Version 3.1 SP2 Reference Guide - Extreme Networks

Managing Network Securityto selected functions for some users, so they can monitor the network but not make any configurationchanges, while allowing other users to make changes to device configurations, policy settings, and soon.By default, Ridgeline communicates with devices for configuration changes using Telnet and TFTP. Youcan optionally configure Ridgeline to use Secure Telnet (SSH) and Secure FTP to execute configurationcommands and to upload and download configuration files on your Extreme Networks switches.Finally, you can secure the communication between Ridgeline clients and the Ridgeline server itself byusing SSH (HTTPS) instead of the standard HTTP protocol, which is the default.Using the Network Security ManagerRidgeline’s Network Security Manager identifies security violations in the network, finds the applicableinformation about the malicious user from the Identity Manager; and carries out the required protectiveactions. Identity management displays the interface that displays threat icons that alert the networkadministrator of a threat and provides threat information. Currently, Ridgeline uses McAfee NetworkSecurity Manager platform to handle threat traps.Network Security Manager RequirementsTo use this feature, a switch must be managed by Ridgeline and must be chosen for the Security FeaturePack license, which is part of the Identity Management Role-based license.Ridgeline’s Network Security Manager requires its Identity Management feature to:●●●●●●●●Provide the switch IP address to Ridgeline’s Network Security Manager that uses it to perform aswitch eligibility check.Add an icon to the Identity Management users’ table that shows the affected user.Performs the predefined actions based on the Threat type.Display detailed information about the threat.Display the top ten identities correlated to threats received from network security managers (NSMs).Clear a threat from the Identity Management users’ table.Undo protection of an identity—raises a new threat cleared alarm.Correlate security events, threats, and information received from network service providers (NSPs) toidentities and display them in the Identity Management table.Threat Types and Corresponding Pre-defined AlarmsRidgeline has pre-defined alarms that support the following traps:Trap NamePre-defined Ridgeline AlarmsivSignatureAlert • Exploit attack• DoS attack• Reconnaissance attack• Policy violation - based on the value of the VARBIND ivAlertCategoryivPortScanAlertPort scan alertivHostSweepAlertHost sweep alert584Ridgeline Reference Guide