Initial configuration

This chapter contains information and instructions for configuring basic network settings for yourNDR appliance using the CLI.

Important
Trellix highly recommends using the CLI to modify your NDR appliance configuration settings. Trellix does not provide technical support for configuration changes made using the shell. (DOC-958)

Network information requirements

The table below provides the network information requirements.

Network Item

Information Needed

NDR Appliance

Cluster name - name for all of the appliances in the same location.
Hostname - unique name for each appliance.
Caution
Elasticsearch does not allow index names with uppercase characters. Cluster names, which are used to create index names, and hostnames must be lowercase when entered in KLISH.
IP address
Subnet mask
Default gateway address

Domain Name Service (DNS)

IP address of one or more DNS Servers

Network Time Protocol (NTP) Service

(Optional)

IP address of one or more NTP servers

IPMI

(Optional)

If you want to access the appliance remotely using the IPMI:

IPMI IP address
IPMI subnet mask
IPMI gateway address

Initial configuration procedure

After your Network Detection and Response appliance has been physically added to your network, you must configure the appliance settings during the first boot. For initial configuration, you need a USB keyboard and a monitor with a VGA connection to the appliance.

Connect the USB keyboard and monitor to the appliance.
Power up the appliance.
Press Enter to review the EULA.
Review the EULA and type q when you are finished. Accept the EULA:
```
Do you accept the FireEye End USer License Agreement?: accept
```
Press Enter.
Enter the hostname. The hostname must be different from the Cluster name, but will also be used as the Cluster node name. For example:
Hostname: cinnamon
Important
Elasticsearch does not allow index names with uppercase characters. Cluster names, which are used to create index names, and hostnames must be lowercase when entered in CLI.
If the NDR is a Data Node within a multi-box cluster:
Enter
```
y
```
.
If the NDR is a standalone appliance or a Master-Data Node within a multi-box cluster:
Enter n.
Enter the Cluster name. This must be different from the hostname. For example:
Cluster name: cinnamon-cluster
Press Enter.
You must change your npadmin, npscp, and IPMI passwords.
Important
The password must meet the following criteria:
- 8 characters minimum
- Contain at least 1 character from each of the following categories:
  Uppercase alphabet (A-Z)
  Lowercase alphabet (a-z)
  Numbers (0-9)
  Symbols (!,?, @, etc.)
Press any key to continue after you update all three passwords.
To customize your system, enter y. Continue below with Configuring Network Settings.

Configuring network settings

Reference the steps below to complete the initial configuration. If you press enter without providing a new value in any of the following steps, a default value shown inside brackets is used. IP addressed provided must be in valid dotted quad notation. DNS and NTP server addresses must be separated with spaces.

Enter the IP address type.
If the IP address is a static address, enter S.
If the IP address is a DHCP address, enter D.
Press Enter.
Enter the routable IP address for the appliance. Press Enter.
Enter the netmask address. Press Enter.
Press Enter when prompted Routable IPv6 Address? [ ]:.
Press Enter when prompted Prefix Length? [ ]:.
Enter the IPv4 address gateway. Press Enter.
Enter the DNS address. Press Enter.
Enter the search domain(s) if you will specify non-fully qualified NTP servers in the following step.
If you will not provide an NTP server in the following step, press Enter when prompted Search Domain(s) [ ]:.
Enter a local NTP server, if available. Otherwise, press Enter to accept the default option.
Enter the IPMI IP address (Optional) or press Enter to accept the default option.
Enter the IPMI Netmask (Optional) or press Enter to accept the default option.
Enter the IPMI Gateway Address (Optional) or press Enter to accept the default option.
To enable the Ether 1 interface, enter Y. The Ether 1 interface is used for internal communication between multi-box NDR clusters and single-box clusters in multi-director configurations.
Your current settings are displayed. Enter Y to save your configuration.
You see the following prompt:
Do you want to rebuild storage? [y/n]:
It is not required to rebuild storage. Capture data on storage disk drives will be erased if you enter y.
Enter n. Press Enter.

The NDR restarts.

Logging in

Log in with default admin username and the password you selected in the Initial Configuration Procedure.
hostname login: npadmin
password: <password>
Note
Do not be alarmed if you see the following message after logging in to the NDR appliance:
SYSTEM CRITICAL - One or more processes (ia-eve-route acm caseengine flowsummaryservice scheduledsearchservice userprofileservice) not running
The services take some time to come up. Ia-eve-route will not come up until a metadata source is configured. To confirm that services are running, wait a few minutes and then use the show status command to show the same output.
Enter privileged mode:
npadmin@hostname> enable
Enter the npadmin password.
Enter config mode:
configure system

You can now continue to set up the users, PX appliance communication, and other configuration settings for the NDR appliance.