This section describes how to update the NP-View Server application and the underlying components if the OVF was used for the initial installation.

Updating the NP-View Server Application

To update an existing NP-View Application, the steps are:

1. Download the latest release Linux Installer Release (not the .OVF) from the Network Perception Portal and copy it onto your NP-view server using SCP (or WinSCP from a Windows client)
2. Login onto the NP-View server using SSH (or Putty from a Windows client)
3. Get root permissions using the command: sudo -i
4. Prior to installing the new version, it is recommended to make a backup of your database (see below)
5. Execute the new NP-View release file using the command: sh NP-View_installer.sh  (where NP-View_installer.sh is the name of the new release file downloaded in step 1).
6. Follow the guided steps of the installer, which will automatically start NP-View once the update is complete.
7. Connect to the user interface of NP-View using your web browser and check in the bottom-left corner of the home page that the version number matches the new release

Backing up the NP-View Server Database

1. Stop the NP-View Server (you can use the script /opt/np-live/stop_nplive.sh)
2. From the NP-View Server folder (by default: /opt/np-live/, run the command: tar -zcf db_backup_$(date '+%Y_%m_%d').tgz db (this command may take few minutes to complete)
3. Run the new release installer, which will update the containers and then launch NP-View Server

Updating CentOS 7 and Docker

If the OVF was used for the initial installation, that package included the CentOS 7 operating system and Docker. These applications must be updated separately from the NP-View Server Application using the below instructions. The instructions cover NP-View Servers that have internet access and those that do not have internet access.

Updating when the NP-View server has internet access:

– stop NP-View
cd /opt/np-live/
./stop_NP-Live.sh

– run all updates
yum update -y

– reboot server
reboot

Updating when the NP-View server does not have internet access:

If NP-View server is installed in an environment that does not have internet access, a separate Centos 7 server with Docker that has internet access is required to create the update package. All commands below are case sensitive.

Centos 7 that is online:

– make sure you are root
sudo su -

– create packages directory
cd /root/
mkdir packages
cd packages

– download all packages
yum list installed | awk {'print $1; }' | tail -n +3 | xargs yumdownloader

– you should see docker included in the output list.

– compress archive (capital -C is important)
tar czf /root/packages.tar.gz *.rpm -C /root/packages/

– Copy packages.tar.gz to the offline server. The user can use the below command to scp:
scp packages.tar.gz root@ipAddress:/root/

Centos 7 that is offline running NP-View:

– make sure you are root
sudo su -
– stop NP-View
cd /opt/np-live/
./stop_NP-Live.sh

– create directory and extract the archive
cd /root/
mkdir packages/
mv packages.tar.gz packages/
cd packages/
tar -xf packages.tar.gz

– install all updates:
yum -y localinstall *.rpm

– reboot server
reboot

– now everything is up to date on the offline server.

If you get any docker swarm errors:

– make sure you are root
sudo su -

– leave and join swarm cluster
docker swarm leave --force && docker swarm init

The Rule Usage feature helps network admins identify rules for potential elimination due to lack of use. This feature only applies to Palo Alto NGFW (not Panorama).  Rule Usage Analysis (aka Hit Count) requests additional Access Rule usage information from firewalls using the connector. When setting up a new connector, the user will have the ability to enable the extraction of rule usage information:

Note that existing connectors will not be affected and cannot be edited to enable hit count data retrieval.

From the NGFW, we extract four values for each access rule:

• First Hit – Timestamp of first rule usage
• Last Hit – Timestamp of last rule usage
• Hits Updated – Timestamp of last data refresh
• Hits – Usage count

The information is presented as additional columns in the Access Rules Table.  The four columns are disabled by default and will need to be enabled by the user using the menu at the top right.

Once enabled, the hit count data will be displayed in the Access rules table:

Below are the currently known issues in NP-View along with the available workarounds. These issues will be addressed as part of the upcoming release. If you are experiencing an issue not covered in this document, please contact Technical Support at: support@network-perception.com. 

 

1. The menu does not load properly: has odd symbols or help text

• Desktop

  • Click on “View” and “Force Reload” the page or use the hotkey (Ctrl + Shift + R)

• • Or open NP View Desktop in a browser window
    • Open a web browser (Chrome/Edge) with your NP-View still running
    • Type “localhost:8080” in the address bar to load NP-View in a browser window
  • Click the 3 dot menu at the top right and select “More Tools”, then “Developer Tools” or use the hotkey (Ctrl + Shift + i)

• • With Developer tools open, Click and hold the “Refresh” Button then click “Empty Cache and Hard Reload”

• Server

  • In web browser (Chrome/Edge), click on the refresh symbol or use the hotkey (Ctrl + Shift + R)
  • Or
  • Click the 3 dot menu at the top right and select “More Tools”, then “Developer Tools” or use the hotkey (Ctrl + Shift + i)

• • With Developer tools open, Click and hold the “Refresh” Button then click “Empty Cache and Hard Reload”

• • NOTE: Firefox – Hold down “Ctrl + Shift + R” key or hold down Ctrl and press F5

2. Typing into a field in NP-View Desktop doesn’t register any text

Reset window focus (This may not always work)

• Alt+Tab out of the application
• Alt+Tab back into the application

Login to NP-View Desktop via web browser

• Open a web browser (Chrome/Edge) with NP-View still running
• Type “localhost:8080” in the address bar to load NP-View in a browser window

 

3. Following an update NP-View Workspace hangs on “Preparing your workspace, hang on..”

• Desktop

  • Go to “View” drop down menu at the top of your NP-View Window
  • Select “Force Reload”

• • Or Open a web browser (Chrome/Edge) with your NP-View still running
  • Type “localhost:8080” in the address bar to load NP-View in a browser window

• • Sign into NP-View and select a workspace
  • Click the 3 dot menu at the top right and select “More Tools”, then “Developer Tools” or use the hotkey (Ctrl + Shift + i)

• • Click and hold the “Refresh” Button then click “Empty Cache and Hard Reload”

• Server

  • In web browser (Chrome/Edge), click on the refresh symbol or use the hotkey (Ctrl + Shift + R)
  • Or
  • Click the 3 dot menu at the top right and select “More Tools”, then “Developer Tools” or use the hotkey (Ctrl + Shift + i)

• • NOTE: Firefox – Hold down “Ctrl + Shift + R” key or hold down Ctrl and press F5

4. Collapse is shown by Default in Object Menu (Expand option unavailable in right click menu)

• Right click on the object and click on collapse

• Right click on the object again and click on expand

 

 

 

 

System Logs

• Data: The System Logs Table shows a detailed sequence of tasks attempted and completed.
• Use: The System Logs Table is primarily used for system debugging and contains information, errors and warnings derived during system operation.
• Filters: The System Logs Table has three views
  • Workspace
    • Displays all system actions for the open workspace
    • Available to the Administrator and Workspace Admin
  • User
    • Displays the actions taken by the current user on the open workspace
    • Available to the Administrator and Workspace Admin
  • System
    • Displays the overall operation of system across users and workspaces
    • Only accessible by the Administrator
• Each view can be filtered to show only
  • Information
  • Errors
    • Errors are generated when a system operation fails to complete
  • Warnings
    • Warnings are generated during data parsing and when policy / requirement infractions are identified
  • or All.

(more…)

Overview

Network visualization via The Topology Map is the most powerful feature of NP-View.

Once you:

1. Create a workspace
2. Import configuration files
3. Import supporting meta data

NP-View’s visualization engine will process your information and create a dynamic, usable network diagram, starting you at the Home View. Workspaces are broken down into views, which you can read more about here.

 

---

Topology Map

Based on your configurations, NP-View will create a map to connect and display:

• Firewalls (physical and virtual)
• Routers (physical and virtual)
• Switches
• Host-Routers
• Networks
• Hosts
• Gateways
• Border Gateways
• VPN Tunnels
• Unmapped Hosts and Networks

 

Details: Each is represented by its own individual icon on the map, and when clicked will open a details panel with information about the selected node. From each details panel devices can be assigned a name (e.g., grey text tag), a category (colored text tag) and criticality (colored ring). See the Info Panels Article for more information.

Risk Display: If a device has active alerts, the number of alerts will be displayed as a red circle on the device icon.

Comment Display: If a device has user entered comments, the number of comments will be displayed as a blue circle on the device icon.

Unmapped Gateway:

• Unmapped hosts and networks indicate IP addresses that are external to the topology and could not be connected to primary networks.
• For a given networking device (e.g., a firewall), primary networks constitute the IP ranges defined by its interfaces.
• In other words, all the networks a device faces are called primary.
• Nonetheless, the device’s ruleset can refer to arbitrary IP spaces, not necessarily those within primary ranges.
• Consequently, NP-View identifies those external/unknown IP spaces as hosts, networks, or ranges, as defined in the config, and places them behind the Unmapped gateway.

 

---

 

Arranging the Map

On the Topology Map, users can rearrange any object or group of objects on the canvas by simply selecting and dragging a device to a new location. Device locations can be saved with the “Save Topology” button which can be found in the top center of the screen.

• Multiple devices can be selected by holding the shift key down (the cursor changes to a + sign) and dragging the mouse to make the selection.
• The Ctrl key can be used to select / deselect individual devices.
• Once selected, the devices can be assigned to a common category or criticality.
• Alternatively, the devices can be segmented into zones. See more info on zone creation.

 

Save Topology: When objects are moved on the topology map, the ‘Save Topology’ button will become active.  Multiple objects can be moved prior to saving the topology.

If the user attempts to switch views before saving, a notification will be presented as follows:

The user can proceed to the selected view without saving by clicking “OK”,  or they can choose “cancel” to go back and ‘Save Topology’ .

 

---

Other Topology Functions

 

Settings: Opens a panel with user preferences that can be set for the map. See the section below for more

Collapse/ Expand Topology Nodes: Some Topology Maps may become visually overwhelming depending on how many nodes are present. This setting will hide end points and only display Primary devices and networks

Pin/ Unpin Topology:  Selecting this, moving one device will cause the map to auto arrange.  This can be helpful if when importing a large number of devices, the topology map initially displays with overlapping devices

Night Mode: Sets the map to a different color scheme

Highlight Paths: Opens the Highlight Paths menu item. See the Paths article for more.

Manage Views: Opens the Manage Views menu item. See the Views article for more.

Center Map: Centers the map on the screen

 

---

Topology Settings

NP-View provides a settings menu specifically for the topology. This menu can be used to show as much or as little information as you desire on the topology map. This keeps the topology map at a level of organization that suits your use.

The topology settings menu is easily accessible from the menu in the bottom right of the topology map by clicking on the gear icon.

 

This will open the topology settings dialog and allow users to show or hide different types of information on the fly.

• Show/Hide Vulnerability Shields – this setting toggles the display of icons that show vulnerabilities on nodes when scans have been imported into the workspace.
• Show Networks with NO IP – this setting toggles the display of networks / interfaces (white cloud icons) that are defined but have no IP address assigned. The default behavior is to hide them.
• Show Comment Bubbles – this setting toggles the display of the blue bubble on Primary Devices that indicates the number of comments associated with that device.
• Show Risk Bubbles – this setting toggles the display of the red bubble on Primary Devices that indicates the number of risks associated with that device.
• Collapse Nodes By Default – this setting toggles the behavior of whether or not nodes on the topology map are collapsed.

 

 

---

 

Note: For very large topologies (over 200 devices), the router, firewall and switch symbols will change to circles to make the map easier to read when zoomed out.

 

 

 

NP-View uses reports to present network information related to the open workspace.  These reports are available to all users and can be accessed from the main menu.

This article is focused on the Background Tasks Table.

 

Background Tasks

This table displays the active and completed processes both for the current workspace, and for all workspaces. When in a workspace you have the ability to filter and view the active processes for the current workspace and to clear or cancel completed or active processes for the current workspace.

 

Access: Background Tasks can be accessed in two ways.

1. From the main menu
2. Clicking on the active spinner on the topology map

*main menu       *active background tasks spinner

 

Overview

The Background Tasks table shows the status of each task spawned by a data import, merge, analysis, or by running a policy.

• Parsing tasks indicate the imported file is being normalized and hosts inferred.
• Merge tasks combine the blueprints into the topology map.
• Analysis tasks define all of the paths and open ports.
• Policies review the active requirements to
  • identify potential risks for review
  • or to provide cell / text highlighting for reports

 

---

 

An example of the table is in the image below.

 

The report contains the following data and has the following functionality:

Report Data:

• Task name
• Progress
• Workspace where the task is running
• User who owns the task
• The time it started or ended

Report Functions:

• The check box allows the user to filter on the tasks pertinent to the current workspace.
• The X allows the user to cancel a task that may be running too long or be stuck for some reason
• The user can also cancel all tasks within a workspace using the “Cancel All for this Workspace” button

 

 

 

Performing a regular review of your compliance metrics is important for your organization.  Performing the review manually is time consuming and tedious. Audit assistance provides the Compliance Team (Auditor, Compliance Officer, Compliance Analyst, and Consultants) with capabilities that allow users to:

• Verify compliance with cybersecurity regulations and best practices through Policy Review.
• Seamlessly store evidence for compliance review with Change Tracking.
• Easily prepare compliance reports using the Audit Assistants listed below:

Workspace Report

The Workspace Report assistant is available within each workspace and will generate a report for a specific view that includes detailed information about configuration files that were imported and parsed including:

• Configuration assessment report including risk alerts and warnings.
• Ports and Interfaces
• Access rules
• Object groups
• Path analysis

Industry Best Practice

The Best Practice assistant requires a license to activate. This report is available within each workspace to generate a report for a specific view that includes the following topics:

• Parser Warnings and potential misconfigurations
• Unused Object Groups
• Access Rules missing a justification
• Unnamed nodes
• NP Best Practice Policies on Access Rules and CiS Benchmarks that have identified potential risks
• ACL’s with no explicit deny by default rule

NERC CIP Compliance

The NERC CIP assistant requires a license to activate this function and guides the user through the steps required to create a report covering CIP-005 requirements. The NERC CIP audit assistant is only available within a NERC-CIP workspace and allows audit teams to classify BES cyber assets as High, Medium, and Low based on the standards. We have added a category for untrusted (Internet, Corp, etc.) to tag non BES assets. NP-View allows compliance teams to collect and report evidence related to the following requirements:

• CIP-002 – BES Cyber System Categorization; impact rating and 15-month review
• CIP-003 – Security Management Control; cyber security policy
• CIP-005 – Electronic Security Perimeter; remote access management
• CIP-007 – System Security Management; ports and services
• CIP-010 – Change Management and Vulnerability; configuration change management, configuration monitoring, vulnerability assessment

A demo workspace for the NERC CIP audit assistant is included with the software.  To see the audit assistant in action, follow these steps:

1. Click on the demo workspace to build the topology.
2. Create a custom view by selecting all of the firewalls, right click, Create View from Selection and give it a name.
3. Once the view is generated, select Manage Zones from the left manu and click on the Auto Generate Zones button.
   1. Red zones represent your high criticality assets.
   2. Orange zones represent your medium criticality assets.
   3. Yellow zones represent your low criticality assets.
   4. Gray zones represent your untrusted assets.
4. On the left menu, select Summary Reports and the NERC-CIP Compliance Report
5. Click through the wizard, the defaults will represent the selections suggested by the auto group function.
6. Click Generate Report to view the report in a new tab.

Compare path history

This interactive report, accessible from the main menu, provides a network path comparison between two points in time.

When a configuration file is added to the system and is different from the previously imported file, a new “Version” is created.

The user can select two versions to compare.  The resulting table will display the changes between the two files. Removals are shown in the left column and additions are shown in the right column.

 

*Compare Path History 0pen and two versions selected

 

*Closeup on the comparison results

This article will focus on the Access Rules Report.

NP-View uses reports to present network information related to the open workspace.  These reports are available to all users and can be accessed from the main menu. For more information visit the Workspace Reports Overview article.

 

---

Connectivity Paths

This report provides a summary of network paths and their analysis results. By clicking on a specific rule sequence, the associated access rule can be displayed for review and comment.

Connectivity Paths Columns

• Destination: (PATH_DST_IP_BEGIN : PATH_DST_IP_END) IP address range of the destination
• Destination Node: (PATH_DST_NODES) device name or IP address of the destination node
• Path Number:  internally generated value used as a marker for each path.
• Path Sequence: (PATH_SEQUENCE) List of IP address or devices traversed by the path from source to destination.
• Port: (PATH_SRC_PORT_BEGIN ) The port that is open along the path
• Protocol: (PATH_PROTOCOL) The protocol enabled on the path
• Rule Sequence: (PATH_RULE_SEQUENCE) Access list sequence of rules and reference line number within the configuration file
• Service: (PATH_SERVICE) The service that corresponds to the open port.
• Source: (PATH_SRC_IP_BEGIN : PATH_SRC_IP_END) IP address range of the source
• Source Node: (PATH_SRC_NODES) device name or IP address of the source node