QRadar Network Insights 1940-C D7 appliance

The IBM QRadar Network Insights 1940-C (MTM 4893-N4E) appliance provides detailed analysis of network flows to extend the threat detection capabilities of IBM QRadar. QRadar Network Insights 1940-C is based on the Dell System R7625 XL (2U).

The appliance has two Napatech 40 GbE cards. By default, the two ports on the first network capture card are configured for inbound traffic from a network tap or mirrored span. If the appliance is included in a stack, the ports are reconfigured for one inbound and one outbound.

The second Napatech card is cabled internally for load balancing and cannot not be used. The QSFP+ ports on this card are disabled. These ports do not receive data if they are connected to external traffic sources.

The management ports are associated with port items 3 and 4 in the diagram. These ports are used to replicate data between QRadar Network Insights and the Console. The port item 5 is reserved for the Dell iDRAC remote management system.

The following table shows the hardware information and requirements for the QRadar Network Insights 1940-C appliance.

Table 1. QRadar Network Insights 1940-C specifications
Description Value
CPU 2 x EPYC 9254, 24 C, 2.9 GHz, 128 MB Cache, 200 W
Network capture transceivers 2 x 40 GbE SR4 QSFP+ transceivers (Finisar FTL410QD2C-IG)

Use these transceivers with ports, labeled as [2] in Figure 1.
Network management transceivers Dell Dual Rate 10G/25G SFP28 Transceiver

The transceivers have the following part number: DP/N 68X15 (E25GSFP28SR)

Use these transceivers with the management ports, labeled as [3] in Figure 1.
Ports

4-port 1 GbE TX OCP

2-port 10/25 GbE SFP28

2 x Napatech 2 x 40 GbE
Storage

480 GB: 2x 480 GB 2.5” SSD RAID 1

Controller: PERC H755 8 GB NV Cache
Memory 384 GB (24 x 16 GB)
Traffic 40 Gbps
Power supply Dual redundant 1100 W AC
Dimensions 29 inches deep x 19 inches wide x 3.4 inches high (2U)
Maximum weight 34.4 kg (75.8 lbs)
Electrical and thermal

  • Two redundant 1100 W titanium power supplies:
    • 100 - 127 V ac at 50/60 Hz, 12 A, each power supply
    • 200 - 240 V ac at 50/60 Hz, 6.3 A, each power supply
  • Input power: 900.00 W
  • Apparent power: 957.45 VA
  • Thermal output: 3070.93 BTU/Hr
Environment

  • Operating temperature: 10 - 35°C (50 - 95°F) ASHRAE Class A2. The maximum ambient temperature derates by 1°C per 300 meters above 900 meters.
  • Nonoperating temperature: -40 - 65°C (-40 - 149°F)
  • Maximum operating altitude: 3,048 m (10,000 ft)
  • Maximum nonoperating altitude: 12,000 m (39,370 ft)
  • Operating noncondensing humidity: ASHRAE Class A2 8 - 80%
  • Maximum operating dew point: 21°C (70°F)
  • Nonoperating noncondensing humidity: 5 - 95%
  • Maximum nonoperating dew point: 27°C (80.6°F)

System performance of QRadar Network Insights appliances varies depending on the on Inspection settings and the type and amount of network data.

For more information, see Performance impacts in the IBM QRadar Network Insights Installation Guide.

The following image is of the QRadar Network Insights 1940-C appliance.

Figure 1. Front and back panel of the QRadar Network Insights 1940-C appliance
Image showing the back and front panels of the QRadar 1940-C NI appliance.
Table 2. Legend for use with the QRadar Network Insights 1940-C image
Label Description
1 QRadar system storage
2 Network Packet Capture ports (QSFP+)
3 Management ports (10/25 GbE SFP28)
4 Management ports (1 GbE TX)
5 IMM port (1 GbE TX)
6 Do not populate these ports

For more information about battery removal, see Replacing the system battery (https://dl.dell.com/content/manual25024882-dell-poweredge-r7625-installation-and-service-manual.pdf?language=en-us).

Appliance stacking

You can stack the QRadar Network Insights 1940-C (type 6600) appliances to distribute network packets across multiple Napatech cards. The following image shows how to connect the cables on up to four QRadar Network Insights 1940 appliances in a stacked configuration. On the first appliance, port 0 is used for the network tap or span port. The traffic is then mirrored to Port 1 on the same card, which sends data to port 0 of the next appliance in the stack.

Figure 2. Cabling for stacked QRadar Network Insights 1940-C appliances
Cabling diagram for stacked appliances with single network taps

For more information about stacking appliances and to learn about a breakout cable for 10 GbE links, see IBM QRadar Network Insights 1940 appliance installations.