Deploy the ExtraHop Discover Appliance with Hyper-V

Installation Requirements

This section includes hardware and software requirements for the host on which you are installing the ExtraHop virtual appliance.

System Requirements: EH1000v

Installation has the following requirements:

  • An existing installation of Hyper-V on Windows Server 2012 (or later)

  • A Hyper-V Manager client

The following server hardware is required for the EH1000v:

  • Processor: 2 processing cores with hyper-threading support, VT-x technology, and 64-bit architecture

    To use SSL decryption, three processing cores are required. Refer to ExtraHop Guide: Adding a CPU Core to the EH1000v with Hyper-V for more information.

  • Memory: 4 GB or higher

  • Disk: 46 GB or higher (thick-provisioned)

  • Network: You can configure the EH1000v to monitor intra-VM or external traffic.

    • Intra-VM: One 1-Gbps Ethernet network port is required (for management). The management port must be accessible on port 443.

    • External: Two 1-Gbps Ethernet network ports are required for the physical port mirror and management. The physical port mirror interface must be connected to the port mirror of the switch. While it is possible to use a 10-Gbps Ethernet network port for the port mirror interface, it is not recommended as the virtual appliance cannot process more than 1 Gbps of traffic.

  • Registration: For registration purposes, the EH1000v requires outbound DNS connectivity on UDP port 53 unless managed by the ExtraHop Central Manager (ECM).

System Requirements: EH2000v

Installation has the following requirements:

  • An existing installation of Hyper-V on Windows Server 2012 (or later)

  • A Hyper-V Manager client

The following server hardware is required for the EH2000v:

  • Processor: 6 processing cores with hyperthreading support, VT-x technology, and 64-bit architecture

    To use SSL decryption, three processing cores are required. Refer to ExtraHop Guide: Adding a CPU Core to the EH1000v with Hyper-V for more information.

  • Memory: 6 GB or higher

  • Disk: 255 GB or higher (thick-provisioned)

  • Network: You can configure the EH2000v to monitor intra-VM or external traffic.

    • Intra-VM: One 1-Gbps Ethernet network port is required (for management). The management interface must be accessible on port 443.

    • External: Two to four 1-Gbps Ethernet network ports are required for the physical port mirror and management. The physical port mirror interface must be connected to the port mirror of the switch. While it is possible to use a 10-Gbps Ethernet network port for the port mirror interface, it is not recommended as the virtual appliance cannot process more than 3 Gbps of traffic.

  • Registration: For registration purposes, the EH2000v requires outbound DNS connectivity on UDP port 53 unless managed by the ExtraHop Central Manager (ECM).

Installing the ExtraHop VM

Before you install the ExtraHop virtual appliance, ensure the following:

  • You have downloaded the file for the ExtraHop virtual appliance (this is an OVA file for OVA-aware hypervisor products). If you have not downloaded the file, contact support@extrahop.com.

  • You have the ExtraHop virtual appliance license key provided by ExtraHop. If you do not have a license key, contact support@extrahop.com.

  • You have an existing installation of one of the following virtualization products:

    • Microsoft Hyper-V

  • Your host system meets the minimum hardware requirements, and you understand the disk requirements for setting up an ExtraHop appliance.

  • If you are using a software tap, you have administrative access to servers you want to monitor, and you are running a 64-bit operating system (Linux/Windows). If you are using Windows, you must be using Windows Server 2008 R2 or Windows Server 2012 (or later).

  • If you want to use Port Mirroring mode, you have administrative access to any physical or virtual switches that require configuration.

Installing the Files for Hyper-V

To install the files to run the ExtraHop virtual appliance with Hyper-V, complete the following steps.

  1. Go to the Start menu and open the Hyper-V Manager.

  2. In the right pane of the Hyper-V Manager, click New and select Import Virtual Machine….

  3. In the Import Virtual Machine Wizard, click Next.

  4. Browse to the folder with the extracted files and click Next.

  5. On Select Virtual Machine, click Next.

  6. Select Copy the virtual machine and click Next.

  7. On Choose Folders for Virtual Machine Files, select the location to store the configuration of the VM and click Next.

  8. On Choose Storage Folders to Store Virtual Hard Disks, select a location to store the virtual hard disks and click Next.

  9. On the summary screen review your choices and then click Finish.

  10. Wait several minutes for the files to copy.

  11. In the Virtual Machines list, right-click the virtual machine and select Start.

  12. Right-click the virtual machine again and select Connect.

  13. Click the green start button at the top of the screen and wait for the login prompt.

  14. Run the show ipaddr command to display the IP address of the ExtraHop Discovery Edition.

    If your network does not support DHCP, see Configure a Static IP Address to set a static IP address.

    Note: The default time server setting is pool.ntp.org. To configure the time servers manually, refer to the System Settings section of the ExtraHop Admin UI Users Guide.
  15. You'll need the IP address to apply the ExtraHop license in the next procedure.

Register the Discover Appliance

Complete the following steps to apply the product key supplied by ExtraHop Customer Support. If you do not have a product key, contact support@extrahop.com.

  1. In your browser, type the IP address of the Explore appliance (https://<explore_ip_address>). If your browser prompts you about security certificates, ignore the warning and proceed.
  2. Review the license agreement, select I Agree, and then click Submit.
  3. On the log in screen, type setup for the user name and default for the password, and then click Log In.
  4. In the System Settings section, click License.
  5. Click Manage License.
  6. Click Register.
  7. Enter the product key and then click Register.

Configure a Static IP Address

The ExtraHop virtual appliance is delivered with DHCP enabled. If your network does not support DHCP, no IP address is acquired, and you must configure a static address manually. To configure a static IP address, complete the following steps:

  1. Log in to the console with the shell user account. At the password prompt, type default, and then press ENTER.

  2. Run the following command to enable privileged commands:
    enable
  3. At the password prompt, type default, and then press ENTER.
  4. Run the following command to enter configuration mode:
    configure
  5. Run the following command to enter the interface configuration mode:
    interface
  6. Run the ip command and specify the IP address and DNS settings in the following format: ip ipaddr <ip_address> <netmask> <gateway> <dns_server>

    For example:

    extrahop[ESA](config-if)# ip ipaddr 10.10.2.14 255.255.0.0 10.10.1.253 10.10.1.254
  7. Run the following command to leave the interface configuration section:
    exit
  8. Run the following command to save the running config file:
    running_config save
  9. Type Y and then press ENTER.

Mirror Wire Data

This section includes procedures for mirroring data to your ExtraHop virtual appliance.

Mirroring Internal and External Traffic

The ExtraHop virtual appliance can be configured to monitor network traffic in the following network configuration examples. Each example requires a modification to the network configuration of its hypervisor host and uses Network Adapter 1 as the management interface.

Note: Monitoring external network-mirrored traffic requires an external NIC and an associated virtual switch.

Monitoring Intra-VM Traffic

The ExtraHop Discovery Edition can be configured to monitor network traffic of another VM on the same host using Port Mirroring mode in the Hyper-V Manager. An ExtraHop virtual machine running in port mirroring mode can only monitor another virtual machine running on the same virtual switch.

Enabling Port Mirroring Mode in the Hyper-V Manager

  1. Right-click the ExtraHop Discover VM and select Settings.
  2. Expand Network Adapter and click Advanced Features.
  3. In the Port mirroring section, click the Mirroring mode drop-down list and select Source.
  4. Make note of the source network and ensure the ExtraHop system’s capture interface is on the same network.
  5. Click Apply.
  6. Click OK.
  7. Repeat these steps for all the VMs you want to monitor, excluding the first VM you created in this procedure.

Monitoring External Mirrored Traffic to the VM

This scenario requires a second physical network interface and the creation of a second vSwitch associated with that NIC. This NIC then connects to a mirror, tap, or aggregator that copies traffic from a switch. This setup is useful for monitoring the intranet of an office.

  1. Right-click the ExtraHop Discover VM and select Settings.

  2. Expand Network Adapter and click Advanced Features.

  3. In the Port mirroring section, click the Mirroring mode drop-down list and select Destination.

  4. Click the Apply button.

  5. Click OK.

  6. Expand the virtual switch associated with the external data feed and enable the Microsoft NDIS Capture switch. You can ignore the warning that the selected extension is not operating correctly.

  7. Click Apply.

  8. Click OK.

  9. Open a PowerShell prompt and run the following commands: 

    $a = Get-VMSystemSwitchExtensionPortFeature -FeatureId 776e0ba7-94a1-41c8-8f28-951f524251b5
    $a.SettingData.MonitorMode = 2
    add-VMSwitchExtensionPortFeature -ExternalPort -SwitchName <name of the switch> -VMSwitchExtensionFeature $a

Monitoring Multiple Interfaces on a Windows Server

For servers with multiple interfaces, you can configure the software tap to forward packets from a particular interface or from multiple interfaces by editing its configuration file on the server.

To edit the configuration file, complete the following steps.

  1. After installing the software tap, on the server, open the configuration file: C:\Program Files\rpcapd\rpcapd.ini

    The configuration file contains this text or similar:

    ActiveClient = 10.0.0.100,2003
    NullAuthPermit = YES
  2. Modify the existing ActiveClient line and create an ActiveClient line for each additional interface to be monitored. Specify each interface by its interface name or IP address. For every ActiveClient line, the software tap will independently forward packets from the interface specified in the line:

    ActiveClient = <extrahop_ip>, <extrahop_port>, ifname=<interface_address>

    or

    ActiveClient = <extrahop_ip>, <extrahop_port>, ifaddr=<interface_name>

    <interface_address> specifies the IP address of the interface from which the packets are forwarded. <interface_address> may be either the IP address itself, such as 10.10.1.100, or a CIDR specification (network IP address/subnet prefix length) that contains the IP address, such as 10.10.1.0/24.

    <interface_name> is the name of the interface from which the packets are forwarded. The name is formatted as \Device\NPF_{<GUID>}, where <GUID> is the globally unique identifier (GUID) of the interface. For example, if the interface GUID is 2C2FC212-701D-42E6-9EAE-BEE969FEFB3F, the interface name is \Device\NPF_{2C2FC212-701D-42E6-9EAE-BEE969FEFB3F}.

    The following is an example of the configuration file specifying two interfaces using the interface IP address:

    ActiveClient = 10.10.6.45, 2003, ifaddr=10.10.1.100
    ActiveClient = 10.10.6.45, 2003, ifaddr=10.10.2.100
    NullAuthPermit = YES

    The following is an example of the configuration file specifying two interfaces using CIDR specifications that contain the interface IP address:

    ActiveClient = 10.10.6.45, 2003, ifaddr=10.10.1.0/24
    ActiveClient = 10.10.6.45, 2003, ifaddr=10.10.2.0/24
    NullAuthPermit = YES

    The following is an example of the configuration file specifying two interfaces using the interface name:

    ActiveClient = 10.10.6.45, 2003, ifname=\Device\NPF_{2C2FC212-701D-42E6-9EAE-BEE969FEFB3F}
    ActiveClient = 10.10.6.45, 2003, ifname=\Device\NPF_{3C2FC212-701D-42E6-9EAE-BEE969FEFB3F}
    NullAuthPermit = YES
  3. Save the configuration (.ini) file. Make sure to save the file in ASCII format to prevent errors.

  4. Restart the software tap by running the command

    restart-service rpcapd
    Note: To reinstall the software tap after changing the configuration file, run the installation command and replace –RpcapIp and –RpcapPort with the -KeepConfig flag in order to preserve the modified configuration file. For example:
    .\install-rpcapd.ps1 -MgmtIp <extrahop_ip> -KeepConfig

    or

    .\install-rpcapd.ps1 –InputDir . -KeepConfig

Analyzing Wire Data from a Software Tap

To find out how much wire data the ExtraHop system is receiving from the software tap:

  1. Log in to the ExtraHop Web UI (https://<extrahop_ip>/extrahop) and click the Settings button.

  2. Click System Health to get more information about the forwarded traffic. This page displays a Packets and Throughput graph for each software tap connected to the ExtraHop system.

  3. The RPCAP Packets and Throughput graphs contain four metrics:

    • Encapsulation: The total number of RPCAP encapsulation packets received by the ExtraHop system.

    • Tunnel Eligible: Total number of packets eligible to be forwarded to the ExtraHop system.

    • Tunnel Sent: Total number of RPCAP-tunneled packets forwarded to the ExtraHop system.

    • Tunnel Received: Total number of RPCAP-tunneled packets received by the ExtraHop system.

    The tunnel eligible, tunnel sent, and tunnel received values are equal if the ExtraHop system is receiving and processing all the packets sent by the server. If they are not equal, use the following reference for troubleshooting:

    • If Tunnel Sent is less than Tunnel Eligible, the server is not able to forward all of the traffic. This behavior may indicate that packet forwarding requires more processing or outbound bandwidth resources on the server. Consider separating the forwarding process onto a separate CPU or allocating a dedicated interface for forwarding traffic.

    • If Tunnel Received is less than Tunnel Sent, the ExtraHop system is not receiving all the traffic forwarded by the server. This behavior may be due to network congestion or insufficient resources on the ExtraHop system. If you suspect it is the latter, contact ExtraHop Support.

  4. Once you have verified that the ExtraHop system is receiving traffic, exit the System Health page and view metrics in the ExtraHop Web UI.

Published 2017-11-14 20:34