Initial Configuration Guide

(1)

Initial Configuration Guide

(2)

Version 1.3.2.1

Third Party Copyright Notices

© Blue Coat Systems, Inc. All rights reserved. BLUE COAT, PROXYSG, PACKETSHAPER, CACHEFLOW, INTELLIGENCECENTER, CACHEOS, CACHEPULSE, CROSSBEAM, K9, DRTR, MACH5, PACKETWISE, POLICYCENTER, PROXYAV, PROXYCLIENT, SGOS, WEBPULSE, SOLERA NETWORKS, DEEPSEE, DS APPLIANCE, CONTENT ANALAYSIS SYSTEM, SEE EVERYTHING. KNOW EVERYTHING., SECURITY

EMPOWERS BUSINESS, BLUETOUCH, the Blue Coat shield, K9, and Solera Networks logos and other Blue Coat logos are registered trademarks or trademarks of Blue Coat Systems, Inc. or its affiliates in the U.S. and certain other countries. This list may not be complete, and the absence of a trademark from this list does not mean it is not a trademark of Blue Coat or that Blue Coat has stopped using the trademark. All other trademarks mentioned in this document owned by third parties are the property of their respective owners. This document is for informational purposes only.

BLUE COAT MAKES NO WARRANTIES, EXPRESS, IMPLIED, OR STATUTORY, AS TO THE INFORMATION IN THIS DOCUMENT. BLUE COAT PRODUCTS, TECHNICAL SERVICES, AND ANY OTHER TECHNICAL DATA REFERENCED IN THIS DOCUMENT ARE SUBJECT TO U.S. EXPORT CONTROL AND SANCTIONS LAWS, REGULATIONS AND REQUIREMENTS, AND MAY BE SUBJECT TO EXPORT OR IMPORT REGULATIONS IN OTHER COUNTRIES. YOU AGREE TO COMPLY STRICTLY WITH THESE LAWS, REGULATIONS AND

REQUIREMENTS, AND ACKNOWLEDGE THAT YOU HAVE THE RESPONSIBILITY TO OBTAIN ANY LICENSES, PERMITS OR OTHER APPROVALS THAT MAY BE REQUIRED IN ORDER TO EXPORT, RE-EXPORT, TRANSFER IN COUNTRY OR IMPORT AFTER DELIVERY TO YOU.

Americas:

Blue Coat Systems, Inc. 420 N. Mary Ave.

Sunnyvale, CA 94085

Rest of the World:

Blue Coat Systems International SARL 3a Route des Arsenaux

(3)

Version 1.3.2.1

Introduction

This guide describes how to use Blue Coat Management Center to set up, monitor, and manage Blue Coat devices, and is intended for administrators. Delegated administrators might not be able to perform all of the tasks described in this guide. This document describes how to install Management Center for the first time. Management Center 1.3.2.1 is a virtual appli-ance release, and supports the following devices:

l ProxySG appliances running SGOS 6.2.x and later (reporting requires SGOS 6.3.x and later) l Content Analysis appliance integration

l Malware Analysis appliance support

Refer to the Blue Coat Management Center Release Notes on the BTO download page to determine require-ments for your virtualization environment and compatibility with third-party products.

Management Center Features and Benefits

Some of the features and benefits of using Management Center are:

Feature

Benefit

Management Center provides cent-ralized management for up to 500 devices.

Eliminate the need to manage each remote device manually, reducing man-agement costs.

Groups devices based on location, department, purpose, and other attrib-utes that you specify.

Delegate administrative duties and deploy policies for specific groups. Enables administrators to assign attributes for managed devices that have different pur-poses within their network.

Roles have greater flexibility, enabling user groups with the same per-missions to access and manage policies and devices within their spe-cific organization.

User Groups with the same permissions access, manage, and can report on devices within their management area without overlapping job duties and wast-ing time and resources. Apply roles to user groups that you need to have homo-genous results (for example user groups that are in specific locations or have a specific job function).

Manages internal and external user accounts for Management Center.

Users only access the functional areas and perform tasks required for their jobs. Facilitates creating and deploying

policy to multiple devices sim-ultaneously. Includes Virtual Policy Management and consistency check-ing between policies and devices

Ensure consistency amongst devices that have the same purpose or require standardized policy. Administrators can manage policy using the Visual Policy Manager on managed devices from within the Management Center web con-sole.

Manage attributes for devices, device groups, policy and device scripts

Use attributes to define custom metadata for devices, device groups, policy and device scripts. Filter on attributes to refine searches for all objects.

Create, edit and execute scripts. Includes the ability to compare script versions and to import a script from a managed device

(4)

Version 1.3.2.1

Feature

Benefit

Audit log records user and system event history

Be aware of all user actions in the system and support organizational account-ability.

Reports on device performance Assess how changes to the network affect performance and proactively reduce their impact.

Storing device backups on an external server

Enables administrators to export backups to external servers using any of the fol-lowing 4 protocols: FTP, HTTP, HTTPS, or SCP

Job scheduling to automate repetitive tasks

Administrators can set up jobs to automate tasks that recur or are otherwise inef-ficient to perform manually. Additional permissions are required to perform some jobs.

Terminology

Important terms used in Management Center documentation are listed alphabetically in the following table.

In some cases, this guide uses abbreviations instead of expanded forms. While using this guide, refer to this table to determ-ine the meaning or expanded form of a term.

Term (Abbreviation,

when applicable)

Description and Usage

Administration The tab in the upper right of the web console where administrators can configure settings and view data specific to Management Center.

Attributes Attributes are additional metadata that you can define and apply to devices, device groups, policy and device scripts.

Blue Coat Licensing Portal (BCLP)

Website where you obtain your license for Management Center:

(5)

Version 1.3.2.1

Term (Abbreviation,

when applicable)

Description and Usage

BlueTouch Online (BTO) Blue Coat support portal, which offers software downloads, documentation, and other information to help you with your Blue Coat appliances:

https://bto.bluecoat.com

You require a login to access some areas of BTO, such as downloads and release notes. Comma-separated values

(CSV)

CSV is a delimited data format. To add multiple devices simultaneously, you use a CSV file (a template is provided in Management Center).

Command Line Interface (CLI)

One of two ways to access Management Center; a command line tool where you can con-figure Management Center and execute administrative commands. Set up the CLI admin account and password during the initial creation of your appliance. SeeLog on to the CLI. Content Policy Language

(CPL)

The language in which ProxySG appliance policy is written. Policies can be customized to an organization’s specific set of users and unique enforcement needs.

Dashboard A page providing a simplified view of important information and statistics in widgets. Dash-boards display in two prominent areas in the web console. The web console displays the main Dashboard by default when you log in, and it displays the Statistics Dashboard when you click Statistics Monitoring.

Device A Blue Coat appliance that you can add and manage in Management Center.

Management

Information Base (MIB)

MIBs are required for configuring SNMP for Management Center alerts. Download MIBs at the BTO Downloads page:

http://bto.bluecoat.com/download

Metadata Data about some user-defined and system-defined data in Management Center, such as

the date and time of creation, the purpose of the data creation, and the user who created it. Policy objects and policy versions have metadata.

Open Virtualized Format (OVF)

A format for packaging and distributing virtual machines. The OVF file in the VAP is an XML text file that defines the attributes of the specific virtual machine package.

Policy Editor The area in Management Center where you write policy and create policy sections. To go to the Policy Editor, click Policy, select an object, and click Edit.

Pinned The pinned item marks the item so that the item is not deleted automatically when the

sys-tem atsys-tempts to recover space.

Prune Pruning items attempts to recover storage by deleting old backup images.

Scripts Commonly used configuration can be scripted. Scripts can be run on a device to configure

that device. Administrators can create a scripts, list them, and filter scripts by attributes. The script itself is not be directly associated to a device, but when you deploy a script, you can select from available devices the device you want the script to be deployed. To deploy a script through a scheduled job, you can schedule a script to run on multiple devices or device groups. Variable replacements are available within all scripts.

Serial Number A string of numbers that uniquely identify an appliance. When you first power on the VA, you must enter the serial number to begin initial configuration.

(6)

Version 1.3.2.1

Term (Abbreviation,

when applicable)

Description and Usage

Service Request (SR) A request for information or assistance with Blue Coat Support. To open an SR, you require a valid support entitlement with Blue Coat.

SGOS Operating system that runs on the ProxySG appliance.

Variable Substitution When enabled, the replacement of substitution variables occurs when policy, policy frag-ments or script variables associated with a device are substituted with a specific value. Management Center attempts to replace variables with the values associated with the device where the policy is being installed or the script is being executed.

VPM Editor Visual Policy Manager Editor enables you to create policy and edit policy.

Virtual Appliance (VA) The Management Center virtual machine image. Virtual Appliance Package

(VAP)

The zip file that contains the OVF file and the virtual disk files (.vmdk) required for creating the Management Center VA.

Virtual Machine (VM) An instance of an operating system and one or more applications that run in an isolated par-tition of a vmware server.

VMware client The virtualization software used to create and/or host the Management Center virtual appli-ance.

For simplicity, this document uses the term "VMware client" in all instances; substitute it with the supported ESX host you are using.

Web Console (Management Center UI)

One of two ways to access Management Center; you display the web interface in a browser window, and it is the main point of access for performing tasks in Management Center. The web console comes with a default admin account and password.

Widget A graphical representation of information, designed to provide you with a quick overview of

statistics or other important information. Widgets display on dashboards in Management Center.

Access Blue Coat Documentation

AccessManagement Center Release Notes,Management Center Solutions Webguide, and other documentation on BTO. 1. Go to BTO:

https://bto.bluecoat.com/documentation

2. Enter your BTO username and password in the fields at the top of the page, and click Login.

3. To download the release notes, select Download and browse to your version of Management Center. 4. To obtain other product documentation:

a. Click Documentation and select Management Center.

b. Click the version of Management Center to access the complete documentation set for the release.

Contact Us

We appreciate your comments about this guide. Please comment on specific errors or omissions, accuracy, organization, subject matter, or completeness of this book.

(7)

Verify VMware Requirements

(If you are running Management Center as a virtual appliance) follow these guidelines to achieve sat-isfactory performance and operation.

The virtualization environment must have, at a minimum:

l VMware® ESX Server 5.x l Dual-core processor l 8 GB of virtual memory l 100 GB hard disk space

(8)

Prepare for Initial Configuration

The initial configuration wizard prompts you to configure basic network settings for Management Center. Obtain and record the information specific to your deployment in this table, and then use your notes for ref-erence when you go through the installation process.

Print out this page for reference.

Requirement

Description

My values

Appliance serial number The serial number from the Blue Coat Licensing Portal (BCLP). SeeRetrieve Your Serial Number.

Interface configuration IP address. Subnet mask. Default gateway

IP address for the default gateway.

DNS servers IP address for the primary DNS server.

(9)

Ports and Protocols Reference

Use the following table as a reference when setting up Management Center.

System Ports Initiated By Function

Management Center

9008 TCP

ProxySG appliance ProxySG appliance Performance

Statistics Management

Center

22 TCP

Management Center ProxySG appliance monitoring

and management Management Center 8080 8082 TCP

User's Client Management Center's UI (web

console) Management Center 389 636 TCP

Management Center Authentication via

AD/LDAP/LDAPS Management Center 80 443 TCP

Management Center bto.bluecoat.com

License activation, the latest release information and doc-umentation

SMTP 25 Management Center Email

(10)

Retrieve Your Serial Number

The Blue Coat eFulfillment e-mail you received after placing your order for the Management Center VA contains activation codes for retrieving appliance serial numbers from the BCLP. You must use the cor-rect serial number to ensure that your license is valid.

To retrieve appliance serial numbers:

1. Make sure you have a BTO username and password. In addition to retrieving appliance serial numbers, these credentials are required for obtaining your license and downloading software upgrades.

If you do not have a BTO account, [email protected]. For additional contact information, go tohttps://bto.bluecoat.com.

2. Locate the e-mail you received from Blue Coat. This e-mail contains the software activation codes as well as a link to the BCLP.

3. Log in to BCLP:

a. Click the link embedded in the e-mail (https://services.bluecoat.com/eservice_ enu/licensing/register.cgi).

The web browser displays the BCLP page.

b. On the BCLP login screen, enter your BTO username and password, and then click Login. The BCLP displays the Home page.

4. In the Enter Activation Code field, enter the activation code from your e-mail. 5. Click Next.

The BCLP displays the License Agreement page.

6. Read and accept the License Agreement, and then click Next. A BCLP displays the serial numbers page.

7. Record the appliance serial number. You will need this number to complete the Management Center initial configuration wizard.

(11)

Set up Management Center

Before you start, make sure that youRetrieve Your Serial Numberand determine your require-ments. SeePrepare for Initial Configuration

If you are using Management Center for the first time, perform the following steps to install and set up Management Center.

1. Download the VAP file from BTO.SeeDownload and Extract the OVF File.

2. Import the OVF file to your VMware client to create the Management Center VA. SeeCreate the Virtual Appliance.

3. Enter the valid serial number to activate Management Center. SeeEnter Your Serial Number. 4. Complete the steps in the initial configuration wizard to configure the Management Center VA.

SeeConfigure the Virtual Appliance.

5. Install the Management Center license. SeeRetrieve and Install the License.

Download and Extract the OVF File

To install Management Center, log in to BTO and download the Management Center VAP file. The VAP file is a .zip file that contains:

l An Open Virtualized Format (OVF) file

l Two Virtual Machine Disk Format (VMDK) files:

o MC-V10-disk1.vmdk (for the boot disk) o MC-V10-disk2.vmdk (for the virtual disk)

l This guide in PDF format

1. Log in to BTO (https://bto.bluecoat.com/download) and select Downloads. 2. Browse to the Management Center page.

3. In the Management Center section, click the link for the VAP file and follow the instructions to save the file.

4. Extract the contents of the VAP file to a location that you can access from the system where you are running the VMware client.

The OVF file includes a pointer to the .vmdk files; thus, you must extract and store the con-tents of the .zip file within the same folder. Do not rename the files.

(12)

Create the Virtual Appliance

After you extract the OVF file, create the Management Center VA. 1. Log into VMware client.

2. Select File > Deploy OVF Template. The VMware client displays a wizard. 3. In the Source dialog, click Browse and browse to where you extracted the OVF file. 4. Click Next.

5. Verify the details for OVF template and click Next.

6. Specify a name for the VA and the inventory location, and then click Next. 7. Select where to put the VA (host or cluster) and click Next.

8. Select where to store the virtual machine's files and click Next. 9. Specify thick or thin provisioning for the disk format and click Next.

If you select thin provisioning, VMware allocates only the required amount of virtual disk space for the VA. Thick provisioning could result in slightly better performance, but it is not required. Refer to VMware documentation if you require more information on virtual disk provisioning.

10. Select a network to map to and click Next.

11. On the Ready to Complete dialog, review your settings.

12. (Optional) At the bottom of the dialog, select Power on after deployment to power on the VA after deployment. If you do not select it, you can power on the VA later.

13. Click Finish. The VMware client displays a "Deploying <name>" message with a progress bar. When deployment is complete, close the message. The inventory on the left displays the VA.

Power On the VA

If you did not power on the VA in step 12 of the previous procedure, power it on now. 1. Locate the VA in the inventory, select it, and right click.

Select Power > Power On.

2. Verify that the VA is powered on. If it is powered on, its icon should look similar to the following:

You can also select the VA and right click. If the VA is already powered on, the Power > Power On option should be unavailable.

Proceed to the next step

Enter Your Serial Number.

Enter Your Serial Number

To activate the Management Center VA, enter the serial number that was provided in the eFulfillment e-mail from Blue Coat. After your serial number is validated, you can enter the Management Center CLI con-sole.

1. In the VMware client, in the inventory on the left, right-click the VA.

2. Select Open Console. The VMware client displays the console. The console prompts you to enter the serial number.

3. Enter your serial number and press Enter.

4. If the serial number is not valid, check the number and try again. If the serial number is not accepted, do not proceed to the next steps; contact Blue Coat Support.

(13)

http://www.bluecoat.com/support/technical-support/bluetouch-support-options

If the serial number is valid, the console prompts you to press Enter three times. 5. Press Enter three times. The console displays the initial configuration wizard.

Proceed to the next step

Go toConfigure the Virtual Appliance.

Configure the Virtual Appliance

After your serial number was validated, the initial configuration wizard displayed. Follow the prompts to complete initial configuration of Management Center and refer to your notes inPrepare for Initial Con-figuration.

You can change these settings at any time after initial configuration. When you change the IP address, note the fol-lowing:

l The web console can take a while to load; if the browser displays an error after you

change the IP address, try again in a few moments.

l The SSL certificate is regenerated; you do not have to do it manually. If a new

certificate is required after is already configured, use the CLI command #security

generate-ssl-certificateto regenerate it.

1. In the initial configuration wizard, enter the following details, pressing Enter after each entry:

l IP address (you will use this IP address for the web console) l Subnet mask

l IP address for the default gateway l IP address for the primary DNS server

l (optional) IP address for the secondary DNS server

l The admin account password; the wizard prompts you to enter the password again for

confirmation

Make sure that the password is not easily guessed; if the password is not valid (for example, it is too short or is a dictionary word), the wizard prompts you to enter another password. Use an alphanumeric password that is at least 8 characters long.

---MENU---1) Command Line Interface

2) Setup

---Enter option:

2. Do one of the following to close the console:

(14)

You can only reset the admin account with the following conditions:

l Serial console access.

l The CLI command #security password: Resets the password used to access the

CLI for the admin account.

Proceed to the next step

Before proceeding to the next step, verify that Management Center has been configured correctly. See

Verify Web Console Access. Then, go toRetrieve and Install the License.

Configure Explicit Proxy

Perform these steps if you have an explicit proxy deployment.

Because Management Center is deployed behind the ProxySG appliance, you must configure proxy set-tings in an explicit deployment. If the proxy configuration is missing or incorrect, Management Center will be unable to connect to BTO for license downloads.

1. Log on to the CLI. SeeLog on to the CLIfor instructions.

2. To enable use of the proxy server, issue the following command: #http-proxy enable

3. To configure the explicit proxy, issue the following command and specify the settings: # http-proxy configure

HTTP Proxy host: <proxy_IP_address_or_hostname>

HTTP Proxy port:<proxy_port_number>

Username:<proxy_username>

Password:<proxy_password>

4. (Recommended) Issue the #show setupinfo command to display and verify the proxy settings you entered. The proxy settings display in the HTTP Proxy Settings section of the command output.

For more information on configuring proxy settings in the web console, refer to theManagement Center Solutions Webguideon BTO. To configure proxy settings using the CLI, refer to the ProxySGCLI Refer-ence Guide.

Retrieve and Install the License

The Management Center license contains data that is used to uniquely identify the VA as a Blue Coat appliance.

(15)

2. Enter privileged mode from standard mode by using the enable command. The prompt changes from a > to a #, indicating that you are in privileged mode.

3. At the # command prompt, type the following command and press Enter: #license get-from-bluecoat

Refer to #license in theManagement Center CLI Reference Guidefor information. 4. Restart the Management Center services. SeeRestart Services.

5. Go to the Management Center web console in a web browser. SeeVerify Web Console Access.

If a license is not installed and the VA is powered on, users will be unable to load the Man-agement Center web console.

Update an existing license

To update an existing license, you can run the #license get-from-url CLI command. In addition, the VA must be allowed access to the following Blue Coat server:

(16)

Log on to the CLI

You can log on to the CLI through an SSH connection, or through the VMware console.

For hardware appliances running Management Center, you can access the CLI over the serial console.

Log on using SSH

1. Install an SSH client. This procedure uses PuTTY as an example; your steps might be slightly different.

2. Open PuTTY and specify the following information:

l Host Name (or IP address)—The IP address that you specified for Management Center

l Port—22

3. (Optional) Specify a name for the connection and click Save to save the settings. 4. Click Open. The SSH window opens, with a login prompt.

5. At the login as: prompt, type admin and press Enter.

6. At the admin@IP_address's password: prompt, type your password and press Enter. The console displays the CLI banner.

Log on through the VMware console

Use the VMware console or SSH if you are logging into a Virtual Appliance.

1. In the VMware client, browse to

Management Center VM in the inventory.

2. Select the VM, right click, and select Open Console.

The console displays the CLI console and prompts you to press Enter three times. 3. Press Enter three times. The console displays the CLI banner.

Verify Web Console Access

After you install a new license or update an existing license, verify that you can access the web console. Refer to theManagement Center Release Notesfor a list of supported browsers.

1. Open a web browser.

2. In the address bar, enter the URL in one of the formats in the following table, and then press Enter:

l http://<IP_address>:8080 l https://<IP_address>:8082

where <IP_address> is the IP address you specified in the CLI. Note that you cannot change these port numbers.

The web browser displays the Management Center login screen.

(17)

Prevent Licensing Issues

To prevent licensing issues, ensure that the VA is allowed network access to the license validation server athttps://validation.es.bluecoat.com. SeeVerify Web Console Access.

If communication with the server fails, the license may be suspended. A constant internet connection is required for Management Center to communicate regularly with the license validation server to confirm that the serial number is valid.

Duplicate Serial Numbers

If the license validation server detects duplicate serial numbers, your license is invalidated and the license health status goes to a critical state. Verify your license inBCLPand contact Blue Coat Support if you continue to have problems.

Expiring Licenses

Management Center health goes into a Warning state when the license is 15 days from expiring. For example, if the license will expire on January 30th, the Messages option in the web console banner dis-plays Warning-level alerts, such as the following, starting on January 15th.

The web console banner displays an alert for each licensed component.

Once the license expires, Management Center goes into an Error state and remains in that state for another 15 days or until the license is updated (whichever occurs first). For example, starting on January 30th, the Messages option in the web console banner displays Warning-level alerts for each licensed com-ponent until the license is renewed.

(18)

Update the Management Center License

If you are running Management Center and you are unable to see some of the features as documented, the following has occurred:

The Management Centerlicensecontains all of the features for which you have purchased a subscription. As a result, not all features are visible to all users.

You can update your existing license from BTO, download the license from a web server or workstation, or install it manually. To upgrade your license to expose additional features, please contact Blue Coat Systems, Inc.

1. In the web console banner, click the Help icon (?).

2. In the drop-down list, select License. The web console displays the License dialog. 3. To view detailed license component information, select the License Components tab. 4. To determine how you will install the license, select the Install New License tab. See the

following sections for instructions.

5. After you complete the license installation, do one of the following:

l Run the CLI command # restart services. SeeRestart Services. l Log in to the CLI via an SSH connection.

l Power off the VA, and then power it back on.

6. Go to the Management Center web console in a web browser. If the web console loads, the license was installed successfully.

If the web console does not load, run the CLI command # license view to determine if the license was installed and is valid.

Install the license from BTO

You must install the license from BTO using the #license

get-from-bluecoatcommand at least once before you can install it from BTO using the web console.

1. Select Install from BTO.

2. Enter your BTO User ID and BTO Password. 3. Click Install License.

4. Click Refresh to display the updated license information in the License Components table.

Install from URL

Before you can install your license you must first get the license file (*.bin) and save it to a location on a web server or workstation that the VA can access.

1. Select Install from URL. The web console displays a text field. 2. Enter the location (a valid URL) of the license file into the field. 3. Click Install License.

4. Click Refresh to display the updated license information in the License Components table.

Paste license text from a text editor

(19)

Open the license file in a text editor (such as Notepad) and make sure you save the file. 1. Select Paste license text. The web console displays a text box.

2. Copy and paste the license from the text editor to the box. 3. Click Install License.

(20)

Restart Services

Restart the services after you install the license.

To troubleshoot some issues, you might need to restart Management Center services. For details about the CLI commands, refer to the Management Center CLI Reference Guide.

2. Enter privileged mode by typing enable at the command prompt. 3. Enter your enable password and press Enter.

4. At the # prompt, type restart services and press Enter. The CLI displays the command prompt.

You cannot access the web console while the services are restarting; however, you can try accessing the web console a few minutes after issuing the command.

Reset CLI Admin Password or Restore UI Default

Password

You can reset the password for the CLI (serial console). You can also restore the default password for the admin UI (web console).

To reset the password used to access the CLI for the admin account. use # security

reset-password. This command is only available through the serial console.

2. Enter privileged mode by typing enable at the command prompt. 3. Enter your enable password and press Enter.

4. At the # prompt, type restore-defaults reset-admin and press Enter. The CLI prompt displays the following:

This operation will restore admin password on UI to default. Management Center service will be unavailable during this operation.

Initial Configuration Guide