Cisco Secure Network Analytics Virtual Flow Collector Installation guide

Cisco Stealthwatch

Virtual Edition Appliance Installation Guide 7.3.2

Table of Contents

Introduction 6

Overview 6

Audience 6

Terminology 6

Abbreviations 7

Before You Begin 9

Installation and Configuration Order 9

Stealthwatch Data Store 9

Installation Methods 10

Compatibility 11

General Requirements for All Appliances 11

VMware 11

KVM 12

Downloading Software 12

TLS 12

Third Party Applications 12

Browsers 13

Host Name 13

Domain Name 13

NTPServer 13

Time Zone 13

Resource Requirements 14

Stealthwatch Management Console VE 15

Stealthwatch Management Console 15

Flow Collector VE 16

Flow Collector 16

Flow Sensor VE 17

Flow Sensor VE Network Environments 18

Flow Sensor VE Traffic 19

UDP Director VE 20

Data Storage 21

1. Configuring your Firewall and Ports 23

Overview 23

Placing the Appliances 23

Stealthwatch Management Console 23

Stealthwatch Flow Collector 23

Stealthwatch Flow Sensor 23

Important Considerations for Integration 24

TAPs 25

Using Electrical TAPs 25

Using Optical TAPs 26

Using TAPs Outside Your Firewall 26

Placing the Flow Sensor VE Inside Your Firewall 27

SPAN Ports 28

Stealthwatch UDP Director 29

Configuring Your Firewall for Communications 30

Open Ports 30

Stealthwatch Management Console (SMC), Flow Collector, Flow Sensor,

and UDP Director 30

Communication Ports and Protocols 31

Optional Communication Ports 33

Stealthwatch Deployment Example 34

2. Downloading VE Installation Files 35

Installation Files 35

1. Log in to Cisco Software Central 35

2. Download Files 36

3a. Installing a Virtual Appliance using VMware vCenter (ISO) 37

Overview 37

Before You Begin 37

Installing a Virtual Appliance Using vCenter (ISO) 38

Process Overview 38

1. Logging in to the VMware Web Client 38

2. Configuring the Flow Sensor to Monitor Traffic 39

Monitoring External Traffic with PCI Pass-Through 39

Monitoring a vSwitch with Multiple Hosts 40

Configuration Requirements 40

Monitoring a vSwitch with a Single Host 43

Configuration Requirements 43

Configure the Port Group to Promiscuous Mode 43

3. Installing the Virtual Appliance 46

4. Defining Additional Monitoring Ports (Flow Sensors only) 53

3b. Installing a Virtual Appliance on an ESXi Stand-Alone Server (ISO) 56

Overview 56

Before You Begin 56

Installing a Virtual Appliance on an ESXi Stand-Alone Server (ISO) 57

Process Overview 57

1. Logging in to the VMware Web Client 57

2. Booting from the ISO 59

3c. Installing a Virtual Appliance on a KVM Host (ISO) 61

Overview 61

Before You Begin 61

Installing a Virtual Appliance on a KVM Host (ISO) 62

Process Overview 62

1. Installing a Virtual Appliance on a KVM Host 62

Monitoring Traffic 62

Configuration Requirements 62

Installing a Virtual Appliance on a KVM Host 62

2. Adding NIC (Flow Sensor) and Promiscuous Port Monitoring on an Open

vSwitch (Flow Sensors Only) 69

4. Configuring your Environment using First Time Setup 71

Configuring a Stealthwatch Management Console or Flow Collector 71

Configuring a Flow Sensor or UDPDirector 75

Troubleshooting 79

Certificate Error 79

Accessing the Appliance 79

5. Configuring your Stealthwatch System 81

Contacting Support 82

Introduction

Overview

Use this guide to install the following Cisco Stealthwatch Enterprise Virtual Edition (VE)

appliances:

lStealthwatch Management Console (SMC) VE

lStealthwatch Flow Collector VE

lStealthwatch Flow Sensor VE

lStealthwatch UDP Director VE

For more information about Stealthwatch, refer to the following online resources:

lOverview:

https://www.cisco.com/c/en/us/products/security/stealthwatch/index.html

lAppliances:

https://www.cisco.com/c/en/us/products/security/stealthwatch/datasheet-

listing.html

lRelease Notes:For details, refer to the Release Notes.

lHardware Installation Guides:To install Stealthwatch x2xx series hardware,

download the guides from

https://www.cisco.com/c/en/us/support/security/stealthwatch/products-

installation-guides-list.html.

Audience

The intended audience for this guide includes network administrators and other

personnel who are responsible for installing and configuring Stealthwatch products.

If you are configuring virtual appliances, we assume you have basic familiarity with

VMware or KVM.

If you prefer to work with a professional installer, please contact your local Cisco Partner

or Cisco Stealthwatch Support.

Terminology

This guide uses the term “appliance” for any Stealthwatch product, including virtual

products such as the Stealthwatch Flow Sensor Virtual Edition (VE).

Introduction

A "cluster" is your group of Stealthwatch appliances that are managed by the

Stealthwatch Management Console (SMC).

Abbreviations

The following abbreviations may appear in this guide:

Abbreviations Definition

DNS Domain Name System (Service or Server)

dvPort Distributed Virtual Port

ESX Enterprise Server X

GB Gigabyte

IDS Intrusion Detection System

IPS Intrusion Prevention System

ISO International Standards Organization

IT Information Technology

KVM Kernel-based Virtual Machine

MTU Maximum Transmission Unit

NTP Network Time Protocol

SMC Stealthwatch Management Console

TB Terabyte

UUID Universally Unique Identifier

VDS vNetwork Distributed Switch

VE Virtual Edition

VLAN Virtual Local Area Network

Introduction

Abbreviations Definition

VM Virtual Machine

Introduction

Before You Begin

Before you begin, review this guide to understand the process as well as the

preparation, time, and resources you'll need to plan for the installation.

Installation and Configuration Order

Before you install your virtual appliances, please note the required order for installing

and configuring Stealthwatch.

1. Install Virtual Appliances:Install your Stealthwatch Virtual Edition (VE)

appliances using this installation guide.

2. Configure Stealthwatch: After you install hardware and virtual appliances, you

are ready to configure Stealthwatch. This step is critical for the successful

configuration and communication of your system.

Follow the instructions in the Stealthwatch System Configuration Guide v7.3.2,

and note the following:

lConfiguration Order: Make sure you configure the appliances in order.

lCertificates: Appliances are installed with a unique, self-signed appliance

identity certificate.

lCentral Management: Use the primary SMC/Central Manager to manage

your appliances and change configuration settings.

After you install your appliances, you will configure Stealthwatch using the

Stealthwatch System Configuration Guide v7.3.2. This step is critical for the

successful configuration and communication of your system.

Stealthwatch Data Store

If you need to deploy Stealthwatch with a Data Store, do not follow the instructions in

this guide. Follow the instructions in the Virtual Edition (with Data Store) Appliance

Installation Guide.



Before You Begin

Installation Methods

You can use a VMware environment or KVM (Kernel-based Virtual Machine) for the

virtual appliance installation.

Before you start the installation, review the compatibility information and

resource requirements.

Use the following table to choose an installation method. Also, make sure you review

the compatibility and resource requirements before you start the installation.

Method

Installation

Instructions

(for reference)

Installation File Details

VMware vCenter

3a. Installing a

Virtual Appliance

using VMware

vCenter (ISO)

ISO

Installing your virtual

appliances using VMware

vCenter.

VMware ESXi

Stand-Alone

Server

3b. Installing a

Virtual Appliance

on an ESXi Stand-

Alone Server (ISO)

ISO

Installing your virtual

appliances on an ESXi

stand-alone host server.

KVM and Virtual

Machine

Manager

3c. Installing a

Virtual Appliance

on a KVM Host

(ISO)

ISO

Installing your virtual

appliances using KVM and

Virtual Machine Manager.

Before You Begin

Compatibility

Whether you plan to install your virtual appliances in a VMware environment or KVM

(Kernel-based Virtual Machine), make sure you review the following compatibility

information:

General Requirements for All Appliances

Requirement Description

Dedicated

Resources

All appliances require the allocation of dedicated resources and

cannot be shared with other appliances or hosts.

No Live

Migration

Appliances do not support vMotion due to the possibility of

corruption.

Network

Adapter

All appliances require at least 1 network adapter.

Flow Sensors can be configured with additional adapters to support

additional throughput.

Storage

Controller

When configuring the ISOin VMware, select the LSILogic

SASSCSIController type.

Storage

Provisioning

Assign Thick Provisioned Lazy Zeroed storage provisioning when

deploying virtual appliances.

VMware

lCompatibility: VMware v6.5, v6.7, v7.0.

lOperating System:Debian 10 64-bit.

lISODeployment: We validated VMware v6.5 using update 2 and the vSphere

flash-based web client. There may be issues using other clients from vSphere.

You can use the ESXi 6.5 update 2 HTML5 client, but you may encounter system

time-outs.

lLive migration: We do not support host to host live migration (for example, with

vMotion).

lSnapshots:Virtual machine snapshots are not supported.

Before You Begin

Do not install VMware Tools on a Stealthwatch virtual appliance because it will

override the custom version already installed. Doing so would render the virtual

appliance inoperable and require reinstallation.

KVM

lCompatibility: You can use any compatible Linux distribution.

lKVM Host Versions: There are several methods used to install a virtual machine

on a KVM host. We tested KVM and validated performance using the following

components:

llibvirt 3.0.0 - 6.5.0

lqemu-KVM 2.8.0 - 5.0.0

lOpen vSwitch 2.6.1 - 2.13.0

lLinux Kernel 4.4.38 - 5.4.55

lOperating System:Debian 10 64-bit.

lVirtualization Host: For minimum requirements and best performance, review the

Resource Requirements section and see the hardware specification sheet for

your appliance at Cisco.com.

The system performance is determined by the host environment. Your

performance may vary.

Downloading Software

Use Cisco Software Central to download virtual appliance (VE) installation files, patches,

and software update files. Log in to your Cisco Smart Account at

https://software.cisco.com or contact your administrator. Refer to 2. Downloading VE

Installation Files for instructions.

TLS

Stealthwatch requires v1.2.

Third Party Applications

Stealthwatch does not support installing third party applications on appliances.

Before You Begin

Browsers

lCompatible Browsers: Stealthwatch supports the latest version of Chrome,

Firefox, and Edge.

lMicrosoft Edge: There may be a file size limitation with Microsoft Edge. We do

not recommend using Microsoft Edge to install the VE ISO files.

Host Name

A unique host name is required for each appliance. We cannot configure an appliance

with the same host name as another appliance. Also, make sure each appliance host

name meets the Internet standard requirements for Internet hosts.

Domain Name

A fully qualified domain name is required for each appliance. We cannot install an

appliance with an empty domain.

NTPServer

lConfiguration: At least 1 NTP server is required for each appliance.

lProblematic NTP:Remove the 130.126.24.53 NTP server if it is in your list of

servers. This server is known to be problematic and it is no longer supported in our

default list of NTP servers.

Time Zone

All Stealthwatch appliances use Coordinated Universal Time (UTC).

lVirtual Host Server: Make sure your virtual host server is set to the correct time.

Make sure the time setting on the virtual host server (where you will be

installing the virtual appliances) is set to the correct time. Otherwise, the

appliances may not be able to boot up.

Before You Begin

Resource Requirements

This section provides the resource requirements for the virtual appliances. Use the

tables provided in this section to record settings you will need to install and configure

the Stealthwatch VE appliances.

lStealthwatch Management Console (SMC)

lFlow Collector

lFlow Sensor

lUDP Director

lData Storage

Make sure you reserve the required resources for your system. This step is

critical for system performance.

If you choose to deploy Cisco Stealthwatch appliances without the required

resources, you assume the responsibility to closely monitor your appliance

resource utilization and increase resources as needed to ensure proper health

and function of the deployment.

Resource Requirements

Stealthwatch Management Console VE

To determine the minimum resource allocations for the Stealthwatch Management

Console VE, you should determine the number of concurrent users expected to log in to

the SMC.

Refer to the following specifications to determine your resource allocations.

Stealthwatch Management Console

Concurrent

Users*

Required

Reserved

Memory

Required

Reserved

CPUs

Minimum

Storage

Space

up to 9 32 GB 4 125 GB

10 or more 64 GB 8 200 GB

*Concurrent users include scheduled reports and people using the SMC client at the

same time.

Resource Requirements

Flow Collector VE

To determine your resource requirements for the Flow Collector VE you should

determine the flows per second expected on the network and the number of exporters

and hosts it is expected to monitor. Refer to the following specifications to determine

your resource requirements:

Flow Collector

Flows per

second Interfaces Exporters

Required

Reserved

Memory

Required

Reserved CPUs

Up to 10,000 Up to 65535 Up to 1024 24 GB 2

Up to 30,000 Up to 65535 Up to 1024 32 GB 6

Up to 60,000 Up to 65535 Up to 2048 64 GB 8

Up to 120,000 Up to 65535 Up to 4096 128 GB 12

Resource Requirements

Flow Sensor VE

Stealthwatch offers various types of Flow Sensor VEs depending upon the number of

NICs for the Flow Sensor VE.

lCache: The Flow Cache Size column indicates the maximum number of active

flows that the Flow Sensor can process at the same time. The cache adjusts with

the amount of reserved memory, and flows are flushed every 60 seconds. Use the

Flow Cache Size to calculate the amount of memory needed for the amount of

traffic being monitored.

lRequirements: Your environment may require more resources depending on a

number of variables, such as average packet size, burst rate, and other network

and host conditions.

NICs -

monitoring

ports

Required

Reserved

CPUs

Required

Minimum

Reserved

Memory

Estimated Throughput

Flow Cache

Size

(maximum

number of

concurrent

flows)

1 x 1 Gbps 2 4 GB 850 Mbps 32,766

2 x 1 Gbps 4 8 GB

1,850 Mbps



Interfaces configured as

PCI pass-through

(igb/ixgbe compliant or

e1000e compliant)

65,537

4 x 1 Gbps 8 16 GB

3,700 Mbps

Interfaces configured as

PCI pass-through

(igb/ixgbe compliant or

e1000e compliant)

131,073

1 x 10 Gbps* 12 24 GB 8 Gbps ~512,000

Resource Requirements

NICs -

monitoring

ports

Required

Reserved

CPUs

Required

Minimum

Reserved

Memory

Estimated Throughput

Flow Cache

Size

(maximum

number of

concurrent

flows)

Interfaces configured as

PCI pass-through (Intel

ixgbe/i40e compliant)

2 x 10 Gbps* 22 40 GB

16 Gbps

Interfaces configured as

PCI pass-through (Intel

ixgbe/i40e compliant)

~1,000,000

*For 10 Gbps throughput, configure all CPUs in 1 socket. For each additional 10 Gbps

NIC, add 10 vCPUs and 16 GBof RAM.

Optional:One or more 10G NICs may be used on the physical VM host.

These figures are based on tests with Cisco UCS C220 M4, which contains the

following:

lProcessors: 2 Intel(R) Xeon(R) CPU E5-2620 v3 @ 2.40 GHz, 2 sockets, 12 cores

per socket

lMemory: 128 GB

lStorage: 800 GB

lESXi: VMware vSphere 6.7.0

lMonitoring Interfaces:PCI pass-through with 1 Gbps and 10 Gbps interfaces

Flow Sensor VE Network Environments

Before installing the Flow Sensor VE, make sure you know the type of network

environment you have. This guide covers all types of network environments that a Flow

Sensor VE can monitor.

Resource Requirements

Compatibility:Stealthwatch supports a VDS environment, but it does not support

VMware Distributed Resource Scheduler (VM-DRS).

Virtual Network Environments: The Flow Sensor VE monitors the following types of

virtual network environments:

lA network with virtual local area network (VLAN) trunking

lDiscrete VLANs where one or more VLANs are prohibited from attaching packet

monitoring devices (for example, due to local policy)

lPrivate VLANs

lHypervisor hosts rather than VLANs

Integration: For integration information, review Stealthwatch Flow Sensor.

Flow Sensor VE Traffic

The Flow Sensor will process traffic with the following Ethertypes:

Ethertype Protocol

0x8000 Normal IPv4

0x86dd Normal IPv6

0x8909 SXP

0x8100 VLAN

0x88a8

0x9100

0x9200

0x9300

VLAN QnQ

0x8847 MLPS unicast

0x8848 MLPS multicast

The Flow Sensor saves the top-level MPLS label or VLAN ID and exports it. It

bypasses the other labels when it is processing packets.

Resource Requirements

UDP Director VE

The UDP Director VE requires that the virtual machine meets the following

specifications:

Required

Reserved

CPU

Required

Reserved

Memory

Minimum Data

Storage

Maximum FPS

Rate

2 4 GB 60 GB 10,000

Resource Requirements

Page is loading ...

Cisco Secure Network Analytics Virtual Flow Collector Installation guide

This manual is also suitable for

Cisco Secure Network Analytics Virtual Flow Collector Installation guide

Related papers

Other documents