QRadar Network Insights 1920-C D7 appliance

The IBM QRadar Network Insights 1920-C (MTM 4893-N2E) appliance provides detailed analysis of network flows to extend the threat detection capabilities of IBM QRadar. QRadar Network Insights 1920-C is based on the Dell System R7625 XL (2U).

The appliance has two Napatech cards, each with four ports. By default, the four ports on the first network capture card are configured for inbound traffic from the network tap. If the appliance is included in a stack, the ports are reconfigured for two inbound ports and two outbound ports.

The management ports are associated with port 3 and port 4. These ports are used to replicate data between QRadar Network Insights and the Console. Port 5 is reserved for the Dell iDRAC remote management system.

The only ports that accept raw network traffic through a mirrored span port or a network tap are the designated Napatech card ports. The Network Packet Capture Card is displayed in Figure 1. If it is a stand-alone QRadar Network Insights appliance, then all four ports are the same. If you are trying to stack the product, only two out of the four ports receive traffic.

For more information about cabling stacked appliances, see the QRadar Network Insights Installation Guide.

Important: The second Napatech card is cabled internally for load balancing and cannot be used. If you use these ports when you cable the appliance, you do not get any data.

The following table shows the hardware information and requirements for the QRadar Network Insights 1920-C appliance.

Table 1. QRadar Network Insights 1920-C specifications
Description Value
CPU 2 x EPYC 9254, 24 C, 2.9 GHz, 128 MB Cache, 200 W
Network capture transceivers 4 x 1 Gb TX Copper SFP transceivers Finisar FCLF8522P2BTL-IG

4 x 1 Gb SX SFP transceivers Finisar FCLF8519P3BNL-IG

4 x 10 Gb SR SFP+ transceivers Finisar FCLF8574D3BCL-IG

Use these transceivers with ports, labeled as [2] in Figure 1.
Network management transceivers Dell Dual Rate 10G/25G SFP28 Transceiver

The transceiver has the following part number: DP/N 68X15 (E25GSFP28SR)

Use these transceivers with the management ports, labeled as [3] in Figure 1.
Ports

4-port 1 GbE TX OCP

2-port 10/25 GbE SFP28

2 x Napatech 4 x 10 GbE
Storage

480 GB: 2 x 480 GB 2.5” SSD RAID 1

Controller: PERC H755 8 GB NV Cache
Memory 384 GB (24 x 16 GB)
Traffic 10 Gbps
Power supply Dual redundant 1100 W AC
Dimensions 29 inches deep x 19 inches wide x 3.4 inches high (2U)
Maximum weight 34.4 kg (75.8 lbs)
Electrical and thermal

  • Two redundant 1100 W Titanium power supplies
    • 100 - 127 V ac, 50 or 60 Hz, 12 A, each power supply
    • 200 - 240 V ac, 50 or 60 Hz, 6.3 A, each power supply
  • Input power: 890.00 W
  • Apparent power: 946.81 VA
  • Thermal output: 3036.81 BTU/Hr
Environment

  • Operating temperature: 10 - 35°C (50 - 95°F) ASHRAE Class A2. The maximum ambient temperature derates by 1°C per 300 meters above 900 meters.
  • Nonoperating temperature: -40 - 65°C (-40 - 149°F)
  • Maximum operating altitude: 3,048 m (10,000 ft)
  • Maximum nonoperating altitude: 12,000 m (39,370 ft)
  • Operating noncondensing humidity: ASHRAE Class A2 8 - 80%
  • Maximum operating dew point: 21°C (70°F)
  • Nonoperating noncondensing humidity: 5 - 95%
  • Maximum nonoperating dew point: 27°C (80.6°F)

System performance of QRadar Network Insights appliances varies depending on the exact configuration and tuning of the system components. Factors such as search, extraction criteria, and the amount of network data also influence system performance.

For more information, see Performance impacts in the IBM QRadar Network Insights Installation Guide.

The following image is of the QRadar Network Insights 1920-C appliance.

Figure 1. Front and back panel of the QRadar Network Insights 1920-C appliance
Image showing the back and front panels of the QRadar 1920-C NI appliance.
Table 2. Legend for use with the QRadar Network Insights 1920-C image
Label Description
1 QRadar system storage
2 Network Packet Capture (SFP/SFP+)
3 Management Ports (10/25 GbE SFP28)
4 Management ports (1 GbE TX)
5 IMM port (1 GbE TX)
6 Do not populate these ports

For information about battery removal, see Replacing the system battery (https://dl.dell.com/content/manual25024882-dell-poweredge-r7625-installation-and-service-manual.pdf).

Appliance stacking

You can stack the QRadar Network Insights appliances (type 6200). When your deployment has incoming data on one network tap only, the stacked appliances must be cabled as shown in the following figure.

Figure 2. Cabling for stacked 1920 appliances with single network TAP
Cabling diagram for stacked appliances with single network taps

When your deployment has incoming data on two network taps, the stacked appliances must be cabled as shown in the following figure.

Figure 3. Cabling for stacked 1920 appliances with dual network TAP
Cabling diagram for stacked appliances with dual network taps