. Encontra-se numa situação que lhe poderá causar danos físicos. Antes de começar a trabalhar com qualquer equipamento, familiarize-se com os perigos relacionados com circuitos eléctricos, e com quaisquer práticas comuns que possam prevenir possíveis acidentes.

¡Atención! Este símbolo de aviso significa peligro. Existe riesgo para su integridad física. Antes de manipular cualquier equipo, considerar los riesgos que entraña la corriente eléctrica y familiarizarse con los procedimientos estándar de prevención de accidentes.

Varning! Denna varningssymbol signalerar fara. Du befinner dig i en situation som kan leda till personskada. Innan du utför arbete på någon utrustning måste du vara medveten om farorna med elkretsar och känna till vanligt förfarande för att förebygga skador.

Cisco Connection Online

Cisco Connection Online (CCO) is Cisco Systems' primary, real-time support channel. Maintenance customers and partners can self-register on CCO to obtain additional information and services.

Available 24 hours a day, 7 days a week, CCO provides a wealth of standard and value-added services to Cisco's customers and business partners. CCO services include product information, product documentation, software updates, release notes, technical tips, the Bug Navigator, configuration notes, brochures, descriptions of service offerings, and download access to public and authorized files.

CCO serves a wide variety of users through two interfaces that are updated and enhanced simultaneously: a character-based version and a multimedia version that resides on the World Wide Web (WWW). The character-based CCO supports Zmodem, Kermit, Xmodem, FTP, and Internet e-mail, and it is excellent for quick access to information over lower bandwidths. The WWW version of CCO provides richly formatted documents with photographs, figures, graphics, and video, as well as hyperlinks to related information.

You can access CCO in the following ways:

WWW: http://www.cisco.com
WWW: http://www-europe.cisco.com
WWW: http://www-china.cisco.com
Telnet: cco.cisco.com
Modem: From North America, 408 526-8070; from Europe, 33 1 64 46 40 82. Use the following terminal settings: VT100 emulation; databits: 8; parity: none; stop bits: 1; and connection rates up to 28.8 kbps.

For a copy of CCO's Frequently Asked Questions (FAQ), contact cco-help@cisco.com. For additional information, contact cco-team@cisco.com.

Note If you are a network administrator and need personal technical assistance with a Cisco product that is under warranty or covered by a maintenance contract, contact Cisco's Technical Assistance Center (TAC) at 800 553-2447, 408 526-7209, or tac@cisco.com. To obtain general information about Cisco Systems, Cisco products, or upgrades, contact 800 553-6387, 408 526-7208, or cs-rep@cisco.com.

Documentation CD-ROM

Cisco documentation and additional literature are available in a CD-ROM package, which ships with your product. The Documentation CD-ROM, a member of the Cisco Connection Family, is updated monthly. Therefore, it might be more current than printed documentation. To order additional copies of the Documentation CD-ROM, contact your local sales representative or call customer service. The CD-ROM package is available as a single package or as an annual subscription. You can also access Cisco documentation on the World Wide Web at http://www.cisco.com, http://www-china.cisco.com, or
http://www-europe.cisco.com.

If you are reading Cisco product documentation on the World Wide Web, you can submit comments electronically. Click Feedback in the toolbar and select Documentation. After you complete the form, click Submit to send it to Cisco. We appreciate your comments.

Table of Contents

About This Guide