The following procedure guides you through the deployment process of the ExtraHop Explore virtual appliance with the vSphere client running on a Windows machine. You should be familiar with administrating VMware ESX and ESXi environments before proceeding.
The Explore virtual appliance is distributed as an OVA package that includes a preconfigured virtual machine (VM) with a 64-bit, Linux-based OS that is optimized to work with VMware ESX and ESXi version 5.0 and later.
|Important:||If you want to deploy more than one ExtraHop virtual appliance, do not clone an existing instance. Always start with the original deployment package when deploying additional instances.|
Your environment must meet the following requirements to deploy a virtual Explore appliance:
- An existing installation of VMware ESX or ESXi server version 5.0 and later capable of
hosting the Explore virtual appliance. The Explore virtual appliance is available in the
EXA-S EXA-M EXA-L 8 CPUs 16 CPUs 32 CPUs 32 GB RAM 64 GB RAM 128 GB RAM 4 GB boot disk 4 GB boot disk 4 GB boot disk 1.2 TB or smaller datastore disk 2.5 TB or smaller datastore disk 4.1 TB or smaller datastore disk Note: You must add the second virtual disk to store record data when you deploy the Explore virtual appliance. Consult with your ExtraHop sales representative to determine the datastore disk size that is best for your needs.
- A vSphere client
- An Explore virtual appliance license key.
- The following TCP ports must be open:
- TCP ports 80 and 443: Enables you to administer the Explore appliance through the Web UI. Requests sent to port 80 are automatically redirected to HTTPS port 443.
- TCP port 9443: Enables Explore nodes to communicate with other Explore nodes in the same cluster.
To deploy the Explore virtual appliance, complete the following steps:
- Contact ExtraHop Support (firstname.lastname@example.org) to obtain and download the OVA package.
- Start the VMware vSphere client and connect to your ESX server.
- Go to the File menu and select Deploy OVF Template.
The steps to deploy the OVF template are described in detail below. For most
deployments, the default settings are sufficient.
When the deployment is complete, you can see the unique name you assigned to the Explore appliance VM instance in the inventory tree for the ESX server to which it was deployed.
- Source: Browse to the location of the downloaded OVA file and then click Next.
- OVF Template Details: Review the details and then click Next.
- Name and Location: Configure the VM name and location. Give the VM a unique and specific name for the ESX Inventory and then click Next.
- Disk Format: Select Thick Provision Lazy Zeroed and then click Next.
- Network Mapping: Map the OVF-configured network interface labels with the correct ESX-configured interface labels and then click Next.
- Ready to Complete: Verify the configuration, do not select the Power on after deployment checkbox, and then click Finish to complete the deployment.
- Click the new Explore appliance VM instance in the directory tree.
- From the Actions drop-down list, select Edit Settings... to configure the disk where the Explore appliance data is stored.
- From the New device drop-down list, select New Hard Disk, and then click Add.
- In the New Hard disk field, type the size of your virtual storage disk and then click OK.
- From the Actions drop-down list, select Power On.
- From the Actions drop-down list, select Open Console.
- Log in with the shell user account. Type default for the password.
- Run the show ipaddr command to display the IP address of the Explore virtual appliance.
- Exit the console window.
The ExtraHop virtual appliance is delivered with DHCP enabled. If your network does not support DHCP, no IP address is acquired, and you must configure a static address manually. To configure a static IP address, complete the following steps:
- Log in to the console with the shell user account. At the password prompt, type default, and then press ENTER.
To configure the static IP address, run the following commands:
Enable privileged commands:
- At the password prompt, type default, and then press ENTER.
Enter configuration mode:
Enter the interface configuration mode:
Run the ip command and specify the IP address and
DNS settings in the following format: ip ipaddr <ip_address>
<netmask> <gateway> <dns_server>
ip ipaddr 10.10.2.14 255.255.0.0 10.10.1.253 10.10.1.254
Leave the interface configuration section:
Save the running config file:
- Type y and then press ENTER.
- Enable privileged commands:
After you obtain the IP address for the Explore appliance, you can log into the Explore Admin UI through the following URL: https://<explore_ip_address>/admin.
|Note:||The default log in name is setup and the password is default. You can add and modify additional user names and passwords in the Explore Admin UI.|
Complete the following steps to apply a product key supplied by ExtraHop Support.
If you do not have a product key, contact email@example.com.
- In your browser, type the IP address of the ExtraHop appliance (https://<extrahop_ip_address>/admin).
- Review the license agreement, select I Agree, and then click Submit.
- On the log in screen, type setup for the user name and default for the password.
- Click Log In.
- In the System Settings section, click License.
- Click Manage License.
- Click Register.
- Enter the product key and then click Register.
- Click Done.
By default, the Explore appliance synchronizes the system time through the pool.ntp.org network time protocol (NTP) server. If your network environment prevents the Explore appliance from communicating with this time server, you must configure an alternate time server source.
|Note:||Time synchronization is critical to ensuring proper cluster operations and maintaining consistent views of data across both Discover and Explore appliances. We strongly recommend that you either keep the default system time setting or configure settings for a different NTP server.|
- In the System Settings section, click System Time.
- Click Configure Time.
- Click the Time Zone drop-down list and select a time zone. Click Save and Continue.
- Select the Use NTP server to set time radio button and then click Select.
- Type the IP addresses for the time server, and then click Save.
- Click Done.
- Click Sync Now to sync system time on the Explore appliance with the remote time server.
You must configure an email server and sender before the ExtraHop appliance can send notifications about system alerts by email.
- A virtual disk is in a degraded state.
- A physical disk is in a degraded state.
- A physical disk has an increasing error count.
- A registered Explore node is missing from the cluster. The node might have failed, or is powered off.
Configure the Email Server and Sender settings:
- In the Network Settings section, click Notifications.
- Click Email Server and Sender.
On the Email Settings page, enter the following
SMTP Server: The IP address for the outgoing SMTP mail server.
Note: The SMTP server should be the FQDN or IP address of an outgoing mail server that is accessible from the Explore management network. If the DNS server is set, then the SMTP server can be a FQDN, otherwise it needs to be an IP address
Sender Address: The email address for the notification sender.
Report Sender Address: The email address for the report sender.
- Click Save.
Add a recipient email address for notifications:
- Go to the Network Settings section and click Notifications.
- Under Notifications, click Email Addresses.
- In the Email address text box, type the recipient email address.
- Click Save.
After you deploy the Explore cluster, you must establish a connection from all ExtraHop Discover and Command appliances to the Explore cluster before you can query records.
- Log in to the Discover or Command appliance Admin UI.
- In the ExtraHop Explore Settings section, click Configure Explore Cluster.
- Click Add New.
- In the Host #1 Host field, type the hostname or IP address of any Explore appliance in the Explore cluster.
- For each additional Explore appliance in the cluster, click Add New and enter the individual hostname or IP address in the corresponding Host field.
- Click Save.
- Note the information listed for Fingerprint. Verify that the fingerprint listed on this page matches the fingerprint of the Explore appliance (Host #1) listed on the Fingerprint page in the Explore Admin UI.
- In the Explore Setup Password field, type the password of the Explore appliance.
- Click Join, and then click Done.
After your Explore appliance is paired with all of your Discover and Command appliances, you must configure the type of records you want to store. See the following documentation for more information about Explore configuration settings, how to generate and store records, and how to create record queries.