Cisco Stealthwatch Flow Sensor Virtual Appliance Installation and Configuration Guide

Type
Installation and Configuration Guide
Cisco Stealthwatch
Installation and Configuration Guide 7.0
Table of Contents
Introduction 8
Overview 8
Virtual Edition (VE) 8
Hardware 8
Audience 8
New Process 9
Required Patches 9
Terminology 9
Abbreviations 9
Before You Begin 11
Hardware 11
Virtual Appliances 11
VMware 11
KVM 12
Downloading the VE Software 12
Registering and Licensing 12
Java 12
TLS 13
Third Party Applications 13
Browsers 13
Host Name 13
Domain Name 13
NTPServer 13
Time Zone 13
Hardware Resource Requirements 15
Virtual Edition (VE) Resource Requirements 16
SMC VE 16
Copyright © 2019 Cisco Systems, Inc. All rights reserved. - 2 -
SMC VE 2000 16
Flow Collector VE 18
Flow Sensor VE 20
Flow Sensor VE Network Environments 21
Flow Sensor VE Traffic 21
UDP Director VE 23
Endpoint Concentrator 23
Data Storage 24
Access Information 26
Hypervisor Server 26
SMC VE 27
Console Access 27
Admin Access 27
Flow Collector VE 28
Console Access 28
Admin Access 28
Flow Sensor VE 29
Console Access 29
Admin Access 29
UDP Director VE 30
Console Access 30
Admin Access 30
Endpoint Concentrator 31
Console Access 31
Admin Access 31
Quick Reference Workflows 32
Stealthwatch Hardware 32
Stealthwatch Virtual Edition 32
1. Installing a Virtual Appliance:Preparing your Network 33
Copyright © 2019 Cisco Systems, Inc. All rights reserved. - 3 -
Overview 33
Placing the Appliances 33
Stealthwatch Management Console 33
Stealthwatch Flow Collector 33
Stealthwatch Flow Sensor 33
Important Considerations for Integration 34
TAPs 34
Using Electrical TAPs 35
Using Optical TAPs 35
Using TAPs Outside Your Firewall 36
Placing the Flow Sensor VE Inside Your Firewall 37
SPAN Ports 38
Stealthwatch UDP Director 39
Configuring Your Firewall for Communications 39
Open Ports 39
SMC, Flow Collector, Flow Sensor, and UDP Director 39
Endpoint Concentrator 40
Communication Ports and Protocols 40
Optional Communication Ports 42
2a. Installing a Virtual Appliance using VMware 46
Overview 46
Before You Begin 46
Installing a Virtual Appliance Using vCenter (OVF) 47
Process Overview 47
1. Logging in to the VMware Client 47
2. Configuring the Flow Sensor to Monitor Traffic 48
Monitoring a vSwitch with Multiple Hosts 48
Configuration Requirements 48
Monitoring a vSwitch with a Single Host 53
Copyright © 2019 Cisco Systems, Inc. All rights reserved. - 4 -
Add a Port Group 53
Set the Port Group to Promiscuous Mode 57
3. Installing the Virtual Appliance 60
4. Defining Additional Monitoring Ports (Flow Sensors only) 67
Installing a Virtual Appliance on an ESXi Stand-Alone Server (ISO) 71
Process Overview 71
1. Logging in to the VMware Web Client 71
2. Booting from the ISO 74
2b. Installing a Virtual Appliance on a KVM Host 75
Overview 75
Before You Begin 75
Process Overview 75
1. Installing a Virtual Appliance on a KVM Host 76
2. Adding NIC and Promiscuous Port Monitoring on an Open vSwitch (Flow
Sensors Only) 82
3. Configuring the IPAddresses 84
Configure the IP Addresses 84
4. Configuring Your Appliances 88
Preparation 88
Appliance Setup Tool Requirements 88
Managed or Stand-Alone 88
SMC Failover 88
Best Practices 89
Configuration Order 90
1. Log In 91
2. Configure the Appliance 92
3. Configure your Flow Collectors for Central Management 97
4. Confirm Appliance Status 98
5. Finishing Appliance Configurations 100
Copyright © 2019 Cisco Systems, Inc. All rights reserved. - 5 -
UDP Director 101
Configuring Forwarding Rules Using the SMC 101
Configuring Forwarding Rules Using Appliance Administration 103
Configuring High Availability Using Appliance Administration 105
Primary Node and Secondary Node 105
Requirements 106
1. Configure the Primary UDP Director HA 106
2. Configure the Secondary UDP Director HA 108
Flow Sensor 109
1. Configure the Application ID and Payload 109
2. Configure the Flow Sensor to Identify Applications (optional) 111
3. Restart the Appliance 111
Endpoint Concentrator 112
Troubleshooting the Endpoint Concentrator 114
6. Activating Licenses 115
7. Verifying Communications 116
Overview 116
Verify NetFlow Data Collection 116
8. Installing v7.0.x Patches 118
Defining an SMCFailover Relationship 119
Enabling the SLIC Threat Feed 120
Copying the SLIC Feed Key 120
Enabling the SLIC Threat Key 120
9. Getting Started with Stealthwatch 124
Overview 124
Managing Your Environment 124
Investigating Behavior 124
Responding To Threats 125
Central Management 126
Copyright © 2019 Cisco Systems, Inc. All rights reserved. - 6 -
Central Management and Appliance Administration Interface 126
Opening Central Management 127
Opening Appliance Admin 127
Opening Appliance Admin through Central Management 127
Opening Appliance Admin through Direct Login 127
Editing Appliance Configuration 127
Viewing Appliance Statistics 129
Removing an Appliance from Central Management 129
Adding an Appliance to Central Management 130
Installing Patches and Updating Software 131
Troubleshooting 132
Config Channel Down 132
Opening Appliance Administration Interface 132
Replacing the Appliance Identity 133
Changing Appliances After Configuration 133
Changing the Host Name 133
Changing the Network Domain Name 134
Changing IP Address 134
Opening the Appliance Setup Tool 135
Changing the Trusted Hosts 135
Resetting Factory Defaults 136
Resetting Passwords 136
Enabling or Disabling Password Reset 136
Resetting Passwords 137
Resetting Admin, Sysadmin, and Root Passwords 137
Resetting Sysadmin and Root Passwords 139
Contacting Support 142
Copyright © 2019 Cisco Systems, Inc. All rights reserved. - 7 -
Introduction
Overview
Use this guide to configure the following Cisco Stealthwatch Enterprise hardware and
Virtual Edition (VE) appliances:
lStealthwatch Management Console (SMC)
lStealthwatch Flow Collector
lStealthwatch Flow Sensor
lStealthwatch UDP Director
lEndpoint Concentrator
For more information about Stealthwatch, refer to the following online resources:
lOverview: https://www.-
cisco.com/c/en/us/products/security/stealthwatch/index.html
lAppliances: https://www.-
cisco.com/c/en/us/products/security/stealthwatch/datasheet-listing.html
Virtual Edition (VE)
You can use this guide to install and configure your virtual appliances.
Hardware
If you are configuring Stealthwatch hardware, install your physical appliances using the
Stealthwatch x210 Series Hardware Installation Guide before you start this con-
figuration.
Audience
The intended audience for this guide includes network administrators and other per-
sonnel who are responsible for installing and configuring Stealthwatch products.
If you are configuring virtual appliances, we assume you have basic familiarity with
VMware or KVM.
If you prefer to work with a professional installer, please contact your local Cisco Partner
or Cisco Stealthwatch Support.
Copyright © 2019 Cisco Systems, Inc. All rights reserved. - 8 -
Introduction
New Process
If you are familiar with Stealthwatch, please note that we have a new process for
installing and configuring your Stealthwatch appliances. The configuration includes the
following:
lConfiguration Order: Make sure you install and configure the appliances fol-
lowing the instructions in this guide and using the new order.
lCertificates: Appliances are installed with a unique, self-signed appliance iden-
tity certificate.
lCentral Management: You can manage your appliances from the primary
SMC/Central Manager.
For details, refer to the Release Notes.
Required Patches
After you install and configure your appliances, make sure you install the required
patches using the patch readme notes.
For details, refer to 8. Installing v7.0.x Patches
Terminology
This guide uses the term appliancefor any Stealthwatch product, including virtual
products such as the Stealthwatch Flow Sensor Virtual Edition (VE).
A "cluster" is your group of Stealthwatch appliances that are managed by the Stealth-
watch Management Console (SMC).
Most appliances are managed by the SMC. If an appliance is not managed by the SMC,
such as an Endpoint Concentrator, it is described as a "stand-alone appliance."
Abbreviations
The following abbreviations may appear in this guide:
Abbreviations Definition
DNS Domain Name System (Service or Server)
dvPort Distributed Virtual Port
Copyright © 2019 Cisco Systems, Inc. All rights reserved. - 9 -
Introduction
Abbreviations Definition
ESX Enterprise Server X
GB Gigabyte
IDS Intrusion Detection System
IPS Intrusion Prevention System
ISO International Standards Organization
IT Information Technology
KVM Kernel-based Virtual Machine
MTU Maximum Transmission Unit
NTP Network Time Protocol
OVF Open Virtualization Format
SMC Stealthwatch Management Console
TB Terabyte
UUID Universally Unique Identifier
VDS vNetwork Distributed Switch
VE Virtual Edition
VLAN Virtual Local Area Network
VM Virtual Machine
Copyright © 2019 Cisco Systems, Inc. All rights reserved. - 10 -
Introduction
Before You Begin
Before you begin, review this guide to understand the process as well as the pre-
paration, time, and resources you'll need to plan for the installation and configuration.
Hardware
lInstallation: Make sure you install your appliance hardware (physical appliances)
using the Stealthwatch x210 Series Hardware Installation Guide before you con-
figure them using this guide.
lSpecifications: Hardware specifications are available on Cisco.com.
lSupported Platforms: To view the supported hardware platforms for each sys-
tem version, refer to the Hardware Version and Support Matrix on Cisco.com.
lWork Flow: See Quick Reference Workflows to review the instructions you'll
need to configure your hardware.
Virtual Appliances
You can use a VMware environment or KVM (Kernel-based Virtual Machine) for the vir-
tual appliance installation. It is important to review the following compatibility inform-
ation:
VMware
lCompatibility: VMware v6.0 or v6.5.
lEnvironment: You can install your virtual appliances on VMware vCenter or on an
ESXi stand-alone server. Refer to 2a. Installing a Virtual Appliance using
VMware for details.
lOVF Deployment: We validated VMware v6.5 using update 2 and the vSphere
flash web client. There may be issues using other clients from vSphere. You can
use the ESXi 6.5 update 2 HTML5 client, but you may encounter system time-
outs.
lVMware Upgrades: Stealthwatch VE appliances that are running on older ver-
sions of VMware are not compatible with v6.5. If you upgrade your VMware envir-
onment to v6.x, delete your existing Stealthwatch VE appliances and reinstall
them.
lLive migration (for example, with vMotion) from host to host is not supported.
lSnapshots:Virtual machine snapshots are not supported.
Copyright © 2019 Cisco Systems, Inc. All rights reserved. - 11 -
Before You Begin
Do not install VMware Tools on a Stealthwatch virtual appliance because it will
override the custom version already installed. Doing so would render the virtual
appliance inoperable and require reinstallation.
KVM
lCompatibility: using any compatible Linux distribution.
lKVM Host Versions: There are several methods used to install a virtual machine
on a KVM host. We tested KVM and validated performance using the following
components:
llibvirt 3.0.0
lqemu-KVM 2.8.0
lOpen vSwitch 2.6.1
lLinux Kernel 4.4.38
lVirtualization Host: For minimum requirements and best performance, review the
Virtual Edition (VE) Resource Requirements section and see the hardware spe-
cification sheet for your appliance at Cisco.com.
The system performance is determined by the host environment. Your per-
formance may vary.
Downloading the VE Software
If you are installing virtual appliances, download the appliance installation file (OVF or
ISO) from the Download and License Center. For instructions, refer to the Down-
loading and Licensing Stealthwatch Products Guide.
Registering and Licensing
As part of the configuration process for both hardware and virtual appliances, you will
register and license your Stealthwatch products. For instructions, refer to the Down-
loading and Licensing Stealthwatch Products Guide.
Java
Stealthwatch requires Java version 8 (latest available update) to run the SMC Desktop Client.
We do not support Java versions 9, 10, or 11.
Review the following product capabilities to determine if you need to install the Java Runtime
Environment:
Copyright © 2019 Cisco Systems, Inc. All rights reserved. - 12 -
Before You Begin
lSMC Desktop Client: maps, customizable dashboards, response management, system
alarms, SLIC configuration, SMC failover configuration, license management across a
cluster, TACACS and RADIUS configuration, and Stealthwatch domain editing. Install the
Java Runtime Environment only for users who require these capabilities. There may be
more capabilities than the information shown here.
lWeb User Interface: Most product capabilities are available through the Web
user interface, and the Java Runtime Environment may not be required.
TLS
Stealthwatch requires TLS v1.1 or v1.2.
Third Party Applications
Stealthwatch does not support installing third party applications on appliances.
Browsers
lCompatible Browsers: Stealthwatch supports the latest version of Chrome, Fire-
fox, and Edge.
lMicrosoft Edge: There may be a file size limitation with Microsoft Edge. We do
not recommend using Microsoft Edge to install the VE OVF or ISO files.
Host Name
A unique host name is required for each appliance. We cannot configure an appliance
with the same host name as another appliance.
Domain Name
A fully qualified domain name is required for each appliance. We cannot install an appli-
ance with an empty domain.
NTPServer
lConfiguration: At least 1 NTP server is required for each appliance.
lProblematic NTP:Remove the 130.126.24.53 NTP server if it is in your list of
servers. This server is known to be problematic and it is no longer supported in our
default list of NTP servers.
Time Zone
All Stealthwatch appliances use Coordinated Universal Time (UTC) in v7.0.x.
Copyright © 2019 Cisco Systems, Inc. All rights reserved. - 13 -
Before You Begin
lVirtual Host Server: Make sure your virtual host server is set to the correct time.
Make sure the time setting on the virtual host server (where you will be
installing the virtual appliances) is set to the correct time. Otherwise, the appli-
ances may not be able to boot up.
Copyright © 2019 Cisco Systems, Inc. All rights reserved. - 14 -
Before You Begin
Hardware Resource Requirements
Use the following table to record the settings that you will need to configure Stealth-
watch appliances.
Settings SMC Flow
Collector
Flow
Sensor
UDP
Director
Host Name
IP Address 192.168.1.11* 192.168.1.4* 192.168.1.7* 192.168.1.2*
Subnet Mask
Gateway   
DNS Server(s)
NTP Server(s)
Mail Relay
*These are default IP addresses. The Flow Collector sFlow default is
192.168.1.5. The default for the Flow Collector 5000 Series Database is
192.168.1.15.
In addition, you could also use the following settings:
Port exporting flow data (usually 2055) ________________________________
SNMP read-only community string of routers _________________________________
___________________________________
Copyright © 2019 Cisco Systems, Inc. All rights reserved. - 15 -
Hardware Resource Requirements
Virtual Edition (VE) Resource Requirements
This section provides the resource requirements for the virtual appliances. Use the
tables provided in this section to record settings you will need to install and configure
the Stealthwatch VE appliances.
SMC VE
To determine the minimum resource allocations for the SMC VE, you should determine
the number of Flow Collectors and users expected to log in to the SMC.
Refer to the following specifications to determine your resource allocations:
Flow Col-
lectors
Concurrent
Users*
Minimum
Reserved
Memory
Recommended
Reserved Memory
Reserved
CPUs
1 2 16 GB 24 GB 3
3 5 24 GB 32 GB 4
5 10 32 GB 32 GB 4
*Concurrent users include scheduled reports and people using the SMC client at the
same time.
ReservedMemory: If your system will have a limited number of Flow Collectors and a
small amount of data collection, you can use the Minimum Reserved Memory amount. If
your system will have a large amount of data collection, use the Recommended
Reserved Memory amount.
SMC VE 2000
The following specifications are the default settings for the download of the SMC VE
2000, the minimum recommended, and an estimate of the hardware equivalent:
OVF or ISO Minimum Recommended Hardware Equivalent*
RAM 64 GB 64 GB 128 GB
CPU 8 8 28
Copyright © 2019 Cisco Systems, Inc. All rights reserved. - 16 -
Virtual Edition (VE) Resource Requirements
*These figures are based on the SMC 2010 appliance and physical (non hyper-threaded)
cores.
These are the Stealthwatch Management Console VE models and their capacities:
SMC VE
Model Reserved Memory Reserved CPUs
SMC VE 63 GB up to 7
SMC VE 2000 64 GB 8 or more
Copyright © 2019 Cisco Systems, Inc. All rights reserved. - 17 -
Virtual Edition (VE) Resource Requirements
Flow Collector VE
To determine your resource allocations for the Flow Collector VE, you should determine
the flows per second expected on the network, and the number of exporters and hosts it
is expected to monitor. Refer to the following specifications to determine your resource
allocations:
Flows per
second Exporters Hosts
Recommended
Reserved
Memory
Reserved
CPUs
Flow Col-
lector VE
Model
Up to 4,500 Up to 250 Up to
125,000 16 GB 2 FCVE
Up to
15,000 Up to 500 Up to
250,000 24 GB 3 FCVE
Up to
22,500
Up to
1000
Up to
500,000 32 GB 4 FCVE
Up to
30,000
Up to
1000
Up to
500,000 32 GB 5 FCVE
Up to
60,000
Up to
1500
Up to
750,000 64 GB 6 2000
Up to
120,000
Up to
2000
Up to
1,000,000 128 GB 7 4000
Copyright © 2019 Cisco Systems, Inc. All rights reserved. - 18 -
Virtual Edition (VE) Resource Requirements
These are the Flow Collector VE models and their capacities*:
FC VE
Model
Flows per
second Exporters Hosts Reserved
Memory
Reserved
CPUs
1000 Up to 30,000 Up to
1,000
Up to
500,000 32 GB 5
2000 Up to 60,000 Up to
1,500
Up to
750,000
33 GB and
65 GB 6
4000 Up to 120,500 Up to
2,000
Up to
1,000,000 ≥66 GB 7
*These figures are based on tests with Cisco UCS C220 M4, which contains the fol-
lowing:
lProcessors: 2 Intel(R) Xeon(R) CPU E5-2650 v4 @ 2.20 GHz, 2 sockets, 12 cores
per socket
lMemory: 256 GB
lStorage: 2.2 TB HDD
lESXi: VMware vSphere 6.5.0
Copyright © 2019 Cisco Systems, Inc. All rights reserved. - 19 -
Virtual Edition (VE) Resource Requirements
Flow Sensor VE
Stealthwatch offers various types of Flow Sensor VEs depending upon the number of
NICs for the Flow Sensor VE.
lCache: The Flow Cache Size column indicates the maximum number of active
flows that the Flow Sensor can process at the same time. The cache adjusts with
the amount of reserved memory, and flows are flushed every 60 seconds. Use the
Flow Cache Size to calculate the amount of memory needed for the amount of
traffic being monitored.
lRecommendations: The allocations presented in the table are only recom-
mendations. To achieve desired throughput, any particular environment may
require more or less resources and may depend on a number of variables, such as
average packet size, burst rate, and other network and host conditions.
License
Type
NICs - mon-
itoring
ports (1
GB)
Reserved
CPUs
Reserved
Memory
Hardware Throughput
Equivalent
Flow
Cache
Size
FSBASE 1 1 4 GB N/A 32,766
FSBASE
4 8 16 GB
Up to FS1200
* Interfaces configured
as PCI pass-through (igb
compliant or e1000e
compliant)
131,073
5 32 32 GB
Up to FS2200
* Interfaces configured
as PCI pass-through (igb
compliant or e1000e
compliant)
262,145
Optional:One or more 10G NICs may be used on the physical VM host.
These figures are based on tests with Cisco UCS C220 M4, which contains the fol-
lowing:
Copyright © 2019 Cisco Systems, Inc. All rights reserved. - 20 -
Virtual Edition (VE) Resource Requirements
  • Page 1 1
  • Page 2 2
  • Page 3 3
  • Page 4 4
  • Page 5 5
  • Page 6 6
  • Page 7 7
  • Page 8 8
  • Page 9 9
  • Page 10 10
  • Page 11 11
  • Page 12 12
  • Page 13 13
  • Page 14 14
  • Page 15 15
  • Page 16 16
  • Page 17 17
  • Page 18 18
  • Page 19 19
  • Page 20 20
  • Page 21 21
  • Page 22 22
  • Page 23 23
  • Page 24 24
  • Page 25 25
  • Page 26 26
  • Page 27 27
  • Page 28 28
  • Page 29 29
  • Page 30 30
  • Page 31 31
  • Page 32 32
  • Page 33 33
  • Page 34 34
  • Page 35 35
  • Page 36 36
  • Page 37 37
  • Page 38 38
  • Page 39 39
  • Page 40 40
  • Page 41 41
  • Page 42 42
  • Page 43 43
  • Page 44 44
  • Page 45 45
  • Page 46 46
  • Page 47 47
  • Page 48 48
  • Page 49 49
  • Page 50 50
  • Page 51 51
  • Page 52 52
  • Page 53 53
  • Page 54 54
  • Page 55 55
  • Page 56 56
  • Page 57 57
  • Page 58 58
  • Page 59 59
  • Page 60 60
  • Page 61 61
  • Page 62 62
  • Page 63 63
  • Page 64 64
  • Page 65 65
  • Page 66 66
  • Page 67 67
  • Page 68 68
  • Page 69 69
  • Page 70 70
  • Page 71 71
  • Page 72 72
  • Page 73 73
  • Page 74 74
  • Page 75 75
  • Page 76 76
  • Page 77 77
  • Page 78 78
  • Page 79 79
  • Page 80 80
  • Page 81 81
  • Page 82 82
  • Page 83 83
  • Page 84 84
  • Page 85 85
  • Page 86 86
  • Page 87 87
  • Page 88 88
  • Page 89 89
  • Page 90 90
  • Page 91 91
  • Page 92 92
  • Page 93 93
  • Page 94 94
  • Page 95 95
  • Page 96 96
  • Page 97 97
  • Page 98 98
  • Page 99 99
  • Page 100 100
  • Page 101 101
  • Page 102 102
  • Page 103 103
  • Page 104 104
  • Page 105 105
  • Page 106 106
  • Page 107 107
  • Page 108 108
  • Page 109 109
  • Page 110 110
  • Page 111 111
  • Page 112 112
  • Page 113 113
  • Page 114 114
  • Page 115 115
  • Page 116 116
  • Page 117 117
  • Page 118 118
  • Page 119 119
  • Page 120 120
  • Page 121 121
  • Page 122 122
  • Page 123 123
  • Page 124 124
  • Page 125 125
  • Page 126 126
  • Page 127 127
  • Page 128 128
  • Page 129 129
  • Page 130 130
  • Page 131 131
  • Page 132 132
  • Page 133 133
  • Page 134 134
  • Page 135 135
  • Page 136 136
  • Page 137 137
  • Page 138 138
  • Page 139 139
  • Page 140 140
  • Page 141 141
  • Page 142 142
  • Page 143 143

Cisco Stealthwatch Flow Sensor Virtual Appliance Installation and Configuration Guide

Type
Installation and Configuration Guide

Ask a question and I''ll find the answer in the document

Finding information in a document is now easier with AI