SG810 Installation Guide (SGOS 5.2.x)

8/9/2019 SG810 Installation Guide (SGOS 5.2.x)

1/110

Blue CoatSystems

SG810 Series

Installation Guide

Version: SGOS 5.2.x


2/110

P/N 231-02941 SG810 Installation Guide page ii

Contact Information

Blue Coat Systems Inc.420 North Mary Ave

Sunnyvale, CA 94085-4121

http://www.bluecoat.com/support/contact.html

[email protected]

http://www.bluecoat.com

For concerns or feedback about the documentation:[email protected]

Note This equipment has been tested and found to comply with the limits for a Class A Digital device pursuant toPart 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interferencewhen the equipment is operated in a commercial environment. This equipment generates, uses, and can radiate radiofrequency energy, and if not installed and used in accordance with the instruction manual, might cause harmfulinterference to radio communications. Operation of this equipment in a residential area is likely to cause harmfulinterference in which case the users are required to correct the interference at their own expense.

Copyright 1999-2008 Blue Coat Systems, Inc. All rights reserved worldwide. No part of thisdocument may be reproduced by any means nor modified, decompiled, disassembled, published ordistributed, in whole or in part, or translated to any electronic medium or other means without thewritten consent of Blue Coat Systems, Inc. All right, title and interest in and to the Software anddocumentation are and shall remain the exclusive property of Blue Coat Systems, Inc. and its licensors.ProxyAV, CacheOS, SGOS, SG, Spyware Interceptor, Scope, RA Connector,RA Manager, Remote Access and MACH5 are trademarks of Blue Coat Systems, Inc. andCacheFlow, Blue Coat, Accelerating The Internet, ProxySG, WinProxy, AccessNow, Ositis,

Powering Internet Management, The Ultimate Internet Sharing Solution, Cerberian, Permeo,Permeo Technologies, Inc., and the Cerberian and Permeo logos are registered trademarks of BlueCoat Systems, Inc. All other trademarks contained in this document and in the Software are theproperty of their respective owners.

BLUE COAT SYSTEMS, INC. DISCLAIMS ALL WARRANTIES, CONDITIONS OR OTHER TERMS,EXPRESS OR IMPLIED, STATUTORY OR OTHERWISE, ON SOFTWARE AND DOCUMENTATIONFURNISHED HEREUNDER INCLUDING WITHOUT LIMITATION THE WARRANTIES OFDESIGN, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE ANDNONINFRINGEMENT. IN NO EVENT SHALL BLUE COAT SYSTEMS, INC., ITS SUPPLIERS OR

ITS LICENSORS BE LIABLE FOR ANY DAMAGES, WHETHER ARISING IN TORT, CONTRACT ORANY OTHER LEGAL THEORY EVEN IF BLUE COAT SYSTEMS, INC. HAS BEEN ADVISED OFTHE POSSIBILITY OF SUCH DAMAGES.

Document Number: 231-02941

Document Revision: B.0
http://www.bluecoat.com/support/contact.htmlmailto:[email protected]://www.bluecoat.com/mailto:[email protected]:[email protected]://www.bluecoat.com/mailto:[email protected]://www.bluecoat.com/support/contact.html


3/110

P/N 231-02941 SG810 Installation Guide page iii

Contents

Chapter 1: The SG810 Series

Unpacking an SG810 ................................................................................................ 7

SG810 Front Panel Features..................................................................................... 8

SG810 Back Panel Features ...................................................................................... 9

Mounting the SG810 in an Equipment Rack....................................................... 10Rack Mounting Notes.......................................................................................... 10

Attaching the Cable Management Support......................................................... 11

Installing the Disk Drives ...................................................................................... 12

Connecting the Cables............................................................................................ 16

Powering On the SG810 ......................................................................................... 16

Chapter 2: Configure an SG810

Overview of First-Time Configuration................................................................ 20

Section A: Initial Configuration Using the Front Panel

LCD Behavior ....................................................................................................... 23

System LCD and Modes...................................................................................... 24SG810 Control Buttons ........................................................................................ 26

Using the Front Panel to Configure Basic Network Settings......................... 27

Section B: Initial Configuration Using the Web Setup Wizard

Requirements........................................................................................................... 30

Section C: Initial Configuration Using a Serial ConsoleSection D: Configuring the SG810 Using Director Registration

Section E: Logging in to the SG810

Logging in to the SG810 Management Console .............................................. 53

Logging in to the SG810 CLI .............................................................................. 55


4/110

P/N 231-02814 SG810 Installation Guide page iv

Section F: Configuring a Front-Panel PIN

Section G: Configuring the Front-Panel LCD Behavior

Chapter 3: Hot-Swapping or Installing Disk Drives

Taking a Disk Offline.............................................................................................. 62

Removing a Disk Drive.......................................................................................... 64

Installing a New Disk Drive.................................................................................. 66Setting the Default Boot System......................................................................... 67

Chapter 4: Next Steps

Chapter 5: Troubleshooting

The SG810 Does Not Come Back Up After Rebooting ...................................... 73

The Disk Drive LED Has A Solid Amber Light.................................................. 74

The SG810 Does Not Power On ............................................................................ 74Testing the SG810.................................................................................................... 75

CLI Session Times Out ........................................................................................... 75

CLI Limited to 16 Sessions..................................................................................... 75

Cannot Access the Serial Console......................................................................... 75

Cannot Access the Management Console ........................................................... 76The SG810 Certificate is no Longer Valid ........................................................... 76

A Security Warning Appears for the Initial Configuration Web Page ........... 77

The Web Setup Wizard Page is Not Accessible.................................................. 77

Resetting the SG810 to Factory Defaults.............................................................. 78

The SG810 Cannot Connect to the Director ........................................................ 80

Connection Request Rejected by the Director..................................................... 81

Appendix A: Specifications

General Specifications ............................................................................................ 83

Environmental Specifications................................................................................ 84


5/110

P/N 231-02941 SG810 Installation Guide page v

Appendix B: Regulatory Statements

General System Cautions....................................................................................... 85

Rack-Mounting Notes ......................................................................................... 85Power Cord Cautions ............................................................................................. 86

Class A Digital Warning ........................................................................................ 86

Advertencia Digital Clase A.................................................................................. 87

EC Community EMC Warning............................................................................. 87

Advertencia EMC de la Comunidad EC ............................................................. 87Canadian EC EMC Warning ................................................................................. 87

Australia/New Zealand EC EMC Warning........................................................ 87

Taiwan BSMI Notification ..................................................................................... 87

Japan VCCI EMC Notification .............................................................................. 88

Battery Warning Notification................................................................................ 88Chinese Battery Warning Notification................................................................. 89

China CCC Notification......................................................................................... 89

Lasers ........................................................................................................................ 89

Declaration of Conformity..................................................................................... 93

Appendix C: Apndice C: Declaraciones Regulatorias

Precauciones generales del sistema...................................................................... 95

Conexin del cable de alimentacin..................................................................... 95

Lasers ........................................................................................................................ 96

Appendix D: Anhang D: Regulierende Anweisungen

Allgemeine Systemvorsichtsmassnahmen.......................................................... 97

Anschliessen des Stromkabels .............................................................................. 97

Lasers ........................................................................................................................ 98


6/110

P/N 231-02814 SG810 Installation Guide page vi

Appendix E: Simplified Chinese Regulatory Statements

Appendix F: Traditional Chinese Regulatory Statements

Index


7/110

P/N 231-02941 SG810 Installation Guide page 7

Chapter 1: The SG810 Series

This installation guideprovides general instructions for installing, configuring, andusing the Blue Coat SG810.

This chapterexplains how to unpack the SG810, install it in an equipment rack,insert the disk drives, connect the cables, and power on.

Important: Follow all warnings and instructions marked on the product andincluded in this manual.

Unpacking an SG810

When you receive and unpack the SG810, verify that the package contains thefollowing items:

Blue Coat SG810 Series Appliance AC Power cord Quick Start Guide Disk drives and/or disk drive spacers (up

to three) Null-modem serial cable Cable Management Support

License, Warranty, and Safety information


8/110


SG810 Front Panel Features

The figure below shows the front of an SG810.

Figure 1-1: The Front of an SG810

The SG810 front panel has the following features: An LCD and six control buttons to monitor activity and configure basic

networking settings.

Power and Disk Drive LEDs.

A front panel that pivots downward and pulls outward giving you access toup to four disk drives.

Mounting brackets that extend from each end of the chassis to secure theSG810 to an equipment rack.

You can mount an SG810 in a standard mounting rack. See Mounting the SG810 inan Equipment Rackon page 10for rack mounting instructions.

Power and Disk

Drive LEDs

Control

buttonsLCDPlates that attach

to the front of the

equipment rack

Front

panel


9/110


10/110


Mounting the SG810 in an Equipment Rack

The SG810 is designed to fit into a standard telco-style or four-post cabinet style

equipment rack.The SG810 ships with the rack-mounting ears installed.

Rack Mounting Notes

Read the following notes before rack-mounting the SG810:

A Elevated Operating AmbientIf installed in a closed or multi-unit rackassembly, the operating ambient temperature of the rack environment may begreater than room ambient. Therefore, consideration should be given toinstalling the equipment in an environment compatible with the maximumambient temperature (Tmax) specified by the manufacturer.

B Reduced Air FlowInstallation of the equipment in a rack should be suchthat the amount of air flow required for safe operation of the equipment is not

compromised.C Mechanical LoadingMounting of the equipment in the rack should be such

that a hazardous condition is not achieved due to uneven mechanical loading.

D Circuit OverloadingConsideration should be given to the connection of theequipment to the supply circuit and the effect that overloading of the circuitsmight have on overcurrent protection and supply wiring. Appropriate

consideration of equipment nameplate ratings should be used whenaddressing this concern.

E Reliable Earthing Reliable earthing of rack-mounted equipment should bemaintained. Particular attention should be given to supply connections otherthan direct connections to the branch circuit (for example, use of powerstrips).


11/110


To attach the SG810 to the equipment mounting rack:

1 Position the SG810 into the equipment rack so that the ears of the brackets

align with the holes in the front of the rack.2 Use equipment-rack screws to mount the SG810 to the equipment rack.

Figure 1-3shows an SG810 flush-mounted on a Telco equipment rack.

Figure 1-3: SG810 Attached to a Telco Equipment Rack

Attaching the Cable Management Support

The cable management support routes network and serial cables to avoidtangling.

Fasten the cable management support to the back of the system as follows:

1 Position the cable management support at the back of the system on the right;secure it with a 6-32 x 1/4 Phillips head screw at the side.

Figure 1-4: Attach the Cable Management Support

When you attach cables to the system, run them through this clip to keepthem from tangling.

Useequipment-rack

screws to attach to

the SG810 to the

rack

Attach the cable

management support with a

Phillips head screw
http://-/?-http://-/?-


12/110


Installing the Disk Drives

The following instructions are for a first-time installation of the disk drives that

are shipped with the SG810.

Note: For instructions about hot-swapping disk-drives (replacing withoutpowering off the unit) see Hot-Swapping or Installing Disk Drivesonpage 61.

Figure 1-5: Disk-Drive Carriers Installed

Important: Disk drives come inside a disk-drive carrier. Four disk-drivecarriers ship with the SG810; if you ordered fewer than four diskdrives, the appliance will ship with one or more blank, disk-drivespacers already installed.

Drive Slot 3Drive Slot 1 Drive Slot 2 Drive Slot 4


13/110


1 Press the push tabs on each side of the front-panel bezel to release the lockedposition of the front panel. Pull the front panel forward and down.

Figure 1-6: Access the Disk Drive Slots

If other equipment blocks the front panel from opening all the way, you canpull the front panel forward, sliding out the front-panel tray until you canaccess the disk drives.


Press the push

tabs on each side

of the front-panel

bezel

The front panel

swings forward

and down

Pull out the front-panel tray, if necessary, to access the disk drives


14/110


2 Position the disk-drive carrier upright, so that the disk-drive button appearson the right; press this button to release the disk-drive lever.

Note: When the disk drive in properly positioned for insertion, the disk drivelever is on the left.

Figure 1-8: Release the Disk-Drive Lever

3 Use the lever to slide the disk-drive carrier into the first open slot (Slot 1 onthe far left).

Figure 1-9: Insert the Disk-Drive Carrier

Important: Always insert disk drives from left to right. If you haveonly one disk drive, install it into drive Slot 1 on the farleft.

Press the

disk-drive

button

The disk-drive lever

is released


15/110


4 When the disk-drive carrier meets the SG810 frame, firmly press the edges ofthe disk drive carrier into the drive slot. Then, push the lever in towards thebutton until the handle latches on the button SG810, seating the drive firmlyin place.

Note: To remove a disk drive, press the button on the right side of thedisk-drive carrier to release the lever. Pull the lever towards you toslide the carrier out of the slot.

5 Repeat steps 2 to 4 to install the number of disk drives you purchased in driveslots 2 through 4.

Important: Before you move or transport an SG810 chassis, you must

remove all the disk drives from the system. Package the drivesseparately in ESD protective materials and place them back intothe accessory kit or equivalent packaging to prevent damage. Ifyou do not follow this guideline, hard drive failure might occur.


16/110


Connecting the Cables

Connect the network cables, serial cable, and AC power cord.

Figure 1-10: Connect the Cables to the Back of the System

1 Plug the network cable into adapter 0. Plug a second cable into the otheradapter if desired.

The two full-duplex, auto-sensing Ethernet network adapters supporting10/100/1000 Base-T connections are labeled 0 and 1.

2 Plug the serial cable into the serial connector, if necessary.

If you attach the serial cable, you can connect the system to a PC, serialterminal, or stand-alone Serial Console box.

3 Plug the enclosed power cord into the power cord receptacle on the back of

the appliance.

Powering On the SG810

1 After you have connected the power cord to the rear of the system, plug theother end of the power cord into a power receptacle.

2 Verify that the system has powered on successfully. See the four system states

described below and the corresponding states of the Power LED.

Power LED

No color: the SG810 is powered off or non-functional

Solid Amber: the SG810 is powered on but unable to perform tasks (forexample, while booting up)

Flashing Green to Amber: the SG810 is powered on but is not configured

Ethernet adapterports (Ports 0 and 1)

Serial portAC Power


17/110


Green: the SG810 is powered on and at least minimally configured

3 The steps below show a typical, first-time, start-up sequence.

The Power LED lights up and the LCD becomes green and displays thename Blue Coat.

The Power LED starts of solid amber and then begins flashing green andamber.

After a moment, the disk drive LEDs corresponding to the disk drivesthat are installed light up. The LCD displays IP address not configured(if afirst-time configuration has not been done) or it cycles between CPUutilization and the hostname.

Figure 1-11: Verify Successful Power On

The SG810 comes with all software installed. To configure an SG810 for the firsttime go to Configure an SG810on page 19.

LCD

Disk Drive

LEDs (4)Power

LED


18/110



19/110


Chapter 2: Configure an SG810

You need to configure an SG810 the first time you power it on to set the basicnetwork parameters and to make sure that the SG810 hardware and software areworking properly.

The initial configuration might be done either using a standalone PC, a serialterminal, or after placing the SG810 into your network. The placement of theSG810 depends on the flow of traffic within your organization. The SG810 must

be able to intercept initial packets on each client or application connection thatneeds to be optimized. Typical deployments include:

Explicit proxy configuration where the client browser is explicitlyconfigured to use a proxy server. The browser is given the IP address and portnumber of the SG810.You may also configure the browser to download the proxy settings from aWeb server. This is called a Proxy Auto-Configuration (PAC) file.

Transparent proxy where the client browser does not know that the trafficis being processed by a machine other than the Origin Content Server. Toenable the SG810 to intercept traffic sent to it, you must create a service anddefine it as transparent. The service is configured to intercept traffic for aspecified port, or for all IP addresses on that port. Traffic redirection ismanaged through polices you create on the redirection device.

A transparent HTTP proxy, for example, typically intercepts all traffic on port80 (all IP addresses). To make sure that the appropriate traffic is directed tothe SG810, deploy hardware such as a Layer-4 switch or a WCCP router, oruse the SG810 appliances software bridge to redirect selected traffic to theappliance.

The following procedure describes a a typical scenario for placing the SG810 intoyour networkplacing the SG810 between the LAN and a router or firewall

connected to the WAN. Use this procedure under the following circumstances: You have already completed an initial configuration on the SG810 using the

front-panel setup.

You are going to complete an initial configuration on the SG810 using a directserial port connection, Web Setup Wizard, or Director Registration.


20/110


To place the SG810 into the network:

1 Connect the SG810 to the WANconnect one end of an Ethernet cable

(straight or crossover depending on your network topology) to one of theSG810s Ethernet ports (either one). Connect the other end to the router orfirewall connected to the WAN.

2 Connect the SG810 to the LANconnect one end of an Ethernet cable(straight or crossover depending on your network topology) into the otherEthernet port on the SG810. Connect the other end to the LAN (such as a PCor a hub).

3 Verify that the network link is established by checking the networkconnection LEDs at the back of the SG810. If the network connection isfunctioning, the left-hand LED on each connection glows green.

The cabling and connections specific to the deployment of the SG810 are notwithin the scope of this book. Consult with your network administrator forguidance on deploying the SG810 within your organization and refer to the Blue

Coat ProxySG Configuration and Management Guide.Overview of First-Time Configuration

While performing the first-time configuration, you must assign an IP address,subnet mask, and IP gateway for the SG810. These parameters must be assignedthrough the serial console or the front panel.

You can select among four options to configure your SG810. Each of these

methods allows you make the basic network settings required to test theconnection and functionality.


21/110


Table 2.1: Configuration methods

Configuration

MethodDescription

Front Panel Use the front-panel LCD and buttons.(This is the quickest and easiest way to do a first-time configuration.)In addition to manually configuring the basic settings, you can usethe front panel to configure access to the Web Setup Wizard or toregister with the Director.To use the option card Ethernet ports instead of the onboardEthernet ports, you must use the serial console set up to specify an IP

address for adapter 2. You cannot specify an IP address for adapter 2from the front panel.To use the front panel method, go to Section A: InitialConfiguration Using the Front Panel on page 23.

Serial SetupConsole

Use a direct connection between the system and a PC, or a serialterminal, or a stand-alone serial console terminal.Use this option of you would like to configure the option cardEthernet ports instead of the onboard Ethernet ports.

To use the serial console connection, go to Section C: InitialConfiguration Using a Serial Console on page 34.

Web Setup Wizard Use a Web browser. Before youuse this method, you must firstconfigure the IP address of the SG810 using the serial console orfront panel. Blue Coat recommends using the Web browserconfiguration method if you need to immediately configure trafficinterception or ADN settings.

To use the Web browser configuration method, go to Section B:Initial Configuration Using the Web Setup Wizard on page 30.

DirectorRegistration

To use this method you might: Use a direct serial port connection between the SG810 and a PC. Open a terminal emulator, such as HyperTerminal. Use the front panel buttons.You can use this method if you have a Blue Coat 510 Director. The

Director allows you to configure an SG appliance and automaticallyregister it with the Director.

To use the Director Registration method, go to Section D:Configuring the SG810 Using Director Registration on page 48.


22/110


After you complete the first-time configuration, you must log on to the systemand use the command-line interface (CLI) or the Management Console graphicaluser interface to fully configure the system. See Section E: Logging in to the

SG810 on page 53for more information.Refer to the Blue Coat ProxySG Configuration and Management Guideforinformation on how to fully configure the software. Download this manual fromthe Blue Coat WebPower site at: http://www.bluecoat.com/support/manuals

You must have a WebPower account to access the documentation. To obtain aWebPower account go to http://www.bluecoat.com/support/webpower
http://www.bluecoat.com/


23/110


Section A: Initial Configuration Using the Front Panel

You can configure an SG810 the first time you power it on using the front panelLCD and control buttons.Using the front panel you can:

manually configure the basic settings.

configure access to the Web setup wizard, and continue further configurationusing the Web browser.

register the SG810 with the Director. You might then push the configurationspre-staged on the Director to the SG810.

Figure 2-1: Front Panel LCD and Control Buttons

Use the LCD and the buttons to monitor the system and to set the basicnetworking parameters.

LCD Behavior

The front-panel LCD dims after 30 seconds. Press any button to illuminate it. The

front-panel LCD behavior is configurable; see Configuring the Front-Panel LCDBehavioron page 59for information.

Menu

button

LCD

Enterbutton

Arrow buttons


24/110


25/110


Edit Mode From Configuration mode, use the Upor Downarrow buttonuntil the parameter you want to configure is displayed,then press the Enterbutton to go to Edit mode for thatparameter (for a first-time configuration, you must beginwith the first displayed parameterIP address).

To configure the parameter, use the Leftand Rightarrowbuttons to position the cursor over a character you want tochange, then use theUpand Downarrow buttons to cyclethrough the characters. When the entire parameter isconfigured correctly, press the Enterbutton to save thesetting and return to Configuration mode.

Important: The system automatically exits Edit mode,without saving parameter configurations, ifno activity is detected for 20 seconds.

In Edit mode, the cursor is a blinking box in the LCD.


26/110


SG810 Control Buttons

Use the control buttons in conjunction with the modes as follows:

Enter Button The Enterbutton functions as follows:

Status mode:When you push the Enterbutton inStatus mode, the system enters Configuration mode.In Configuration mode, one of the six configurableparameters displays in the LCD (starting with IPaddress).

Configuration mode:When you push the Enterbutton in Configuration mode, the system enters Editmode for the parameter displayed.

Edit mode:When you push the Enterbutton in Editmode, the system saves any changes you made to theparameter displayed and returns to Configurationmode.

Menu Button The Menubutton functions like an Escape key. Whenyou push the Menubutton in Edit mode, the systemreturns to Configuration mode, cancelling any changesyou made to the displayed parameter.

When you push the Menubutton in Configurationmode, the system returns to Status mode. Anychanges you made while in Edit mode have alreadybeen saved, and are not affected when you push theMenubutton in Configuration mode.

Left and Right Arrow

ButtonsWhen you push the Leftand Rightarrow buttons inEdit mode, the cursor moves back and forth over theconfigurable settings of the parameter displayed.


27/110


Using the Front Panel to Configure Basic Network SettingsUse the front panel to do a quick first-time configuration of the followingnetworking parameters on Adapter 0:

Important: A default username (admin) is already set on the SG810. A

unique console and enable password are generatedautomatically. You can configure the passwords now, or write

down the auto-generated passwords and use them to log in,changing them later. The enable password is not required if youlog in using a browser.

1 When the LCD displays IP address not configured, press Enterto enterConfigure mode.

2 Select your preference Manual setup, Web wizard, Register with Director.

The IP address parameter appears in the LCD, and the cursor appears as anunderscore.

3 Press Enteragain to enter Edit mode.

The cursor changes to a blinking box.

Up and Down Arrow

ButtonsWhen you push the Upand Downarrow buttons inConfiguration mode, the system cycles through thesix configurable parameters.

When you push the Upand Downarrow buttons inEdit mode, the system cycles through the charactersavailable for the selected setting of the parameter (theselected setting is the character that the cursor is overwhen you push the arrow buttons).

IP address Subnet mask

Gateway address DNS address

Console password Enable password


28/110


4 Press the Leftor Rightarrow to position the cursor over the characters youwant to change; press the Upor Downarrow to change them.

5 When you have entered the characters of the parameter, press Enterto savethe changes and return to Configure mode.

6 Press the Downarrow to move to the next parameter; press Enterto enter Editmode.

7 Repeat Steps 3 through 5 for assigning the parameters. Your preference inStep 2 above triggers the sequence of parameters for which you provide

values.

Note: If you had selected the Web wizard, you are directed to use the Webbrowser for the rest of the configuration, see Section B: InitialConfiguration Using the Web Setup Wizard on page 30.

If you had selected Director registration, see Section D: Configuringthe SG810 Using Director Registration on page 48.

If you had selected Manual setup, continue with the instructionsbelow.

1 When the LCD reads, Console password: Push to set, Press Enterto enterEdit mode and complete one of the following steps:

To configure the password later (after you log in), write down theauto-generated password and press the Enterbutton to return toConfigure mode.

To configure the password now, follow steps 4 and 5 above.

2 Push the Downarrow to move to the enable password parameter; repeat steps4 and 5 above to set the enable password.

Do not push Enteragain, or a new auto-generated enable password will becreated (if that happens, repeat step 4 and 5).

3 Push the Downarrow to move to the secure serial port parameter.


29/110


If you select Yesto secure the serial port, you must provide the administrativeusername/password when accessing the serial console and the setuppassword when accessing the setup console.

To restrict access to the front panel, configure the front panel PIN from theCLI after initial setup is complete (see Configuring a Front-Panel PINonpage 58).

4 Select the trial edition license that you purchased Proxy or MACH5. If youleave the Noneoption selected, an Invalid trial editionerror message isdisplayed.

5 Press the Menubutton to return to Status mode.

Initial network configuration is now complete. The LCD cycles between CPUUtilization and Freshness statistics.


30/110


Section B: Initial Configuration Using the Web SetupWizard

This section describes how to configure the SG810 with a Web browser.

Requirements

To configure your SG810 using a browser, you must meet the followingrequirements.

The browser must support Javascript and Javascript must be enabled.

The browser must not be proxied. For information about proxied browsers,see The Web Setup Wizard Page is Not Accessibleon page 73.

Your SG810 must not already be configured.

Note: If the SG810 has already been configured, you cannot access the Webwizard unless you reset the SG810 to factory defaults as described inResetting the SG510 to Factory Defaultson page 77.

You must configure the SG810 IP address, subnet mask, gateway, using thefront panel or the serial console before accessing the Setup Wizard throughthe Web browser.

To configure the SG810using the Web Setup Wizard:

1 Connect the SG810 to a PC or place it within your network, and configure an

IP address, subnet mask, and IP gateway using the serial console or the frontpanel buttons. See Overview of First-Time Configurationon page 20.

2 Enter the following URLs into your browser:https://proxysg_IP:8083/

where,proxysg_IPis the IP address you configured for this SG810 using thefront panel or the serial console.
http://../SG510/SG510%20Installation%20Guide/BC_510_ch05.pdfhttp://../SG510/SG510%20Installation%20Guide/BC_510_ch05.pdfhttp://../SG510/SG510%20Installation%20Guide/BC_510_ch05.pdfhttp://../SG510/SG510%20Installation%20Guide/BC_510_ch05.pdfhttp://../SG510/SG510%20Installation%20Guide/BC_510_ch05.pdfhttp://../SG510/SG510%20Installation%20Guide/BC_510_ch05.pdf


31/110


A security warning dialog displays. For more information about this warningdialog, see A Security Warning Appears for the Initial Configuration Web Pageon page 77.

Note: The appearance of the dialog varies depending on the browser thatyou use.

3 Click Yes(or OK) in the dialog.

Important: If you do not see the warning dialog or if you cannot connect tothe Initial Configuration page, see Cannot Access the Serial Consoleon page 75.

When the appliance connects, the Setup Wizard displays, as shown in thefollowing figure.


32/110


4 Enter information on each screen, as prompted, and click Next to proceed tothe next screen.

Each page is described; some pages include mouse-over help. To complete theSetup Wizard you must:

a. Enter the console access information in Security > Console.

b. Enter the CLI Enable password in Security > CLI.

(Optional but highly recommended) Secure the serial port in Security > SerialPort.

The serial port allows you to configure and access the SG810 using a serialcable. This option allows you to set a password for the serial console setup,thus enabling only authorized personnel (who have access to the serial portpassword) to reconfigure the appliance.

c. Enter the network settings:

IP Address

Subnet Mask Gateway

DNS Server

d. (Optional) Configure the Application Delivery Network (ADN) settings.

The ADN settings optimize the delivery of applications over the WAN.Ifyou choose to set up the ADN, you need to configure the Primary ADNManager IP Address and/or the Backup ADN Manager IP Address.

e. Select the traffic types that the appliance should intercept in Services >Intercepted Traffic.

f. Set the Default Settings policy to either the MACH5 settings for WANacceleration or retain the default more secure settings.

Note: Select the license trial version that matches the license youpurchased, while buying the ProxySG810 Series appliance.


33/110


g. Confirm the settings and click Configure.This screen displays:

Note: The Web-based wizard is available only for initial appliance

configuration (or following a reset to factory defaults). After youclick Configureduring the final step, the wizard is no longer available.


34/110


Section C: Initial Configuration Using a Serial Console

This section describes how to configure the SG810 using a direct serial port

connection.A PC, serial terminal, or a stand-alone serial console terminal can be used toconfigure an SG810 the first time you power it on. Use the serial console setup toconfigure the following basic network information:

You can also configure a bridge or a forwarding host, or you can restrict access tothe SG810to a particular IP address or set of IP addresses.

PC Note: If the PC is using standard serial port settings, you should havea problem-free connection. You can run into problems, though, ifthere are non-standard PC serial port settings.

IP address Subnet mask

Gateway address DNS address Console username

and password Enable password


35/110


Configuring the SG810 using a direct serial port connection:

Do the following procedure by reading the onscreen material and entering datawhere necessary. In the procedure below, places where you must enter data areillustrated by example entries in bold text.

1 Power on and connect the serial terminal or PC as described below (the SG810must be powered off):

Serial terminal: Connect the terminals serial cable to the SG810s serialconsole port; start the terminal and verify that it is set using the parametersdescribed below.

Table 2.2: RS-232C Parameters

PC

: Connect a serial cable to a serial port on the PC and to the SG810s serialconsole port; start the PC, open a terminal emulator (such as HyperTerminal),and connect to the serial port to which you attached the cable. Create andname a new connection (either a COM or TCP/IP), and verify that the port isset using the parameters described in the preceding table.

Parameter Setting

Baud rate 9600 bps

Data bits 8

Parity none

Stop bits 1

Flow control none

Smooth-scroll disabled

Emulation VT 100


36/110


2 Power on the SG810 and wait for the system to finish booting.

The following configuration alert displays:

Figure 2-2: Initial SetupConfiguration Alert

3 Press three times.

When the Wel come t o t he SG Appl i ance Set up Consol e prompt appears,the system is ready for the first-time network configuration.

Figure 2-3: Initial Setup- Setup Console

******* ** ****** ** ** CONFI GURATI ON ALERT ** ****** ** ****** ** *Syst em st ar t up cannot cont i nue f or one of t hese reasons:

( a) Need at l east one adapt er conf i gur ed wi t h an

I P addr ess and subnet .

( b) Need t he consol e password and enabl e password.

( c) Need t he speci f y the t r i al edi t i on.

********** SYSTEM STARTUP TEMPORARI LY SUSPENDED **********

Pr ess "ent er " t hr ee t i mes t o act i vat e t he ser i al consol e

Wel come t o t he SG Appl i ance Set up Consol e

How do you want t o set up t he SG appl i ance?

M) anual set up usi ng t he ser i al consol e

W) eb wi zar d ( af t er set t i ng net wor k conf i gur at i on usi ng t heser i al consol e)

R) egi st er wi t h Di r ect or ( r egi st r at i on passwor d r equi r ed)

Choose set up mode:

4


37/110


4 You can do one of the following:

TypeMto use the Manual Serial Setup Console. This option allows you tocontinue using the serial console for fully configuring your SG810appliance.

TypeWto use the Web Setup Wizard. This option requires you to assignthe IP address, IP subnet mask, and the IP gateway through the serialconsole, then you can continue the configuration using the Web browser.

Type Rto use Director Registration.This option requires you to assign theIP address, IP subnet mask, and the IP gateway for the SG810 and the IP

address for the Director through the serial console, before registering theSG810 with a Director.

5 If l h f ll i di l


38/110


5 If you selectM, the following screen displays:

Figure 2-4: Setup ConsolePage One

Enter the interface number, IP address, IP subnet mask, IP gateway, and DNSserver parameters.

Note: If you enter YES, to configure a bridge, you must configure at leastone bridge port and associate a network interface with it

Wel come t o t he SG Appl i ance Setup Consol e

- - - - - - - - - - - - - - - - - - - - - - ( page 1 of 5) - - - - - - - - - - - - - - - - - - - - -

Press at any t i me t o r et urn t o t he mai n menu

Set up mode: Manual

DI RECTI ONS:

Pl ease ent er t he I P addr esses f or t he SG Appl i ance.The f ol l owi ng i nt er f ace wi l l be conf i gur ed:

1. Br i dge passt hr u- 0 ( no WAN l i nk, LAN l i nk)

I P addr ess [ 0. 0. 0. 0] : 10. 0. 1. 246

I P subnet mask [ 255. 255. 255. 0] :

IP gat eway [ 0. 0. 0. 0] : 10. 0. 1. 1

DNS ser ver [ 0. 0. 0. 0] : 10. 9. 8. 700

You have enter ed t he f ol l owi ng I P addresses:

I P addr ess: 10. 0. 1. 246

I P subnet mask: 255. 255. 255. 0

I P gat eway: 10. 0. 1. 1

DNS ser ver : 10. 9. 8. 700

Woul d you l i ke t o change any of t hem? Y/ N [ No]


39/110


6 To continue using the serial console, continue with Step 7.To use the Web Setup Wizard, see Section B: Initial Configuration Using theWeb Setup Wizard on page 30.To use the Director Registration feature, see Section D: Configuring the SG810Using Director Registration on page 48.

Note: A similar screen displays for each of the configuration options.The parameters that you enter vary according to the selectedconfiguration option M,W, R.

7 On page 2 enter a console username and a console and enable password A


40/110


7 On page 2, enter a console username and a console and enable password. Adefault username (admi n) is already in placeyou can change it here.Usernames and passwords can each be from 1 to 64 characters in length.

Passwords that contain special characters (such as an exclamation point) mustbe in quotes.

Figure 2-5: Setup ConsolePage Two

---- - - - - - - - - - - - - - - - - - - ( page 2 of 5) - - - - - - - - - - - - - - - - - - - - -

Pr ess at any t i me t o r et urn t o t he mai n menu

DI RECTI ONS:

The consol e user name, passwor d, and enabl e passwor d ar especi al admi ni st r at i ve credent i al s whi ch can be used t o l og i nt o t he command l i ne i nter f ace or web management i nter f ace.

WARNI NG - The consol e passwor d and enabl e passwor d ar e notdef i ned.

The syst emcannot st ar t up unt i l t hese are def i ned.

You must conf i gur e t he consol e user account now.Ent er consol e user name [ admi n] : admin

Ent er consol e password: *****

Ver i f y consol e password: *****

That password i s easi l y guessed. Choose anot her? Y/ N [ Yes] No

Ent er enabl e password: *****

Ver i f y enabl e passwor d: *****

That password i s easi l y guessed. Choose anot her? Y/ N [ Yes] No

8 (Optional) On page 2 you also have the option to secure the serial port For


41/110


8 (Optional) On page 2, you also have the option to secure the serial port.Formaximum security, secure the serial port.

The serial port allows you to configure and access the SG810 using a serialcable. This can pose a security risk because anyone with access to theappliance can reconfigure the SG810 settings. This optional step sets apassword for the serial console setup, allowing only authorized personnel theability to reconfigure the appliance.

Note: If you set the serial console password and then lose the password,you must restore the appliance to its original factory defaults toaccess the serial setup console (see Resetting the SG810 to FactoryDefaultson page 78).You might still be able to access the Management Console or CLI ifyou know the administrative credentials console username,password, and the enable password.


42/110


Figure 2-6: Setup Console- Page two continued

Do you want t o secur e the ser i al port ? Y/ N [ Yes] Yes

Ent er set up password:*****

Ver i f y set up passwor d: *****

That password i s easi l y guessed.

Choose anot her ? Y/ N [ Yes] No

WARNI NG:

I f you cont i nue and enabl e t he secur e ser i al por t i t wi l l

not be possi bl e t o ent er t he set up consol e wi t hout t he

setup passwor d. I f t he set up passwor d i s l ost , assi st ance

f r om Bl ue Coat Syst ems wi l l be r equi r ed and al l syst em

conf i gur at i on may be l ost . I t i s r ecommended t hat t he

passwor d be st or ed i n a physi cal l y secur e l ocat i on.

Access t o t he CLI on t he ser i al por t wi l l chal l enge f or

credent i al s.

To enabl e t he secur e ser i al port , r e- enter t he set uppassword:

9 (Optional) On page 3, you might restrict the use of the console account to a


43/110


( p ) p g , y gspecific workstation. On this screen, you can add one IP address to the list ofauthorized workstations that are approved to use the console account.

Additional workstations maybe configured later using the CLI or through theManagement Console.

Figure 2-7: Setup ConsolePage Three

--- - - - - - - - - - - - - - - - - - - - ( page 3 of 5) - - - - - - - - - - - - - - - - - - - - -

Press at any t i me t o r et urn t o t he mai n menu

DI RECTI ONS:

The consol e user name and password ar e speci al . They can be usedt o l og i n t o t he CLI or Web Management i nterf ace even i nci r cumst ances where t hi s i s deni ed by VPM or CPL pol i cy.

Thi s makes t he consol e account usef ul i n emergenci es, as a wayt o l og i n when pol i cy i s br oken, but i t may al so cr eat e asecur i t y hol e.

To cl ose t he secur i t y hol e, we r ecommend t hat you r est r i ct t he

use of t he consol e account t o speci f i c wor kstat i ons, i dent i f i edby thei r I P addr ess.

Thi s di al og al l ows you t o add one I P addr ess t o t he l i st ofwor kst at i ons t hat ar e aut hor i zed to use t he consol e account .( Thi s same l i st i s al so used t o r est r i ct whi ch wor kstat i ons canuse SSH wi t h RSA aut hent i cat i on. )

Addi t i onal workst at i ons may be conf i gur ed l ater f r omt he commandl i ne i nt er f ace or t he Web i nt er f ace.

WARNI NG: The consol e account can cur r ent l y be used t o l og i nf r om any wor kstat i on.

Woul d you l i ke t o r est r i ct access t o an aut hor i zed wor kst at i on?

Y/ N [ Yes] Yes

Aut hor i zed wor kstat i on [ 0. 0. 0. 0] : 10. 2. 33. 1

10 Select the trial license version that matches the license that you purchased for


44/110


the SG810.

Figure 2-8: Setup ConsolePage Four

Important: In the trial period, Blue Coat allows you to migrate between theMACH5 edition and the Proxy edition.

-- - - - - - - - - - - - - - - - - - - - - ( page 4 of 5) - - - - - - - - - - - - - - - - - - - - -

Pr ess at any t i me t o r et urn t o t he mai n menu

DI RECTI ONS:

An SG can have ei t her a MACH5 Edi t i on or Proxy Edi t i onl i cense.

The SGOS MACH5 Edi t i on i s desi gned t o opt i mi ze and secur e WAN

networ ks bei ng used i n Appl i cat i on Del i ver y Net wor ks ( ADN) .The MACH5 Edi t i on does not i ncl ude al l of t he secur i t y andcont r ol f eat ur es i ncl uded i n t he Pr oxy Edi t i on. Al l SGOSMACH5 Edi t i on f eat ur es, i ncl udi ng ADN opt i mi zat i on, ar eavai l abl e i n t he Pr oxy Edi t i on.

A new SG wi l l r un wi t h a 60 day tr i al pr i or t o i nst al l i ng al i cense.

The SG can r un ei t her t he MACH5 or Pr oxy Edi t i on of SGOSdur i ng t he t r i al per i od.

I t i s i mpor t ant t o not e t hat a downgr ade f r om Proxy Edi t i ont o MACH5 Edi t i on wi l l r esul t i n a l oss of conf i gur at i on. Aswel l , some def aul t s di f f er bet ween t he MACH5 and ProxyEdi t i on of SGOS so set t i ngs may need to be changed af t er anupgr ade f r om MACH5 Edi t i on t o Pr oxy Edi t i on.

Whi ch edi t i on woul d you l i ke t o r un dur i ng t he t r i al per i od?

M) ACH5 Edi t i on

P) r oxy Edi t i on

Choose edi t i on [ Proxy] : MACH5 Edi t i on

You have chosen MACH5 Edi t i on as t he t r i al edi t i on.

Woul d you l i ke t o change i t ? Y/ N [ No]

If you have purchased a MACH5 edition license, you may run theP diti d i th t i l i d Wh it h f th


45/110


Proxy edition during the trial period. When you switch from theProxy edition to the MACH5 edition at the end of the trial period,

the SG510 will lose all configuration settings.Conversely, if you have purchased a Proxy edition license andyou move from the MACH5 edition to the Proxy edition at the endof the trial period, you might need to reconfigure theSG510because some default settings for the Proxy editiondiffer from those of the MACH5 edition.

11 The SG810 is configured, and Page 5 displays. This page explains how toh SG810 f SSH Cli i h W b b S S ti E


46/110


access the SG810 from an SSH Client or with a Web browser. See Section E:Logging in to the SG810 on page 53for more information.

Figure 2-9: Setup ConsolePage Five

--------------------- - ( page 5 of 5) - - - - - - - - - - - - - - - - - - - - -

DI RECTI ONS:

The SG Appl i ance has been successf ul l y conf i gur ed t o use I Paddr ess: "10. 0. 1. 246"

You can connect t o t he command l i ne i nt er f ace or Webi nt er f ace t o perf ormaddi t i onal management t asks.

To connect t o t he command l i ne i nt er f ace, open t he f ol l owi ngl ocat i on f r omyour SSH appl i cat i on: 10. 0. 1. 246

To connect t o t he Web management i nt er f ace, go t o t hef ol l owi ng l ocat i on wi t h your web br owser:

ht t ps: / / 10. 0. 1. 246: 8082/

- - - - - - - - - - - - - - CONFI GURATI ON COMPLETE- - - - - - - - - - - - - - - - - -


Execut i ng i mage: Versi on: SGOS 5. 2. 1. 9, Rel ease i d: 30429Debug

I nt er f ace 0: 0: MAC addr ess 00: 00: 00: 00: 00: 00, no l i nk

I nt er f ace 0: 1: MAC addr ess 00: 00: 00: 00: 00: 00, f ul l dupl ex,100 megabi t s/ sec

Management Consol e st ar t ed

12 To log in to the serial console right away, press three times.


47/110


A menu displays offering two choices:

1) Command Li ne I nt er f ace2) Setup Consol e

13 Access the CLI or Management Console:

Enter 1in the serial console menu to select the CLI.

See Logging in to the SG810 CLIon page 55for information about usingthe SG810 CLI.

To access the SG810 Management Console, enter the following addressinto your Web browser:

ht tps : / /proxysg_IP: 8082/

whereproxysg_IPis the IP address that you configured for this SG810.

See Logging in to the SG810 Management Consoleon page 53for moreinformation about accessing the SG810.

Section D: Configuring the SG810 Using DirectorRegistration


48/110


Registration

This section describes how to configure the SG810 using the Director Registrationfeature.

Director Registration is a process that provides appliance authentication, andallows Blue Coat devices to verify each other without exchanging passwords overthe network. Director registration establishes a secure administrative session withthe SG810 and authenticates the SG appliance to the Director as an SSL client.Upon authentication, it allows you to control access to the SG810 through the

Director. To complete the registration process, both the SG810 and the Directorneed to authenticate each other.

If you have Internet connectivity, an appliance certificate is automatically fetchedby the SG810, and no human intervention is required. In other cases, if theInternet connection is delayed or if you do not have Internet access, you mighthave to manually initiate the process of obtaining an appliance certificate. Fordetails on manually obtaining an appliance certificate refer to the Blue CoatProxySG Configuration and Management Guide(Volume 5: Advanced Networking,Chapter 6: Authenticating a ProxySG).

If the SG appliance does not have an appliance certificate, you must configure aregistration password on the Director and enter the same password whenconfiguring the SG appliance to confirm their identities before exchanging publickeys. For details on setting a registration password, refer to Blue Coat DirectorConfiguration and Management Guide.

Note: Director Registration feature is only supported on the SG510Director.


49/110


Important: Before using Director Registration in the SG810 set up console,

log in to the Director and obtain the appliance certificate for it.The Director must have an appliance certificate and it must beconfigured properly so that it can receive the registrationrequest from the SG810.

To configure the SG810 using Director Registration:

1 Connect the SG810 to a serial console, PC, or place it within your network,and configure an IP address, subnet mask, and IP gateway using the serialconsole or the front panel buttons. See Overview of First-Time Configurationon page 20.

2 Power on the SG810 and wait for the system to finish booting.

Figure 2-10: SG Applinace Setup Console

3 Enter information on the screen, as prompted, and press enter to proceed tothe next line.

a. Enter R using the keyboard to select Director Registration.The followingscreenshot shows the SG appliance setup console.

b. Enter the Director IP address, IP subnet mask, Director IP address, andthe IP gateway for the SG810.

c. Enter the registration password if the SG810 does not have an appliancecertificate. This password is the shared secretthat was configured in the

Wel come t o t he SG Appl i ance Setup Consol e

How do you want t o set up t he SG appl i ance?

M) anual setup usi ng t he ser i al consol e

W) eb wi zar d ( af t er set t i ng net wor k conf i gur at i on usi ngt he ser i al consol e)

R) egi st er wi t h Di r ect or ( r egi st r at i on passwor dr equi r ed)

Choose set up mode: R

Director to authenticate the SG810 appliance. For more information referto Blue Coat Systems DirectorConfiguration and Management Guide.


50/110


y f g g

Note: The SG810 does not prompt for a registration password if it detectsthat it has an appliance certificate.

d. Enter the appliance name. The appliance name is for your reference, forexample: SG810 Atlanta you can name the appliance based on itslocation.If you provide an appliance name, the Director uses the appliance nameto create a Device ID. Otherwise, the IP address of the SG810 is thedefault Device ID.

e. Verify the IP addresses.Type Yto confirm the serial number of the Director. The SG810 is


51/110


ypregistered.

or, TypeNto abort the registration process.f.

Figure 2-11: Screen to verify Director serial number and register with Director

4 If you would like to configure the SG810 using the Director, go to the DirectorManagement Console or the Director CLI.

5 To log in to the serial console right away, press three times.

A menu displays offering two choices:

1) Command Li ne I nt er f ace2) Setup Consol e

Choose set up mode:RI P addr ess[ 0. 0. 0. 0] : 10. 0. 0. 146I P subnet mask [ 255. 255. 255. 0] :Di r ector I P addr ess [ 0. 0. 0. 0] : 10.0.0.146I PRegi st r at i on passwor d:

Appl i ance name ( opt i onal ) :

You have entered t he f ol l owi ng I P addresses:

I P addr ess: 10. 0. 0. 1I P subnet mask: 255. 255. 255. 0Di r ect or I P: 10. 0. 0. 146I P gat eway: 10. 9. 44. 1

Choose set up mode:RI PI PDi r ect orI P gat eway [ 0. 0. 0. 0] : 10. 0. 1. 1Regi st r at i on passwor d:

Appl i ance name ( opt i onal ) :

You have entered t he f ol l owi ng I P addresses:

I P subnet mask: 255. 255. 255. 0

I P gat eway: 10. 9. 44. 1

Woul d you l i ke t o change any of t hem? Y/ NNConnect i ng to 10. 0. 0. 146 to det er mi ne Di r ect or ser i al number

Thi s can t ake up t o 90 seconds . . . pl ease wai tDi r ect or r epor t s ser i al number : 1234567899I s t hat t he expect ed ser i al number ? Y/ N Y

Connect i ng t o 10. 0. 0. 146 t o regi st er wi t h Di r ect or 1234567899Regi st r at i on succeeded


b

e

d

6 To access the CLI or Management Console of the SG810:

Enter 1 in the serial console menu to select the CLI


52/110


Enter 1in the serial console menu to select the CLI.

See Logging in to the SG810 CLIon page 55for information about usingthe SG810 CLI.

To access the SG810 Management Console, enter the following addressinto your Web browser:

ht tps : / /proxysg_IP: 8082/

whereproxysg_IPis the IP address that you configured for this SG810.

See Logging in to the SG810 Management Consoleon page 53for moreinformation about accessing the SG810.

(

Section E: Logging in to the SG810


53/110


Once the SG810 is configured, the LCD will cycle through and display various

messages, such as CPU Utilizationand Freshness.After you have completed the initial configuration and connected the SG810 tothe network, you must log on to the SG810 to fully configure the appliance. Youmay fully configure the SG810using two methods.

Use a browser to access the SG810 Management Console Web interface.

Use a direct serial connection or an SSH Client to access the SG810

command-line interface (CLI).

Important: Blue Coat recommends that you set up a secure SSL connectionfor greater security. For instructions, refer to the Volume 5:Securing the ProxySGin the Blue Coat ProxySG Configuration andManagement Guide.

Logging in to the SG810 Management Console

The Management Console is a graphical interface for configuring and managingall aspects of the SG810. You can log on to the Management Console using a

browser.To log on to the Management Console using a Web browser:

1 Start the SG810.

2 Open a browser. Refer to the release notes of your SGOS version for details oncompatible browsers.

3 Enter the IP address configured during initial configuration, followed by theport number 8082. For example, enter: ht t ps: / / 10. 25. 36. 47: 8082.

4 Click Yesin the Security Alert dialog; enter a username and password in theEnter Network Password dialog that displays. If the username has not been

changed, the default is admin. The password is the one you wrote down orconfigured during initial configuration.


54/110


The SG810 home page displays.

5 Click the Management Consolelink from the top of the list on the left.

The Management Console page displays.

Figure 2-12: The Management Console Page

6 Navigate among Configuration, Maintenance, and Statistics by clicking oneof the three tabs near the top of the screen. Click the links on the left to select a

configurable component. Click the Helpbutton on any screen to displayinformation for that screen.

The online Help contains the complete text of the Blue Coat ProxySGConfiguration and Management Guide. Once you are in the online Help, use theContentsand Indexlinks to navigate through the onlien help.

Logging in to the SG810 CLI

You can connect to the SG810 CLI (a) by using a direct serial connection or (b) by


55/110


( ) y g ( ) yusing an SSH client, such as PuTTY or F-Secure. To connect to the SG810 CLI using

Telnet, you must first enable the Telnet-Console. Refer to the Managing PortServices section of the Blue Coat ProxySG Configuration and Management Guide.

Note: The CLI uses two passwords: The console password is required toestablish a connection to the interface, and the enable password canbe set to restrict access to the privileged mode configuration

options. If you forget the username or password, you can reset themusing either the front panel control buttons and LCD or a serialterminal or PC.

To log in to the SG810 CLI using a direct serial connection:

1 To set up the serial connection, complete steps 1 and 2 in the section Initial

Configuration Using a Serial Consoleon page 34.

2 After the system has finished booting, press the computer keyboard Enter keythree times. The following text displays:

Figure 2-13: Serial Console Login Page

3 Enter 1to select the Command Line Interface option.

4 Enter the username and password when prompted. If the username has notbeen changed, the default is admin. The password is the one you wrote downor configured during initial configuration.

Wel come t o t he Appl i ance Ser i al Consol e

Vers i on: SGOS 4. 1. 0. 0, Rel ease i d: 12345- - - - - - - - - - - - - - - - - - - - - - - - - MENU- - - - - - - - - - - - - - - - - - - - - - - - -

1) Command Li ne I nter f ace2) Setup Consol e

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Ent er opt i on:

5 At the command prompt, enter enable, then enter the enable password thatyou wrote down or configured during initial configuration:


56/110


SGOS>enable

Enabl e Password:SGOS#

You are now in privileged mode.

6 At the privileged-mode command prompt, enter configure terminaltoconfigure SG810 settings:

SGOS# configure terminal

Ent er conf i gur at i on commands, one per l i ne. End wi t h CTRL- Z.SGOS#( conf i g)

Refer to the Blue Coat ProxySG Configuration and Management Guideforinformation about configuring and administering the ProxySG.

To log in to the SG810 CLI using an SSH client:

1 Start the ProxySG.

Note: You must already have an SSH Client installed before you proceedwith the steps below.

2 Launch your SSH Cliententer the following settings as necessary: The IP address that you configured during initial configuration.

A port number, if necessary. (Port 22 is the default.)

The username and password. If the username has not been changed, thedefault is admin. The password is the one you wrote down or configuredduring initial configuration.

3 At the command prompt, enter enable, then enter the enable password thatyou wrote down or configured during initial configuration:

SGOS>enableEnabl e Password:SGOS#

You are now in privileged mode.

4 At the privileged-mode command prompt, enter configure terminaltoconfigure ProxySG settings:


57/110


SGOS#configure terminal

[ Enter configuration commands, one per line. End with CTRL-Z. ]SGOS#( conf i g)

Refer to the Blue Coat ProxySG Configuration and Management Guideforinformation about configuring and administering the ProxySG.

Section F: Configuring a Front-Panel PIN

The front panel allows you to reconfigure the initial settings of the SG810, which


58/110


The front panel allows you to reconfigure the initial settings of the SG810, which

can represent a security risk. Setting a front-panel PIN limits access to authorizedpersonnel only.

This procedure is only available through the CLIyou cannot set a front-panelPIN through the Management Console.

To configure a front-panel PIN:

1 Connect to the SG810 CLI and access the privileged-mode configure

commands (see Logging in to the SG810 CLIon page 55).2 From the privileged mode command prompt, change the SG810 front panel

PIN by entering one of the following commands:

SGOS#( conf i g) secur i t y f r ont - panel - pi n PIN

-or-

SGOS#( conf i g) secur i t y hashed- f r ont - panel - pi nhashed_PIN

where PINis an unhashed PIN and hashed_PINis a PIN in hashed format.After entering one of these commands, anyone who attempts to configure theSG810 through the front panel will be prompted to enter the PIN.

Section G: Configuring the Front-Panel LCD Behavior

The front-panel LCD turns off after 30 seconds by default. This behavior is


59/110


p y

configurableyou can set the LCD to remain on at all times, to turn off after aspecified length of time, or to flash (the flash setting can be helpful if you need tofind one SG810 in a room full of them).

The front-panel LCD cannot be configured through the ManagementConsoleyou must use the CLI.

To configure the front-panel LCD through the CLI:

1 Open a terminal session with the SG810; at the standard-mode commandprompt, enter enableand your privileged-mode password.

SGOS>enableEnabl e Password: ******SGOS#

2 At the privileged-mode command prompt, enter the configure terminalcommand to access the privileged mode configure commands:

SGOS#configure terminalSGOS#( conf i g)

3 At the ( conf i g) prompt, enter the f r ont - panel command to access thefront-panel mode commands and to configure the front-panel LCD behavior.

SGOS#( conf i g) front-panelSGOS#( conf i g f r ont - panel )SGOS#( conf i g f r ont - panel )backlight flashSGOS#( conf i g f r ont - panel ) backlight state {off | on | timeout}SGOS#( conf i g f r ont - panel )backlight timeout seconds

where:

f l ash Configures the LCD to flash. When set, the LCDcontinues to flash until the user presses a front panel


60/110


continues to flash until the user presses a front panel

button or the setting is changed through the CLIcommand no backl i ght f l ash.

The flash setting can overwrite the backlight statesetting.

st at e of f Configures the LCD to always remain off when theProxySG is powered on. This is the default behavior.

on Configures the LCD to always remain on when the

SG810 is powered on.t i meout Configures the LCD to turn off after a specified

number of seconds. Use the backl i ght t i meoutsecondscommand (described below) to specify thenumber of seconds.

t i meout seconds Specifies the number of seconds that the LCDremains on without activity. The backl i ghtst at e t i meout command specifies an LCD

timeout; this command specifies the number ofseconds before timeout occurs.

Chapter 3: Hot-Swapping or Installing Disk Drives


61/110


This chapter describes how to remove and install disk drives.

Important: The SG810 only supports disk-drive upgrade packages obtainedfrom Blue Coat Systems, Inc.

An SG810 Appliance has slots for four disk drives. If your original appliancecame with less than four disk drives, upgrade options are available from BlueCoat. See Table 4.1 on page 71.

If you are upgrading your SG810 by adding (not replacing) disk drives, you canskip to Installing a New Disk Driveon page 66.

Each of the disk drives (including Disk 1) can be removed and replaced

independently, without powering off the SG810 this process is called hotswapping.

The SG810 will boot from any disk. When you have installed or hot-swapped anew disk drive, the SG810 recognizes it, initializes it, and starts using itimmediately.

For initial installation of disk drives into a new SG810, see Installing the Disk

Driveson page 12.There are three steps to follow when you hot-swap a disk drive.

Taking a Disk Offline

Removing a Disk Drive

Installing a New Disk Drive

Taking a Disk Offline

You can take a disk offline through either the Management Console or the CLI.


62/110


To take a disk offline using the Management Console:1 Go to the SG810 home page. In a browser enter the IP address followed by a

colon and the port number 8082; for example, enter:ht t ps: / / 10. 25. 36. 47: 8082.

2 Click the Management Consolelink.

3 Select Maintenance > System and Disks, and then select Disks 1-2or Disks 3-4,

depending on the number of the disk you are taking offline (the disks arenumbered according to the drive slot they occupy: from number 1 through 4starting on the left).

The Disks 1-2 (or 3-4) tab displays, providing information about the disk inslot 1.

Figure 3-1: Taking a Disk Offline Through the Management Console

4 Click the Take disk # offlinebutton of the disk that you want to take offline, (#indicates the number of the disk). The disk status changes to offline.

5 Click OKin the Take disk offline dialog that displays.

6 Close the Management Console.


63/110


7 Check the front panel Disk Drive LEDs: wait for the corresponding DiskDrive LED to flash before you remove the disk.

Figure 3-2: Check the Disk Drive LED

8 See Removing a Disk Driveon page 64for removal instructions.

To take a disk offline using the CLI:

1 Open a terminal session with the SG810 and enter the password whenprompted.

2 At the command prompt, type enableand enter your privileged-modepassword when prompted.

3 At the privileged-mode command prompt, enter the following command:SGOS#disk offline disk_number

where disk_number is the number of the disk going offline, a number from2 to 4 .

4 Check the front panel Disk Drive LEDs: wait for the corresponding DiskDrive LED to go off before you remove the disk (see Figure 3-2).

See Removing a Disk Drive, below, for removal instructions.

Check that the corresponding

Disk Drive LED is flashing

(this example shows that Disk

Drive 2 is offline)

An unlit LED indicates there is

no disk in the slot.

Removing a Disk Drive


64/110


WARNING! Always take a disk drive offline before removing it (see Taking aDisk Offlineon page 62).

1 Press the push tabs on each side of the front-panel bezel to release the lockedposition of the SG810 front panel. Pull the front panel forward and down.


2 If other equipment blocks the front panel from opening all the way, you can

pull the front-panel forward, sliding out the front-panel tray until you canaccess the disk drives.


Press the pushtabs on each side

of the front-panel

bezel

The front panelswings forward

and down

Pull out the front-panel tray, if necessary, to access the disk drives

3 On the disk drive to be removed, gently press the button on the right side ofthe disk-drive carrier to release the disk lever.

4 Carefully pull the lever towards you to slide the disk drive out.


65/110


Figure 3-5: Slide the Disk Drive Out

First press this button to

release the leverPull the lever toward you to slide the

disk drive carrier out

Installing a New Disk Drive

Follow these steps to install a new disk drive.


66/110


Note: You do not need to power off the SG810 before installing a new diskdrive.

1 Take the new disk drive and press the button to release the lever.

2Align the drive carrier with the guide rails of the drive slot. Using the lever,carefully insert the drive carrier into the slot.

3 When the disk meets the SG810 frame, firmly press the edges of the disk drivecarrier into the drive slot. Then, push the lever in towards the button until itlatches and the drive is seated firmly in place.

4 Slide in the front panel tray, if necessary, and close the front panel.

The SG810 recognizes and initializes the disk; no configuration is necessary.When the new disk is plugged in, the corresponding Disk Drive LED flashesamber while the disk drive initializes. When it comes online, the LED lightsup solid green to show that the drive is online.

Setting the Default Boot System

The system will always try to boot the newest software image, which might be theimage installed on the new disk drive. If you do not want to boot that software


67/110


image on the next reboot, you must reselect the default software image. Using theManagement Console, configure the appliance to boot the desired system image.

To set the default boot system using the Management Console:

1 Select Maintenance > Upgrade > Systems.

In the SG Appliance Systems section, locate the desired software image andselect the Default radio button.

The SGappliance Systemstab displays the five available systems. Emptysystems are indicated by the word Empty. The system currently running ishighlighted in blue and cannot be replaced or deleted.

Figure 3-6: Setting the default boot system


68/110


Chapter 4: Next Steps


69/110


After you have completed the first-time configuration of the SG810 and havelogged in, you should do the following:

Upgrade the SG810 software by downloading the latest patch release(available at http://download.bluecoat.com).

Fully configure the appliance.

To configure the SG810, you will need to download the Blue Coat ProxySGConfiguration and Management Guide, (the CMG) available on the Blue CoatWeb site at http://www.bluecoat.com/support/manuals

You must have aWebPower account to access the documentation. If you doyet have an account, go to: https://services.bluecoat.com/

You can also find tech briefs(technical briefs) on the Blue Coat Web site.

If you log on to the SG810 using a Web browser, you can access the onlinehelp by clicking the Helpbutton on the Management Console screens. TheManagement Console is the graphical user interface for the SG810. See SectionE: Logging in to the SG810 on page 53for more information.

Activate the SG810 license. You must have a Blue Coat WebPower account.

Note: If you have new SG810 hardware that previously has been registered, thelicense is already associated with the hardware. Go to Maintenance >

Licensing > Installand click Retrieveto obtain the license.If you have older hardware that previously has been registered or if theSG810 does not have Internet access, you can install the software licenseunder Maintenance > Licensing > Install.

To activate the SG810 license:

1. Open a Web browser.

2. Disable the browsers pop-up blocker.

3. Enter the IP address you assigned to this appliance during initial setup:ht t ps: / / i p_addr ess: 8082

4. Enter the access credentials, as specified during initial setup.

5. Click Management Console.The license warning/registration screen displays.

6. Enter your WebPower credentials and click Register Now; this automaticallyregisters the hardware and software.

7. From the Management Console, go to the License page to begin the license

l M i t Li i I t ll
http://www.bluecoat.com/http://www.bluecoat.com/


70/110


retrieval process: Maintenance > Licensing > Install.8. Click Retrieve. The Request License Key dialog displays.

9. Enter your WebPower credentials and click SendRequest.

10.To verify license installation, click the Viewtab and click Refresh Data.

If you require detailed procedures regarding registration, license retrieval,

and installation, refer to the Licensing chapter in the SG Appliance Volume 1:Getting Starteddocument, or click the Help button to view the contents of thatchapter in HTML format.

Blue Coat recommends attaching one of the software license stickers to thechassis and saving the other one for future reference. You can attach it to thisdocument and file it, or attach it to another document, as required in yourenterprise.

Table 4.3: Licensed users

Archive your system configuration and store it in a remote location so thatyou may restore it, if needed.

For comprehensive archiving instrutions, refer to the Backup chapter inVolume 1: Getting Startedof the Blue Coat ProxySG Configuration andManagement Guide.

Hardware ModelNumber of Users (Without ADN

Enabled)

Number of Users

(With ADN Enabled)

810-5 2500 500

810-10 3500 700

810-20 5000 1000810-25 Not License Limited Not License Limited

(Optional) Purchase the SG810 option card kits. The Blue Coat SG810 Seriescomes with a number of expansion slots. The option cards that are compatiblewith the SG810 are listed below:

D l Gi E Fib


71/110


Dual GigE Fiber Dual GigE Copper NIC

Dual GigE Copper with Pass-Through

Quad GigE Copper with Pass-Through

SSL Accelerator Card. You must purchase an SSL license to use the SSLAccelerator card.

(Optional) Purchase the SG810 upgrade kits. For more details and upgradepaths, refer to the table below. To purchase your upgrade kit, find the tableentry that matches your upgrade

The following table describes the components included in each upgrade kit.

Table 4.1: Upgrade paths

Upgradingfrom. . . to. . .

PartNumber

Kit contains:

810-5 810-10 085-02503 One 2.8 Ghz Xeon processor; four 1GBDIMM; two 300GB HDD SCSI; one two-portPass-Through card; one SSL card

810-5 810-20 085-02504 One 2.8 Ghz Xeon processor; six 1GB DIMM;four 300GB HDD SCSI; one two-portPass-Through card; one SSL card

810-10 810-20 085-02505 Six 1GB DIMM; two 300GB HDD SCSI

Older Models

810-b 810-10 085-02503 One 2.8 Ghz Xeon processor; four 1GB

DIMM; two 300GB HDD SCSI; one two-portPass-Through card; one SSL card

810-b 810-20 085-02504 One 2.8 Ghz Xeon processor; six 1GB DIMM;four 300GB HDD SCSI; one two-portPass-Through card; one SSL card

810-c 810-10 085-02503 One 2.8 Ghz Xeon processor; four 1GBDIMM; two 300GB HDD SCSI; one two-portPass-Through card; one SSL card

810 c 810 20 085 02504 One 2 8 Ghz Xeon processor; six 1GB DIMM;


72/110


810-c 810-20 085-02504 One 2.8 Ghz Xeon processor; six 1GB DIMM;four 300GB HDD SCSI; one two-portPass-Through card; one SSL card

810-d 810-20 085-02504 One 2.8 Ghz Xeon processor; six 1GB DIMM;four 300GB HDD SCSI; one two-portPass-Through card; one SSL card

810-e 810-20 085-02504 One 2.8 Ghz Xeon processor; six 1GB DIMM;four 300GB HDD SCSI; one two-portPass-Through card; one SSL card

810-f 810-20 085-02507 One 2.8 Ghz Xeon processor; six 1Gb DIMM;one two-port Pass-Through card; one SSLcard

Each kit also includes the following:

Upgrade Instructions

Upgrade Sticker

Software License Agreement

ESD Wrist Strap

Chapter 5: Troubleshooting

This chapter describes how to isolate and solve common problems during the


73/110


This chapter describes how to isolate and solve common problems during theinstallation of the SG810.

The topics discussed in this section are:

The SG810 Does Not Come Back Up After Rebootingon page 73

The Disk Drive LED Has A Solid Amber Lighton page 74

The SG810 Does Not Come Back Up After Rebootingon page 73 Testing the SG810on page 75

CLI Session Times Outon page 75

CLI Limited to 16 Sessionson page 75

Cannot Access the Serial Consoleon page 75

Cannot Access the Management Consoleon page 76 Resetting the SG810 to Factory Defaultson page 78

A Security Warning Appears for the Initial Configuration Web Pageon page 77

Cannot Access the Serial Consoleon page 75

Resetting the SG810 to Factory Defaultson page 78

The SG810 Cannot Connect to the Directoron page 80 Connection Request Rejected by the Directoron page 81

The SG810 Does Not Come Back Up After Rebooting

If the appliance is not coming back up after rebooting and the serial port isconnected to terminal serv

SG810 Installation Guide (SGOS 5.2.x)

Documents

Transcript of SG810 Installation Guide (SGOS 5.2.x)