traps deployment workshop installation activity

1、Lab 1, Activity 1: Configure ESM Server PrerequisitesBackground: Your employer wants to build out a very small test environment for Traps.Lab Objective: Configure components needed by the Endpoint Security Manager.Systems Used in This Activity:Server: Windows Server 2008 R2 Endpoint: Windows 7 (32-b

2、it) Endpoint: Windows 7 (64-bit)This activity contains nine tasks.Lab 1, Activity 1, Task 1: Read the Documentation/edu281installLab 1, Activity 1, Task 2: Configure Internet Information Services (IIS) on the ESM ServerIIS, the Windows-native web server, is a Windows Ser

3、ver role. Install it through the Server Manager dashboard.Ensure that you are logged in to the ESM system as Administrator.1.On the Windows Server, launch Server Manager from the Start menu:Start Administrative Tools Server Manager2.Select Roles Summary and click Add Roles:3.In the Add Roles window,

4、 click Next in the Before You Begin window to open the Select Server Roles window.In the Select Server Roles window, check the Web Server (IIS) check box and then click Next to open the Web Server (IIS) window:4.5.6.In the Web Server window, click Next to open the Select Role Services window. In the

5、 Select Role Services window:a. Select Application Development and enable the group by checking the check box.b. Select Performance and check the Static Content Compressions check box. (Note that it may already be enabled by default.)Leave the other check boxes at their default settings.Click Next a

6、nd then Install to install Internet Information Services - IIS. Click Next to open the Confirm Installation Selections window:0. In the Confirm Installation Selections window, verify that Application Development services are listed, and then click Install. If you receive a warning about the f

7、act that automatic updates are not configured, in this lab environment2 | 2016 Palo Alto Networks, Inc.you may disregard it. (In your own environment, configure IIS updates in accordance with your organizations policies.)11. In the Installation Results window, click Close to close the window. IIS is

8、 now installed with a default configuration for hosting ASP.NET on the Windows Server.12. Click Close to complete the process.13. Confirm that the Web Service is running and listening on port 80 by launching Chrome and browsing to localhost .2016 Palo Alto Networks, Inc. | 3Lab 1, Activity 1, Task 3

9、: Check for .NET 4.5.1 and SQL Server Express on the ESM Server SystemThe ESM Server software requires version 4.5.1 of the Microsoft .NET Framework. We will use Microsoft SQL Server Express Edition for our Traps database. Confirm that these packages are installed.Ensure that you are logged in to th

10、e ESM system as Administrator.Choose Start Control Panel Programs Programs and Features, and confirm the presence of Microsoft .NET Framework 4.5.1 and Microsoft SQL Server 2014:Lab 1 Activity 1 Task 4: Configure the Windows FirewallWe will configure the Windows firewall for Microsoft SQL Server and

11、 ESM Server operation. Ensure that you are logged in to the ESM system as Administrator.1. Launch the Windows Firewall management console component by entering wf.msc into the Start menus search box. Choose Windows Firewall from the search results.2. Confirm that the firewall is on in the active pro

12、file:3. Confirm that the “World Wide Web Services (HTTP Traffic-In)” and “World Wide Web Services (HTTPS Traffic-In)” rules are enabled, and that they allow inbound traffic to TCP ports 80 and 443, respectively.4. Scroll down in the center panel and click the Inbound Rules link to add several inboun

13、d firewall rules:4 | 2016 Palo Alto Networks, Inc.5. To add each rule, click the New Rule link in the right panel. Use the resulting wizard to add rules one by one. For each of the rules you create, choose the Specific local ports option and give a port shown in the preceding table. Choose Allow the

14、 connection for each rule (whether it is protected by IPSec or not). When prompted, apply the rules to all profiles: domain, private, and public.6. Close the Windows Firewall management component.Lab 1, Activity 1, Task 5: Configure SQL Server for ESM OperationWe will set up Microsoft SQL Server 201

15、4 Express Edition to support the Traps database. Ensure that you are logged in to the ESM system as Administrator.1.From the Start menu, choose Microsoft SQL Server 2014 Configuration Tools SQL Server 2014 Configuration Manager. Expand SQL Server Network Configuration to reveal Protocols for SQLEXPR

16、ESS. Right-click TCP/IP and click Enable.2.In the right panel, right-click TCP/IP and choose Properties. In the resulting Properties screens IP Addresses panel, scroll down to the IPAll section. Clear TCP Dynamic Ports and add 1433 to the TCP Ports field.Restart the SQL Server service to force these

17、 changes to take effect. In the left panel, choose SQL Server Services and then right-click SQL Server (SQLEXPRESS) and choose Restart:3.2016 Palo Alto Networks, Inc. | 5Rule typeProtocolPortRule nameWhy?PortTCP2125ESM ServerAllow connections to the ESM Server from endpointsPortTCP1433SQL ServerAllo

18、w connections to the database from the ESM Server4. Close SQL Server Configuration Manager.Lab 1, Activity 1, Task 6: Check That the Database User Is Correctly ConfiguredWe will configure the database to be owned by a role account called PANTRAPSDBUSER. Confirm that this user has the Logon as a serv

19、ice user right. Ensure that you are logged in to the ESM system as Administrator.1.At the Start menus search box, type Local Security Policy and launch the Local Security Policy control panel from the search results. In the left panel, expand Local Policies. Click User Rights Assignment. In the righ

20、t panel, right-click Log on as a service and choose Properties. Confirm that TRAPSDBUSER is listed:2.Close the Local Security Policy control panel.6 | 2016 Palo Alto Networks, Inc.Lab 1, Activity 1, Task 7: Create a Database for Traps on the ESM Server SystemNow we will build the database itself. En

21、sure that you are logged in to the ESM system as Administrator.1.From the Start menu, choose and launch Microsoft SQL Server Management Studio. Log in with Windows authentication and your Administrator credentials:2.Allow the Windows user PANTRAPSDBUSER to own databases. In the left pane, expand Sec

22、urity and right-click Logins. Choose New Login:2016 Palo Alto Networks, Inc. | 73.In the Login name field, enter PANTRAPSDBUSER, leave Windows authentication selected, and click OK.4.5.Repeat the above two steps for PANTRAPSADMIN.In the left pane, right-click Databases and choose New Database:6.Name

23、 the new database TRAPSDB. Use the “” button to assign its ownership to TRAPSDBUSER.8 | 2016 Palo Alto Networks, Inc.7. Click OK to save the database.Lab 1, Activity 1, Task 8: Grant Database-Owner Privilege to NT AUTHORITYSYSTEM and PANTRAPSADMINConfirm that you still are logged in to the ESM Serve

24、r system as Administrator, and that you are still in Microsoft SQL Server Management Studio.1.In the left panel, expand Security Logins, and double-click NT AUTHORITYSYSTEM. The Login Properties window opens at the right. In the left panel of that window, select User Mapping. In the right panel, che

25、ck the TRAPSDB check box. Then check the check box for db_owner in the panels lower portion.2.3.Repeat the above steps for PANTRAPSADMIN. Click OK to save your change.2016 Palo Alto Networks, Inc. | 9This task is required for NT AUTHORITYSYSTEM in our lab environment because the SQL Server database

26、is running inside the same system image as the ESM Server.Omit this task when SQL Server is running on a separate system (which is the more common configuration for production Traps deployments).Lab 1, Activity 1, Task 9: Get an SSL Certificate from Active Directory Certificate ServicesWe will now g

27、et an SSL certificate for the ESM system, signed by the domain certificate authority. (All computers joined to this domain after setup of the domain certificate authority will trust it, because its certificate will be included in their Trusted Root Certificate Authority store.) Confirm that you stil

28、l are logged in to the ESM Server system as Administrator.1.Launch the Microsoft Management Console (mmc). Press Ctrl-M to add a management snap-in, select the Certificates snap-in, and click Add. When prompted, direct the snap-in to manage certificates for the computer account (not a service accoun

29、t or your user account) on the local computer, and click Finish. Click OK to install the snap-in.After the Certificates (Local Computer) snap-in is installed, it will appear in mmcs left panel underneath Console Root. Expand Certificates (Local Computer) and then expand Personal to reveal Certificat

30、es. Right-click in the middle panel and choose All Tasks Request New Certificate. The Certificate Enrollment wizard appears.The first screen in the wizard offers the choice to accept the certificate enrollment policy already configured (the default) or to create a new certificate enrollment policy.

31、Click Next to accept the default.The next screen displays the types of certificates that are available. Check the check box for the Computer certificate type. Expand the details. Confirm that the certificate type offers both the Digital signature and Key encipherment uses, and both the Client Authen

32、tication and Server Authentication application policies..6.Click Properties to begin the process of requesting a new certificate.In the resulting Certificate Properties windows General tab, enter ESMCert into the Friendly name field. In the Private Key tab, expand Key options. Confirm that th

33、e key size is 2048. Check the check box for Make private key exportable.10 | 2016 Palo Alto Networks, Inc.7.8.Now click OK in the Certificate Properties window.Youll return to the Certificate Enrollment window. Click Enroll. The new certificate is enrolled. Click Finish.The newly created certificate

34、 will be listed under Certificates (Local Computer) Personal Certificates; you can recognize it by its Friendly Name value of ESM_Cert.9.10. Right-click the certificate and choose All Tasks Export. In the resulting Certificate Export Wizard, click the box for Yes, export the private key, then click

35、Next.11. In the Export File Format screen, choose Personal Information Exchange PKCS #12 (.PFX) and select the check box for Export all extended properties. Click Next.12. In the Security screen, click the check box to define a password to protect the private key. Enter TrapsPriv as the password. Cl

36、ick Next.13. In the File to export screen, choose a save location and filename for the exported certificate using the Browse button. Be sure to choose a file of type .PFX in a convenient location, such as your desktop. Click Save, then Next. Allow the wizard to run to completion, then exit mmc. Ther

37、e is no need to save the mmc console you created2016 Palo Alto Networks, Inc. | 11Lab 1, Activity 2: Install Traps ComponentsBackground: Your company wants to build out a small test environment for Traps.Lab Objective: Install version 3.3.3 of the Endpoint Security Manager (ESM) Server, ESM Console,

38、 and the Traps endpoints.Systems Used in This Activity:Server: Windows Server 2008 R2 Endpoint: Windows 7 (32-bit) Endpoint: Windows 7 (64-bit)Lab Files: Ask your instructor for the location of the Traps 3.3.3 installler binaries.This activity contains five tasks.Lab 1, Activity 2, Task 1: Install t

39、he ESM ServerLog in to the ESM Server system as trapsadmin.1.2.Copy the ESM Core 3.3.3 installer to the desktop.To install the ESM Server components, use the msiexec command with these switches and parameters:msiexec /i /L*v For example:C:Userstrapsadmin msiexec /i DesktopESMCore_x64_3.3.3. 11013.ms

40、i /L*v .core-install.log3.Supply the following parameters to the ESM Server core installer:12 | 2016 Palo Alto Networks, Inc.ChoiceValueInstallation pathAccept the defaultDatabase typeSelect SQL Server 2014Server nameesmserver.pan.aepDatabaseTRAPSDBDatabase authentication typeSelect WindowsDatabase

41、userPANTRAPSDBUSERDatabase passwordPassword1!Use SSL?YesPath to external certificatePath to the .pfx file you created previouslyLab 1, Activity 2, Task 2: Install the ESM ConsoleEnsure that you are logged in to the ESM system as trapsadmin.1.Copy the ESM Console 3.3.3 installer from the SharedInstal

42、lers folder to the desktop.To install the ESM Console components, use the msiexec command with these flags and parameters:msiexec /i console-installer-path /L*v For example:C:Userstrapsadmin msiexec /i DesktopESMConsole_x64_3.3.3. 11013.msi /L*v .console-install.logSupply these parameters to the ESM

43、 Console installer:2.3.2016 Palo Alto Networks, Inc. | 13ChoiceValueInstallation pathAccept the defaultDatabase typeSelect SQL Server 2014DatabaseTRAPSDBDatabase authentication typeSelect WindowsDatabase userPANTRAPSDBUSERDatabase passwordPassword1!Forensic folderdefaultIf the database validation st

44、ep fails, confirm that you correctly completed the prerequisite steps in the previous activity. Also confirm that you typed the database authentication information correctly. Finally, if you created more than one database instance in your SQL Server installation, you may need to explicitly point to

45、the correct instance, by supplying (for example) SQLEXPRESSTRAPSDB rather than TRAPSDB as the database name.External certificate requires a passwordYesPasswordTrapsPrivAdmin user authentication typeSelect DomainAdmin usertrapsadminPort2125Uninstall passwordPassword1!License fileAsk your instructor f

46、or the pathLab 1, Activity 2, Task 3: Delete Desktop Shortcut to ESM Console; Set Browser Home PageIn a production environment, you usually will use the ESM Console via a web browser from any computer you find convenient. For an ESM Console installation on a server named esmserver.pan.aep, you will

47、navigate to eitherhttps:/esmserver.pan.aep/EndpointSecurityManager/orhttp:/esmserver.pan.aep/EndpointSecurityManager/depending on whether the installation of Traps is SSL-based.Installation of ESM Console also creates a desktop shortcut on the local system. In current versions of Traps, this shortcu

48、t works only if the installation is non-SSL based. We will delete this shortcut, and set our browsers home page to the ESM Console for convenience instead.Ensure that you are logged in to the ESM system as trapsadmin.1.2.Right-click the desktop icon for ESM Consoleand delete it.Launch the Google Chr

49、ome browser. From its context menu Settings.choose3.In the resulting screens On startup section, click the radio button for Open a specific page or set of pages. The click the Set pages link.In the Add a new page field, typehttps:/esmserver.pan.aep/EndpointSecurityManager/Be sure to include https at

50、 the beginning of the URL, and use the servers fully qualified domain name esmserver.pan.aepClick OK.Exit and relaunch Google Chrome. Your browser will present the ESM Consoles login screen.4 | 2016 Palo Alto Networks, Inc.Use SSL?YesPath to external certificatePath to the .pfx file you creat

51、ed previouslyExternal certificate requires a passwordYesPasswordTrapsPrivLab 1, Activity 2, Task 4: Install the 32-Bit Agent (Version 3.3.3) on the x86 EndpointLog in to WIN07-32 as trapsadmin.1.Copy the 32-bit Traps endpoint agent 3.3.3 installer from the SharedInstallers folder to the desktop.To i

52、nstall the Traps endpoint agent, use the msiexec command with these flags and parameters:msiexec /i /L*v For example:C:Userstrapsadmin msiexec /i DesktopTraps_x86_3.3.3. 11013.msi /L*v .console-install.logSupply these parameters to the Traps endpoint agent installer:2.3.4.When the installation is co

53、mplete, right-click the tray icon for Traps (the small shield) and choose Console to open its console.Confirm that the Traps console says, Advanced Endpoint Protection is Enabled.5.Lab 1, Activity 2, Task 5: Install the 64-Bit Agent (Version 3.3.3) on the x64 EndpointLog in to WIN07-64 as trapsadmin.1. Co