QRadar Network Insights 1920 M7 appliance
The IBM QRadar Network Insights 1920 (MTM 4723-N2A) appliance provides detailed analysis of network flows to extend the threat detection capabilities of IBM QRadar. QRadar Network Insights 1920 is based on the Lenovo System SR650 V2 (2U).
The appliance has two Napatech cards, each with four ports. By default, the four ports on the first network capture card are configured for inbound traffic from the network tap. If the appliance is included in a stack, the ports are reconfigured for two inbound ports and two outbound ports.
The management ports are associated with port 2 and port 4. These are used to replicate data between QRadar Network Insights and the Console. Port 3 is reserved for the XClarity Controller (XCC), remote management system.
The only ports that accept raw network traffic through a mirrored span port or a network tap are the designated Napatech card ports. The Network Packet Capture Card is displayed in Figure 1. If it is a stand-alone QRadar Network Insights appliance, then all four ports are the same. If you are trying to stack the product, only two out of the four ports receive traffic.
For more information about cabling stacked appliances, see the QRadar Network Insights Installation Guide.
The second Napatech card is cabled internally for load balancing and cannot not be used. If you use these ports when you cable the appliance, you do not get any data.
The following table shows the hardware information and requirements for the QRadar Network Insights 1920 appliance:
| Description | Value |
|---|---|
| CPU | 2 x Gold 6354 18 C 3.0 GHz 205 W |
| Network capture transceivers |
4 x 1 Gb TX Copper SFP transceivers Finisar FCLF8522P2BTL-IG 4 x 1 Gb SX SFP transceivers Finisar FCLF8519P3BNL-IG 4 x 10 Gb SR SFP+ transceivers Finisar FCLF8574D3BCL-IG Use these transceivers with the network packet capture card, labeled as [5] in the appliance diagram. |
| Network management transceivers |
Lenovo Dual Rate 10G/25G SFP28 Transceiver, The transceivers have the following part numbers: AFBR-735ASMZ-LVX Use these transceivers with the management ports, labeled as [4] in the appliance diagram |
| Ports |
4-port 1 GbE TX OCP 2-port 10/25 GbE SFP28 4 x Network capture (SFP+) ports 1 x 1 GbE RJ-45 Ethernet systems management IPMI (XCC) port |
| Storage |
480 GB: 2 x 480 GB 2.5” SSD RAID 1 Controller: RAID 540-8i |
| Memory | 256 GB (8 x 32 GB) |
| Traffic | 10 Gbps |
| Power supply | Dual redundant 1100 W AC power supply |
| Dimensions | 30.1 inches deep x 17.5 inches wide x 3.4 inches high |
System performance of QRadar Network Insights appliances varies depending on the exact configuration and tuning of the system components. It is influenced not only by hardware, but also factors such as the search, extraction criteria, and the amount of network data.
For more information, see Performance impacts in the IBM QRadar Network Insights Installation Guide.
The following image is of the QRadar Network Insights 1920 appliance.
| Label | Description |
|---|---|
| 1 | QRadar system storage |
| 2 | Management ports (1 GbE TX) |
| 3 | IIPMI (XCC) port (1 GbE RJ-45) |
| 4 | Management Ports (10/25 GbE SFP28) |
| 5 | Network Packet Capture (SFP/SFP+) |
| 6 | Do not populate these ports |
For information about battery removal, see Removing the coin-cell battery (https://thinksystem.lenovofiles.com/help/index.jsp?topic=%2F7X05%2Fcmos_battery_replacement.html&cp=4_8_8_13&anchor=CMOS_battery_replacement).
Appliance stacking
You can stack the QRadar Network Insights appliances (type 6200). When your deployment has incoming data on one network tap only, the stacked appliances must be cabled like this:
When your deployment has incoming data on two network taps, the stacked appliances must be cabled like this:
