Trustwave and Cybereason Merge to Form Global MDR Powerhouse for Unparalleled Cybersecurity Value. Learn More

Trustwave and Cybereason Merge to Form Global MDR Powerhouse for Unparalleled Cybersecurity Value. Learn More

Services
Managed Detection & Response

Eliminate active threats with 24/7 threat detection, investigation, and response.

Co-Managed SOC (SIEM)

Maximize your SIEM investment, stop alert fatigue, and enhance your team with hybrid security operations support.

Advisory & Diagnostics

Advance your cybersecurity program and get expert guidance where you need it most.

Penetration Testing

Test your physical locations and IT infrastructure to shore up weaknesses before exploitation.

Database Security

Prevent unauthorized access and exceed compliance requirements.

Email Security

Stop email threats others miss and secure your organization against the #1 ransomware attack vector.

Digital Forensics & Incident Response

Prepare for the inevitable with 24/7 global breach response in-region and available on-site.

Firewall & Technology Management

Mitigate risk of a cyberattack with 24/7 incident and health monitoring and the latest threat intelligence.

Solutions
BY TOPIC
Microsoft Security
Unlock the full power of Microsoft Security
Offensive Security
Solutions to maximize your security ROI
Rapidly Secure New Environments
Security for rapid response situations
Securing the Cloud
Safely navigate and stay protected
Securing the IoT Landscape
Test, monitor and secure network objects
Why Trustwave
About Us
Awards and Accolades
Trustwave SpiderLabs Team
Trustwave Fusion Security Operations Platform
Trustwave Security Colony
Partners
Technology Alliance Partners
Key alliances who align and support our ecosystem of security offerings
Trustwave PartnerOne Program
Join forces with Trustwave to protect against the most advance cybersecurity threats
Loading...
Loading...

INFO: How to replace a synchronized source box

Expand / Collapse


This article applies to:

  • R3000

Question:

How to replace a synchronized source box

Reply

How to replace a synchronized source box

If you have multiple R3000 filters in synchronization, it's usually very simple to replace a TARGET (slave) box, since all you need to do is configure the network settings and then point it to the source box to obtain the configuration information.

However, replacing a SOURCE (master) filter involves a few more steps.  You have the option of either configuring the new box from scratch using the QuickStart Guide, or you can do a "backup" on the old box and use it to "restore" on the new box.  This article assumes that you want to perform a backup/restore.

Prerequisites for backup/restore:

1.  The software version on both R3000 boxes must be the same.  If you did a backup your current box and attempt to "restore" it on the new box running a different version, it won't work. (It's highly advisable to do a backup every time you apply a patch, especially on a source box in synchronization).

2.  If you're replacing the source box because of a bad hard drive, you should NOT use the backup file if there's even the slightest chance of it being corrupted.  Otherwise, you might transfer the corruption to the new box.  (In this scenario, it would be better to change one of the target boxes to stand-alone mode temporarily, and do your backup on that box).

How to do a backup/restore:

On the old R3000:

1.  Check the version on each box--make sure they're the same!

2.  On your current source box, go to System -> Backup/Restore, and perform a backup of the configuration and library (combined).

3. Download/save a copy of the backup file to your PC.

4.  The network settings are NOT saved with the backup; therefore, go to System -> Network -> LAN Settings and copy down the IP addresses, default gateway, hostname, and name servers.  (The hostname is registered in our databases for authenticating with our library and patch servers, so be sure to copy the hostname exactly as it appears in the GUI).

5.  Shut down the source box and replace it with the new box.  (Be sure to connect the two ethernet cables into the proper ports).

On the NEW R3000:

1.  You should have received an activation code by email.  If so, you'll need to activate the new R3000 at our web site.  If you get a "Duplicate entry" error during the activation process, please contact 8e6 technical support and ask us to delete the hostname from our database so that you can re-use it.

2.  Use the QuickStart Guide that came with the box to log into the text-based setup wizard.  (The easiest way to access the text interface is to connect a keyboard and monitor directly to the R3000, but the QuickStart Guide tells you how to set up HyperTerm and log in that way).

3.  Using the text-based setup wizard, configure the LAN Settings (IP addresses, hostname, default gateway, etc). 

4.  Reboot the box.

5.  After the box finishes rebooting, it should be reachable on your network.  Open your web browser and log into the Java GUI, just as you normally do, on port 88.

6.  Go to System -> Backup/Restore.

7.  Upload your backup file, and then do a RESTORE.

8. When the "restore" has completed, go to System -> Synchronization -> Synchronization Setup and make sure the settings were carried over.

9.  Verify that your Range to Detect was carried over (Group -> Global Group -> Range to Detect).  (The Range to Detect is optional, so it's okay if it's blank).

10.  At this point, the R3000 doesn't have the 8e6 core libraries, so you'll need to download them before the box can start filtering.  Go to Library -> Library Updates -> Manual Update.  Start a "Full URL Library Update."   Be patient, as this can take as long as TWO hours!  The library update log will indicate when it's finished.

Please contact 8e6 technical support if you experience any problems with the backup/restore process.


This article was previously published as:
8e6 KB 291131

To contact Trustwave about this article or to request support:


Rate this Article:
     
Tags:

Add Your Comments


Comment submission is disabled for anonymous users.
Please send feedback to Trustwave Technical Support or the Webmaster
.